AZ-500 Secure identity and access Practice Test 3 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to ensure that users accessing internal applications from unmanaged devices are required to use Microsoft Edge with specific security configurations. Which Conditional Access control should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Session control: Use app enforced restrictions. The 'Use app enforced restrictions' session control in Conditional Access allows you to require that users access internal applications using Microsoft Edge with specific security configurations (such as preventing copy/paste or downloads) when coming from unmanaged devices. This control works by sending a device claim to the application, which then enforces the restrictions at the app level, rather than relying on device compliance or location.

Answer

Grant control: Require device to be marked as compliant

Answer

Grant control: Require trusted location

Answer

Grant control: Require approved client app

Question 2

You are implementing a B2B collaboration solution in Microsoft Entra ID. You need to ensure that external users from a partner tenant can access your internal applications, but they must use MFA from their home tenant. The partner tenant does not support MFA. What should you do?

Accepted Answer

Configure a Conditional Access policy targeting external users that requires MFA. You can configure a Conditional Access policy that targets external users (guest users) and requires MFA. Since the partner tenant does not support MFA, you cannot rely on cross-tenant trust; instead, you enforce MFA directly in your tenant using Microsoft Entra ID's own MFA capabilities. This ensures external users must complete MFA using your tenant's authentication methods, even if their home tenant lacks MFA support.

Answer

Configure cross-tenant access settings to trust MFA from the partner tenant

Answer

Use Microsoft Entra ID Governance to enforce MFA

Answer

Disable MFA for external users

Question 3

Which TWO of the following are valid methods to authenticate users in Microsoft Entra ID?

Accepted Answer

Certificate-based authentication. Certificate-based authentication (B) is a valid Entra ID authentication method in which a user presents an X.509 certificate (mapped to a user account) to authenticate directly to Entra ID, satisfying phishing-resistant and MFA requirements. Password hash synchronization (C) is a valid sign-in method because it synchronizes the on-premises Active Directory password hash to Entra ID via Microsoft Entra Connect, allowing users to authenticate to Entra ID with their on-premises credentials. SMS one-time passcode (A) is not a standalone authentication method in Entra ID — it is only usable as an MFA/second-factor verification method, not as a primary authentication method. Facebook account federation (D) is not supported by Entra ID for authentication (only Google and, historically, some social providers via B2B/B2C scenarios, not Facebook for Entra ID sign-in). Hardware OTP tokens (E) are supported only as an MFA verification method in Entra ID, not as a primary authentication method.

Answer

SMS text message one-time passcode

Answer

Facebook account federation

Answer

Hardware OTP tokens

Question 4

You executed the PowerShell script shown in the exhibit. What is the result?

Accepted Answer

All users are added to the Global Administrator role. The PowerShell script uses the `Add-MgRoleManagementDirectoryRoleAssignment` cmdlet to assign the Global Administrator role (identified by its well-known role definition ID) to each user retrieved from Microsoft Entra ID. Since the script iterates over all users and assigns the role without any filtering or removal logic, every user in the directory is added to the Global Administrator role, making option B correct.

Answer

All users are removed from the Global Administrator role

Answer

No users are added because of an error

Answer

Only users with the Global Administrator role are listed

Question 5

You executed the PowerShell script shown in the exhibit to set a token lifetime policy for an application. What is the effect on users accessing the application?

Accepted Answer

Access tokens expire after 2 hours. The PowerShell script sets an access token lifetime of 2 hours via the `New-AzureADPolicy` cmdlet with `TokenLifetimePolicy` type. This policy is then assigned to a specific service principal (application) using `Add-AzureADServicePrincipalPolicy`. Therefore, for users accessing that application, access tokens will expire after 2 hours, requiring a new token to be obtained once the lifetime is exceeded.

