AZ-500 Secure identity and access Practice Test 3 — 15 Questions

Question 1

You manage a Microsoft Entra ID tenant for a multinational company. Users in the European office report that they cannot access the company's custom line-of-business application during peak hours, while users in the US office have no issues. The application uses OAuth 2.0 authentication with Conditional Access policies applied. What is the most likely cause?

Accepted Answer

The Conditional Access policy requires compliant devices, and European devices are taking longer to report compliance during peak hours.. Option C is correct because users in different regions may experience different authentication latency if the Conditional Access policy is configured to require compliant devices, and the device compliance evaluation may take longer during peak hours due to network congestion. Option A is wrong because MFA timeout is typically uniform per policy. Option B is wrong because token lifetime policies are applied globally. Option D is wrong because session revocation is not triggered by peak hours.

Answer

The application's service principal has been accidentally disabled in the European tenant location.

Answer

The Conditional Access policy requires multi-factor authentication for all users, and the MFA session token expired for European users.

Answer

The token lifetime policy for the application is set too low, causing European users to reauthenticate more frequently.

Question 2

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?

Accepted Answer

Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.. Option B is correct because in Microsoft Entra ID PIM, role settings allow you to require approval and specify approvers, including the user's manager via the 'Manager as approver' option. The maximum activation duration setting controls how long the role is active after approval, but the approval timeout (which defaults to 1 hour) can be adjusted via the 'Approval timeout' setting in the role settings; however, the question's requirement for a 30-minute timeout on the approval response itself is achieved by setting the 'Approval timeout' to 30 minutes, not the activation duration. The correct configuration is to require approval, add the manager as an approver, and set the approval timeout to 30 minutes, which matches the described behavior.

Answer

Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.

Answer

Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.

Answer

Configure the role settings to require approval and set the approval timeout to 0 minutes.

Question 3

You are a security engineer for a company that uses Microsoft Entra ID. You need to ensure that all users accessing the company's Salesforce application from unmanaged devices are prompted for multi-factor authentication (MFA) every time. What should you configure?

Accepted Answer

Create a Conditional Access policy that targets the Salesforce application, apply to all users, include 'All device platforms' with 'Device state' filter for 'Unmanaged', and grant access requiring MFA with session control 'Sign-in frequency - Every time'.. Option B is correct because a Conditional Access policy with a 'Device state' filter for 'Unmanaged' and 'Sign-in frequency - Every time' session control forces MFA prompts on every access attempt from unmanaged devices. This meets the requirement to prompt MFA every time for users accessing Salesforce from unmanaged devices, without affecting managed devices or requiring per-user MFA.

Answer

Enable per-user MFA for all users in the Salesforce application.

Answer

Configure device compliance policy to require MFA on non-compliant devices.

Answer

Configure MFA registration policy to require all users to register MFA.

Question 4

Your organization has a Microsoft Entra ID tenant with 50,000 users. You are designing a solution to automatically revoke access for users who have not signed in for 90 days. The solution must be cost-effective and use built-in Microsoft Entra ID features. What should you do?

Accepted Answer

Configure the 'User sign-in frequency' setting in the 'User feature' settings to automatically remove users inactive for 90 days.. Option C is correct because Microsoft Entra ID includes a built-in 'User sign-in frequency' setting under 'User feature' preview that can automatically revoke access for users who have not signed in for a specified period (e.g., 90 days). This feature is cost-effective as it requires no additional licensing beyond the base Entra ID P1 or P2, and it operates natively without custom scripts or external automation.

Answer

Create a Power Automate flow that triggers monthly to check sign-in logs and disable inactive users.

Answer

Use Microsoft Entra Connect to synchronize a 'disable' attribute from on-premises and set it for inactive users.

Answer

Write a PowerShell script using Microsoft Graph API to check last sign-in times and disable users.

Question 5

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?

Accepted Answer

Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.. Option B is correct because a Conditional Access policy can enforce device compliance as a grant control for Exchange Online, ensuring only compliant devices can access the service. Setting the session sign-in frequency to 12 hours forces users to reauthenticate at that interval, meeting the requirement without requiring MFA. This combines device compliance enforcement with session lifetime control in a single policy.

