AZ-500 Secure identity and access Practice Test 4 — 15 Questions

Question 1

Your company has Microsoft Entra ID and uses Azure Bastion for secure VM access. You need to ensure that only administrators with PIM-activated roles can access the Bastion host. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Conditional Access policy to require privileged access for the Azure Bastion application. Azure Bastion integrates with Microsoft Entra ID and Conditional Access, allowing you to enforce policies that require privileged access (e.g., requiring a PIM-activated role) before users can connect to the Bastion host. By targeting the Azure Bastion application in a Conditional Access policy, you can restrict access to only administrators who have activated their privileged roles via PIM, ensuring that only authorized, elevated identities can reach the Bastion service.

Answer

Configure Azure Bastion with just-in-time access

Answer

Assign the Bastion Reader role to administrators

Answer

Configure network security groups to restrict access to Bastion

Question 2

You need to grant a group of users the ability to read Microsoft Entra ID sign-in logs in the Azure portal. Which role should you assign?

Accepted Answer

Reports Reader. The Reports Reader role is specifically designed to grant read-only access to monitoring data, including Microsoft Entra ID sign-in logs and audit logs, without granting broader read permissions to the entire directory. This role is the least-privileged option that directly meets the requirement to read sign-in logs in the Azure portal.

Answer

Security Reader

Answer

Global Reader

Answer

Global Administrator

Question 3

You are the security engineer for Contoso, a multinational company with 50,000 users in Microsoft Entra ID Premium P2. The company has a strict security policy requiring that all administrative actions be performed using just-in-time (JIT) access with approval, and that all privileged role activations be audited. Additionally, you need to ensure that Global Administrators are required to use phishing-resistant MFA (e.g., FIDO2 security keys) when activating their role. You have already configured Privileged Identity Management (PIM) for Azure AD roles. However, during a recent audit, you discovered that several Global Administrators were able to activate their role using only a text message (SMS) for MFA, violating the policy. You need to enforce the use of phishing-resistant MFA for all privileged role activations. What should you do?

Accepted Answer

Create a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' app and requires authentication strength 'Phishing-resistant MFA'. Privileged Identity Management (PIM) role activation is triggered by signing in to the Microsoft Entra Privileged Identity Management application (the PIM blade or API). By creating a Conditional Access policy that targets this specific app and requires the 'Phishing-resistant MFA' authentication strength, you enforce FIDO2 or Windows Hello for Business during the activation step, regardless of the user's baseline MFA method. This directly addresses the audit finding that Global Administrators were using SMS to activate their roles.

Answer

Create a Conditional Access policy that targets all cloud apps and requires authentication strength 'Phishing-resistant MFA'

Answer

In PIM, configure the role settings to require Azure MFA and set the authentication method to FIDO2

Answer

Configure authentication methods policy to allow only FIDO2 security keys for all users

Question 4

Your organization, Fabrikam, uses Microsoft Entra ID and has recently deployed Microsoft Copilot for Azure to assist administrators with troubleshooting. You need to ensure that access to Copilot for Azure is restricted to a specific group of security administrators and that all interactions are logged for compliance. You have created a security group named 'Copilot-Admins' and assigned it the appropriate role. However, you notice that users outside this group can still access Copilot for Azure. Additionally, you need to ensure that all Copilot interactions are stored in a Log Analytics workspace for analysis. What should you do?

Accepted Answer

Create a Conditional Access policy that requires the user to be a member of 'Copilot-Admins' and enable diagnostic settings for Copilot to send logs to Log Analytics. Conditional Access policies in Microsoft Entra ID can enforce access controls based on group membership, ensuring only members of 'Copilot-Admins' can access Copilot for Azure. Additionally, diagnostic settings for Copilot can be configured to stream all interaction logs to a Log Analytics workspace, meeting the compliance requirement for logging and analysis.

