AZ-500 Secure identity and access Practice Test 5 — 15 Questions

Question 1

A company uses Microsoft Entra ID and has a custom application that authenticates via OAuth 2.0 device authorization grant. The app recently started receiving 'access_denied' errors for some users. The errors occur only for users who have Conditional Access policies applied. What change should be made to fix the issue while maintaining security?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Conditional Access policy to exclude the custom application's service principal from requiring device compliance. The 'access_denied' error occurs because the device authorization grant flow does not support device-based Conditional Access controls like 'Require device to be marked as compliant'. The device authorization grant flow is designed for devices that may not be able to perform interactive browser-based authentication, such as IoT devices or CLI tools, and thus cannot enforce device compliance. Configuring the Conditional Access policy to exclude the custom application's service principal from requiring device compliance resolves the error while maintaining security by still applying other controls like MFA or sign-in risk.

Answer

Require MFA for the application instead of device compliance

Answer

Disable Conditional Access for the affected users

Answer

Change the application to use authorization code grant flow

Question 2

Your company uses Microsoft Entra ID with hybrid identity. You have a custom line-of-business application that uses SAML 2.0 for authentication. The application is registered in Microsoft Entra ID as an enterprise application. Users report that they are prompted for credentials twice when accessing the app from a domain-joined Windows 10 device. You need to prevent the second prompt. What should you do?

Accepted Answer

Configure the application to include a domain hint (whr parameter) in the SAML request.. The correct option is A: configuring the application to include a domain hint (whr parameter) in the SAML request. When a SAML 2.0 enterprise application is accessed from a domain-joined Windows 10 device, the second credential prompt typically occurs because Microsoft Entra ID cannot determine that the user should be authenticated against the on-premises AD FS/domain; adding the whr parameter (e.g., whr=contoso.com) tells Entra ID to route authentication to the federated domain, enabling Integrated Windows Authentication and eliminating the extra prompt. Option B does not address the SAML domain routing issue, since device compliance policies only gate access and do not prevent the duplicate credential prompt. Option C, Seamless SSO, applies to password hash sync or pass-through authentication scenarios for domain-joined devices, not to federated SAML apps where the whr hint is required. Option D, PHS, changes the sign-in method for the directory but does not by itself stop the second prompt for a federated SAML application.

Answer

Create a Conditional Access policy requiring device compliance.

Answer

Enable Seamless Single Sign-On (SSO) for all users.

Answer

Implement Password Hash Sync (PHS) for the directory.

Question 3

Refer to the exhibit. You are reviewing a Conditional Access policy JSON definition. What is the MOST likely result of this policy?

Accepted Answer

All users accessing Office 365 from trusted locations will be blocked.. The policy targets Office 365 applications and includes the condition 'locations: trusted' with a block grant control. Therefore, all users (since the policy applies to all users) accessing Office 365 from trusted locations will be blocked. Option A is incorrect because the policy blocks access, not requires MFA. Option B is incorrect because it specifies 'external guest users' but the policy applies to all users, not just guests. Option C is incorrect because the action is block, not require MFA. Option D is correct.

Answer

Users with low sign-in risk accessing Office 365 from trusted locations will be blocked.

Answer

Only external guest users accessing Office 365 from any location will be blocked.

Answer

All users accessing Office 365 from trusted locations will be required to perform MFA.

Question 4

You are a security architect for Contoso, a global financial services company with 10,000 employees. Contoso uses Microsoft Entra ID (P2 licensed), Microsoft Intune, and Microsoft Defender for Cloud Apps. All corporate devices are enrolled in Intune and marked as compliant. The company is adopting Microsoft Copilot for Microsoft 365 to boost productivity. The security team requires that access to Copilot for Microsoft 365 be restricted to users who have completed the required training (confirmed by HR system). Additionally, any access to Copilot from unmanaged devices must be blocked. You need to design an access control solution that meets these requirements with minimal administrative overhead and without custom code. Which action should you take?

Accepted Answer

Create an access package in Microsoft Entra ID Governance that includes the Copilot for Microsoft 365 app, with a policy requiring a custom extension to verify training completion via the HR system, and configure Conditional Access to allow access only from compliant devices.. It combines Entra ID Governance access packages with a custom extension that calls the HR system to verify training completion, and Conditional Access that allows access only from Intune-compliant (managed) devices, which directly satisfies both the training-attestation and unmanaged-device-block requirements without custom code. Access packages natively support approval and custom extensions for external verification, and Conditional Access with the compliant device grant control blocks unmanaged devices. Option A only assigns licenses by department and does not verify training or block unmanaged devices. Option C misuses Identity Protection risk policies, which evaluate sign-in/user risk, not HR training status. Option D uses PIM for just-in-time privileged role activation, which is unrelated to Copilot access control or device compliance.

