AZ-500 Manage identity and access — Timed 30 Questions

Question 1

A company uses Azure AD Identity Protection. They want to automatically block sign-ins that have a high user risk level, but only for users in the 'Finance' department. They also want to require MFA for medium user risk level for all users (including Finance) when sign-in risk is not blocked. They have already created a Conditional Access policy for the Finance department that has a condition of 'User risk level: High' and a grant control of 'Block access'. What additional configuration is needed to also require MFA for all users with medium user risk?

Accepted Answer

Create a second Conditional Access policy targeting all users with condition 'User risk level: Medium' and grant control 'Require multi-factor authentication'. Option A is correct because Azure AD Conditional Access policies are evaluated independently, and a separate policy is needed to require MFA for medium user risk across all users. The existing policy blocks high-risk sign-ins for Finance only, but does not address medium risk for any user. Creating a second policy targeting all users with 'User risk level: Medium' and grant control 'Require multi-factor authentication' satisfies the requirement without conflicting with the existing block policy, as Conditional Access policies are combined (unless explicitly excluded).

Answer

Modify the existing policy to include 'User risk level: Medium' and change the grant control to 'Require multi-factor authentication'

Answer

Use Identity Protection's 'User risk policy' instead of Conditional Access

Answer

Create a new Conditional Access policy with condition 'User risk level: Medium' and grant control 'Block access'

Question 2

A company uses Azure AD Privileged Identity Management (PIM) to manage access to Azure AD roles. They want to require that users who activate the Global Administrator role must get approval from their manager before activation, and that the approval must be time-bound (maximum 8 hours). Which two PIM configurations should they set?

Accepted Answer

Set the activation maximum duration to 8 hours.. Option A is correct because setting the activation maximum duration to 8 hours enforces the time-bound requirement, ensuring that once a user activates the Global Administrator role, the activation automatically expires after 8 hours. Option B is correct because enabling the approval workflow and adding the manager as an approver ensures that the manager must approve each activation request, meeting the requirement for manager approval. Together, these two configurations satisfy both the time-bound and approval constraints.

Answer

Require multi-factor authentication on activation.

Answer

Require justification on activation.

Question 3

A company uses Azure AD Privileged Identity Management (PIM) to manage the Global Administrator role. They want to require that when a user activates the role, they must be using a device that is compliant with Intune policies (e.g., compliant device) and must provide a justification. The company already has Conditional Access policies in place for regular access. How should they enforce the device compliance requirement specifically during PIM activation?

Accepted Answer

In PIM settings for the Global Administrator role, enable 'Require Azure AD Conditional Access authentication context' and create a Conditional Access policy that requires compliant device when that authentication context is used.. Option C is correct because Azure AD PIM can integrate with Conditional Access via authentication context. By enabling 'Require Azure AD Conditional Access authentication context' in the PIM role settings and then creating a Conditional Access policy that targets that authentication context with the 'Require compliant device' grant control, you enforce device compliance specifically during role activation. This approach ensures the device compliance check is applied only when the user activates the Global Administrator role, not during regular access.

Answer

Configure a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' cloud app, requiring compliant device.

Answer

In PIM settings for the Global Administrator role, enable 'Require Multi-Factor Authentication on activation'.

Answer

Use Azure AD Identity Protection's user risk policy to require device compliance when a high-risk user activates the role.

Question 4

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They have configured the role activation to require approval from a specific security group. When a user attempts to activate the role, they are immediately approved without any approval request being sent. The user is a member of the same security group that is configured as the approver. What is the most likely cause?

Accepted Answer

The user is a member of the approver group and is self-approving the request. Option B is correct because when a user is a member of the approver security group in Azure AD PIM, they can approve their own activation request. PIM does not prevent self-approval by default; the approval workflow sends the request to all members of the approver group, and if the requesting user is also a member, they can approve it themselves, resulting in immediate activation without any external approval.

Answer

The activation approval requirement is not supported for the Global Administrator role

Answer

The PIM policy has not been activated for the Global Administrator role

Answer

The role activation duration is set to zero, causing immediate activation

Question 5

A company has a partner organization in another Azure AD tenant. They want to allow users from the partner tenant to access their Azure resources through Azure AD B2B collaboration. They also want the partner's Multi-Factor Authentication (MFA) claims to be trusted when partner users access their resources, so that they do not need to perform MFA again. Which configuration in cross-tenant access settings should they enable?

