AZ-500 Secure identity and access — 40 Questions

Question 1

Your company has a Microsoft Entra ID tenant and uses Azure AD Application Proxy to publish on-premises web apps. Users report that they are prompted for their password every time they access the app, even though they selected 'Keep me signed in'. You need to improve the sign-in experience without compromising security. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Seamless Single Sign-On (SSO) for the domain. Seamless Single Sign-On (SSO) for the domain integrates with Microsoft Entra application proxy to automatically authenticate users against on-premises Active Directory without prompting for credentials. This eliminates repeated password prompts while maintaining security by leveraging Kerberos delegation and the user's existing domain session.

Answer

Configure conditional access policies to require device compliance

Answer

Enable B2B collaboration for the app

Answer

Set 'Session lifetime' to 'Permanent' in sign-in frequency

Question 2

Your organization is implementing a zero-trust security model using Microsoft Entra ID. You need to ensure that all access requests to sensitive applications are evaluated in real-time based on user behavior and device posture before granting access. Which Microsoft Entra ID feature should you use?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct feature because it enforces real-time access revocation based on critical events such as user behavior changes (e.g., account disablement, password change) and device posture shifts (e.g., device non-compliance). Unlike periodic token validation, CAE uses a near-real-time event-driven model via the Microsoft Entra ID event service and OAuth 2.0 token claims to immediately block access to sensitive applications when risk is detected.

Answer

Privileged Identity Management (PIM) with approval workflow

Answer

Conditional Access with session controls

Answer

Identity Protection with sign-in risk policy

Question 3

Your company uses Microsoft Entra ID Governance features for access reviews. You need to ensure that guest users who do not sign in for 90 days are automatically removed from access to a critical application. The removal should happen without manual intervention. What should you configure?

Accepted Answer

Configure an access review with 'Auto-apply results' enabled. Configuring an access review with 'Auto-apply results' enabled in Microsoft Entra ID Governance allows you to automatically remove guest users who have not signed in for 90 days from the critical application's access. The access review can be set to evaluate sign-in activity and, upon completion, automatically apply the results (e.g., remove access) without manual intervention, fulfilling the requirement for automated removal.

Answer

Use an Azure Automation runbook to disable users after 90 days

Answer

Enable 'Inactive users' policy in Identity Protection

Answer

Create a dynamic group based on sign-in activity

Question 4

Your company has a Microsoft Entra ID tenant and uses Azure AD Application Proxy to publish on-premises web apps. Users report that they are prompted for their password every time they access the app, even though they selected 'Keep me signed in'. You need to improve the sign-in experience without compromising security. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Passwordless phone sign-in (Microsoft Authenticator). Passwordless phone sign-in with Microsoft Authenticator is correct because it allows users to sign in from unmanaged devices without installing any additional software (the Authenticator app is already installed on their personal phone). It eliminates password risks by using a biometric or PIN gesture tied to a key stored on the device, and it works on any device with the Authenticator app, including unmanaged ones. This method supports the requirement of no software installation on the signing-in device itself, as the authentication happens via the phone.

Answer

Windows Hello for Business

Answer

Certificate-based authentication (CBA)

Answer

FIDO2 security keys

Question 5

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to implement a solution that detects password changes on-premises and forces re-authentication for active sessions within minutes. Which feature should you enable?

Accepted Answer

Password Writeback with password change notification. Password Writeback with password change notification, is correct because it enables on-premises password changes to be synchronized back to Microsoft Entra ID in near real-time. When a password is changed on-premises, the password change notification triggers a re-authentication requirement for active sessions within minutes, ensuring that users with stale tokens are forced to re-authenticate using the new password.