Answer

Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.

Answer

Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.

Answer

Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.

Question 6

You need to assign the 'Security Administrator' role in Microsoft Entra ID to a user named User1. The role assignment must be eligible, and User1 must provide a justification when activating the role. What should you use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID is the only service that supports time-bound, eligible role assignments with activation justification. By configuring a PIM policy for the Security Administrator role, you can require User1 to provide a business justification before the role is activated for a specified duration.

Answer

Direct role assignment in Azure AD roles and administrators

Answer

Global Administrator role with custom activation policy

Answer

User Administrator role with access reviews

Question 7

Your organization uses Microsoft Entra ID and has several applications registered. You need to ensure that only specific applications can call a particular web API. The web API is also registered in Microsoft Entra ID. What should you configure?

Accepted Answer

In the web API's application registration, configure the 'expose an API' blade to define scopes, and then pre-authorize the specific client applications in the web API's manifest.. Option D is correct because pre-authorizing specific client applications in the web API's manifest (via the 'expose an API' blade) explicitly grants those clients permission to call the API without requiring user consent. This ensures that only the listed applications can acquire tokens for the API, as the API's application registration defines the scopes and pre-authorizations that control access.

Answer

Configure an app role assignment policy for the web API.

Answer

Set a token lifetime policy on the web API to accept tokens only from approved client applications.

Answer

Create a Conditional Access policy targeting the web API and require that the client application is managed.

Question 8

Your company uses Microsoft Entra ID and Microsoft Sentinel. You need to detect when a user account is created outside of normal business hours (9 AM - 5 PM local time) and automatically suspend the account. What should you use?

Accepted Answer

Create an analytics rule in Microsoft Sentinel that triggers on user creation events and runs a playbook to disable the account. Option C is correct because Microsoft Sentinel analytics rules can be configured to trigger on specific log events (such as user creation from Azure Active Directory audit logs) and then execute a playbook (an automated workflow in Azure Logic Apps) to perform actions like disabling the account. This directly meets the requirement to detect user creation outside business hours and automatically suspend the account.

Answer

Configure a session policy in Microsoft Defender for Cloud Apps

Answer

Configure an access review in Privileged Identity Management

Answer

Configure a risk detection policy in Microsoft Entra ID Identity Protection

Question 9

You need to ensure that external users who are invited to collaborate via Microsoft Entra B2B can only access the applications assigned to them. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that applies to guest users and targets the specific applications.. Option B is correct because Conditional Access policies in Microsoft Entra ID can be scoped to guest/external users and specific applications, allowing you to enforce access controls such as requiring MFA or blocking access for unapproved apps. This directly meets the requirement to restrict B2B guest users to only the applications assigned to them, without affecting other sign-in behaviors or tenant-wide settings.

Answer

Require guest users to register for MFA before accessing any applications.

Answer

Configure cross-tenant access settings to block all applications except those assigned.

Answer

Configure SharePoint external sharing settings to limit application access.

Question 10

Your organization uses Microsoft Entra ID. You need to recommend solutions to reduce the risk of privileged role abuse. Which TWO actions should you recommend? (Choose two.)

Accepted Answer

Configure access reviews for privileged roles to run quarterly.. Option B is correct because PIM provides just-in-time access and approval workflows. Option D is correct because access reviews can periodically verify that role assignments are still needed. Option A is wrong because permanent role assignment increases risk. Option C is wrong because requiring MFA for all users does not target privileged roles. Option E is wrong because disabling sign-in logs reduces visibility.

Answer

Assign privileged roles permanently to reduce friction.

Answer

Disable sign-in logs for privileged users to reduce noise.

Answer

Require all users to use MFA for all applications.

Question 11

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a secure authentication strategy that satisfies the following requirements:
- Users must not be able to bypass security verification using alternate authentication methods.
- Passwordless authentication should be used where possible.
- Legacy authentication protocols must be blocked.

