AZ-500 Secure identity and access Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID and needs to implement a policy that blocks all sign-ins from countries that are not approved. What should you configure?

Accepted Answer

Create a Conditional Access policy with a location condition set to block. A Conditional Access policy in Microsoft Entra ID allows you to define location conditions based on IP ranges, countries, or regions. By configuring the location condition to include all countries except the approved ones and setting the access control to 'Block access', you can effectively block sign-ins from non-approved countries. This is the native, policy-driven approach to enforce geographic restrictions without manual intervention.

Answer

Enable multi-factor authentication for all users

Answer

Review sign-in logs and manually block IPs

Answer

Configure an Identity Protection risk policy

Question 2

You are designing a privileged identity management strategy for Microsoft Entra ID. You need to ensure that eligible role assignments require approval from a designated group before activation. What configuration is required?

Accepted Answer

In PIM, configure the role settings to require approval and specify an approver group. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role settings to require approval for activation. By specifying an approver group, you ensure that eligible role assignments cannot be activated without explicit approval from designated members, enforcing a just-in-time (JIT) access control model.

Answer

Configure the role as eligible and set activation duration

Answer

Configure a Conditional Access policy with approval control

Answer

Create an access review for the role

Question 3

Your organization has Microsoft Entra ID and uses Microsoft Copilot for Microsoft 365. You need to ensure that Copilot interactions are logged and accessible for security investigations. What should you configure?

Accepted Answer

Ensure that auditing is enabled in Microsoft Purview to capture Copilot interactions. Microsoft Copilot for Microsoft 365 interactions are audited through the Microsoft Purview audit log. Enabling auditing in Purview captures detailed records of Copilot prompts and responses, which are then accessible for security investigations via the Purview compliance portal or through the Office 365 Management Activity API. This is the designated mechanism for logging Copilot activity, as Copilot interactions are considered Microsoft 365 workload events.

Answer

Configure Microsoft Sentinel to collect Copilot logs via the Office 365 connector

Answer

Enable diagnostic settings in Azure Monitor to collect Copilot logs

Answer

Deploy Microsoft Defender for Cloud Apps to monitor Copilot usage

Question 4

You need to grant a group of users the ability to read Microsoft Entra ID sign-in logs in the Azure portal. Which role should you assign?

Accepted Answer

Reports Reader. The Reports Reader role is specifically designed to grant read-only access to monitoring data, including Microsoft Entra ID sign-in logs and audit logs, without granting broader read permissions to the entire directory. This role is the least-privileged option that directly meets the requirement to read sign-in logs in the Azure portal.

Answer

Security Reader

Answer

Global Reader

Answer

Global Administrator

Question 5

Which TWO actions should you take to implement a zero-trust identity model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Configure Privileged Identity Management to require approval for role activation. Privileged Identity Management (PIM) enforces just-in-time (JIT) access by requiring approval for role activation, which aligns with the zero-trust principle of 'never trust, always verify' by eliminating standing privileges. Option E is correct because Conditional Access policies that require MFA and device compliance enforce continuous verification of user identity and device health before granting access, a core tenet of zero-trust identity.

Answer

Configure password expiration policies to force frequent changes

Answer

Enable password hash synchronization to Azure AD

Answer

Assign permanent Global Administrator roles to IT staff

Question 6

Which THREE components are part of Microsoft Entra Conditional Access? (Choose three.)

Accepted Answer

Conditions (sign-in risk, device state, location). Microsoft Entra Conditional Access is a policy-based engine that evaluates signals to enforce access decisions. The three core components are Assignments (who the policy applies to, such as users, groups, or workload identities), Conditions (the signals evaluated, like sign-in risk, device state, or location), and Access Controls (the enforcement actions, such as grant or block access, and session controls). These three elements form the complete structure of a Conditional Access policy.

Answer

Multi-factor authentication service settings

Answer

Role assignments

Question 7

Which TWO methods can be used to protect privileged accounts in Microsoft Entra ID? (Choose two.)

Accepted Answer

Create a Conditional Access policy that requires MFA for privileged roles. Requiring MFA for privileged roles via a Conditional Access policy adds a critical layer of security, ensuring that even if credentials are compromised, an attacker cannot authenticate without the second factor. This directly mitigates the risk of credential theft for high-privilege accounts. Option E is correct because Privileged Identity Management (PIM) provides just-in-time (JIT) access, reducing the attack surface by granting administrative roles only when needed and for a limited duration, with approval workflows and auditing.

Answer

Enable external identities for guest users

Answer

Enable self-service password reset for all users

Answer

Register all devices with Azure AD

Question 8

You are the security engineer for Contoso, a multinational company with 50,000 users in Microsoft Entra ID Premium P2. The company has a strict security policy requiring that all administrative actions be performed using just-in-time (JIT) access with approval, and that all privileged role activations be audited. Additionally, you need to ensure that Global Administrators are required to use phishing-resistant MFA (e.g., FIDO2 security keys) when activating their role. You have already configured Privileged Identity Management (PIM) for Azure AD roles. However, during a recent audit, you discovered that several Global Administrators were able to activate their role using only a text message (SMS) for MFA, violating the policy. You need to enforce the use of phishing-resistant MFA for all privileged role activations. What should you do?

Accepted Answer

Create a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' app and requires authentication strength 'Phishing-resistant MFA'. Privileged Identity Management (PIM) role activation is triggered by signing in to the Azure AD Privileged Identity Management application (the PIM blade or API). By creating a Conditional Access policy that targets this specific app and requires the 'Phishing-resistant MFA' authentication strength, you enforce FIDO2 or Windows Hello for Business during the activation step, regardless of the user's baseline MFA method. This directly addresses the audit finding that Global Administrators were using SMS to activate their roles.