Answer

Azure AD Connect Health

Answer

Azure AD Domain Services

Answer

Seamless SSO

Question 6

Which TWO of the following are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Detect leaked credentials. Entra ID Protection is Microsoft's identity risk engine, and option D is correct because it detects leaked credentials by scanning for user accounts whose valid credentials appear in dumps on the dark web, surfacing this as a 'leaked credentials' user risk detection. Option E is correct because ID Protection includes sign-in risk detections such as 'anonymous IP address,' which flags sign-ins originating from anonymizing sources like Tor exit nodes or anonymous VPNs. Both detections feed the risk signals that drive risk-based Conditional Access. Option A is not an ID Protection capability: device compliance is enforced through Intune compliance policies combined with Conditional Access, not by ID Protection itself. Option B is also incorrect: FIDO2 security keys are managed as authentication methods via the Entra ID Authentication Methods policy, not through ID Protection. Option C is a related but distinct feature: risk-based Conditional Access policies are configured in Conditional Access using the risk signals that ID Protection generates, so the policy configuration itself is not an ID Protection capability.

Answer

Enforce device compliance via Intune

Answer

Manage FIDO2 security keys

Answer

Configure risk-based conditional access policies

Question 7

Refer to the exhibit. You are reviewing the output of the Get-AzureADGroup PowerShell cmdlet. You need to create a Conditional Access policy that dynamically includes users based on their department attribute set to 'Finance'. Which group should you use in the policy?

Accepted Answer

Finance Team. The 'Finance Team' group is a dynamic group configured with a membership rule that automatically includes users whose department attribute equals 'Finance'. Conditional Access policies can target dynamic groups, and using this group ensures that only users with the 'Finance' department attribute are included in the policy without manual updates.

Answer

All Users

Answer

Sales Team

Answer

Administrators

Question 8

Your organization uses Microsoft Entra ID for identity management. You need to prevent users from using their work accounts to access corporate resources from untrusted locations unless they have registered their devices. Which conditional access policy setting should you configure?

Accepted Answer

Grant access, require device to be marked as compliant. The 'Grant access, require device to be marked as compliant' condition ensures that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus running, OS patch level) can access corporate resources. When combined with a location condition (e.g., 'All trusted locations' or 'All locations' with an exclusion for trusted IPs), this setting effectively blocks access from untrusted locations unless the device is compliant, which implies it has been registered and managed in Microsoft Entra ID.

Answer

Grant access, require approved client app

Answer

Block access

Answer

Grant access, require multi-factor authentication

Question 9

You are implementing Microsoft Entra ID Protection. You need to detect and respond to risky user behaviors such as leaked credentials and anonymous IP address usage. Which feature should you enable?

Accepted Answer

Risk policies. Risk policies. Microsoft Entra ID Protection provides risk policies (user risk and sign-in risk) that automatically detect and respond to risky behaviors such as leaked credentials and anonymous IP address usage. Option A (Privileged Identity Management) manages just-in-time access for privileged roles. Option B (Conditional Access policies) can use risk signals but does not detect them. Option D (Identity Governance) manages access reviews and entitlement management.

Answer

Privileged Identity Management

Answer

Conditional Access policies

Answer

Identity Governance

Question 10

Your organization uses Microsoft Entra ID and wants to provide external partners with access to a specific SharePoint Online site. You need to ensure that partners authenticate using their own corporate credentials (SAML/WS-Fed) and that access is automatically revoked when the partner's account is disabled. Which solution should you use?

Accepted Answer

Microsoft Entra B2B collaboration with cross-tenant access settings. Microsoft Entra B2B collaboration with cross-tenant access settings is the correct solution because it allows external partners to authenticate using their own corporate identity provider via SAML/WS-Fed, and it automatically revokes access when the partner's account is disabled in their home tenant. This is achieved through inbound trust settings that honor the partner tenant's user lifecycle, ensuring that access tokens are invalidated when the external user account is disabled or deleted.

Answer

Azure AD B2C

Answer

Direct federation

Answer

SharePoint external sharing

Question 11

Refer to the exhibit. A Microsoft Entra ID Conditional Access policy is defined as shown. You observe that the policy is blocking all users from accessing email via Exchange ActiveSync, but users can still access email via Outlook for iOS. What is the most likely reason?

