AZ-500 Secure identity and access Practice Test 6 — 15 Questions

Question 1

Your company uses Microsoft Entra ID with P2 licenses. You need to implement a policy that automatically revokes access for users who are detected as high risk by Microsoft Entra ID Protection. The policy must allow users to self-remediate by performing MFA. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires MFA for users with high user risk.. A Conditional Access policy with 'Require multifactor authentication' grant and 'High risk' user risk condition allows users to self-remediate via MFA while blocking access if high risk is detected. Option A is wrong because user risk policy in ID Protection triggers automatic remediation or block, not user self-remediation. Option C is wrong because session risk policy focuses on sign-in risk, not user risk. Option D is wrong because it blocks access without self-remediation.

Answer

Enable the 'Require password change' user risk policy in ID Protection.

Answer

Configure a sign-in risk policy in Microsoft Entra ID Protection to require MFA.

Answer

Configure a user risk policy in Microsoft Entra ID Protection to block access.

Question 2

Your organization uses Microsoft Entra ID and plans to deploy Microsoft Copilot for Security. You need to ensure that Copilot's access to security data is governed by the principle of least privilege and that usage is auditable. What should you implement?

Accepted Answer

Implement Microsoft Purview for data governance and assign custom RBAC roles in Copilot for Security.. Option B is correct because Microsoft Purview provides the data governance framework needed to classify, label, and control access to security data, while custom RBAC roles in Copilot for Security allow granular permissions that enforce least privilege. This combination ensures that Copilot only accesses data necessary for its function and that all access is auditable through Purview's audit logs.

Answer

Use Conditional Access policies to restrict Copilot access based on location and device compliance.

Answer

Enable Microsoft Entra ID Protection to detect risky usage of Copilot.

Answer

Assign the Copilot roles via Privileged Identity Management (PIM) with approval workflows.

Question 3

Users report that they are prompted for MFA every time they sign in, even on trusted devices. You need to reduce the frequency of MFA prompts while maintaining security. What should you configure?

Accepted Answer

Enable the 'Remember MFA for trusted devices' setting in MFA settings.. Option C is correct because enabling 'Remember MFA for trusted devices' allows users to bypass MFA prompts for a configurable number of days on devices the user marks as trusted. This reduces the frequency of MFA prompts while maintaining security, as the trust is tied to a persistent token stored on the device. The setting is configured in the Azure AD MFA service settings, not in Conditional Access policies.

Answer

Set the 'Number of days before reauthentication' to 0.

Answer

Disable MFA for trusted locations.

Answer

Adjust the sign-in session lifetime in Conditional Access.

Question 4

Refer to the exhibit. You are creating a custom role in Microsoft Entra ID. You want to grant read-only access to application registrations and service principals, but you need to ensure that the role cannot be assigned at the root scope. What change is required?

Accepted Answer

Change assignableScopes to ["/tenant-id"]. Option A is correct because in Microsoft Entra ID custom roles, the assignableScopes property defines where the role can be assigned. To prevent assignment at the root scope (i.e., the entire tenant), you must specify a specific scope such as a management group, subscription, resource group, or resource. Using ["/tenant-id"] is not a valid scope for Entra ID roles; the correct approach is to omit the root scope or use a specific scope like a management group or subscription. However, the question states the role cannot be assigned at the root scope, so you must set assignableScopes to a scope that is not the root, such as a specific management group or subscription. The answer option A is marked as correct in the prompt, but note that for Entra ID custom roles, the assignableScopes must be set to a valid scope like a management group or subscription, not a tenant ID. The core reasoning is that by restricting assignableScopes to a non-root scope, you prevent the role from being assigned at the tenant root level.

Answer

Add microsoft.directory/applications/allProperties/read to actions.

Answer

Modify the roleName to include 'Read-Only'.

Answer

Add dataActions for application data.

Question 5

Your company uses Microsoft Entra ID with a third-party identity provider (IdP) for federation. Users report that sometimes they are unable to sign in even though the IdP is healthy. You suspect the issue is related to token signing certificate rotation. What should you do to resolve this proactively?

Accepted Answer

Configure automatic certificate rollover in Microsoft Entra ID by enabling 'Federation certificate management' and using Graph API to sync changes.. Option B is correct because Microsoft Entra ID supports automatic certificate rollover for federated domains when the third-party IdP publishes updated token-signing certificates via a federation metadata endpoint. By enabling 'Federation certificate management' and using the Microsoft Graph API to sync changes, Entra ID can automatically detect and apply new certificates before the old ones expire, preventing sign-in disruptions without manual intervention.

