AZ-500 Secure identity and access Practice Test 6 — 15 Questions

Question 1

You are designing a secure access solution for an Azure App Service web application. The application uses Microsoft Entra ID for authentication. You need to ensure that only users from specific partner organizations can access the app. Which configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the app to accept tokens from the partner tenants as external identity providers. Azure App Service can be configured to accept tokens from multiple Microsoft Entra ID tenants as external identity providers. This allows users from specific partner organizations to authenticate using their own Entra ID tenant, while the app validates the tokens and grants access only to those partner tenants you explicitly trust.

Answer

Use a custom domain for the app

Answer

Block all external users

Answer

Require multi-factor authentication for all users

Question 2

Your organization uses Microsoft Intune for mobile device management. You need to implement a conditional access policy that only allows access to corporate email from devices that are enrolled in Intune and compliant with security policies. However, the policy is not working for some users who report that they cannot access email even though their devices are compliant. You discover that the users have multiple devices and are signing in from a device that is not enrolled. What should you do?

Accepted Answer

Ensure users sign in only from compliant devices. Ensure users sign in only from compliant devices. In a Conditional Access scenario, the policy evaluates the specific device used for the sign-in, so if a user has multiple devices and authenticates from a non-enrolled or non-compliant one, access to corporate email will be blocked even if another of their devices is compliant; the fix is to make sure the sign-in originates from a compliant device. Option A is unnecessary and impractical because enrolling every device is not required by the policy, only the device being used for access must be enrolled and compliant. Option B would defeat the security requirement entirely by removing the control. Option C does not fit because app protection policies (MAM) protect app data on unmanaged devices but do not satisfy a Conditional Access requirement that the device itself be Intune-enrolled and compliant.

Answer

Enroll all devices in Intune

Answer

Remove the conditional access policy

Answer

Use app protection policies instead

Question 3

Your company is implementing a zero-trust security model. You need to ensure that all access to cloud applications is continuously verified based on user identity, device health, and location. Which combination of Microsoft security solutions should you use?

Accepted Answer

Microsoft Entra ID Conditional Access, Microsoft Intune, and Microsoft Defender for Cloud Apps. The zero-trust requirement for continuous verification of user identity, device health, and location is met by combining Microsoft Entra ID Conditional Access (enforces policies based on user, device, and location signals), Microsoft Intune (manages device compliance and health), and Microsoft Defender for Cloud Apps (provides continuous session-level monitoring and control of cloud app access). This trio delivers the real-time, policy-driven access checks that zero trust demands.

Answer

Microsoft Sentinel and Azure Policy

Answer

Microsoft Entra ID Protection and Privileged Identity Management

Answer

Azure Active Directory Domain Services and Azure Firewall

Question 4

You are configuring Microsoft Entra ID Connect to synchronize on-premises Active Directory identities to the cloud. You need to ensure that password hashes are synchronized to enable Microsoft Entra ID Password Protection and Identity Protection. Which option should you enable?

Accepted Answer

Password hash synchronization. Password hash synchronization (PHS) is the correct option because it is the specific feature that synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID. This enables Microsoft Entra ID Password Protection (which blocks weak passwords by comparing against a global banned password list) and Identity Protection (which detects leaked credentials by comparing synchronized hashes against known compromised password databases). Without PHS, these cloud-based security features have no access to the on-premises password hashes.

Answer

Pass-through authentication

Answer

Federation with AD FS

Answer

Azure AD Connect Health

Question 5

Which TWO features are available in Microsoft Entra ID Privileged Identity Management (PIM) for managing Azure AD roles? (Choose two.)

Accepted Answer

Just-in-time activation. Option B (Just-in-time activation) is correct because PIM's core capability is making users eligible for Microsoft Entra ID roles and requiring them to activate the role only when needed, granting time-bound, temporary elevation instead of permanent assignment. Option E (Approval workflow for role activation) is correct because PIM role settings allow administrators to require approval before an eligible user's activation request is granted, with designated approvers reviewing the request. The other options do not belong: self-service password reset (A) is an Entra ID authentication feature, not a PIM role-management feature; multi-factor authentication enforcement (C) is configured via Conditional Access or authentication methods, not as a PIM role feature; and automatic role assignment based on group membership (D) is handled by group-based licensing/role-assignable groups, not by PIM activation.

