AZ-500 Secure identity and access Practice Test 6 — 15 Questions

Question 1

Your company uses Microsoft Entra ID with a third-party identity provider (IdP) for federation. Users report that sometimes they are unable to sign in even though the IdP is healthy. You suspect the issue is related to token signing certificate rotation. What should you do to resolve this proactively?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure automatic certificate rollover in Microsoft Entra ID by enabling 'Federation certificate management' and using Graph API to sync changes.. Microsoft Entra ID supports automatic certificate rollover for federated domains when the third-party IdP publishes updated token-signing certificates via a federation metadata endpoint. By enabling 'Federation certificate management' and using the Microsoft Graph API to sync changes, Entra ID can automatically detect and apply new certificates before the old ones expire, preventing sign-in disruptions without manual intervention.

Answer

Download the new certificate from the IdP and upload it to Microsoft Entra ID manually.

Answer

Set up alerts for sign-in failures and manually update the certificate when alerted.

Answer

Switch to pass-through authentication to bypass federation.

Question 2

You need to ensure that external users who are invited to your Microsoft Entra ID tenant via B2B collaboration can only access a specific SaaS application. What should you configure?

Accepted Answer

Create a Conditional Access policy targeting the SaaS application and apply it to 'Guest or external users'.. A Conditional Access policy can be scoped to a specific SaaS application and applied to 'Guest or external users'. This ensures that only invited B2B collaboration users are subject to the access control for that application, while all other users and apps remain unaffected. The policy enforces authentication and authorization rules exclusively for the targeted SaaS app and guest identity type.

Answer

Configure SharePoint Online external sharing settings.

Answer

Create a Conditional Access policy targeting 'All cloud apps' and include guest users.

Answer

Use Microsoft Entra application proxy.

Question 3

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You want to detect and block sign-ins from non-compliant devices to a critical SaaS application. The solution must work for both managed (Microsoft Intune enrolled) and unmanaged devices. What should you use?

Accepted Answer

Use Conditional Access with device compliance condition and session control via Defender for Cloud Apps.. It combines Conditional Access with a device compliance condition to evaluate device state for both managed (Intune-enrolled) and unmanaged devices, and then uses session control via Defender for Cloud Apps to block sign-ins from non-compliant devices. This approach works for unmanaged devices by leveraging device compliance signals from Intune or third-party MDM, and the session control enforces real-time blocking at the app level.

Answer

Deploy Microsoft Entra application proxy and require pre-authentication.

Answer

Configure Intune compliance policies and require compliant device in Conditional Access.

Answer

Enable Microsoft Entra ID Protection and set sign-in risk policy to block medium and above.

Question 4

Your company uses Microsoft Entra ID with a third-party identity provider (IdP) for federation. Users report that sometimes they are unable to sign in even though the IdP is healthy. You suspect the issue is related to token signing certificate rotation. What should you do to resolve this proactively?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Custom Authentication Extension to federate with social IdPs and apply Conditional Access policy requiring MFA.. Custom Authentication Extensions allow you to integrate external identity providers (like social IdPs) into the Microsoft Entra ID authentication flow while still enforcing Conditional Access policies, including MFA. This approach brings the social identity into the Entra ID tenant as a federated identity, enabling the organization to apply its own MFA policies rather than relying on the social IdP's native MFA.

Answer

Configure federation with the social IdP in Microsoft Entra ID.

Answer

Use Microsoft Entra B2B collaboration and invite users with their social accounts.

Answer

Enable self-service password reset (SSPR) with identity verification.

Question 5

You need to ensure that when a user's role in Microsoft Entra ID is changed (e.g., from User to Global Administrator), the change is approved by a manager before it takes effect. Additionally, you need to enforce just-in-time (JIT) access for that role. What should you use?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) for the role with approval required and JIT activation.. Microsoft Entra Privileged Identity Management (PIM) provides approval workflows and just-in-time (JIT) activation for Microsoft Entra roles. Option B is wrong because access reviews are for periodic review of role assignments, not for immediate approval or JIT activation. Option C is wrong because Conditional Access policies manage access to applications and services, not role activation or approval. Option D is wrong because Azure RBAC is for managing access to Azure resources, not Microsoft Entra roles.

