AZ-500 Secure identity and access Practice Test 5 — 15 Questions

Question 1

Your organization is using Microsoft Entra ID Conditional Access to enforce MFA for all external users. A partner company reports that their users are prompted for MFA every time they access your resources, even though they already authenticated in their home tenant. What should you configure to reduce repeated prompts?

Accepted Answer

Configure MFA lifetime settings via cross-tenant access settings. Option B is correct. Configuring MFA lifetime settings for federated users reduces the frequency of MFA prompts by allowing longer token validity. Option A is wrong because session control does not reduce MFA frequency. Option C is wrong because it does not apply to external users. Option D is wrong because sign-in frequency controls session reauthentication, not MFA lifetime.

Answer

Modify the external user’s home tenant conditional access policy

Answer

Set sign-in frequency to 0 (zero) for the conditional access policy

Answer

Configure session control to use persistent browser session

Question 2

You are designing a privileged access strategy for Microsoft Entra ID. Your organization requires that all users who are assigned to the Global Administrator role must perform a privileged elevation only when needed, and the elevation must be approved by a security officer. Which feature should you implement?

Accepted Answer

Microsoft Entra Identity Governance – Privileged Identity Management. Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged elevation for roles like Global Administrator, requiring approval from designated approvers (e.g., a security officer) before activation. This directly meets the requirement of elevation only when needed with approval, as PIM manages time-bound role assignments and approval workflows.

Answer

Azure AD administrative units

Answer

Conditional Access with session control

Answer

Microsoft Entra ID protection risk policies

Question 3

You are a security engineer for a company that uses Microsoft Entra ID. You need to implement a solution that automatically blocks sign-ins from users detected as compromised credentials. The solution should work in real-time and require no manual intervention. What should you use?

Accepted Answer

User risk policy in Microsoft Entra ID Protection. Option B is correct. Microsoft Entra ID Protection automatically detects and blocks compromised credentials using user risk policies. Option A is wrong because it is not real-time. Option C is wrong because it is not specific to compromised credentials. Option D is wrong because it is a reporting tool.

Answer

Azure AD Identity Protection weekly digest

Answer

Conditional Access policy with sign-in risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Question 4

Your organization uses Microsoft Entra ID to manage identities. You need to ensure that users can reset their own passwords without help desk intervention, but they must register for self-service password reset (SSPR) first. Which configuration is required?

Accepted Answer

Enable SSPR and set the registration campaign to require registration at next sign-in. Option A is correct. SSPR requires users to register authentication methods before they can reset passwords. Option B is wrong because combined registration is not mandatory. Option C is wrong because password protection is unrelated. Option D is wrong because it applies to administrators.

Answer

Configure Microsoft Entra Password Protection

Answer

Enable Privileged Identity Management for SSPR

Answer

Enable combined registration for SSPR and Microsoft Entra ID Protection

Question 5

You are troubleshooting a sign-in issue. A user reports that they are repeatedly prompted for authentication when accessing a cloud app, even though they already authenticated earlier in the day. You check the Conditional Access policy and see that 'Session control - Sign-in frequency' is set to 1 hour. What is the most likely cause?

Accepted Answer

The sign-in frequency setting forces reauthentication after 1 hour. Option C is correct. A sign-in frequency of 1 hour will prompt reauthentication every hour, causing the repeated prompts. Option A is wrong because token lifetime settings are separate. Option B is wrong because session persistence does not affect reauthentication frequency. Option D is wrong because risk policies are not configured.

Answer

The browser is blocking persistent cookies

Answer

Token lifetime policy overrides the sign-in frequency

Answer

The user is considered high risk by Identity Protection

Question 6

Your organization uses Microsoft Entra ID and requires that all accesses to sensitive applications be approved by the application owner. You need to implement a solution where users can request access to these applications, and the request is automatically routed to the owner for approval. What should you configure?

Accepted Answer

Entitlement management access packages. Option D is correct. Microsoft Entra entitlement management allows you to create access packages requiring approval from the application owner. Option A is wrong because it is for role activation. Option B is wrong because it is for administrative roles. Option C is wrong because it is for external collaboration.

Answer

Microsoft Entra roles and administrative units

Answer

Privileged Identity Management for groups

Answer

Cross-tenant access settings

Question 7

You need to grant a user the ability to reset passwords for all users in the finance department. The finance department users are in a specific organizational unit (OU) in on-premises Active Directory, which syncs to Microsoft Entra ID. What is the most secure way to delegate this?

Accepted Answer

Create an administrative unit containing the finance users and assign the Helpdesk Administrator role scoped to that unit. Option B is correct because it uses Administrative Units (AUs) in Microsoft Entra ID to scope the Helpdesk Administrator role to only the finance department users. This provides the least-privilege delegation for password reset, as the user can only reset passwords for the specific synced users in that AU, not all users in the tenant. The Helpdesk Administrator role includes the 'Reset password' permission, and scoping it to an AU ensures the delegated user cannot affect users outside the finance OU.