Answer

Session tokens expire after 1 hour

Answer

The policy applies to all applications in the tenant

Answer

Users are forced to reauthenticate every hour

Question 6

Your company uses Microsoft Entra ID with P2 licenses. You need to implement a policy that automatically revokes access for users who are detected as high risk by Microsoft Entra ID Protection. The policy must allow users to self-remediate by performing MFA. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires MFA for users with high user risk.. It combines a Conditional Access policy with the 'Require MFA' grant control, targeting users with high user risk. This meets the requirement to automatically revoke access (by requiring MFA) while allowing self-remediation through MFA. Conditional Access policies can evaluate user risk from ID Protection and enforce MFA as a remediation step, which is the intended design for user-initiated risk remediation.

Answer

Enable the 'Require password change' user risk policy in ID Protection.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to require MFA.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block access.

Question 7

Your organization uses Microsoft Entra ID. You need to ensure that users accessing internal applications from unmanaged devices are required to use Microsoft Edge with specific security configurations. Which Conditional Access control should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Microsoft Purview for data governance and assign custom RBAC roles in Copilot for Security.. Microsoft Purview provides the data governance framework needed to classify, label, and control access to security data, while custom RBAC roles in Copilot for Security allow granular permissions that enforce least privilege. This combination ensures that Copilot only accesses data necessary for its function and that all access is auditable through Purview's audit logs.

Answer

Use Conditional Access policies to restrict Copilot access based on location and device compliance.

Answer

Enable Microsoft Entra ID Protection to detect risky usage of Copilot.

Answer

Assign the Copilot roles via Privileged Identity Management (PIM) with approval workflows.

Question 8

Users report that they are prompted for MFA every time they sign in, even on trusted devices. You need to reduce the frequency of MFA prompts while maintaining security. What should you configure?

Accepted Answer

Enable the 'Remember MFA for trusted devices' setting in MFA settings.. Enabling 'Remember MFA for trusted devices' allows users to bypass MFA prompts for a configurable number of days on devices the user marks as trusted. This reduces the frequency of MFA prompts while maintaining security, as the trust is tied to a persistent token stored on the device. The setting is configured in the Microsoft Entra ID MFA service settings, not in Conditional Access policies.

Answer

Set the 'Number of days before reauthentication' to 0.

Answer

Disable MFA for trusted locations.

Answer

Adjust the sign-in session lifetime in Conditional Access.

Question 9

Refer to the exhibit. You are creating a custom role in Microsoft Entra ID. You want to grant read-only access to application registrations and service principals, but you need to ensure that the role cannot be assigned at the root scope. What change is required?

Accepted Answer

Add microsoft.directory/applications/allProperties/read to actions.. To grant read-only access to both application registrations and service principals, the role must include both microsoft.directory/applications/allProperties/read and microsoft.directory/servicePrincipals/allProperties/read. Option B only includes the applications permission. Also, application-related permissions cannot be scoped to administrative units; therefore, the requirement to prevent assignment at the tenant root cannot be satisfied for this role. Option A is invalid because ['/tenant-id'] is not a valid assignable scope.

Answer

Change assignableScopes to ["/tenant-id"]

Answer

Modify the roleName to include 'Read-Only'.

Answer

Add dataActions for application data.

Question 10

Your company uses Microsoft Entra ID with a third-party identity provider (IdP) for federation. Users report that sometimes they are unable to sign in even though the IdP is healthy. You suspect the issue is related to token signing certificate rotation. What should you do to resolve this proactively?

Accepted Answer

Configure automatic certificate rollover in Microsoft Entra ID by enabling 'Federation certificate management' and using Graph API to sync changes.. Microsoft Entra ID supports automatic certificate rollover for federated domains when the third-party IdP publishes updated token-signing certificates via a federation metadata endpoint. By enabling 'Federation certificate management' and using the Microsoft Graph API to sync changes, Entra ID can automatically detect and apply new certificates before the old ones expire, preventing sign-in disruptions without manual intervention.

Answer

Download the new certificate from the IdP and upload it to Microsoft Entra ID manually.

Answer

Set up alerts for sign-in failures and manually update the certificate when alerted.

Answer

Switch to pass-through authentication to bypass federation.