Answer

Self-service password reset

Answer

Multi-factor authentication enforcement

Answer

Automatic role assignment based on group membership

Question 6

Which THREE Microsoft Entra ID roles can be assigned to a user to manage Microsoft Defender XDR (formerly Microsoft 365 Defender) incidents? (Choose three.)

Accepted Answer

Security Administrator. The Security Administrator role (Option B) can manage Microsoft Defender XDR incidents because it grants full access to security features, including the ability to view, investigate, and respond to incidents in the Microsoft 365 Defender portal. This role is designed for users who need to manage security policies and incidents without having full administrative control over the tenant.

Answer

Exchange Administrator

Answer

Global Reader

Question 7

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM) to manage roles. You need to ensure that when a user activates a role, the activation is automatically approved only if the user's manager approves within 30 minutes. If the manager does not respond, the activation is denied. What configuration should you implement?

Accepted Answer

Configure the role settings to require approval, set the maximum activation duration to 30 minutes, and add the user's manager as an approver.. In Microsoft Entra ID PIM, the 'Maximum activation duration' setting in role settings controls the time window within which an approval must be granted. If the approver does not respond within that duration, the activation request is denied. By setting this to 30 minutes, requiring approval, and adding the user's manager as an approver, you ensure the manager must approve within 30 minutes or the activation is automatically denied. This directly meets the requirement.

Answer

Enable just-in-time access for the role and configure a group approval with a 30-minute timeout.

Answer

Create an approval workflow in Microsoft Entra ID that assigns the manager as the approver and set a timeout of 30 minutes.

Answer

Configure the role settings to require approval and set the approval timeout to 0 minutes.

Question 8

You are a security engineer for a company that uses Microsoft Entra ID. You need to ensure that all users accessing the company's Salesforce application from unmanaged devices are prompted for multi-factor authentication (MFA) every time. What should you configure?

Accepted Answer

Create a Conditional Access policy that targets the Salesforce application, apply to all users, include 'All device platforms' with 'Device state' filter for 'Unmanaged', and grant access requiring MFA with session control 'Sign-in frequency - Every time'.. A Conditional Access policy with a 'Device state' filter for 'Unmanaged' and 'Sign-in frequency - Every time' session control forces MFA prompts on every access attempt from unmanaged devices. This meets the requirement to prompt MFA every time for users accessing Salesforce from unmanaged devices, without affecting managed devices or requiring per-user MFA.

Answer

Enable per-user MFA for all users in the Salesforce application.

Answer

Configure device compliance policy to require MFA on non-compliant devices.

Answer

Configure MFA registration policy to require all users to register MFA.

Question 9

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access Exchange Online. The solution must require users to reauthenticate every 12 hours. What should you configure?

Accepted Answer

Create a Conditional Access policy that grants access to Exchange Online only if the device is compliant, and set session sign-in frequency to 12 hours.. A Conditional Access policy can enforce device compliance as a grant control for Exchange Online, ensuring only compliant devices can access the service. Setting the session sign-in frequency to 12 hours forces users to reauthenticate at that interval, meeting the requirement without requiring MFA. This combines device compliance enforcement with session lifetime control in a single policy.

Answer

Create a Conditional Access policy that requires MFA for Exchange Online and set sign-in frequency to 12 hours.

Answer

Create an app protection policy for Exchange Online that requires device compliance and sets sign-in frequency.

Answer

Configure a device compliance policy for all devices and enable 'Reauthenticate every 12 hours' in the compliance policy.

Question 10

You need to assign the 'Security Administrator' role in Microsoft Entra ID to a user named User1. The role assignment must be eligible, and User1 must provide a justification when activating the role. What should you use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID is the only service that supports time-bound, eligible role assignments with activation justification. By configuring a PIM policy for the Security Administrator role, you can require User1 to provide a business justification before the role is activated for a specified duration.

Answer

Direct role assignment in Azure AD roles and administrators

Answer

Global Administrator role with custom activation policy

Answer

User Administrator role with access reviews

Question 11

Your company has a Microsoft Entra ID tenant with 10,000 users. You need to implement a secure authentication strategy that satisfies the following requirements:
- Users must not be able to bypass security verification using alternate authentication methods.
- Passwordless authentication should be used where possible.
- Legacy authentication protocols must be blocked.

Which THREE actions should you take? (Choose three.)