Answer

Add the user to the Password Administrator role

Answer

Assign the User Access Administrator role to the user

Answer

Assign the Global Administrator role to the user

Question 8

Your organization uses Microsoft Entra ID. You need to ensure that users accessing internal applications from unmanaged devices are required to use Microsoft Edge with specific security configurations. Which Conditional Access control should you use?

Accepted Answer

Session control: Use app enforced restrictions. Option D is correct because the 'Use app enforced restrictions' session control in Conditional Access allows you to require that users access internal applications using Microsoft Edge with specific security configurations (such as preventing copy/paste or downloads) when coming from unmanaged devices. This control works by sending a device claim to the application, which then enforces the restrictions at the app level, rather than relying on device compliance or location.

Answer

Grant control: Require device to be marked as compliant

Answer

Grant control: Require trusted location

Answer

Grant control: Require approved client app

Question 9

You are implementing a B2B collaboration solution in Microsoft Entra ID. You need to ensure that external users from a partner tenant can access your internal applications, but they must use MFA from their home tenant. The partner tenant does not support MFA. What should you do?

Accepted Answer

Configure a Conditional Access policy targeting external users that requires MFA. Option A is correct because you can configure a Conditional Access policy that targets external users (guest users) and requires MFA. Since the partner tenant does not support MFA, you cannot rely on cross-tenant trust; instead, you enforce MFA directly in your tenant using Microsoft Entra ID's own MFA capabilities. This ensures external users must complete MFA using your tenant's authentication methods, even if their home tenant lacks MFA support.

Answer

Configure cross-tenant access settings to trust MFA from the partner tenant

Answer

Use Microsoft Entra ID Governance to enforce MFA

Answer

Disable MFA for external users

Question 10

Which TWO of the following are valid methods to authenticate users in Microsoft Entra ID?

Accepted Answer

Certificate-based authentication. Certificate-based authentication (CBA) is a valid method in Microsoft Entra ID that allows users to authenticate using X.509 certificates issued by a trusted public key infrastructure (PKI). This method is commonly used for smart card or device-based authentication, and it supports both user and device scenarios without requiring passwords.

Answer

SMS text message one-time passcode

Answer

Facebook account federation

Answer

Hardware OTP tokens

Question 11

Which TWO of the following are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Sign-in risk policy. Microsoft Entra ID Protection provides two risk-based policies: a sign-in risk policy (Option B) and a user risk policy (Option C). The sign-in risk policy evaluates the likelihood that an authentication request is not legitimate based on real-time signals such as anonymous IP addresses, atypical travel, or malware-linked IPs, and can automatically block or require multi-factor authentication (MFA). The user risk policy assesses the probability that a user's credentials have been compromised, based on events like leaked credentials or suspicious activity, and can force a password reset or block sign-in.

Answer

Conditional Access session controls

Answer

Access reviews

Answer

Role-based access control (RBAC)

Question 12

Which THREE of the following are required to configure Microsoft Entra ID self-service password reset (SSPR)?

Accepted Answer

Microsoft Entra ID P1 or P2 license. Microsoft Entra ID self-service password reset (SSPR) requires a Microsoft Entra ID P1 or P2 license because the SSPR feature is a premium capability that is not available in the Free or Office 365 app-only licenses. Without at least a P1 license, the tenant cannot enable or use SSPR for users. The P2 license adds additional protections like Identity Protection but is not strictly required for basic SSPR functionality.

Answer

Microsoft Entra ID Premium P2 license

Answer

Password writeback must be enabled

Question 13

You have configured the Conditional Access policy shown in the exhibit. Users report that they can still access Exchange Online using legacy authentication protocols. What is the most likely reason?

Accepted Answer

The policy state is set to reporting mode. Option B is correct. The policy state is 'enabledForReportingButNotEnforced', meaning it only reports without blocking. Option A is wrong because legacy authentication is included. Option C is wrong because other clients are included. Option D is wrong because it is a valid block policy.

Answer

The policy should use 'Require MFA' instead of 'Block'

Answer

The policy does not include the correct client app types

Answer

The policy should include 'mobileAppsAndDesktopClients' instead

Question 14

You executed the PowerShell script shown in the exhibit. What is the result?

Accepted Answer

All users are added to the Global Administrator role. Option D is correct. The script adds all users with @contoso.com suffix to the Global Administrator role, which is a security risk. Option A is wrong because it doesn't remove. Option B is wrong because it doesn't filter by role. Option C is wrong because it does add them.

Answer

All users are removed from the Global Administrator role

Answer

No users are added because of an error

Answer

Only users with the Global Administrator role are listed

Question 15

You executed the PowerShell script shown in the exhibit to set a token lifetime policy for an application. What is the effect on users accessing the application?

Accepted Answer

Access tokens expire after 2 hours. The PowerShell script sets an access token lifetime of 2 hours via the `New-AzureADPolicy` cmdlet with `TokenLifetimePolicy` type. This policy is then assigned to a specific service principal (application) using `Add-AzureADServicePrincipalPolicy`. Therefore, for users accessing that application, access tokens will expire after 2 hours, requiring a new token to be obtained once the lifetime is exceeded.

Answer

Session tokens expire after 1 hour

Answer

The policy applies to all applications in the tenant

Answer

Users are forced to reauthenticate every hour