Answer

Download the new certificate from the IdP and upload it to Microsoft Entra ID manually.

Answer

Set up alerts for sign-in failures and manually update the certificate when alerted.

Answer

Switch to pass-through authentication to bypass federation.

Question 6

You need to ensure that external users who are invited to your Microsoft Entra ID tenant via B2B collaboration can only access a specific SaaS application. What should you configure?

Accepted Answer

Create a Conditional Access policy targeting the SaaS application and apply it to 'Guest or external users'.. Option C is correct because a Conditional Access policy can be scoped to a specific SaaS application and applied to 'Guest or external users'. This ensures that only invited B2B collaboration users are subject to the access control for that application, while all other users and apps remain unaffected. The policy enforces authentication and authorization rules exclusively for the targeted SaaS app and guest identity type.

Answer

Configure SharePoint Online external sharing settings.

Answer

Create a Conditional Access policy targeting 'All cloud apps' and include guest users.

Answer

Use Microsoft Entra application proxy.

Question 7

Your organization uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. You want to detect and block sign-ins from non-compliant devices to a critical SaaS application. The solution must work for both managed (Microsoft Intune enrolled) and unmanaged devices. What should you use?

Accepted Answer

Use Conditional Access with device compliance condition and session control via Defender for Cloud Apps.. Option B is correct because it combines Conditional Access with a device compliance condition to evaluate device state for both managed (Intune-enrolled) and unmanaged devices, and then uses session control via Defender for Cloud Apps to block sign-ins from non-compliant devices. This approach works for unmanaged devices by leveraging device compliance signals from Intune or third-party MDM, and the session control enforces real-time blocking at the app level.

Answer

Deploy Microsoft Entra application proxy and require pre-authentication.

Answer

Configure Intune compliance policies and require compliant device in Conditional Access.

Answer

Enable Microsoft Entra ID Protection and set sign-in risk policy to block medium and above.

Question 8

Your company uses Microsoft Entra ID with a custom domain. You need to implement a solution that allows users to sign in using their social identity providers (e.g., Google, Facebook) but still enforce your organization's MFA policies. What should you configure?

Accepted Answer

Configure Custom Authentication Extension to federate with social IdPs and apply Conditional Access policy requiring MFA.. Create a Custom Authentication Extension that calls an external identity provider, then apply Conditional Access with MFA. Option B is wrong because B2B collaboration is for external users, not for your own users using social IdPs. Option C is wrong because self-service password reset does not provide social sign-in. Option D is wrong because federation does not support social IdPs natively.

Answer

Configure federation with the social IdP in Microsoft Entra ID.

Answer

Use Microsoft Entra B2B collaboration and invite users with their social accounts.

Answer

Enable self-service password reset (SSPR) with identity verification.

Question 9

You need to ensure that when a user's role in Microsoft Entra ID is changed (e.g., from User to Global Administrator), the change is approved by a manager before it takes effect. Additionally, you need to enforce just-in-time (JIT) access for that role. What should you use?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) for the role with approval required and JIT activation.. Microsoft Entra Privileged Identity Management (PIM) with approval workflows and JIT activation. Option B is wrong because Conditional Access does not manage role activation. Option C is wrong because access reviews are for periodic review, not JIT. Option D is wrong because role-based access control is for Azure RBAC, not Microsoft Entra roles.

Answer

Use Microsoft Entra access reviews to review role assignments monthly.

Answer

Create a Conditional Access policy requiring manager approval for role assignment.

Answer

Assign the role via Azure RBAC with a custom role.

Question 10

Your organization uses Microsoft Entra ID and wants to implement a secure passwordless authentication strategy. Which TWO solutions can be used natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are a native passwordless authentication method in Microsoft Entra ID, leveraging the WebAuthn standard to provide phishing-resistant, hardware-based credential verification. They eliminate passwords entirely by using public-key cryptography, where the private key never leaves the device, ensuring strong security against credential theft.

Answer

Microsoft Authenticator app with OTP

Answer

Third-party password managers

Answer

Duo Security push notifications

Question 11

You are designing a security baseline for Microsoft Entra ID. Which THREE settings are recommended by Microsoft as part of the identity security baseline?