Answer

Configure PIM to require approval for Copilot access

Answer

Use Azure Policy to deny access to Copilot for users not in the group

Answer

Assign the 'Copilot-Admins' group the 'Reader' role to the Copilot service

Question 5

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

Accepted Answer

The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group. PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Answer

Users have permanent eligible assignments that bypass approval

Answer

The audit log is not enabled for PIM

Answer

Users are assigned the role directly instead of through eligibility

Question 6

You are managing a Microsoft Entra ID tenant with external collaboration enabled. You need to restrict external user access to only the groups and applications they are explicitly granted. You also want to prevent external users from seeing other external users in the tenant directory. Which settings should you configure?

Accepted Answer

Set 'Guest user access restrictions' to 'Guest users have limited access...' and configure 'External collaboration settings' to restrict external user visibility. The 'Guest user access restrictions' setting controls the level of directory data guest users can see, and setting it to 'Guest users have limited access...' restricts guests from enumerating the full directory. Additionally, the 'External collaboration settings' allow you to limit guest visibility to only the groups and applications they are explicitly granted, preventing them from seeing other external users. This combination directly meets both requirements: restricting access to explicitly granted resources and hiding other external users from the directory.

Answer

Use Microsoft Entra entitlement management to create access packages for external users

Answer

Configure cross-tenant access settings to block all external collaboration

Answer

Set 'Guest user access restrictions' to 'Guest users have same access as members'

Question 7

Which THREE of the following are recommended practices for securing administrative accounts in Microsoft Entra ID?

Accepted Answer

Use separate administrative accounts for day-to-day administration. Option A is correct because Microsoft recommends using separate, dedicated administrative accounts that are distinct from regular user accounts, so that day-to-day activities like email and browsing are not performed with privileged credentials, reducing exposure to phishing and credential theft. Option B is correct because enforcing MFA for all administrative accounts through Conditional Access is a core Microsoft Entra ID best practice, adding a strong authentication factor that blocks the vast majority of identity-based attacks against privileged roles. Option C is correct because break-glass (emergency access) accounts should be created and deliberately excluded from Conditional Access and MFA policies, ensuring administrators can still sign in if the MFA service, Conditional Access policies, or other dependencies fail. Option D is not recommended for administrative accounts because SSPR registration ties privileged accounts to additional self-service reset channels that can widen the attack surface; administrative accounts should instead use strong, controlled credential management. Option E is incorrect because permanently assigning the Global Administrator role to all IT staff violates least-privilege and just-in-time access principles; privileged roles should be granted only when needed, ideally through Privileged Identity Management.

Answer

Register all administrative accounts for self-service password reset (SSPR)

Answer

Assign Global Administrator role permanently to all IT staff

Question 8

Refer to the exhibit. You are reviewing the external collaboration settings for your Microsoft Entra ID tenant. Based on the exhibit, which of the following statements is true about the current configuration?

Accepted Answer

External users will receive a one-time passcode via email when they are invited.. The exhibit shows that 'Email one-time passcode' is enabled under the 'External collaboration settings' for Microsoft Entra ID. When this feature is on, external users who do not have Microsoft work or school accounts or other federated identity providers will receive a one-time passcode via email to authenticate when they are invited for B2B collaboration. This is the default behavior for guest users who cannot authenticate through other means.

Answer

Only administrators can invite external users.

Answer

B2B direct connect is enabled for Teams external access.

Answer

Users with email-verified accounts can join the organization automatically.

Question 9

You are a security administrator for a healthcare organization that uses Microsoft Entra ID and Microsoft 365. The organization must comply with HIPAA regulations, which require that access to protected health information (PHI) is logged and monitored. You need to configure access reviews for all users who have access to SharePoint Online sites containing PHI. The reviews must occur quarterly and be assigned to the respective site owners. Additionally, you need to ensure that inactive guest accounts are automatically removed after 90 days of inactivity. Which actions should you take?

