AZ-500 Secure identity and access Practice Test 4 — 15 Questions

Question 1

Your company uses Microsoft Entra ID with a hybrid identity model. You need to implement a solution that allows you to block legacy authentication attempts while still allowing modern authentication protocols. What should you use?

Accepted Answer

Create a Conditional Access policy to block legacy authentication. Conditional Access policies in Microsoft Entra ID allow you to explicitly block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic auth) while permitting modern authentication (OAuth 2.0, OpenID Connect). By targeting the 'Client apps' condition and selecting 'Exchange ActiveSync clients' and 'Other clients', you can block all legacy auth attempts without affecting modern protocol traffic. This is the precise, granular control required for a hybrid identity model.

Answer

Enable Security defaults

Answer

Use Identity Protection to detect legacy authentication

Answer

Configure MFA for all users

Question 2

You are designing a Microsoft Entra ID tenant for a multinational organization. The security team requires that all administrative users must use phishing-resistant MFA. Administrators are located in different regions and may use different devices. Which MFA method should you enforce?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the only option that provides phishing-resistant MFA, as they use public-key cryptography and are bound to a specific web origin, preventing credential theft via man-in-the-middle attacks. This satisfies the security team's requirement for all administrative users, regardless of region or device, because FIDO2 keys are hardware-based and interoperable across platforms.

Answer

SMS-based verification

Answer

Phone call verification

Answer

Microsoft Authenticator with OTP

Question 3

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?

Accepted Answer

Self-service password reset (SSPR). Self-service password reset (SSPR) is the correct feature because it allows users to reset their own passwords without IT intervention. SSPR integrates with Microsoft Entra ID and can be configured to require verification methods such as email, phone, or security questions before allowing a password change. This directly meets the requirement of enabling users to reset passwords independently.

Answer

Identity Protection

Answer

Multifactor authentication

Answer

Password Protection

Question 4

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access corporate email. You configure a Conditional Access policy targeting Exchange Online. Which grant control should you use?

Accepted Answer

Require device to be marked as compliant. Option A is correct because Require device to be marked as compliant ensures only compliant devices can access. Option B is wrong because Require MFA does not check device compliance. Option C is wrong because Require hybrid Azure AD join is for domain-joined devices. Option D is wrong because Block access is too restrictive.

Answer

Require multifactor authentication

Answer

Block access

Answer

Require hybrid Azure AD joined device

Question 5

You are troubleshooting an issue where users are unable to access a sensitive application protected by a Conditional Access policy. The policy requires MFA from trusted locations, but users are reporting that they are prompted for MFA even when connecting from the corporate office, which is defined as a trusted location. What is the most likely cause?

Accepted Answer

The corporate office's public IP address is not correctly defined in the trusted location. Option A is correct because the most likely cause is that the corporate office's public IP address is not correctly defined in the trusted location. Conditional Access policies evaluate location based on named locations configured in Azure AD, which must include the exact public IP ranges (CIDR notation) of the trusted network. If the IP address is missing, misconfigured, or the user's outbound IP differs (e.g., due to a VPN or proxy), the policy treats the location as untrusted and enforces MFA.

Answer

The policy is configured to require MFA for all locations regardless of trust

Answer

The policy is set to 'Require MFA' instead of 'Require MFA from trusted locations'

Answer

Users are not assigned to the policy

Question 6

Your organization uses Microsoft Entra ID. The security team wants to ensure that users cannot reuse the last five passwords. Which feature should you configure?

Accepted Answer

Password expiration policy. Option C is correct because password expiration policy can enforce password history to prevent reuse. Option A is wrong because SSPR is for self-reset. Option B is wrong because Password Protection blocks weak passwords. Option D is wrong because MFA adds a second factor.

Answer

Multifactor authentication

Answer

Password Protection

Answer

Self-service password reset

Question 7

Your company uses Microsoft Entra ID and has Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud apps based on user behavior. Which feature should you use?

Accepted Answer

Conditional Access for Cloud Apps (session control). Option B is correct because session control in Conditional Access for Cloud Apps enables real-time monitoring and control. Option A is wrong because app proxy is for on-prem apps. Option C is wrong because DLP is for data protection. Option D is wrong because Cloud Discovery identifies shadow IT.

Answer

Information Protection (DLP)

Answer

Cloud Discovery

Answer

Application Proxy

Question 8

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM). You need to ensure that all privileged role activations are approved by a manager and require a ticket number. What should you configure in PIM?