Answer

Use Microsoft Entra access reviews to review role assignments monthly.

Answer

Create a Conditional Access policy requiring manager approval for role assignment.

Answer

Assign the role via Azure RBAC with a custom role.

Question 6

Your organization uses Microsoft Entra ID and wants to implement a secure passwordless authentication strategy. Which TWO solutions can be used natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are a native passwordless authentication method in Microsoft Entra ID, leveraging the WebAuthn standard to provide phishing-resistant, hardware-based credential verification. They eliminate passwords entirely by using public-key cryptography, where the private key never leaves the device, ensuring strong security against credential theft.

Answer

Microsoft Authenticator app with OTP

Answer

Third-party password managers

Answer

Duo Security push notifications

Question 7

You are designing a security baseline for Microsoft Entra ID. Which THREE settings are recommended by Microsoft as part of the identity security baseline?

Accepted Answer

Enable risk-based Conditional Access policies. Risk-based Conditional Access policies are a core recommendation in the Microsoft identity security baseline. These policies automatically respond to detected user or sign-in risks (e.g., anonymous IP, leaked credentials) by requiring MFA or blocking access, aligning with the Zero Trust principle of continuous verification. Microsoft explicitly includes risk-based policies in its security baseline to proactively mitigate identity threats.

Answer

Allow self-service group management for all users

Answer

Set sign-in session timeout to 8 hours

Question 8

Your company wants to implement a least-privilege model for administrative roles in Microsoft Entra ID. Which TWO features should you use?

Accepted Answer

Custom roles in Microsoft Entra ID. Custom roles in Microsoft Entra ID allow you to define roles with precisely the permissions needed for specific administrative tasks, enabling a least-privilege model by granting only the required actions on specific resources. Privileged Identity Management (PIM) complements this by providing just-in-time (JIT) activation, time-bound assignments, and approval workflows for those custom roles, ensuring that elevated privileges are only used when necessary and are automatically revoked.

Answer

Azure RBAC roles

Answer

Conditional Access policies

Answer

Microsoft Entra B2B external identities

Question 9

Refer to the exhibit. A user's sign-in to Azure Portal failed MFA. The risk level is medium due to leaked credentials. Conditional Access was not applied. What is the most likely reason for MFA failure?

Accepted Answer

The user's credentials were compromised, leading to a failed MFA attempt possibly due to incorrect code.. The exhibit shows a sign-in failure due to MFA, with a risk level of 'medium' attributed to 'leaked credentials.' When credentials are leaked, the user's password is known to an attacker, but MFA still requires a second factor (e.g., a code from an authenticator app). The most likely reason for the MFA failure is that the user entered an incorrect MFA code, possibly because the attacker attempted to use a stolen password but could not provide the correct MFA code, or the user themselves mistyped it. The risk event (leaked credentials) does not directly cause the MFA failure; it indicates the password was compromised, but the MFA challenge itself failed due to an incorrect second factor.

Answer

The user's password was leaked, and the sign-in was blocked by a risk-based policy.

Answer

The user did not have MFA registered, so the MFA attempt failed.

Answer

Conditional Access policy required MFA but was not applied due to licensing issue.

Question 10

Refer to the exhibit. You are reviewing a custom Microsoft Entra role for an application developer. A developer reports that they cannot register an application even though they have the 'applications/create' permission. What is the most likely cause?

Accepted Answer

The developer does not have permission to consent to application permissions.. The 'applications/create' permission allows a user to create application registrations, but registering an application also requires the ability to consent to permissions, specifically delegated permissions or application permissions. Without the 'Consent to application permissions' permission (or equivalent admin consent), the developer cannot complete the registration process because the app registration wizard requires consent for the permissions it requests. This is a separate permission that must be explicitly granted in the custom role definition.