Accepted Answer

Create a Conditional Access policy to block legacy authentication protocols.. Option A is correct because a Conditional Access policy targeting the 'Other clients' client apps condition (which covers legacy protocols such as IMAP, POP3, SMTP AUTH, and older Office clients) is the supported way to block legacy authentication in Microsoft Entra ID. Option C is correct because enabling the FIDO2 security key authentication method and configuring it for passwordless sign-in provides a phishing-resistant, passwordless credential that satisfies the passwordless requirement. Option E is correct because disabling SMS and voice call methods removes weaker alternate authentication methods that users could otherwise use to bypass stronger security verification, directly addressing the no-bypass requirement. Option B is not correct because per-user MFA is a legacy, always-on setting that cannot enforce method restrictions or passwordless flows and does not block legacy authentication. Option D is not correct because Security defaults are a baseline for tenants without Conditional Access and cannot be combined with the granular Conditional Access policy needed here, nor do they enforce passwordless authentication.

Answer

Configure per-user MFA to require verification.

Answer

Enable the 'Security defaults' feature in Microsoft Entra ID.

Question 12

Refer to the exhibit. You are creating a custom Azure RBAC role for a security analyst. The role as shown allows read access to storage accounts. The analyst reports that they cannot read the contents of a blob container in a storage account. Why is this?

Accepted Answer

The role does not include dataActions to read blob data.. The custom RBAC role only includes read permissions for the storage account's control plane (e.g., listing keys, reading properties) but lacks the necessary dataActions to read blob data. To read blob container contents, the role must include 'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read' under dataActions, which governs access to the data plane. Without this, the analyst can see the storage account but cannot access the blobs within it.

Answer

The role is not assigned to the analyst's user account.

Answer

The assignable scope is incorrect; it should be at the resource group level.

Answer

The storage account does not exist in the specified subscription.

Question 13

Refer to the exhibit. You are reviewing user sign-in activity using Microsoft Graph API. The user has not performed an interactive sign-in since December 1, but had a non-interactive sign-in on December 5. You need to determine if the user should be considered inactive for a policy that defines inactivity as no interactive sign-in for 30 days. Today is December 15. What should you do?

Accepted Answer

Use the lastSignInDateTime of December 1, which is only 14 days ago, so the user is not inactive.. The policy defines inactivity as no interactive sign-in for 30 days. The user's last interactive sign-in was on December 1, which is only 14 days ago as of December 15, so the user is not inactive. Microsoft Graph API's lastSignInDateTime property specifically tracks interactive sign-ins, while non-interactive sign-ins are tracked separately via lastNonInteractiveSignInDateTime and do not reset the interactive inactivity timer.

Answer

Check if the user has any sign-in in the last 30 days; since there is a non-interactive sign-in, the user is active.

Answer

Use the lastNonInteractiveSignInDateTime as the last sign-in time, so the user is not inactive.

Answer

The user is inactive because the account is enabled but there is no interactive sign-in in the last 30 days.

Question 14

Your company uses Microsoft Entra ID with a hybrid identity model. You need to implement a solution that allows you to block legacy authentication attempts while still allowing modern authentication protocols. What should you use?

Accepted Answer

Create a Conditional Access policy to block legacy authentication. Conditional Access policies in Microsoft Entra ID allow you to explicitly block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic auth) while permitting modern authentication (OAuth 2.0, OpenID Connect). By targeting the 'Client apps' condition and selecting 'Exchange ActiveSync clients' and 'Other clients', you can block all legacy auth attempts without affecting modern protocol traffic. This is the precise, granular control required for a hybrid identity model.

Answer

Enable Security defaults

Answer

Use Identity Protection to detect legacy authentication

Answer

Configure MFA for all users

Question 15

You are designing a Microsoft Entra ID tenant for a multinational organization. The security team requires that all administrative users must use phishing-resistant MFA. Administrators are located in different regions and may use different devices. Which MFA method should you enforce?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are the only option that provides phishing-resistant MFA, as they use public-key cryptography and are bound to a specific web origin, preventing credential theft via man-in-the-middle attacks. This satisfies the security team's requirement for all administrative users, regardless of region or device, because FIDO2 keys are hardware-based and interoperable across platforms.

Answer

SMS-based verification

Answer

Phone call verification

Answer

Microsoft Authenticator with OTP