AZ-500 Secure identity and access — 50 Questions

Question 1

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using a one-time passcode sent to their mobile device, without requiring any additional app or software installation. Which authentication method should you enable?

Accepted Answer

One-time passcode (OTP). Option A is correct because the one-time passcode (OTP) authentication method in Microsoft Entra ID allows users to sign in with a temporary code sent via SMS to their mobile device, requiring no additional app or software installation. This method is specifically designed for scenarios where users cannot or should not install the Microsoft Authenticator app, such as for guest users or in bring-your-own-device (BYOD) environments. The OTP is generated by Entra ID and delivered over the mobile network, satisfying the requirement of no extra software.

Answer

Microsoft Authenticator app

Answer

FIDO2 security keys

Answer

Certificate-based authentication

Question 2

Your company has a Microsoft Entra ID tenant and uses Azure AD Application Proxy to publish on-premises web apps. Users report that they are prompted for their password every time they access the app, even though they selected 'Keep me signed in'. You need to improve the sign-in experience without compromising security. What should you configure?

Accepted Answer

Enable Seamless Single Sign-On (SSO) for the domain. Seamless Single Sign-On (SSO) for the domain integrates with Azure AD Application Proxy to automatically authenticate users against on-premises Active Directory without prompting for credentials. This eliminates repeated password prompts while maintaining security by leveraging Kerberos delegation and the user's existing domain session.

Answer

Configure conditional access policies to require device compliance

Answer

Enable B2B collaboration for the app

Answer

Set 'Session lifetime' to 'Permanent' in sign-in frequency

Question 3

Your organization is implementing a zero-trust security model using Microsoft Entra ID. You need to ensure that all access requests to sensitive applications are evaluated in real-time based on user behavior and device posture before granting access. Which Microsoft Entra ID feature should you use?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct feature because it enforces real-time access revocation based on critical events such as user behavior changes (e.g., account disablement, password change) and device posture shifts (e.g., device non-compliance). Unlike periodic token validation, CAE uses a near-real-time event-driven model via the Microsoft Entra ID event service and OAuth 2.0 token claims to immediately block access to sensitive applications when risk is detected.

Answer

Privileged Identity Management (PIM) with approval workflow

Answer

Conditional Access with session controls

Answer

Identity Protection with sign-in risk policy

Question 4

You are configuring a conditional access policy to block access from untrusted locations. The policy should apply to all cloud apps except Microsoft Entra ID Administration. How should you configure the policy?

Accepted Answer

Include 'All cloud apps' and exclude 'Microsoft Entra ID Administration'. Option C is correct because the requirement is to block access from untrusted locations for all cloud apps except Microsoft Entra ID Administration. In Conditional Access, you include 'All cloud apps' to cover every app, then explicitly exclude 'Microsoft Entra ID Administration' to exempt it from the block. This ensures the policy applies broadly while honoring the exclusion.

Answer

Include 'All cloud apps' and set 'Block access'

Answer

Include 'Select apps' and choose all apps except admin

Answer

Include 'All cloud apps' and exclude 'Office 365'

Question 5

Your company uses Microsoft Entra ID Governance features for access reviews. You need to ensure that guest users who do not sign in for 90 days are automatically removed from access to a critical application. The removal should happen without manual intervention. What should you configure?

Accepted Answer

Configure an access review with 'Auto-apply results' enabled. Option C is correct because configuring an access review with 'Auto-apply results' enabled in Microsoft Entra ID Governance allows you to automatically remove guest users who have not signed in for 90 days from the critical application's access. The access review can be set to evaluate sign-in activity and, upon completion, automatically apply the results (e.g., remove access) without manual intervention, fulfilling the requirement for automated removal.

Answer

Use an Azure Automation runbook to disable users after 90 days

Answer

Enable 'Inactive users' policy in Identity Protection

Answer

Create a dynamic group based on sign-in activity

Question 6

Your organization uses Microsoft Entra ID to manage access for employees and partners. You need to implement a solution that allows partners to self-service request access to specific applications, with approval from their manager, and access expires after 30 days. Which feature should you use?

Accepted Answer

Entitlement Management access packages. Entitlement Management access packages are designed to allow external partners to request access to specific applications through a self-service portal. The feature supports approval workflows (e.g., manager approval) and automatically enforces time-bound access, such as a 30-day expiration. This directly matches the requirement for partner self-service with approval and expiration.

Answer

Azure AD B2B collaboration

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access with session restrictions

Question 7

You are troubleshooting why a user cannot sign in to a custom line-of-business application that is federated with Microsoft Entra ID. The user reports that they are repeatedly prompted for credentials and then receive an error. The application is configured for SAML-based SSO. What is the most likely cause?