Answer

The developer is not a Global Administrator.

Answer

The role needs to be assigned at the root scope.

Answer

The role is not assigned to the developer.

Question 11

Your organization wants to ensure that users accessing Office 365 from outside the corporate network must use MFA. What is the most efficient way to enforce this?

Accepted Answer

Create a Conditional Access policy for Office 365 with location condition and require MFA.. It specifically targets Office 365 cloud apps and uses the location condition to restrict MFA enforcement to access from outside the corporate network. This is the most efficient approach as it applies only to the relevant application and network location, minimizing user friction while meeting the requirement exactly.

Answer

Enable MFA for all users in Microsoft Entra ID.

Answer

Create a Conditional Access policy for all cloud apps with location condition.

Answer

Use Conditional Access with device compliance condition.

Question 12

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user accounts and enable self-service password reset (SSPR) for cloud users. You have set up Microsoft Entra Connect Sync. Which additional configuration is required to allow password writeback for SSPR?

Accepted Answer

Enable password writeback in Microsoft Entra Connect and assign Azure AD Premium licenses. Password writeback requires both the feature to be enabled in Microsoft Entra Connect (via the synchronization settings) and Azure AD Premium licenses (P1 or P2) assigned to users. Without the license, the SSPR writeback functionality is not available, even if the feature is enabled in the sync tool. This combination allows password changes from the cloud to be written back to on-premises Active Directory.

Answer

Configure pass-through authentication

Answer

Enable password hash synchronization

Answer

Install the Azure AD Password Protection proxy

Question 13

Your organization has Microsoft Entra ID P2 licenses. You want to automatically detect and respond to compromised identities by requiring MFA when a sign-in risk is medium or above. Which policy should you configure?

Accepted Answer

Configure an Identity Protection user risk policy to require MFA. An Identity Protection user risk policy is designed to automatically respond to user risk levels (e.g., low, medium, high) by triggering actions such as requiring MFA or blocking sign-in. Since the requirement is to detect and respond to compromised identities based on user risk (medium or above), the user risk policy directly maps to this scenario. This policy evaluates the risk associated with the user account itself, not just individual sign-in events.

Answer

Enable self-service password reset

Answer

Configure a Conditional Access policy with sign-in risk condition

Answer

Configure an Identity Protection sign-in risk policy

Question 14

Your organization uses Microsoft Entra ID. You need to manage access to a line-of-business application that supports SAML 2.0. The application should be integrated as an enterprise application in Entra ID. What steps must you take?

Accepted Answer

Create a new enterprise application as a non-gallery app, configure SAML, assign users, and test. To integrate a line-of-business application that supports SAML 2.0 as an enterprise application in Microsoft Entra ID, you must create a new enterprise application using the 'Non-gallery application' option, configure SAML-based sign-on with the application's metadata, assign users or groups, and test the integration. This process allows you to define custom SAML attributes and claims specific to the application, which is necessary for non-gallery apps that are not pre-integrated.

Answer

Configure user consent settings for the application

Answer

Register the application in App Registrations and configure SAML

Answer

Add the application from the Azure AD gallery

Question 15

Your company has Microsoft Entra ID and uses Azure Bastion for secure VM access. You need to ensure that only administrators with PIM-activated roles can access the Bastion host. What should you configure?

Accepted Answer

Use a Conditional Access policy to require privileged access for the Azure Bastion application. Azure Bastion integrates with Microsoft Entra ID and Conditional Access, allowing you to enforce policies that require privileged access (e.g., requiring a PIM-activated role) before users can connect to the Bastion host. By targeting the Azure Bastion application in a Conditional Access policy, you can restrict access to only administrators who have activated their privileged roles via PIM, ensuring that only authorized, elevated identities can reach the Bastion service.

Answer

Configure Azure Bastion with just-in-time access

Answer

Assign the Bastion Reader role to administrators

Answer

Configure network security groups to restrict access to Bastion