Accepted Answer

Create an access review for the security group containing users with access to PHI sites. Assign reviewers as group owners (site owners). Set frequency to quarterly. Configure external collaboration settings to automatically remove guest accounts that have not signed in for 90 days.. Option C is correct because it uses Microsoft Entra access reviews on the security group that contains users with access to PHI sites, assigns the reviewers as the group owners (the site owners), and sets the recurrence to quarterly, which directly satisfies the HIPAA logging/monitoring and review requirements. It also configures external collaboration settings to automatically remove guest accounts that have not signed in for 90 days, matching the inactive-guest cleanup requirement. Option A is wrong because Entra ID Protection does not automatically block or delete guest accounts after 90 days of inactivity, and manual PowerShell access reviews do not meet the quarterly, owner-assigned review requirement. Option B is wrong because Microsoft Purview auto-labeling classifies PHI data but does not create access reviews or automatically remove inactive guests. Option D is wrong because a PIM access review for the SharePoint administrator role reviews privileged role assignments, not all users with access to PHI sites, and Entra ID does not automatically delete guest accounts after 90 days of inactivity by default.

Answer

Enable Microsoft Entra ID Protection to automatically block guest accounts after 90 days of inactivity. Create manual access reviews for each site using PowerShell.

Answer

Use Microsoft Purview to create an auto-labeling policy for PHI data. Assign site owners as reviewers and manually remove inactive guests.

Answer

Create a PIM access review for the SharePoint administrator role. Set frequency to quarterly. Configure Microsoft Entra ID to automatically delete guest accounts after 90 days of inactivity.

Question 10

You work for a software development company that uses GitHub Enterprise and Microsoft Entra ID for identity management. Developers need to access Azure resources from their CI/CD pipelines. You need to configure secure authentication for these service principals used in pipelines. The requirements are:

- No client secrets should be used because they can be leaked.
- The authentication method must be automatically rotated.
- The service principal must have access only to a specific resource group.
- You need to monitor and alert if the service principal is used outside of the expected geographic region.

Which of the following is the most appropriate solution?

Accepted Answer

Use a system-assigned managed identity for the Azure resource running the pipeline. Assign the managed identity the Contributor role at the resource group scope. Configure Conditional Access for workload identities to block sign-ins from unexpected geographic regions.. System-assigned managed identities are automatically managed and rotated by Azure, eliminating the need for secrets. They can be scoped to a specific resource group via RBAC by assigning the Contributor role at that scope. Conditional Access for workload identities can monitor and block sign-ins from unexpected geographic regions, satisfying the monitoring requirement. Option A is wrong because certificate-based credentials still require manual rotation and management. Option B is wrong because PIM is designed for user identities, not service principals or managed identities, and requires approval, which does not address automatic rotation. Option D is wrong because using a client secret, even stored in Key Vault, violates the 'no client secrets' requirement and is not automatically rotated.

Answer

Create a service principal with a certificate-based credential. Assign the service principal the Contributor role at the resource group scope. Use a custom script to rotate the certificate monthly.

Answer

Use a user-assigned managed identity and configure PIM to require approval for each pipeline run. Assign the identity the Contributor role at the resource group scope.

Answer

Create a service principal and use OAuth 2.0 client credentials grant with a client secret stored in Azure Key Vault. Assign the service principal the Contributor role at the resource group scope. Use Key Vault access policies to control secret access.

Question 11

You are the security administrator for a company that is integrating a third-party SaaS application (AppA) with Microsoft Entra ID for single sign-on (SSO). The application requires the following permissions: read all users, read all groups, and sign in users. The security team is concerned about over-privileged applications. They require that:

- The application must not be able to read users or groups without an admin's explicit consent.
- Users should be able to sign in to the application without admin consent for basic profile access.
- Admin consent must be granted only for the minimal permissions required.
- You must be able to review and audit all permissions granted to applications.

What should you do?

Accepted Answer

In Microsoft Entra ID, configure user consent settings to require admin consent for permissions classified as 'high risk' (e.g., User.Read.All, Group.Read.All). Allow user consent for low-risk permissions. Grant admin consent for the required Graph permissions.. You can configure user consent settings to require admin consent for high-risk permissions (User.Read.All, Group.Read.All) while allowing user consent for low-risk permissions like profile access. Admin consent must be granted for Graph permissions. Option B is wrong because blocking all user consent would prevent users from signing in for basic profile. Option C is wrong because allowing all user consent would allow users to consent to high-risk permissions. Option D is wrong because blocking all OAuth apps is too restrictive.

