AZ-500 Secure identity and access Practice Test 4 — 15 Questions

Question 1

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access corporate email. You configure a Conditional Access policy targeting Exchange Online. Which grant control should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require device to be marked as compliant. The scenario requires that only devices compliant with security policies can access corporate email. The 'Require device to be marked as compliant' grant control in Conditional Access checks the device compliance status reported by Microsoft Intune. If the device is not compliant, access to Exchange Online is blocked, ensuring policy enforcement.

Answer

Require multifactor authentication

Answer

Block access

Answer

Require hybrid Azure AD joined device

Question 2

You are troubleshooting an issue where users are unable to access a sensitive application protected by a Conditional Access policy. The policy requires MFA from trusted locations, but users are reporting that they are prompted for MFA even when connecting from the corporate office, which is defined as a trusted location. What is the most likely cause?

Accepted Answer

The corporate office's public IP address is not correctly defined in the trusted location. The most likely cause is that the corporate office's public IP address is not correctly defined in the trusted location. Conditional Access policies evaluate location based on named locations configured in Azure AD, which must include the exact public IP ranges (CIDR notation) of the trusted network. If the IP address is missing, misconfigured, or the user's outbound IP differs (e.g., due to a VPN or proxy), the policy treats the location as untrusted and enforces MFA.

Answer

The policy is configured to require MFA for all locations regardless of trust

Answer

The policy is set to 'Require MFA' instead of 'Require MFA from trusted locations'

Answer

Users are not assigned to the policy

Question 3

Your organization uses Microsoft Entra ID. The security team wants to ensure that users cannot reuse the last five passwords. Which feature should you configure?

Accepted Answer

Password expiration policy. The password expiration policy can enforce a password history setting that prevents users from reusing their last five passwords. This is configured in the password expiration policy. Option B (Multifactor authentication) is incorrect because MFA adds an additional verification step but does not control password reuse. Option C (Password Protection) is incorrect because it prevents users from using weak or common passwords, not from reusing recent passwords. Option D (Self-service password reset) is incorrect because it allows users to reset their own passwords but does not enforce password history.

Answer

Multifactor authentication

Answer

Password Protection

Answer

Self-service password reset

Question 4

Your company uses Microsoft Entra ID and has Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud apps based on user behavior. Which feature should you use?

Accepted Answer

Conditional Access for Cloud Apps (session control). Conditional Access for Cloud Apps with session control is the correct feature because it allows you to monitor and control access to cloud apps in real time based on user behavior. It uses Microsoft Entra ID Conditional Access policies combined with Microsoft Defender for Cloud Apps to enforce session policies, such as blocking downloads or requiring multi-factor authentication, when anomalous behavior is detected.

Answer

Information Protection (DLP)

Answer

Cloud Discovery

Answer

Application Proxy

Question 5

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM). You need to ensure that all privileged role activations are approved by a manager and require a ticket number. What should you configure in PIM?

Accepted Answer

Role settings for the privileged role. In Microsoft Entra ID PIM, role settings for each privileged role allow you to configure approval requirements and justification fields. By editing the role settings, you can require approval from a designated approver (e.g., a manager) and mandate a ticket number in the justification field, ensuring compliance with organizational policies.

Answer

Audit history

Answer

Alerts

Answer

Access reviews

Question 6

Your company uses Microsoft Entra ID. You need to block sign-ins from countries where your company does not operate. Which approach should you use?

Accepted Answer

Create a Conditional Access policy to block access from those countries. Conditional Access policies can block sign-ins by geographic location. Option A is wrong because MFA doesn't block by location. Option C is wrong because Identity Protection user risk policy detects risky sign-ins but does not block by country. Option D is wrong because Named locations are used in Conditional Access, but they define trusted locations, not block others.

Answer

Configure MFA for all users

Answer

Use Identity Protection user risk policy

Answer

Add those countries as Named locations

Question 7

Which TWO of the following are methods to enforce MFA in Microsoft Entra ID?

Accepted Answer

Security defaults. Security defaults (Option C) is a method to enforce MFA because it automatically enables MFA for all users in a tenant, along with other baseline security policies, without requiring additional configuration. Conditional Access policy (Option D) is a method to enforce MFA because it allows granular, policy-driven MFA requirements based on conditions such as user, location, device state, or risk level, using the Microsoft Entra ID Conditional Access engine.

Answer

Identity Protection user risk policy

Answer

Password Protection

Answer

Self-service password reset

Question 8

Which THREE of the following can be used to provide just-in-time (JIT) privileged access to Azure resources?

Accepted Answer

Privileged Access Groups (PAG). Privileged Access Groups (PAG) allow you to manage just-in-time (JIT) access by assigning users to a group that has time-bound, activated roles. When a user activates their membership in a PAG via Microsoft Entra Privileged Identity Management (PIM), they receive the necessary permissions for a specified duration, providing JIT privileged access to Azure resources.

