AZ-500 Secure identity and access Practice Test 3 — 15 Questions

Question 1

You manage a Microsoft Entra ID tenant for a multinational company. Users in the European office report that they cannot access the company's custom line-of-business application during peak hours, while users in the US office have no issues. The application uses OAuth 2.0 authentication with Conditional Access policies applied. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Conditional Access policy requires compliant devices, and European devices are taking longer to report compliance during peak hours.. The issue is that the Conditional Access policy requires compliant devices, and during peak hours, European devices may take longer to report compliance status due to network latency or increased load on the compliance evaluation infrastructure. This delay can cause the Conditional Access policy to deny access until compliance is verified, while US users, likely in a different time zone, are not experiencing peak load. The OAuth 2.0 authentication flow includes a device compliance check, and if the compliance state is not reported in time, the token issuance is blocked.

Answer

The application's service principal has been accidentally disabled in the European tenant location.

Answer

The Conditional Access policy requires multi-factor authentication for all users, and the MFA session token expired for European users.

Answer

The token lifetime policy for the application is set too low, causing European users to reauthenticate more frequently.

Question 2

You are a security engineer for a company that uses Microsoft Entra ID. You need to ensure that all users accessing the company's Salesforce application from unmanaged devices are prompted for multi-factor authentication (MFA) every time. What should you configure?

Accepted Answer

Create a Conditional Access policy that targets the Salesforce application, apply to all users, include 'All device platforms' with 'Device state' filter for 'Unmanaged', and grant access requiring MFA with session control 'Sign-in frequency - Every time'.. A Conditional Access policy with a 'Device state' filter for 'Unmanaged' and 'Sign-in frequency - Every time' session control forces MFA prompts on every access attempt from unmanaged devices. This meets the requirement to prompt MFA every time for users accessing Salesforce from unmanaged devices, without affecting managed devices or requiring per-user MFA.

Answer

Enable per-user MFA for all users in the Salesforce application.

Answer

Configure device compliance policy to require MFA on non-compliant devices.

Answer

Configure MFA registration policy to require all users to register MFA.

Question 3

Your organization has a Microsoft Entra ID tenant with 50,000 users. You are designing a solution to automatically revoke access for users who have not signed in for 90 days. The solution must be cost-effective and use built-in Microsoft Entra ID features. What should you do?

Accepted Answer

Configure the 'User sign-in frequency' setting in the 'User feature' settings to automatically remove users inactive for 90 days.. Microsoft Entra ID includes a built-in 'User sign-in frequency' setting under 'User feature' settings that automatically revokes access for users who have not signed in for a specified period (e.g., 90 days). This feature is cost-effective as it requires no additional licensing beyond Microsoft Entra ID P2, and it operates natively without custom scripts or external automation.

Answer

Create a Power Automate flow that triggers monthly to check sign-in logs and disable inactive users.

Answer

Use Microsoft Entra Connect to synchronize a 'disable' attribute from on-premises and set it for inactive users.

Answer

Write a PowerShell script using Microsoft Graph API to check last sign-in times and disable users.

Question 4

You need to assign the 'Security Administrator' role in Microsoft Entra ID to a user named User1. The role assignment must be eligible, and User1 must provide a justification when activating the role. What should you use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID is the only service that supports time-bound, eligible role assignments with activation justification. By configuring a PIM policy for the Security Administrator role, you can require User1 to provide a business justification before the role is activated for a specified duration.

Answer

Direct role assignment in Azure AD roles and administrators

Answer

Global Administrator role with custom activation policy

Answer

User Administrator role with access reviews

Question 5

Your organization uses Microsoft Entra ID and has several applications registered. You need to ensure that only specific applications can call a particular web API. The web API is also registered in Microsoft Entra ID. What should you configure?

Accepted Answer

In the web API's application registration, configure the 'expose an API' blade to define scopes, and then pre-authorize the specific client applications in the web API's manifest.. Pre-authorizing specific client applications in the web API's manifest (via the 'expose an API' blade) explicitly grants those clients permission to call the API without requiring user consent. This ensures that only the listed applications can acquire tokens for the API, as the API's application registration defines the scopes and pre-authorizations that control access.