Accepted Answer

Trust multi-factor authentication from the partner tenant (inbound trust).. Option A is correct because cross-tenant access settings in Azure AD allow you to configure inbound trust for MFA from an external Azure AD tenant. When enabled, Azure AD B2B collaboration will accept the partner tenant's MFA claims, so partner users who have already satisfied MFA in their home tenant will not be prompted again when accessing your resources. This is configured under 'Cross-tenant access settings' > 'Inbound trust settings' for the specific partner tenant.

Answer

Trust device compliance from the partner tenant.

Answer

Enable a Conditional Access policy that grants access to the partner tenant.

Answer

Configure identity synchronization with the partner tenant.

Question 6

A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?

Accepted Answer

Azure AD Application Proxy.. Azure AD Application Proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Azure AD, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.

Answer

Azure AD B2C (Business-to-Consumer).

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Front Door.

Question 7

A company uses Azure AD Identity Protection and Conditional Access. A user is detected with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user, but only when the sign-in originates from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy targeting all users. Which configuration should they add to the policy to achieve this?

Accepted Answer

Add a condition for 'User risk' set to 'High' and exclude 'All trusted locations' under the 'Locations' condition, then grant 'Block access'.. Option B is correct because it combines a condition for 'User risk' set to 'High' with an exclusion of 'All trusted locations' under the 'Locations' condition, then grants 'Block access'. This ensures that the block only applies when the sign-in originates from an untrusted location, meeting the requirement to automatically block sign-ins for high-risk users only from locations not in the company's trusted IP list.

Answer

Add a condition for 'User risk' set to 'High', and a condition for 'Sign-in risk' set to 'High', then grant 'Block access'.

Answer

Add a condition for 'User risk' set to 'High', and under 'Grant', select 'Require multi-factor authentication' and 'Block access'.

Answer

Add a condition for 'Locations' set to 'Any location' and under 'Grant', select 'Block access' for all users.

Question 8

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. The security policy requires that when a user activates the Security Administrator role, they must: 1) Provide a justification, 2) Get approval from a designated security group, and 3) The activation must last a maximum of 4 hours. Which combination of PIM settings should they configure?

Accepted Answer

Enable 'Require justification', 'Require approval', and set 'Maximum activation duration' to 4 hours. Assign the security group as the approver.. Option A is correct because Azure AD PIM allows you to enforce all three requirements: justification, approval from a specified security group, and a maximum activation duration. By enabling 'Require justification' and 'Require approval' and setting the 'Maximum activation duration' to 4 hours, you meet the security policy exactly. The approval step requires assigning a designated security group as the approver, which is supported in PIM role settings.

Answer

Enable 'Require justification', 'Require ticket information', and set 'Maximum activation duration' to 8 hours.

Answer

Enable 'Require approval' and set 'Maximum activation duration' to 4 hours. Do not require justification.

Answer

Enable 'Require Azure MFA on activation', 'Require justification', and set 'Maximum activation duration' to 4 hours.

Question 9

A company uses Azure AD Privileged Identity Management (PIM) to manage access to critical roles. They want to require that users who are eligible for the 'Security Administrator' role must provide a support ticket number in the justification when activating the role. Additionally, they want to set a maximum activation duration of 4 hours. Which PIM role setting should they configure?

Accepted Answer

Activation settings. Option A is correct because the 'Activation settings' in Azure AD PIM allow you to configure the maximum activation duration (in hours) and require justification, including a support ticket number, when a user activates an eligible role. These settings directly control the conditions under which role activation occurs, such as duration and mandatory justification fields.

Answer

Notification settings

Answer

Approval settings

Answer

Assignment settings

Question 10

A company has Azure AD Conditional Access policies that require multi-factor authentication (MFA) for all users accessing sensitive cloud apps. The security team wants to extend this protection by monitoring and controlling user activities within those applications (e.g., preventing data exfiltration during a session). Which Conditional Access session control should they implement?

Accepted Answer

Session control: Conditional Access Application Control. Option D is correct because Conditional Access Application Control (also known as Microsoft Defender for Cloud Apps session control) allows real-time monitoring and control of user activities within cloud apps, such as blocking downloads or preventing data exfiltration. This session control works by redirecting user traffic through Microsoft Defender for Cloud Apps as a reverse proxy, enabling granular policy enforcement during the session. The requirement specifically asks for monitoring and controlling activities inside the app, which goes beyond just requiring MFA at sign-in.

Answer

Grant control: Require MFA

Answer

Session control: Use app enforced restrictions

Answer

Session control: Sign-in frequency

Question 11

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Global Administrator' role. The security team wants to ensure that when a user activates the role, they must provide a justification, and the activation request must be approved by a specific group of security administrators. They have already configured the role for activation with a maximum duration of 8 hours. Which additional PIM settings should they configure?