Accepted Answer

The SAML certificate has expired or the configuration has a mismatch. When a SAML-based SSO application repeatedly prompts for credentials and then fails, the most common cause is an expired or misconfigured SAML signing certificate. The certificate is used by Microsoft Entra ID to sign SAML assertions; if it has expired, or if the thumbprint, audience URI, or reply URL in the Entra ID configuration does not match what the application expects, the application will reject the assertion and force re-authentication or display an error.

Answer

The user's browser cookies are disabled

Answer

The application is not registered in the app gallery

Answer

The user does not have a license for Microsoft Entra ID

Question 8

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a secure authentication method that reduces password-related risks. The solution must support users signing in from unmanaged devices without installing any software. Which authentication method should you prioritize?

Accepted Answer

Passwordless phone sign-in (Microsoft Authenticator). Passwordless phone sign-in with Microsoft Authenticator is correct because it allows users to sign in from unmanaged devices without installing any additional software (the Authenticator app is already installed on their personal phone). It eliminates password risks by using a biometric or PIN gesture tied to a key stored on the device, and it works on any device with the Authenticator app, including unmanaged ones. This method supports the requirement of no software installation on the signing-in device itself, as the authentication happens via the phone.

Answer

Windows Hello for Business

Answer

Certificate-based authentication (CBA)

Answer

FIDO2 security keys

Question 9

Your organization uses Microsoft Entra ID and has a hybrid identity setup with password hash synchronization. You need to implement a solution that detects password changes on-premises and forces re-authentication for active sessions within minutes. Which feature should you enable?

Accepted Answer

Password Writeback with password change notification. Option B, Password Writeback with password change notification, is correct because it enables on-premises password changes to be synchronized back to Microsoft Entra ID in near real-time. When a password is changed on-premises, the password change notification triggers a re-authentication requirement for active sessions within minutes, ensuring that users with stale tokens are forced to re-authenticate using the new password.

Answer

Azure AD Connect Health

Answer

Azure AD Domain Services

Answer

Seamless SSO

Question 10

Which TWO of the following are valid configurations for Microsoft Entra ID Conditional Access policies?

Accepted Answer

Include all users and exclude specific groups. Option A is correct because Conditional Access policies allow you to include all users as a baseline and then exclude specific groups (e.g., break-glass emergency accounts) to ensure critical access is never blocked. Option C is correct because you can target a specific cloud application (e.g., Microsoft Azure Management, SharePoint Online) to apply granular access controls only to that app, leaving other apps unaffected.

Answer

Force password change on next sign-in

Answer

Block access for users without MFA registered

Answer

Assign licenses to users based on location

Question 11

Which THREE of the following are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Configure risk-based conditional access policies. Microsoft Entra ID Protection is a security service that detects identity-based risks and automates remediation. It specifically identifies sign-ins from anonymous IP addresses (e.g., Tor) by analyzing the IP address against known proxy and VPN lists, and it detects leaked credentials by cross-referencing user credentials against publicly available breach databases. These risk detections can then be used to configure risk-based Conditional Access policies, such as requiring multi-factor authentication when a sign-in risk level is medium or high.

Answer

Enforce device compliance via Intune

Answer

Manage FIDO2 security keys

Question 12

Which TWO of the following are authentication methods supported by Microsoft Entra ID?

Accepted Answer

Certificate-based authentication (CBA). Certificate-based authentication (CBA) is a supported authentication method in Microsoft Entra ID that allows users to authenticate using X.509 certificates issued by a trusted Certificate Authority (CA). This method is commonly used for passwordless authentication, especially in hybrid environments where smart cards or device certificates are deployed. Entra ID validates the certificate chain and maps the certificate to a user object, enabling secure sign-in without a password.

Answer

Security questions

Answer

Smart card with PIN

Answer

OAuth 2.0 authorization code flow

Question 13

Refer to the exhibit. You are analyzing a Conditional Access policy JSON. The policy requires MFA for Office 365 applications. However, users report that they are still able to access Office 365 without MFA. What is the most likely reason?

Accepted Answer

The 'authenticationStrength' property is not a valid Conditional Access policy property. The 'authenticationStrength' property is not a valid property in a Conditional Access policy JSON schema. Conditional Access policies use 'grantControls' with 'builtInControls' (e.g., 'mfa') to enforce MFA. An unrecognized property like 'authenticationStrength' would be ignored by Azure AD, causing the policy to not enforce MFA as intended.

Answer

The policy excludes some Office 365 apps

Answer

The 'grantControls' section is empty

Answer

The policy does not include all users

Question 14

Refer to the exhibit. You are reviewing the output of the Get-AzureADGroup PowerShell cmdlet. You need to create a Conditional Access policy that dynamically includes users based on their department attribute set to 'Finance'. Which group should you use in the policy?