Answer

Create a Conditional Access policy that targets all cloud apps and requires authentication strength 'Phishing-resistant MFA'

Answer

In PIM, configure the role settings to require Azure MFA and set the authentication method to FIDO2

Answer

Configure authentication methods policy to allow only FIDO2 security keys for all users

Question 9

Your organization, Fabrikam, uses Microsoft Entra ID and has recently deployed Microsoft Copilot for Azure to assist administrators with troubleshooting. You need to ensure that access to Copilot for Azure is restricted to a specific group of security administrators and that all interactions are logged for compliance. You have created a security group named 'Copilot-Admins' and assigned it the appropriate role. However, you notice that users outside this group can still access Copilot for Azure. Additionally, you need to ensure that all Copilot interactions are stored in a Log Analytics workspace for analysis. What should you do?

Accepted Answer

Create a Conditional Access policy that requires the user to be a member of 'Copilot-Admins' and enable diagnostic settings for Copilot to send logs to Log Analytics. Conditional Access policies in Microsoft Entra ID can enforce access controls based on group membership, ensuring only members of 'Copilot-Admins' can access Copilot for Azure. Additionally, diagnostic settings for Copilot can be configured to stream all interaction logs to a Log Analytics workspace, meeting the compliance requirement for logging and analysis.

Answer

Configure PIM to require approval for Copilot access

Answer

Use Azure Policy to deny access to Copilot for users not in the group

Answer

Assign the 'Copilot-Admins' group the 'Reader' role to the Copilot service

Question 10

You are the security administrator for a company that uses Microsoft Entra ID. You need to configure a Conditional Access policy that applies to all users except the emergency break-glass accounts. The policy must require multi-factor authentication (MFA) when accessing the Azure portal from a location that is not trusted. What should you include in the policy?

Accepted Answer

Include all users, exclude break-glass accounts, require MFA for Azure portal, and use 'Locations' condition to specify untrusted locations. It includes all users, excludes the emergency break-glass accounts to ensure they remain accessible during outages, requires MFA for the Azure portal, and uses the 'Locations' condition to target untrusted locations. This configuration aligns with the requirement to enforce MFA only when accessing Azure portal from untrusted locations, while preserving access for break-glass accounts.

Answer

Include all users, require MFA for Azure portal, and exclude all administrators

Answer

Include break-glass accounts, require MFA for Azure portal, and block access from untrusted locations

Answer

Include all users, require MFA for Azure portal, and exclude break-glass accounts

Question 11

Your organization uses Microsoft Entra ID and needs to implement a policy that blocks all sign-ins from countries that are not approved. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is a feature of Microsoft Defender for Cloud Apps that integrates with Microsoft Entra ID Conditional Access policies to monitor and control access to cloud applications in real time. It enforces access controls based on user behavior (e.g., risky sign-ins) and device health (e.g., compliance status from Intune), allowing actions like blocking downloads or requiring session monitoring. This directly meets the requirement to monitor and control access based on user behavior and device health.

Answer

Microsoft Purview Information Protection

Answer

Cloud App Discovery

Answer

OAuth app policies

Question 12

Your company uses Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with company policies can access corporate resources. You have configured compliance policies in Intune. What additional step is required to enforce access control based on device compliance?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant. A is correct because Conditional Access in Azure AD is the policy engine that enforces access control decisions based on signals like device compliance. Even after Intune compliance policies are configured, you must create a Conditional Access policy that requires the device to be marked as compliant. This policy blocks or grants access to corporate resources (e.g., Exchange Online, SharePoint) based on the compliance state reported by Intune to Azure AD.

Answer

Enable certificate-based authentication for all devices

Answer

Deploy device configuration profiles to all devices

Answer

Configure app protection policies in Microsoft Defender for Cloud Apps

Question 13

You are a security administrator for a financial institution. You need to implement a solution that allows users to authenticate using biometrics and prevents password-based attacks. Which Microsoft Entra ID feature should you enable?

Accepted Answer

Passwordless authentication (FIDO2 or Windows Hello for Business). Passwordless authentication methods like FIDO2 and Windows Hello for Business eliminate the use of passwords entirely, thereby preventing password-based attacks such as brute force, phishing, and credential stuffing. Biometric verification (e.g., fingerprint or facial recognition) is a core component of these methods, meeting the requirement for biometric authentication. This aligns with the Zero Trust principle of reducing the attack surface by removing shared secrets.

Answer

Microsoft Entra ID Protection

Answer

Password hash synchronization

Answer

Azure Multi-Factor Authentication

Question 14

Which THREE of the following are valid methods to secure service principals in Microsoft Entra ID?

Accepted Answer

Use certificate-based credentials instead of client secrets. Certificate-based credentials are more secure than client secrets. Client secrets are static strings that can be leaked, stored in plaintext, or accidentally committed to source code. Certificates, when properly managed with private key protection and short lifetimes, provide stronger authentication through asymmetric cryptography and can be rotated automatically.

Answer

Assign the service principal to the Global Administrator role to monitor its activity

Answer

Enable Azure Multi-Factor Authentication for the service principal sign-in

Question 15

Which TWO of the following are required to implement a successful Just-In-Time (JIT) access strategy using Microsoft Entra Privileged Identity Management (PIM) for Azure resources?

Accepted Answer

Configure role settings to specify activation duration and require approval if needed. Configuring role settings in Microsoft Entra PIM, such as activation duration and requiring approval, is essential to control how and when eligible users activate their JIT access. These settings enforce security policies like time-bound activation and multi-step approval, which are core to a successful JIT strategy.

Answer

Enable Azure Multi-Factor Authentication for all users in the tenant

Answer

Create custom RBAC roles for the JIT access

Answer

Assign users as permanently active for the roles they need