Accepted Answer

Enable 'Require approval to activate' and select the security group as approver. Option A is correct because the scenario requires both justification and approval for role activation. PIM allows you to enforce 'Require justification on activation' and 'Require approval to activate' as separate settings. By enabling 'Require approval to activate' and selecting the security group as the approver, you meet the requirement for approval. Justification is already a default requirement in PIM when approval is enabled, but you must also explicitly set 'Require justification on activation' to 'On' if not already enforced; however, the question states they have already configured the role for activation with a maximum duration, so the missing piece is the approval configuration.

Answer

Set 'Require Azure Multi-Factor Authentication' to 'On'

Answer

Set 'Require justification on activation' to 'On' and also enable 'Require ticket information'

Answer

Create a separate PIM request workflow using Azure Logic Apps

Question 12

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They have configured the role activation to require Azure Multi-Factor Authentication and a support ticket number. However, users are reporting that they can activate the role without entering a ticket number. What is the most likely cause?

Accepted Answer

The 'Require ticket information on activation' setting is not enabled in the role settings. Option A is correct because the 'Require ticket information on activation' setting is a separate toggle in the PIM role settings that must be explicitly enabled. Even if the support ticket number field is displayed in the activation form, the system will not enforce its entry unless this specific setting is turned on. Without it, users can leave the field blank and still successfully activate the role.

Answer

Users are activating through the Azure AD overview page instead of the PIM blade

Answer

The activation policy requires approval but the approvers ignore the ticket field

Answer

The role is configured for 'Active' assignment instead of 'Eligible'

Question 13

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. They want the activation of this role to require approval from a specific group of senior security engineers before the role becomes active. They also want the approvers to receive an email notification when an activation request is submitted. Which PIM configuration must be set?

Accepted Answer

Require approval to activate.. Option C is correct because Azure AD PIM requires the 'Require approval to activate' setting to enforce that activation requests for a role must be approved by designated approvers before the role becomes active. This setting also automatically triggers email notifications to the configured approvers when a request is submitted, fulfilling both the approval and notification requirements.

Answer

Set the activation maximum duration to 1 hour.

Answer

Require justification on activation.

Answer

Configure notification emails for role activation.

Question 14

A company uses Azure Active Directory (Azure AD) and has a conditional access policy that requires multi-factor authentication (MFA) for all external users accessing SharePoint Online. However, the security team wants to enforce that external users must re-authenticate every 30 minutes when accessing SharePoint. Which control should they configure in a new conditional access policy targeting SharePoint Online?

Accepted Answer

Add a session control and set 'Sign-in frequency' to 30 minutes.. Option C is correct because the 'Sign-in frequency' session control in a Conditional Access policy allows administrators to enforce re-authentication at a specified interval. By setting this to 30 minutes and targeting the SharePoint Online app, external users will be prompted to re-authenticate every 30 minutes, meeting the security team's requirement. This control is independent of MFA and specifically addresses the frequency of authentication sessions.

Answer

Assign the policy to 'All cloud apps' and use a grant control to require multi-factor authentication.

Answer

Configure a condition for sign-in risk level and set it to 'High'.

Answer

Configure a session control to use 'App enforced restrictions' for SharePoint.

Question 15

A company manages Azure AD roles with Privileged Identity Management (PIM). They want to enforce that when a user activates the Global Administrator role, they must provide a justification and also use Multi-Factor Authentication. Which PIM settings should they configure? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication on activation.. Option B is correct because PIM allows you to enforce Multi-Factor Authentication (MFA) as a mandatory step during role activation, ensuring the user's identity is verified beyond just a password. Option C is correct because PIM's 'Require justification on activation' setting forces the user to provide a business reason for activating the Global Administrator role, which is a common compliance requirement. Together, these two settings satisfy the requirement for both MFA and justification during activation.

Answer

Require approval on activation.

Answer

Extend activation duration.

Question 16

A company uses Azure AD B2B collaboration to invite external partner users to collaborate on a project. The security team wants to ensure that when a partner user's account is disabled in their home Azure AD tenant, the user should immediately lose access to the company's resources, even if the user had a valid session token. Which configuration should they implement in cross-tenant access settings?

Accepted Answer

Configure cross-tenant access settings to trust the user's account status from the home tenant.. Option A is correct because configuring cross-tenant access settings to trust the user's account status from the home tenant enables Azure AD to evaluate the external user's account state (enabled/disabled) in their home tenant at each authentication. When the partner user's account is disabled in their home tenant, Azure AD will deny access even if a valid session token exists, because the token's validity is rechecked against the home tenant's account status via the cross-tenant trust policy.

