AZ-500 Secure identity and access Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?

Accepted Answer

Self-service password reset (SSPR). Self-service password reset (SSPR) is the correct feature because it allows users to reset their own passwords without IT intervention. SSPR integrates with Microsoft Entra ID and can be configured to require verification methods such as email, phone, or security questions before allowing a password change. This directly meets the requirement of enabling users to reset passwords independently.

Answer

Identity Protection

Answer

Multifactor authentication

Answer

Password Protection

Question 2

Your company uses Microsoft Entra ID and Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with your security policies can access corporate email. You configure a Conditional Access policy targeting Exchange Online. Which grant control should you use?

Accepted Answer

Require device to be marked as compliant. The scenario requires that only devices compliant with security policies can access corporate email. The 'Require device to be marked as compliant' grant control in Conditional Access checks the device compliance status reported by Microsoft Intune. If the device is not compliant, access to Exchange Online is blocked, ensuring policy enforcement.

Answer

Require multifactor authentication

Answer

Block access

Answer

Require hybrid Azure AD joined device

Question 3

You are troubleshooting an issue where users are unable to access a sensitive application protected by a Conditional Access policy. The policy requires MFA from trusted locations, but users are reporting that they are prompted for MFA even when connecting from the corporate office, which is defined as a trusted location. What is the most likely cause?

Accepted Answer

The corporate office's public IP address is not correctly defined in the trusted location. The most likely cause is that the corporate office's public IP address is not correctly defined in the trusted location. Conditional Access policies evaluate location based on named locations configured in Microsoft Entra ID, which must include the exact public IP ranges (CIDR notation) of the trusted network. If the IP address is missing, misconfigured, or the user's outbound IP differs (e.g., due to a VPN or proxy), the policy treats the location as untrusted and enforces MFA.

Answer

The policy is configured to require MFA for all locations regardless of trust

Answer

The policy is set to 'Require MFA' instead of 'Require MFA from trusted locations'

Answer

Users are not assigned to the policy

Question 4

Your company uses Microsoft Entra ID and has Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud apps based on user behavior. Which feature should you use?

Accepted Answer

Conditional Access for Cloud Apps (session control). Conditional Access for Cloud Apps with session control is the correct feature because it allows you to monitor and control access to cloud apps in real time based on user behavior. It uses Microsoft Entra ID Conditional Access policies combined with Microsoft Defender for Cloud Apps to enforce session policies, such as blocking downloads or requiring multi-factor authentication, when anomalous behavior is detected.

Answer

Information Protection (DLP)

Answer

Cloud Discovery

Answer

Application Proxy

Question 5

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Role settings for the privileged role. In Microsoft Entra ID PIM, role settings for each privileged role allow you to configure approval requirements and justification fields. By editing the role settings, you can require approval from a designated approver (e.g., a manager) and mandate a ticket number in the justification field, ensuring compliance with organizational policies.

Answer

Audit history

Answer

Alerts

Answer

Access reviews

Question 6

Your company uses Microsoft Entra ID. You need to block sign-ins from countries where your company does not operate. Which approach should you use?

Accepted Answer

Create a Conditional Access policy to block access from those countries. The correct option is B: create a Conditional Access policy to block access from those countries. Conditional Access is the Microsoft Entra ID feature designed to enforce sign-in decisions based on conditions such as location, and a policy can be scoped to all users and cloud apps with a Block grant control, using a Named location that defines the countries to exclude or block. Option D is only a building block—Named locations merely define geographic IP ranges and do not by themselves block anything. Option A (MFA for all users) adds an authentication requirement but does not prevent sign-ins from specific countries, and Option C (Identity Protection user risk policy) responds to risky user behavior, not geographic origin.

Answer

Configure MFA for all users

Answer

Use Identity Protection user risk policy

Answer

Add those countries as Named locations

Question 7

Which TWO of the following are methods to enforce MFA in Microsoft Entra ID?

Accepted Answer

Security defaults. Security defaults (C) is correct because it is a Microsoft-managed baseline that, once enabled, automatically requires all users to register for MFA and enforces MFA for privileged actions such as Azure portal, Microsoft Entra admin center, and Azure CLI/PowerShell access. Conditional Access policy (D) is correct because it is the primary granular method to enforce MFA, letting you create a policy that targets users/groups and cloud apps with a Grant control of 'Require multifactor authentication' (optionally combined with conditions like sign-in risk, location, or device state). Identity Protection user risk policy (A) does not itself enforce MFA; it can require a password change or, in some configurations, allow access, and MFA enforcement is typically achieved by pairing risk signals with a Conditional Access grant control. Password Protection (B) only blocks weak or banned passwords via custom banned password lists and does not perform MFA. Self-service password reset (E) is a credential-reset feature and does not enforce MFA, even though it may require MFA as an authentication method for the reset process.

Answer

Identity Protection user risk policy

Answer

Password Protection

Answer

Self-service password reset

Question 8

Which TWO of the following are valid authentication methods in Microsoft Entra ID?

Accepted Answer

Temporary Access Pass. Temporary Access Pass (TAP) is a valid authentication method in Microsoft Entra ID that allows users to register passwordless methods (like FIDO2 or Microsoft Authenticator) by providing a time-limited passcode. It is designed for scenarios where users have forgotten their credentials or need to onboard new devices without a password. TAP is configured via the Authentication methods policy in Entra ID and supports both one-time use and configurable lifetimes.

Answer

App registration

Answer

Managed identity

Answer

Azure AD Connect

Question 9

Refer to the exhibit. You run the command and see the output. What does the UserType 'Member' indicate?