Answer

Configure an app role assignment policy for the web API.

Answer

Set a token lifetime policy on the web API to accept tokens only from approved client applications.

Answer

Create a Conditional Access policy targeting the web API and require that the client application is managed.

Question 6

Your company uses Microsoft Entra ID and Microsoft Sentinel. You need to detect when a user account is created outside of normal business hours (9 AM - 5 PM local time) and automatically suspend the account. What should you use?

Accepted Answer

Create an analytics rule in Microsoft Sentinel that triggers on user creation events and runs a playbook to disable the account. Microsoft Sentinel analytics rules can be configured to trigger on specific log events (such as user creation from Azure Active Directory audit logs) and then execute a playbook (an automated workflow in Azure Logic Apps) to perform actions like disabling the account. This directly meets the requirement to detect user creation outside business hours and automatically suspend the account.

Answer

Configure a session policy in Microsoft Defender for Cloud Apps

Answer

Configure an access review in Privileged Identity Management

Answer

Configure a risk detection policy in Microsoft Entra ID Identity Protection

Question 7

You need to ensure that external users who are invited to collaborate via Microsoft Entra B2B can only access the applications assigned to them. Which configuration should you use?

Accepted Answer

Create a Conditional Access policy that applies to guest users and targets the specific applications.. Conditional Access policies in Microsoft Entra ID can be scoped to guest/external users and specific applications, allowing you to enforce access controls such as requiring MFA or blocking access for unapproved apps. This directly meets the requirement to restrict B2B guest users to only the applications assigned to them, without affecting other sign-in behaviors or tenant-wide settings.

Answer

Require guest users to register for MFA before accessing any applications.

Answer

Configure cross-tenant access settings to block all applications except those assigned.

Answer

Configure SharePoint external sharing settings to limit application access.

Question 8

Your organization uses Microsoft Entra ID. You need to recommend solutions to reduce the risk of privileged role abuse. Which TWO actions should you recommend? (Choose two.)

Accepted Answer

Configure access reviews for privileged roles to run quarterly.. Access reviews can periodically verify that role assignments are still needed, reducing the risk of stale privileged roles. Option D is correct because PIM provides just-in-time access and approval workflows, requiring approval for role activation. Option A is wrong because permanent role assignment increases risk. Option C is wrong because disabling sign-in logs reduces visibility, making it harder to detect abuse. Option E is wrong because requiring MFA for all users does not specifically target privileged role abuse; it is a general security measure.

Answer

Assign privileged roles permanently to reduce friction.

Answer

Disable sign-in logs for privileged users to reduce noise.

Answer

Require all users to use MFA for all applications.

Question 9

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a secure authentication strategy that satisfies the following requirements:
- Users must not be able to bypass security verification using alternate authentication methods.
- Passwordless authentication should be used where possible.
- Legacy authentication protocols must be blocked.

Which THREE actions should you take? (Choose three.)

Accepted Answer

Create a Conditional Access policy to block legacy authentication protocols.. A Conditional Access policy can explicitly block legacy authentication protocols (such as POP3, IMAP, SMTP, and older Office clients) by targeting 'Exchange ActiveSync' and 'Other clients' in the client apps condition. This prevents users from bypassing modern authentication requirements and ensures that only modern authentication flows (e.g., OAuth 2.0) are allowed, which is a key requirement to block legacy protocols.

Answer

Configure per-user MFA to require verification.

Answer

Enable the 'Security defaults' feature in Microsoft Entra ID.

Question 10

Refer to the exhibit. You are creating a custom Azure RBAC role for a security analyst. The role as shown allows read access to storage accounts. The analyst reports that they cannot read the contents of a blob container in a storage account. Why is this?