Answer

Configure external collaboration settings to restrict B2B users to specific apps.

Answer

Assign a conditional access policy that requires device compliance for B2B users.

Answer

Enable Azure AD Identity Protection for B2B users.

Question 17

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to ensure that when a user activates the role, they must provide a ticket number as justification, and the activation must be approved by a designated approver group. The role activation duration should be limited to 4 hours. Which PIM settings should be configured?

Accepted Answer

Enable 'Require approval' and set 'Approvers' to the designated group. Also, enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours.. Option C is correct because the scenario requires both approval and ticket-based justification. In Azure AD PIM, 'Require approval' enforces that a designated approver group must approve the activation, while 'Require ticket information on activation' ensures the user provides a ticket number as justification. Setting 'Activation maximum duration' to 4 hours limits the role activation time. These three settings together satisfy all requirements.

Answer

Enable 'Require approval' for the role and set 'Approvers' to the designated group. Also, set 'Activation maximum duration' to 4 hours.

Answer

Enable 'Require justification on activation' and set 'Activation maximum duration' to 4 hours. No approval configuration is needed.

Answer

Enable 'Require ticket information on activation' and set 'Activation maximum duration' to 4 hours. Approval is not required because the ticket number serves as justification.

Question 18

A company uses Azure AD Identity Protection. They have detected a user with a 'High' user risk level due to suspicious activity. The security team wants to automatically block sign-ins for this user only when the sign-in comes from a location that is not in the company's list of trusted IPs. They have created a Conditional Access policy. Which configuration should they use?

Accepted Answer

Assign the user to the policy, set condition 'User risk level: High' and condition 'Locations: All locations except trusted', and set 'Grant' to 'Block access'. Option A is correct because it combines the 'User risk level: High' condition (triggered by Identity Protection's user risk detection) with the 'Locations: All locations except trusted' condition, and sets 'Grant' to 'Block access'. This ensures that only sign-ins from untrusted locations are blocked when the user's risk is high, meeting the requirement to allow sign-ins from trusted IPs even for high-risk users.

Answer

Assign the user to the policy, set condition 'Sign-in risk level: High' and condition 'Locations: All trusted locations', and set 'Grant' to 'Block access'

Answer

Assign the user to the policy, set condition 'User risk level: High' and set 'Grant' to 'Require multi-factor authentication'

Answer

Create a risk detection policy in Identity Protection that triggers a user risk policy, and have Conditional Access use the risk policy

Question 19

A company uses Azure AD B2B collaboration to invite external partner users. The security policy requires that guest users who have not signed in for more than 90 days should have their access automatically reviewed and, if not approved, removed. The company has Azure AD Premium P2 licenses. Which Azure AD feature should they configure to meet this requirement?

Accepted Answer

Configure an Azure AD Access Review that reviews guest user access and automatically removes access after 90 days of inactivity.. Option C is correct because Azure AD Access Reviews, available with Azure AD Premium P2 licenses, allow you to create recurring reviews that specifically target guest users who have not signed in for a specified period (e.g., 90 days). The review can be configured to automatically remove access if the reviewer does not approve, directly meeting the requirement for automatic review and removal after 90 days of inactivity.

Answer

Enable automatic user deletion in the Azure AD B2B collaboration settings.

Answer

Create a Conditional Access policy that blocks sign-ins for guest users who haven't authenticated in 90 days.

Answer

Use Azure AD Identity Protection to detect guest user sign-in anomalies and revoke sessions.

Question 20

A company uses Azure AD Privileged Identity Management (PIM) for the Global Administrator role. They want to ensure that when a user activates the role, the activation request must be approved by a member of the 'Global Admin Approvers' group, and the activation should be time-bound with a maximum of 4 hours. Which PIM settings should they configure?

Accepted Answer

Set the activation maximum duration to 4 hours and require approval from the 'Global Admin Approvers' group.. Option A is correct because Azure AD PIM allows you to configure role activation settings, including an activation maximum duration (which can be set to 4 hours) and requiring approval from a specified group (in this case, 'Global Admin Approvers'). These settings directly meet the requirement for time-bound activation with approval.

Answer

Set the activation maximum duration to 4 hours and enable MFA on activation.

Answer

Set the activation to require a ticket number justification and set the maximum duration to 8 hours.

Answer

Set the role to be permanently active but with a just-in-time approval workflow.