Accepted Answer

Finance Team. Option D is correct because the 'Finance Team' group is a dynamic group configured with a membership rule that automatically includes users whose department attribute equals 'Finance'. Conditional Access policies can target dynamic groups, and using this group ensures that only users with the 'Finance' department attribute are included in the policy without manual updates.

Answer

All Users

Answer

Sales Team

Answer

Administrators

Question 15

Refer to the exhibit. You are configuring an Entitlement Management access package. The policy allows any existing user to request access without approval, and access expires after 30 days. However, security requirements dictate that all access to Finance applications must be reviewed by the finance team manager every quarter. What should you add to the policy?

Accepted Answer

Enable access reviews and assign the finance team manager as reviewer. Option D is correct because the security requirement mandates quarterly reviews by the finance team manager, which is exactly what an access review does in Entitlement Management. Access reviews allow you to require periodic attestation of access by a designated reviewer, ensuring ongoing compliance even though the initial request does not require approval. The policy already sets a 30-day expiration, but a quarterly review adds a separate recurring governance check that overrides the shorter duration for compliance purposes.

Answer

Add a connected organization for external users

Answer

Set 'isApprovalRequiredForAdd' to true

Answer

Set 'durationInDays' to 90

Question 16

Your organization uses Microsoft Entra ID for identity management. You need to prevent users from using their work accounts to access corporate resources from untrusted locations unless they have registered their devices. Which conditional access policy setting should you configure?

Accepted Answer

Grant access, require device to be marked as compliant. Option B is correct because the 'Grant access, require device to be marked as compliant' condition ensures that only devices meeting your organization's compliance policies (e.g., BitLocker enabled, antivirus running, OS patch level) can access corporate resources. When combined with a location condition (e.g., 'All trusted locations' or 'All locations' with an exclusion for trusted IPs), this setting effectively blocks access from untrusted locations unless the device is compliant, which implies it has been registered and managed in Microsoft Entra ID.

Answer

Grant access, require approved client app

Answer

Block access

Answer

Grant access, require multi-factor authentication

Question 17

You are implementing Microsoft Entra ID Protection. You need to detect and respond to risky user behaviors such as leaked credentials and anonymous IP address usage. Which feature should you enable?

Accepted Answer

Risk policies. The correct answer is D: Risk policies. Microsoft Entra ID Protection provides risk policies (user risk and sign-in risk) that automatically detect and respond to risky behaviors. Option A (Identity Governance) manages access reviews and entitlement management. Option B (Privileged Identity Management) manages just-in-time access for privileged roles. Option C (Conditional Access policies) can use risk signals but does not detect them.

Answer

Privileged Identity Management

Answer

Conditional Access policies

Answer

Identity Governance

Question 18

Your company deploys Microsoft Sentinel for security operations. You need to configure just-in-time (JIT) access for Azure VMs. Which Azure security feature should you integrate with Sentinel?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides the just-in-time (JIT) VM access capability, which can be integrated with Microsoft Sentinel to enable automated threat response. When a security incident is detected in Sentinel, a playbook can trigger Defender for Cloud to lock down or open specific ports (e.g., RDP 3389, SSH 22) for a defined time window, reducing the attack surface. This integration relies on the Defender for Cloud's JIT policy applied at the subscription or VM level, not on external network controls or identity governance.

Answer

Azure Policy

Answer

Azure Firewall

Answer

Microsoft Entra Privileged Identity Management

Question 19

You are designing a secure access solution for an Azure App Service web application. The application uses Microsoft Entra ID for authentication. You need to ensure that only users from specific partner organizations can access the app. Which configuration should you use?

Accepted Answer

Configure the app to accept tokens from the partner tenants as external identity providers. Option B is correct because Azure App Service can be configured to accept tokens from multiple Microsoft Entra ID tenants as external identity providers. This allows users from specific partner organizations to authenticate using their own Entra ID tenant, while the app validates the tokens and grants access only to those partner tenants you explicitly trust.

Answer

Use a custom domain for the app

Answer

Block all external users

Answer

Require multi-factor authentication for all users

Question 20

Your organization uses Microsoft Intune for mobile device management. You need to implement a conditional access policy that only allows access to corporate email from devices that are enrolled in Intune and compliant with security policies. However, the policy is not working for some users who report that they cannot access email even though their devices are compliant. You discover that the users have multiple devices and are signing in from a device that is not enrolled. What should you do?

Accepted Answer

Ensure users sign in only from compliant devices. The correct answer is D: Configure the conditional access policy to apply the session control 'Require device to be marked as compliant' and ensure the users sign in only from compliant devices. Users with multiple devices may inadvertently sign in from a non-compliant device. Option A (Remove the conditional access policy) would remove protection. Option B (Enroll all devices) may not be practical. Option C (Use app protection policies) addresses app-level protection but not device-level compliance.

Answer

Enroll all devices in Intune

Answer

Remove the conditional access policy

Answer

Use app protection policies instead