Question 11

Your organization uses Microsoft Entra ID. You need to ensure that users accessing internal applications from unmanaged devices are required to use Microsoft Edge with specific security configurations. Which Conditional Access control should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Conditional Access with device compliance condition and session control via Defender for Cloud Apps.. It combines Conditional Access with a device compliance condition to evaluate device state for both managed (Intune-enrolled) and unmanaged devices, and then uses session control via Defender for Cloud Apps to block sign-ins from non-compliant devices. This approach works for unmanaged devices by leveraging device compliance signals from Intune or third-party MDM, and the session control enforces real-time blocking at the app level.

Answer

Deploy Microsoft Entra application proxy and require pre-authentication.

Answer

Configure Intune compliance policies and require compliant device in Conditional Access.

Answer

Enable Microsoft Entra ID Protection and set sign-in risk policy to block medium and above.

Question 12

Your company uses Microsoft Entra ID with a custom domain. You need to implement a solution that allows users to sign in using their social identity providers (e.g., Google, Facebook) but still enforce your organization's MFA policies. What should you configure?

Accepted Answer

Configure Custom Authentication Extension to federate with social IdPs and apply Conditional Access policy requiring MFA.. Custom Authentication Extensions allow you to integrate external identity providers (like social IdPs) into the Microsoft Entra ID authentication flow while still enforcing Conditional Access policies, including MFA. This approach brings the social identity into the Entra ID tenant as a federated identity, enabling the organization to apply its own MFA policies rather than relying on the social IdP's native MFA.

Answer

Configure federation with the social IdP in Microsoft Entra ID.

Answer

Use Microsoft Entra B2B collaboration and invite users with their social accounts.

Answer

Enable self-service password reset (SSPR) with identity verification.

Question 13

Refer to the exhibit. A user's sign-in to Azure Portal failed MFA. The risk level is medium due to leaked credentials. Conditional Access was not applied. What is the most likely reason for MFA failure?

Accepted Answer

The user's credentials were compromised, leading to a failed MFA attempt possibly due to incorrect code.. The exhibit shows a sign-in failure due to MFA, with a risk level of 'medium' attributed to 'leaked credentials.' When credentials are leaked, the user's password is known to an attacker, but MFA still requires a second factor (e.g., a code from an authenticator app). The most likely reason for the MFA failure is that the user entered an incorrect MFA code, possibly because the attacker attempted to use a stolen password but could not provide the correct MFA code, or the user themselves mistyped it. The risk event (leaked credentials) does not directly cause the MFA failure; it indicates the password was compromised, but the MFA challenge itself failed due to an incorrect second factor.

Answer

The user's password was leaked, and the sign-in was blocked by a risk-based policy.

Answer

The user did not have MFA registered, so the MFA attempt failed.

Answer

Conditional Access policy required MFA but was not applied due to licensing issue.

Question 14

Refer to the exhibit. You are reviewing a custom Microsoft Entra role for an application developer. A developer reports that they cannot register an application even though they have the 'applications/create' permission. What is the most likely cause?

Accepted Answer

The developer does not have permission to consent to application permissions.. The 'applications/create' permission allows a user to create application registrations, but registering an application also requires the ability to consent to permissions, specifically delegated permissions or application permissions. Without the 'Consent to application permissions' permission (or equivalent admin consent), the developer cannot complete the registration process because the app registration wizard requires consent for the permissions it requests. This is a separate permission that must be explicitly granted in the custom role definition.

Answer

The developer is not a Global Administrator.

Answer

The role needs to be assigned at the root scope.

Answer

The role is not assigned to the developer.

Question 15

Your organization has Microsoft Entra ID P2 licenses. You want to automatically detect and respond to compromised identities by requiring MFA when a sign-in risk is medium or above. Which policy should you configure?

Accepted Answer

Configure an Identity Protection user risk policy to require MFA. An Identity Protection user risk policy is designed to automatically respond to user risk levels (e.g., low, medium, high) by triggering actions such as requiring MFA or blocking sign-in. Since the requirement is to detect and respond to compromised identities based on user risk (medium or above), the user risk policy directly maps to this scenario. This policy evaluates the risk associated with the user account itself, not just individual sign-in events.

Answer

Enable self-service password reset

Answer

Configure a Conditional Access policy with sign-in risk condition

Answer

Configure an Identity Protection sign-in risk policy