Answer

Create a dynamic group in Microsoft Entra ID based on the department attribute and assign the Copilot license to that group.

Answer

Use Microsoft Entra Identity Protection to create a risk policy that blocks access if the user's training is incomplete.

Answer

Configure Privileged Identity Management (PIM) for the Copilot for Microsoft 365 application, requiring approval for activation.

Question 5

You are a security administrator for a company that uses Microsoft Entra ID. Employees report that they are prompted for MFA when signing in from the corporate office but not when signing in from a coffee shop. You need to ensure that MFA is required from the coffee shop as well. What should you do?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users and all locations, then verify no trusted locations are excluded.. Conditional Access evaluates location conditions, and trusted named locations can be excluded from MFA requirements. To require MFA everywhere, the policy must include all locations and must not exclude the coffee shop or any trusted location that covers it.

Answer

Configure a named location for the coffee shop and mark it as trusted.

Answer

Create a Conditional Access policy that requires MFA for all users and excludes the corporate office IP address range.

Answer

Enable security defaults and disable per-user MFA for all users.

Question 6

You are a security engineer for a company that uses Microsoft Entra ID. The company wants to ensure that only users who are members of a specific security group can access a critical application. What should you use?

Accepted Answer

Conditional Access policy with user assignment to the security group and the application as the target.. Conditional Access is the appropriate feature to enforce access control based on group membership for a specific application. By creating a policy that includes the security group as the assigned user and the application as the target resource, you ensure only those users can access it. Other options either address different security aspects or are less flexible, making Conditional Access the correct choice.

Answer

Microsoft Entra ID Protection policy with risk level set to high.

Answer

Role-based access control (RBAC) in Microsoft Entra ID with a custom role.

Answer

Enterprise application assignment required setting, and assign the security group to the application.

Question 7

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using a one-time passcode sent to their mobile device, without requiring any additional app or software installation. Which authentication method should you enable?

Accepted Answer

One-time passcode (OTP). The one-time passcode (OTP) authentication method in Microsoft Entra ID allows users to sign in with a temporary code sent via SMS to their mobile device, requiring no additional app or software installation. This method is specifically designed for scenarios where users cannot or should not install the Microsoft Authenticator app, such as for guest users or in bring-your-own-device (BYOD) environments. The OTP is generated by Entra ID and delivered over the mobile network, satisfying the requirement of no extra software.

Answer

Microsoft Authenticator app

Answer

FIDO2 security keys

Answer

Certificate-based authentication

Question 8

You are configuring a conditional access policy to block access from untrusted locations. The policy should apply to all cloud apps except Microsoft Entra ID Administration. How should you configure the policy?

Accepted Answer

Include 'All cloud apps' and exclude 'Microsoft Entra ID Administration'. The requirement is to block access from untrusted locations for all cloud apps except Microsoft Entra ID Administration. In Conditional Access, you include 'All cloud apps' to cover every app, then explicitly exclude 'Microsoft Entra ID Administration' to exempt it from the block. This ensures the policy applies broadly while honoring the exclusion.

Answer

Include 'All cloud apps' and set 'Block access'

Answer

Include 'Select apps' and choose all apps except admin

Answer

Include 'All cloud apps' and exclude 'Office 365'

Question 9

Your organization uses Microsoft Entra ID to manage access for employees and partners. You need to implement a solution that allows partners to self-service request access to specific applications, with approval from their manager, and access expires after 30 days. Which feature should you use?

Accepted Answer

Entitlement Management access packages. Entitlement Management access packages are designed to allow external partners to request access to specific applications through a self-service portal. The feature supports approval workflows (e.g., manager approval) and automatically enforces time-bound access, such as a 30-day expiration. This directly matches the requirement for partner self-service with approval and expiration.

Answer

Azure AD B2B collaboration

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access with session restrictions

Question 10

You are troubleshooting why a user cannot sign in to a custom line-of-business application that is federated with Microsoft Entra ID. The user reports that they are repeatedly prompted for credentials and then receive an error. The application is configured for SAML-based SSO. What is the most likely cause?