Which THREE actions should you take? (Choose three.)

Accepted Answer

Create a Conditional Access policy to block legacy authentication protocols.. Option A is correct because a Conditional Access policy can explicitly block legacy authentication protocols (such as POP3, IMAP, SMTP, and older Office clients) by targeting 'Exchange ActiveSync' and 'Other clients' in the client apps condition. This prevents users from bypassing modern authentication requirements and ensures that only modern authentication flows (e.g., OAuth 2.0) are allowed, which is a key requirement to block legacy protocols.

Answer

Configure per-user MFA to require verification.

Answer

Enable the 'Security defaults' feature in Microsoft Entra ID.

Question 12

Your organization uses Microsoft Entra ID and has a hybrid identity with Microsoft Entra Connect. You need to ensure that all user password changes and resets are synchronized to the cloud within 30 minutes. Which TWO actions should you take? (Choose two.)

Accepted Answer

Set the Azure AD Connect synchronization frequency to 30 minutes.. Option B is correct because the Azure AD Connect synchronization frequency can be configured to run every 30 minutes (the minimum supported interval) to ensure password changes and resets are synchronized to the cloud within that timeframe. Option C is correct because enabling password writeback in Microsoft Entra Connect allows password changes and resets initiated in the cloud to be written back to the on-premises directory, ensuring bidirectional synchronization within the 30-minute window.

Answer

Configure federation with AD FS.

Answer

Enable Azure AD Connect Health to monitor synchronization.

Answer

Configure pass-through authentication for user sign-ins.

Question 13

Refer to the exhibit. You are creating a custom Azure RBAC role for a security analyst. The role as shown allows read access to storage accounts. The analyst reports that they cannot read the contents of a blob container in a storage account. Why is this?

Accepted Answer

The role does not include dataActions to read blob data.. The custom RBAC role only includes read permissions for the storage account's control plane (e.g., listing keys, reading properties) but lacks the necessary dataActions to read blob data. To read blob container contents, the role must include 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' under dataActions, which governs access to the data plane. Without this, the analyst can see the storage account but cannot access the blobs within it.

Answer

The role is not assigned to the analyst's user account.

Answer

The assignable scope is incorrect; it should be at the resource group level.

Answer

The storage account does not exist in the specified subscription.

Question 14

Refer to the exhibit. You are reviewing user sign-in activity using Microsoft Graph API. The user has not performed an interactive sign-in since December 1, but had a non-interactive sign-in on December 5. You need to determine if the user should be considered inactive for a policy that defines inactivity as no interactive sign-in for 30 days. Today is December 15. What should you do?

Accepted Answer

Use the lastSignInDateTime of December 1, which is only 14 days ago, so the user is not inactive.. Option C is correct because the policy defines inactivity as no interactive sign-in for 30 days. The user's last interactive sign-in was on December 1, which is only 14 days ago as of December 15, so the user is not inactive. Microsoft Graph API's lastSignInDateTime property specifically tracks interactive sign-ins, while non-interactive sign-ins are tracked separately via lastNonInteractiveSignInDateTime and do not reset the interactive inactivity timer.

Answer

Check if the user has any sign-in in the last 30 days; since there is a non-interactive sign-in, the user is active.

Answer

Use the lastNonInteractiveSignInDateTime as the last sign-in time, so the user is not inactive.

Answer

The user is inactive because the account is enabled but there is no interactive sign-in in the last 30 days.

Question 15

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Accepted Answer

The policy requires service provider guest users accessing Office 365 to either use MFA or have a compliant device.. The policy targets 'Guest users' and 'Service provider guest users' specifically, not all users. It applies to the Office 365 cloud app and grants access only if the user satisfies either the MFA requirement or the compliant device requirement (using an OR condition). Option B correctly identifies that service provider guest users must meet one of the two controls to access Office 365.

Answer

The policy requires all guest users to use MFA and a compliant device to access Office 365.

Answer

The policy requires all users accessing Office 365 to use MFA and a compliant device.

Answer

The policy blocks all external users from accessing Office 365.