Accepted Answer

The user is a member of the tenant. The UserType 'Member' indicates that the user is a member of the tenant, meaning the user's identity is native to the Microsoft Entra ID tenant and not from an external directory. This is distinct from 'Guest' (UserType = Guest), which represents external users invited via B2B collaboration. The command shown is likely Get-AzureADUser or a similar cmdlet, where the UserType property directly reflects the user's relationship to the tenant.

Answer

The user is a service principal

Answer

The user is a guest user

Answer

The user is an administrator

Question 10

You are designing a privileged access strategy for Microsoft Entra ID. Your organization requires that all users who are assigned to the Global Administrator role must perform a privileged elevation only when needed, and the elevation must be approved by a security officer. Which feature should you implement?

Accepted Answer

Microsoft Entra Identity Governance – Privileged Identity Management. Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged elevation for roles like Global Administrator, requiring approval from designated approvers (e.g., a security officer) before activation. This directly meets the requirement of elevation only when needed with approval, as PIM manages time-bound role assignments and approval workflows.

Answer

Azure AD administrative units

Answer

Conditional Access with session control

Answer

Microsoft Entra ID protection risk policies

Question 11

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SSPR and set the registration campaign to require registration at next sign-in. Enabling SSPR and configuring the registration campaign to require registration at next sign-in ensures users must register for SSPR before they can reset their own passwords. This satisfies the requirement that users register first, and the registration campaign enforces this without requiring help desk intervention.

Answer

Configure Microsoft Entra Password Protection

Answer

Enable Privileged Identity Management for SSPR

Answer

Enable combined registration for SSPR and Microsoft Entra ID Protection

Question 12

You are troubleshooting a sign-in issue. A user reports that they are repeatedly prompted for authentication when accessing a cloud app, even though they already authenticated earlier in the day. You check the Conditional Access policy and see that 'Session control - Sign-in frequency' is set to 1 hour. What is the most likely cause?

Accepted Answer

The sign-in frequency setting forces reauthentication after 1 hour. The 'Session control - Sign-in frequency' setting in Conditional Access enforces reauthentication at the specified interval. When set to 1 hour, the user must re-authenticate every hour, regardless of prior authentication earlier in the day. This explains the repeated prompts, as the session lifetime is capped by this policy.

Answer

The browser is blocking persistent cookies

Answer

Token lifetime policy overrides the sign-in frequency

Answer

The user is considered high risk by Identity Protection

Question 13

Your organization uses Microsoft Entra ID. You need to ensure that users can reset their own passwords without contacting IT. Which feature should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Entitlement management access packages. Entitlement management access packages in Microsoft Entra ID are the correct choice because they let you bundle resources such as sensitive applications into an access package with an approval policy, so users request access through the My Access portal and the request is automatically routed to the designated approver (the application owner) before access is granted. This directly satisfies the requirement for owner-approved, request-based access to applications. Option A (Entra roles and administrative units) governs role assignments and scoping, not user access-request approval workflows for applications. Option C (Privileged Identity Management for groups) handles just-in-time activation of privileged group membership, not application access requests with owner approval. Option D (cross-tenant access settings) controls collaboration and trust with external Entra tenants, which is unrelated to internal application access approvals.

Answer

Microsoft Entra roles and administrative units

Answer

Privileged Identity Management for groups

Answer

Cross-tenant access settings

Question 14

Which TWO of the following are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Sign-in risk policy. Microsoft Entra ID Protection is specifically designed to detect identity-based risks and let administrators respond to them via two built-in policies: the sign-in risk policy (B), which evaluates each authentication attempt and can require MFA or block the sign-in when the sign-in is deemed risky, and the user risk policy (C), which evaluates the overall risk of a user account (for example, from leaked credentials) and can force a secure password change. Both B and C are core, out-of-the-box capabilities of Entra ID Protection and are configured directly in its Risk policies blade. Conditional Access session controls (A) are a feature of Conditional Access (sign-in frequency, app-enforced restrictions, Cloud App Security/Defender for Cloud Apps controls), not of ID Protection itself, even though risk signals can feed Conditional Access. Access reviews (D) belong to Entra ID Governance (Identity Governance), and role-based access control (E) is the general authorization model used across Azure and Entra ID, not a risk-detection capability of ID Protection.

Answer

Conditional Access session controls

Answer

Access reviews

Answer

Role-based access control (RBAC)

Question 15

Which THREE of the following are required to configure Microsoft Entra ID self-service password reset (SSPR)?

Accepted Answer

Microsoft Entra ID P1 or P2 license. Option A is correct because Microsoft Entra ID self-service password reset requires a Microsoft Entra ID P1 or P2 license (or Microsoft 365 Business Premium, which includes Entra ID P1 features); the P1 tier is the minimum paid license that unlocks SSPR for cloud-only and hybrid users. Option D is correct because users must register their authentication methods (such as Microsoft Authenticator, email, phone, or security questions) before they can prove their identity and reset their own password. Option E is correct because an administrator must explicitly enable SSPR in the tenant (for example, by selecting All users or a pilot group under Password reset > Properties), since the feature is not active by default. Option B is not required because Premium P2 is not the minimum license — P1 already satisfies the SSPR licensing requirement, and P2 is only needed for features like Identity Protection and Privileged Identity Management. Option C is not required because password writeback is only necessary for hybrid environments where the password must sync back to on-premises Active Directory via Microsoft Entra Connect; for cloud-only users, SSPR works without writeback.

Answer

Microsoft Entra ID Premium P2 license

Answer

Password writeback must be enabled