Accepted Answer

The role does not include dataActions to read blob data.. The custom RBAC role only includes read permissions for the storage account's control plane (e.g., listing keys, reading properties) but lacks the necessary dataActions to read blob data. To read blob container contents, the role must include 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' under dataActions, which governs access to the data plane. Without this, the analyst can see the storage account but cannot access the blobs within it.

Answer

The role is not assigned to the analyst's user account.

Answer

The assignable scope is incorrect; it should be at the resource group level.

Answer

The storage account does not exist in the specified subscription.

Question 11

Refer to the exhibit. You are reviewing user sign-in activity using Microsoft Graph API. The user has not performed an interactive sign-in since December 1, but had a non-interactive sign-in on December 5. You need to determine if the user should be considered inactive for a policy that defines inactivity as no interactive sign-in for 30 days. Today is December 15. What should you do?

Accepted Answer

Use the lastSignInDateTime of December 1, which is only 14 days ago, so the user is not inactive.. The policy defines inactivity as no interactive sign-in for 30 days. The user's last interactive sign-in was on December 1, which is only 14 days ago as of December 15, so the user is not inactive. Microsoft Graph API's lastSignInDateTime property specifically tracks interactive sign-ins, while non-interactive sign-ins are tracked separately via lastNonInteractiveSignInDateTime and do not reset the interactive inactivity timer.

Answer

Check if the user has any sign-in in the last 30 days; since there is a non-interactive sign-in, the user is active.

Answer

Use the lastNonInteractiveSignInDateTime as the last sign-in time, so the user is not inactive.

Answer

The user is inactive because the account is enabled but there is no interactive sign-in in the last 30 days.

Question 12

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What is the effect of this policy?

Accepted Answer

The policy requires service provider guest users accessing Office 365 to either use MFA or have a compliant device.. The policy targets 'Guest users' and 'Service provider guest users' specifically, not all users. It applies to the Office 365 cloud app and grants access only if the user satisfies either the MFA requirement or the compliant device requirement (using an OR condition). Option B correctly identifies that service provider guest users must meet one of the two controls to access Office 365.

Answer

The policy requires all guest users to use MFA and a compliant device to access Office 365.

Answer

The policy requires all users accessing Office 365 to use MFA and a compliant device.

Answer

The policy blocks all external users from accessing Office 365.

Question 13

Your company uses Microsoft Entra ID with a hybrid identity model. You need to implement a solution that allows you to block legacy authentication attempts while still allowing modern authentication protocols. What should you use?

Accepted Answer

Create a Conditional Access policy to block legacy authentication. Conditional Access policies in Microsoft Entra ID allow you to explicitly block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic auth) while permitting modern authentication (OAuth 2.0, OpenID Connect). By targeting the 'Client apps' condition and selecting 'Exchange ActiveSync clients' and 'Other clients', you can block all legacy auth attempts without affecting modern protocol traffic. This is the precise, granular control required for a hybrid identity model.

Answer

Enable Security defaults

Answer

Use Identity Protection to detect legacy authentication

Answer

Configure MFA for all users

Question 14

You are designing a Microsoft Entra ID tenant for a multinational organization. The security team requires that all administrative users must use phishing-resistant MFA. Administrators are located in different regions and may use different devices. Which MFA method should you enforce?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the only option that provides phishing-resistant MFA, as they use public-key cryptography and are bound to a specific web origin, preventing credential theft via man-in-the-middle attacks. This satisfies the security team's requirement for all administrative users, regardless of region or device, because FIDO2 keys are hardware-based and interoperable across platforms.

Answer

SMS-based verification

Answer

Phone call verification

Answer

Microsoft Authenticator with OTP

Question 15

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?

Accepted Answer

Self-service password reset (SSPR). Self-service password reset (SSPR) is the correct feature because it allows users to reset their own passwords without IT intervention. SSPR integrates with Microsoft Entra ID and can be configured to require verification methods such as email, phone, or security questions before allowing a password change. This directly meets the requirement of enabling users to reset passwords independently.

Answer

Identity Protection

Answer

Multifactor authentication

Answer

Password Protection