Accepted Answer

Role settings for the privileged role. Option A is correct because role settings in PIM allow you to configure approval and justification. Option B is wrong because access reviews are for periodic reviews. Option C is wrong because alerts are for notifications. Option D is wrong because audit history is for logging.

Answer

Audit history

Answer

Alerts

Answer

Access reviews

Question 9

Your company uses Microsoft Entra ID. You need to block sign-ins from countries where your company does not operate. Which approach should you use?

Accepted Answer

Create a Conditional Access policy to block access from those countries. Option B is correct because Conditional Access policies can block sign-ins by geographic location. Option A is wrong because MFA doesn't block by location. Option C is wrong because Named locations are used in Conditional Access, but they define trusted locations, not block others. Option D is wrong because Identity Protection detects risky sign-ins but does not block by country.

Answer

Configure MFA for all users

Answer

Use Identity Protection user risk policy

Answer

Add those countries as Named locations

Question 10

Which TWO of the following are methods to enforce MFA in Microsoft Entra ID?

Accepted Answer

Security defaults. Security defaults (Option C) is a method to enforce MFA because it automatically enables MFA for all users in a tenant, along with other baseline security policies, without requiring additional configuration. Conditional Access policy (Option D) is a method to enforce MFA because it allows granular, policy-driven MFA requirements based on conditions such as user, location, device state, or risk level, using the Microsoft Entra ID Conditional Access engine.

Answer

Identity Protection user risk policy

Answer

Password Protection

Answer

Self-service password reset

Question 11

Which THREE of the following can be used to provide just-in-time (JIT) privileged access to Azure resources?

Accepted Answer

Privileged Access Groups (PAG). Privileged Access Groups (PAG) allow you to manage just-in-time (JIT) access by assigning users to a group that has time-bound, activated roles. When a user activates their membership in a PAG via Microsoft Entra Privileged Identity Management (PIM), they receive the necessary permissions for a specified duration, providing JIT privileged access to Azure resources.

Answer

Conditional Access

Answer

Azure RBAC role assignment

Question 12

Which TWO of the following are valid authentication methods in Microsoft Entra ID?

Accepted Answer

Temporary Access Pass. Temporary Access Pass (TAP) is a valid authentication method in Microsoft Entra ID that allows users to register passwordless methods (like FIDO2 or Microsoft Authenticator) by providing a time-limited passcode. It is designed for scenarios where users have forgotten their credentials or need to onboard new devices without a password. TAP is configured via the Authentication methods policy in Entra ID and supports both one-time use and configurable lifetimes.

Answer

App registration

Answer

Managed identity

Answer

Azure AD Connect

Question 13

Refer to the exhibit. A Conditional Access policy is configured to block legacy authentication for Office 365. However, users are still able to access Exchange Online using Outlook (modern authentication). What is the most likely reason?

Accepted Answer

The policy only blocks legacy protocols, not modern authentication. The Conditional Access policy is configured to block legacy authentication, which targets protocols like POP3, IMAP, SMTP, and Exchange ActiveSync that do not support modern authentication. Modern authentication (used by Outlook with OAuth 2.0) is not affected by this policy, so users can still access Exchange Online via Outlook. The policy explicitly allows modern authentication flows, making option A correct.

Answer

The policy does not include Exchange Online

Answer

The policy does not apply to all users

Answer

The policy is not enabled

Question 14

Refer to the exhibit. A user is eligible for a role in PIM. When they activate the role, how long will the activation last?

Accepted Answer

8 hours. In Azure AD Privileged Identity Management (PIM), the default maximum activation duration for an eligible role is 8 hours. This is configurable by administrators, but the question refers to the standard default setting. When a user activates a role, the activation lasts for this predefined period unless a different duration is explicitly set in the role settings.

Answer

1 hour

Answer

24 hours

Answer

Indefinite

Question 15

Refer to the exhibit. You run the command and see the output. What does the UserType 'Member' indicate?

Accepted Answer

The user is a member of the tenant. The UserType 'Member' indicates that the user is a member of the tenant, meaning the user's identity is native to the Azure AD tenant and not from an external directory. This is distinct from 'Guest' (UserType = Guest), which represents external users invited via B2B collaboration. The command shown is likely Get-AzureADUser or a similar cmdlet, where the UserType property directly reflects the user's relationship to the tenant.

Answer

The user is a service principal

Answer

The user is a guest user

Answer

The user is an administrator