Answer

Allow user consent for all permissions. Grant admin consent for Graph permissions.

Answer

Block all user consent and require admin consent for all permissions. Grant admin consent for all required permissions.

Answer

Block all OAuth 2.0 applications and use SAML-based SSO instead.

Question 12

An organization requires that all Azure SQL Database connections from non-corporate networks must be blocked unless initiated through Azure Bastion. Which Microsoft Entra ID Conditional Access policy setting should be configured?

Accepted Answer

Block access. The requirement is to block all Azure SQL Database connections from non-corporate networks unless they go through Azure Bastion. In Microsoft Entra ID Conditional Access, the 'Block access' control explicitly denies authentication requests that match the policy conditions. By configuring a policy that targets the Azure SQL Database application and includes conditions for non-corporate network locations, the 'Block access' grant effectively enforces the restriction, allowing only connections routed through Azure Bastion (which originates from a corporate network or a trusted IP).

Answer

Require sign-in frequency

Answer

Require multifactor authentication (MFA)

Answer

Require device to be marked as compliant

Question 13

A company plans to implement a Zero Trust identity strategy using Microsoft Entra ID. Which TWO actions should be taken to enforce least-privilege access for administrative roles?

Accepted Answer

Configure Privileged Identity Management (PIM) to require approval for role activation. Option A is correct because Microsoft Entra Privileged Identity Management (PIM) makes administrative roles eligible rather than permanently active and enforces just-in-time activation with approval, which directly implements least-privilege access by granting elevated permissions only when needed and authorized. Option B is correct because Conditional Access policies that require multifactor authentication (MFA) for administrative roles add a strong identity verification control at sign-in, ensuring that privileged access is only granted after satisfying the organization's access requirements. Option C is incorrect because enabling legacy authentication bypasses modern security controls such as Conditional Access and MFA, weakening rather than enforcing least privilege. Option D is incorrect because granting guest users the same permissions as employees violates least privilege by over-provisioning external identities. Option E is incorrect because assigning permanent Global Administrator roles to all IT staff creates standing privileged access, which is the opposite of least-privilege enforcement.

Answer

Enable legacy authentication for administrative accounts

Answer

Set guest user permissions to the same level as employees

Answer

Assign permanent Global Administrator roles to all IT staff

Question 14

A company uses Microsoft Entra ID and has an application registered that exposes scopes. An external partner organization needs to authenticate and access a specific scope. The partner's tenant is not federated. What is the most secure way to provide access without creating user accounts?

Accepted Answer

Configure an enterprise application with 'Users and groups' assignment and set 'Assignment required?' to Yes. Configuring an enterprise application with 'Users and groups' assignment and setting 'Assignment required?' to Yes ensures that only explicitly assigned users (including guest users from the partner tenant) can access the application and its scopes. This approach leverages Microsoft Entra ID's enterprise application model to enforce conditional access and scope-specific permissions without creating full user accounts, maintaining security by requiring explicit assignment.

Answer

Set the application to be multitenant and allow any user to sign in

Answer

Create a service principal and share the client secret

Answer

Create guest users in the tenant and assign licenses

Question 15

Refer to the exhibit. A custom role definition is created with the JSON above. A user assigned this role in the Prod resource group attempts to restart a VM but receives an authorization error. What is the most likely cause?

Accepted Answer

The role definition lacks the 'Microsoft.Compute/virtualMachines/read' action. The custom role definition includes the 'Microsoft.Compute/virtualMachines/restart' action but lacks the required 'Microsoft.Compute/virtualMachines/read' action. In Azure RBAC, the 'read' action is a prerequisite for any control-plane operation on a resource, as Azure Resource Manager must first read the resource metadata to validate the request. Without the read permission, the user cannot even retrieve the VM object, causing an authorization error even though the restart action is present.

Answer

The assignable scope should include the subscription

Answer

The role definition includes 'restart' but not 'start'

Answer

The user is not assigned the role at the correct scope