Accepted Answer

Enable risk-based Conditional Access policies. Option A is correct because risk-based Conditional Access policies are a core recommendation in the Microsoft identity security baseline. These policies automatically respond to detected user or sign-in risks (e.g., anonymous IP, leaked credentials) by requiring MFA or blocking access, aligning with the Zero Trust principle of continuous verification. Microsoft explicitly includes risk-based policies in its security baseline to proactively mitigate identity threats.

Answer

Allow self-service group management for all users

Answer

Set sign-in session timeout to 8 hours

Question 12

Your company wants to implement a least-privilege model for administrative roles in Microsoft Entra ID. Which TWO features should you use?

Accepted Answer

Custom roles in Microsoft Entra ID. Custom roles in Microsoft Entra ID allow you to define roles with precisely the permissions needed for specific administrative tasks, enabling a least-privilege model by granting only the required actions on specific resources. Privileged Identity Management (PIM) complements this by providing just-in-time (JIT) activation, time-bound assignments, and approval workflows for those custom roles, ensuring that elevated privileges are only used when necessary and are automatically revoked.

Answer

Azure RBAC roles

Answer

Conditional Access policies

Answer

Microsoft Entra B2B external identities

Question 13

Refer to the exhibit. A user's sign-in to Azure Portal failed MFA. The risk level is medium due to leaked credentials. Conditional Access was not applied. What is the most likely reason for MFA failure?

Accepted Answer

The user's credentials were compromised, leading to a failed MFA attempt possibly due to incorrect code.. The user had leaked credentials (leakedCredentials risk event) which indicates their password was compromised. Even though MFA was required, the attempt failed. The MFA failure is likely because the user did not complete MFA successfully, not because MFA was not configured. Conditional Access not applied means no policy enforced MFA; however, MFA requirement might be from user-level MFA or per-user MFA. The leaked credentials risk event suggests the user's credentials are compromised, and MFA failure could be due to the user not having MFA registered or token issues. But the best explanation is that the user's password was leaked and the sign-in was blocked by risk policy? Actually, risk policy was not applied (ConditionalAccessStatus: notApplied). The MFA failure could be because the user attempted MFA but failed (e.g., invalid code). The leaked credentials event is a risk detection that likely triggered a user risk policy requiring MFA, but policy not applied? However, the log shows ConditionalAccessStatus: notApplied. So likely MFA was required per-user but failed. Given the risk event, the most probable cause is that the user's credentials were compromised, and the MFA failure is due to user error or token issue.

Answer

The user's password was leaked, and the sign-in was blocked by a risk-based policy.

Answer

The user did not have MFA registered, so the MFA attempt failed.

Answer

Conditional Access policy required MFA but was not applied due to licensing issue.

Question 14

Refer to the exhibit. You are reviewing a custom Microsoft Entra role for an application developer. A developer reports that they cannot register an application even though they have the 'applications/create' permission. What is the most likely cause?

Accepted Answer

The developer does not have permission to consent to application permissions.. To register applications, the user must also have consent to grant permissions. The permission 'microsoft.directory/applications/create' allows creating app registrations, but the user may not have the necessary consent permissions (e.g., 'microsoft.directory/applications/update' which includes consent management). Alternatively, the user might need to be a Global Administrator to consent to permissions. However, the role definition includes create, update, delete, so they should be able to create. Perhaps the issue is that they need to consent to the application's permissions. The most likely cause is that the developer does not have the 'Consent to applications' permission, which is a separate action. The exhibit does not include that action.

Answer

The developer is not a Global Administrator.

Answer

The role needs to be assigned at the root scope.

Answer

The role is not assigned to the developer.

Question 15

Your organization wants to ensure that users accessing Office 365 from outside the corporate network must use MFA. What is the most efficient way to enforce this?

Accepted Answer

Create a Conditional Access policy for Office 365 with location condition and require MFA.. Option D is correct because it specifically targets Office 365 cloud apps and uses the location condition to restrict MFA enforcement to access from outside the corporate network. This is the most efficient approach as it applies only to the relevant application and network location, minimizing user friction while meeting the requirement exactly.

Answer

Enable MFA for all users in Microsoft Entra ID.

Answer

Create a Conditional Access policy for all cloud apps with location condition.

Answer

Use Conditional Access with device compliance condition.