Accepted Answer

The SAML certificate has expired or the configuration has a mismatch. When a SAML-based SSO application repeatedly prompts for credentials and then fails, the most common cause is an expired or misconfigured SAML signing certificate. The certificate is used by Microsoft Entra ID to sign SAML assertions; if it has expired, or if the thumbprint, audience URI, or reply URL in the Entra ID configuration does not match what the application expects, the application will reject the assertion and force re-authentication or display an error.

Answer

The user's browser cookies are disabled

Answer

The application is not registered in the app gallery

Answer

The user does not have a license for Microsoft Entra ID

Question 11

Which TWO of the following are valid configurations for Microsoft Entra ID Conditional Access policies?

Accepted Answer

Include all users and exclude specific groups. Conditional Access policies allow you to include all users as a baseline and then exclude specific groups (e.g., break-glass emergency accounts) to ensure critical access is never blocked. Option C is correct because you can target a specific cloud application (e.g., Microsoft Azure Management, SharePoint Online) to apply granular access controls only to that app, leaving other apps unaffected.

Answer

Force password change on next sign-in

Answer

Block access for users without MFA registered

Answer

Assign licenses to users based on location

Question 12

Which TWO of the following are authentication methods supported by Microsoft Entra ID?

Accepted Answer

Certificate-based authentication (CBA). Microsoft Entra ID natively supports certificate-based authentication (CBA), where a user presents an X.509 certificate and Entra ID validates it against configured trusted certificate authorities to satisfy authentication, making option A correct. Entra ID also supports SMS-based one-time passcode as a built-in authentication method, sending a code to a registered phone number that the user enters to complete sign-in, making option E correct. Security questions (B) are not an Entra ID authentication method; they are used in self-service password reset (SSPR) for identity verification, not as a primary or MFA authentication method. Smart card with PIN (C) is not a distinct Entra ID authentication method — smart cards are typically surfaced through certificate-based authentication, so C is not separately supported. OAuth 2.0 authorization code flow (D) is an authorization protocol used by applications to obtain tokens, not an authentication method offered by Entra ID.

Answer

Security questions

Answer

Smart card with PIN

Answer

OAuth 2.0 authorization code flow

Question 13

Refer to the exhibit. You are analyzing a Conditional Access policy JSON. The policy requires MFA for Office 365 applications. However, users report that they are still able to access Office 365 without MFA. What is the most likely reason?

Accepted Answer

The 'grantControls' section is empty. The most likely reason is that the 'grantControls' section is empty. In a Conditional Access policy, the 'grantControls' section specifies the controls to enforce, such as requiring MFA. If this section is empty, no controls are applied, and users can access Office 365 without MFA.

Answer

The policy excludes some Office 365 apps

Answer

The 'authenticationStrength' property is not a valid Conditional Access policy property

Answer

The policy does not include all users

Question 14

Refer to the exhibit. You are configuring an Entitlement Management access package. The policy allows any existing user to request access without approval, and access expires after 30 days. However, security requirements dictate that all access to Finance applications must be reviewed by the finance team manager every quarter. What should you add to the policy?

Accepted Answer

Enable access reviews and assign the finance team manager as reviewer. The security requirement mandates quarterly reviews by the finance team manager, which is exactly what an access review does in Entitlement Management. Access reviews allow you to require periodic attestation of access by a designated reviewer, ensuring ongoing compliance even though the initial request does not require approval. The policy already sets a 30-day expiration, but a quarterly review adds a separate recurring governance check that overrides the shorter duration for compliance purposes.

Answer

Add a connected organization for external users

Answer

Set 'isApprovalRequiredForAdd' to true

Answer

Set 'durationInDays' to 90

Question 15

Your company deploys Microsoft Sentinel for security operations. You need to configure just-in-time (JIT) access for Azure VMs. Which Azure security feature should you integrate with Sentinel?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides the just-in-time (JIT) VM access capability, which can be integrated with Microsoft Sentinel to enable automated threat response. When a security incident is detected in Sentinel, a playbook can trigger Defender for Cloud to lock down or open specific ports (e.g., RDP 3389, SSH 22) for a defined time window, reducing the attack surface. This integration relies on the Defender for Cloud's JIT policy applied at the subscription or VM level, not on external network controls or identity governance.

Answer

Azure Policy

Answer

Azure Firewall

Answer

Microsoft Entra Privileged Identity Management