Answer

Conditional Access

Answer

Azure RBAC role assignment

Question 9

Which TWO of the following are valid authentication methods in Microsoft Entra ID?

Accepted Answer

Temporary Access Pass. Temporary Access Pass (TAP) is a valid authentication method in Microsoft Entra ID that allows users to register passwordless methods (like FIDO2 or Microsoft Authenticator) by providing a time-limited passcode. It is designed for scenarios where users have forgotten their credentials or need to onboard new devices without a password. TAP is configured via the Authentication methods policy in Entra ID and supports both one-time use and configurable lifetimes.

Answer

App registration

Answer

Managed identity

Answer

Azure AD Connect

Question 10

Refer to the exhibit. A Conditional Access policy is configured to block legacy authentication for Office 365. However, users are still able to access Exchange Online using Outlook (modern authentication). What is the most likely reason?

Accepted Answer

The policy only blocks legacy protocols, not modern authentication. The Conditional Access policy is configured to block legacy authentication, which targets protocols like POP3, IMAP, SMTP, and Exchange ActiveSync that do not support modern authentication. Modern authentication (used by Outlook with OAuth 2.0) is not affected by this policy, so users can still access Exchange Online via Outlook. The policy explicitly allows modern authentication flows, making option A correct.

Answer

The policy does not include Exchange Online

Answer

The policy does not apply to all users

Answer

The policy is not enabled

Question 11

Refer to the exhibit. A user is eligible for a role in PIM. When they activate the role, how long will the activation last?

Accepted Answer

8 hours. In Azure AD Privileged Identity Management (PIM), the default maximum activation duration for an eligible role is 8 hours. This is configurable by administrators, but the question refers to the standard default setting. When a user activates a role, the activation lasts for this predefined period unless a different duration is explicitly set in the role settings.

Answer

1 hour

Answer

24 hours

Answer

Indefinite

Question 12

Refer to the exhibit. You run the command and see the output. What does the UserType 'Member' indicate?

Accepted Answer

The user is a member of the tenant. The UserType 'Member' indicates that the user is a member of the tenant, meaning the user's identity is native to the Azure AD tenant and not from an external directory. This is distinct from 'Guest' (UserType = Guest), which represents external users invited via B2B collaboration. The command shown is likely Get-AzureADUser or a similar cmdlet, where the UserType property directly reflects the user's relationship to the tenant.

Answer

The user is a service principal

Answer

The user is a guest user

Answer

The user is an administrator

Question 13

Your organization is using Microsoft Entra ID Conditional Access to enforce MFA for all external users. A partner company reports that their users are prompted for MFA every time they access your resources, even though they already authenticated in their home tenant. What should you configure to reduce repeated prompts?

Accepted Answer

Configure MFA lifetime settings via cross-tenant access settings. Cross-tenant access settings in Microsoft Entra ID allow you to configure MFA trust from external home tenants. By enabling the 'Trust MFA from external tenants' option, you suppress repeated MFA prompts for partner users who have already authenticated in their home tenant, as the resource tenant accepts the MFA claim from the home tenant's token.

Answer

Modify the external user’s home tenant conditional access policy

Answer

Set sign-in frequency to 0 (zero) for the conditional access policy

Answer

Configure session control to use persistent browser session

Question 14

You are a security engineer for a company that uses Microsoft Entra ID. You need to implement a solution that automatically blocks sign-ins from users detected as compromised credentials. The solution should work in real-time and require no manual intervention. What should you use?

Accepted Answer

User risk policy in Microsoft Entra ID Protection. The User risk policy in Microsoft Entra ID Protection is specifically designed to automatically block sign-ins when a user's credentials have been compromised, based on real-time risk detection. This policy operates without manual intervention by evaluating user risk level (e.g., high) and triggering a block action, aligning with the requirement for real-time, automated blocking of compromised credentials.

Answer

Azure AD Identity Protection weekly digest

Answer

Conditional Access policy with sign-in risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Question 15

Your organization uses Microsoft Entra ID to manage identities. You need to ensure that users can reset their own passwords without help desk intervention, but they must register for self-service password reset (SSPR) first. Which configuration is required?

Accepted Answer

Enable SSPR and set the registration campaign to require registration at next sign-in. Enabling SSPR and configuring the registration campaign to require registration at next sign-in ensures users must register for SSPR before they can reset their own passwords. This satisfies the requirement that users register first, and the registration campaign enforces this without requiring help desk intervention.

Answer

Configure Microsoft Entra Password Protection

Answer

Enable Privileged Identity Management for SSPR

Answer

Enable combined registration for SSPR and Microsoft Entra ID Protection