Accepted Answer

Outlook for iOS uses a client app type not blocked by the policy. The policy blocks Exchange ActiveSync (EAS) client app type, which is used by native mail clients and older mobile apps. Outlook for iOS uses the Microsoft Authenticator and modern authentication (OAuth 2.0) with the 'Mobile apps and desktop clients' app type, not EAS. Therefore, the policy does not apply to Outlook for iOS, allowing it to access email.

Answer

The policy is not assigned to any locations

Answer

The policy does not include all applications

Answer

The policy does not include all users

Question 12

Which TWO actions should you perform to implement Microsoft Entra ID Password Protection for an on-premises Active Directory environment? (Choose two.)

Accepted Answer

Install the Azure AD Password Protection DC agent on each domain controller. Option A is correct because the Microsoft Entra ID Password Protection DC agent must be installed on every domain controller in the on-premises Active Directory environment; this agent enforces the downloaded password policy and audits or blocks banned passwords during password change operations. Option B is correct because password protection must be enabled for the domain in the Azure portal (Microsoft Entra admin center), which activates the global banned password list and optional custom banned password list that the DC agents consume. Option C is not required because password hash synchronization is a sign-in method for hybrid identity and does not deliver the banned-password policy to domain controllers. Option D is not required because Microsoft Entra Connect is used to synchronize identities, not to implement Password Protection. Option E is not required because password writeback supports self-service password reset from the cloud to on-premises, not the banned-password enforcement mechanism.

Answer

Enable password hash synchronization

Answer

Install Azure AD Connect

Answer

Configure password writeback

Question 13

Which THREE conditions can be used in a Microsoft Entra ID Conditional Access policy to control access based on sign-in risk? (Choose three.)

Accepted Answer

Low. In Microsoft Entra ID Conditional Access, sign-in risk is a condition that can be selected under the Sign-in risk assignment, and the available risk levels are Low (B), Medium (D), and High (E), each of which can be individually targeted by a policy to require controls such as MFA or block access. These three values correspond to the risk levels produced by Entra ID Protection's sign-in risk detections, so a policy can be scoped to any combination of them. 'All' (A) is not a selectable sign-in risk value in the Conditional Access condition picker, and 'None' (C) is likewise not a sign-in risk level option, so neither can be used as a sign-in risk condition.

Answer

All

Answer

None

Question 14

Refer to the exhibit. You are configuring a PIM role setting for an Azure AD role. The exhibit shows the activation settings. A user activates the role and provides a justification. An approver from the Security Team does not see any pending requests. What is the most likely reason?

Accepted Answer

The user is a member of the approver group. The user who activated the role is a member of the approver group. In Microsoft Entra Privileged Identity Management (PIM), when a user is both the requester and a member of the approver group, the approval request is automatically approved and does not appear as a pending request for other approvers. This self-approval behavior prevents the request from being visible in the pending requests queue.

Answer

The role is permanently assigned

Answer

The activation duration is set to 0 days

Answer

The user did not provide a justification

Question 15

Refer to the exhibit. You run the PowerShell cmdlet Get-AzureADPolicy for a tenant. Based on the output, what is the access token lifetime for this policy?

Accepted Answer

1 hour. The output of Get-AzureADPolicy shows a policy definition with 'TokenLifetime' set to '1.00:00:00', which represents 1 day. However, the question asks for the access token lifetime. In Microsoft Entra ID, the default access token lifetime is 1 hour, and the policy shown overrides the default token lifetime settings. Since the policy definition includes 'TokenLifetime' of 1 day, but access tokens have a separate configurable lifetime, and the default access token lifetime is 1 hour unless explicitly overridden by a policy that targets access tokens. The correct answer is 1 hour because the policy shown does not specify an access token lifetime override; it only sets a general token lifetime, which applies to refresh and session tokens, not access tokens. Therefore, the access token lifetime remains the default of 1 hour.

Answer

24 hours

Answer

6 hours

Answer

12 hours

Question 16

You manage a Microsoft Entra ID tenant for a multinational company. Users in the European office report that they cannot access the company's custom line-of-business application during peak hours, while users in the US office have no issues. The application uses OAuth 2.0 authentication with Conditional Access policies applied. What is the most likely cause?

Accepted Answer

The Conditional Access policy requires compliant devices, and European devices are taking longer to report compliance during peak hours.. The issue is that the Conditional Access policy requires compliant devices, and during peak hours, European devices may take longer to report compliance status due to network latency or increased load on the compliance evaluation infrastructure. This delay can cause the Conditional Access policy to deny access until compliance is verified, while US users, likely in a different time zone, are not experiencing peak load. The OAuth 2.0 authentication flow includes a device compliance check, and if the compliance state is not reported in time, the token issuance is blocked.

Answer

The application's service principal has been accidentally disabled in the European tenant location.

Answer

The Conditional Access policy requires multi-factor authentication for all users, and the MFA session token expired for European users.

Answer

The token lifetime policy for the application is set too low, causing European users to reauthenticate more frequently.

Question 17

Your organization has a Microsoft Entra ID tenant with 50,000 users. You are designing a solution to automatically revoke access for users who have not signed in for 90 days. The solution must be cost-effective and use built-in Microsoft Entra ID features. What should you do?

Accepted Answer

Configure the 'User sign-in frequency' setting in the 'User feature' settings to automatically remove users inactive for 90 days.. Microsoft Entra ID includes a built-in 'User sign-in frequency' setting under 'User feature' settings that automatically revokes access for users who have not signed in for a specified period (e.g., 90 days). This feature is cost-effective as it requires no additional licensing beyond Microsoft Entra ID P2, and it operates natively without custom scripts or external automation.

Answer

Create a Power Automate flow that triggers monthly to check sign-in logs and disable inactive users.

Answer

Use Microsoft Entra Connect to synchronize a 'disable' attribute from on-premises and set it for inactive users.

Answer

Write a PowerShell script using Microsoft Graph API to check last sign-in times and disable users.

Question 18

Your organization uses Microsoft Entra ID and has several applications registered. You need to ensure that only specific applications can call a particular web API. The web API is also registered in Microsoft Entra ID. What should you configure?

Accepted Answer

In the web API's application registration, configure the 'expose an API' blade to define scopes, and then pre-authorize the specific client applications in the web API's manifest.. Pre-authorizing specific client applications in the web API's manifest (via the 'expose an API' blade) explicitly grants those clients permission to call the API without requiring user consent. This ensures that only the listed applications can acquire tokens for the API, as the API's application registration defines the scopes and pre-authorizations that control access.

Answer

Configure an app role assignment policy for the web API.

Answer

Set a token lifetime policy on the web API to accept tokens only from approved client applications.

Answer

Create a Conditional Access policy targeting the web API and require that the client application is managed.

Question 19

Your company uses Microsoft Entra ID and Microsoft Sentinel. You need to detect when a user account is created outside of normal business hours (9 AM - 5 PM local time) and automatically suspend the account. What should you use?

Accepted Answer

Create an analytics rule in Microsoft Sentinel that triggers on user creation events and runs a playbook to disable the account. Microsoft Sentinel analytics rules can be configured to trigger on specific log events (such as user creation from Microsoft Entra ID audit logs) and then execute a playbook (an automated workflow in Azure Logic Apps) to perform actions like disabling the account. This directly meets the requirement to detect user creation outside business hours and automatically suspend the account.

Answer

Configure a session policy in Microsoft Defender for Cloud Apps

Answer

Configure an access review in Privileged Identity Management

Answer

Configure a risk detection policy in Microsoft Entra ID Identity Protection

Question 20

You need to ensure that external users who are invited to collaborate via Microsoft Entra B2B can only access the applications assigned to them. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that applies to guest users and targets the specific applications.. Conditional Access policies in Microsoft Entra ID can be scoped to guest/external users and specific applications, allowing you to enforce access controls such as requiring MFA or blocking access for unapproved apps. This directly meets the requirement to restrict B2B guest users to only the applications assigned to them, without affecting other sign-in behaviors or tenant-wide settings.

Answer

Require guest users to register for MFA before accessing any applications.

Answer

Configure cross-tenant access settings to block all applications except those assigned.

Answer

Configure SharePoint external sharing settings to limit application access.