AZ-500 Secure identity and access Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?

Accepted Answer

Configure a Conditional Access policy that requires that the device be marked as compliant. Option B is correct because Conditional Access policies can enforce device compliance requirements. Option A is incorrect because MFA alone does not enforce device compliance. Option C is incorrect because Identity Protection focuses on risk, not device state. Option D is incorrect because device registration does not enforce compliance checks.

Answer

Configure a device registration policy

Answer

Configure an Identity Protection policy for user risk

Answer

Configure a Conditional Access policy that requires multi-factor authentication

Question 2

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user accounts and enable self-service password reset (SSPR) for cloud users. You have set up Microsoft Entra Connect Sync. Which additional configuration is required to allow password writeback for SSPR?

Accepted Answer

Enable password writeback in Microsoft Entra Connect and assign Azure AD Premium licenses. Option C is correct because password writeback requires an Azure AD Premium license and the writeback feature enabled in Entra Connect. Option A is incorrect because password hash sync alone does not enable writeback. Option B is incorrect because PHS is not required for writeback. Option D is incorrect because Password Protection is a separate feature.

Answer

Configure pass-through authentication

Answer

Enable password hash synchronization

Answer

Install the Azure AD Password Protection proxy

Question 3

Your organization has Microsoft Entra ID P2 licenses. You want to automatically detect and respond to compromised identities by requiring MFA when a sign-in risk is medium or above. Which policy should you configure?

Accepted Answer

Configure an Identity Protection user risk policy to require MFA. Option A is correct because Identity Protection user risk policy can automatically trigger MFA based on risk level. Option B is incorrect because sign-in risk policy is for sign-in risk, not user risk. Option C is incorrect because Conditional Access is the foundation but the policy type is Identity Protection. Option D is incorrect because it requires user action.

Answer

Enable self-service password reset

Answer

Configure a Conditional Access policy with sign-in risk condition

Answer

Configure an Identity Protection sign-in risk policy

Question 4

Your organization uses Microsoft Entra ID. You need to manage access to a line-of-business application that supports SAML 2.0. The application should be integrated as an enterprise application in Entra ID. What steps must you take?

Accepted Answer

Create a new enterprise application as a non-gallery app, configure SAML, assign users, and test. Option C is correct because to integrate a line-of-business application that supports SAML 2.0 as an enterprise application in Microsoft Entra ID, you must create a new enterprise application using the 'Non-gallery application' option, configure SAML-based sign-on with the application's metadata, assign users or groups, and test the integration. This process allows you to define custom SAML attributes and claims specific to the application, which is necessary for non-gallery apps that are not pre-integrated.

Answer

Configure user consent settings for the application

Answer

Register the application in App Registrations and configure SAML

Answer

Add the application from the Azure AD gallery

Question 5

Your company has Microsoft Entra ID and uses Azure Bastion for secure VM access. You need to ensure that only administrators with PIM-activated roles can access the Bastion host. What should you configure?

Accepted Answer

Use a Conditional Access policy to require privileged access for the Azure Bastion application. Option B is correct because Bastion does not support Conditional Access directly, but you can use a Conditional Access policy targeting the Bastion service with a session control for privileged access. Option A is incorrect because Bastion does not support just-in-time access natively. Option C is incorrect because network policies are not granular enough. Option D is incorrect because RBAC alone does not enforce activation.

Answer

Configure Azure Bastion with just-in-time access

Answer

Assign the Bastion Reader role to administrators

Answer

Configure network security groups to restrict access to Bastion

Question 6

Your organization uses Microsoft Entra ID and needs to implement a policy that blocks all sign-ins from countries that are not approved. What should you configure?

Accepted Answer

Create a Conditional Access policy with a location condition set to block. A Conditional Access policy in Microsoft Entra ID allows you to define location conditions based on IP ranges, countries, or regions. By configuring the location condition to include all countries except the approved ones and setting the access control to 'Block access', you can effectively block sign-ins from non-approved countries. This is the native, policy-driven approach to enforce geographic restrictions without manual intervention.

Answer

Enable multi-factor authentication for all users

Answer

Review sign-in logs and manually block IPs

Answer

Configure an Identity Protection risk policy

Question 7

You are designing a privileged identity management strategy for Microsoft Entra ID. You need to ensure that eligible role assignments require approval from a designated group before activation. What configuration is required?

Accepted Answer

In PIM, configure the role settings to require approval and specify an approver group. Option C is correct because Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role settings to require approval for activation. By specifying an approver group, you ensure that eligible role assignments cannot be activated without explicit approval from designated members, enforcing a just-in-time (JIT) access control model.

Answer

Configure the role as eligible and set activation duration

Answer

Configure a Conditional Access policy with approval control

Answer

Create an access review for the role

Question 8

Your organization has Microsoft Entra ID and uses Microsoft Copilot for Microsoft 365. You need to ensure that Copilot interactions are logged and accessible for security investigations. What should you configure?

Accepted Answer

Ensure that auditing is enabled in Microsoft Purview to capture Copilot interactions. Option C is correct because Microsoft Copilot for Microsoft 365 interactions are audited through the Microsoft Purview audit log. Enabling auditing in Purview captures detailed records of Copilot prompts and responses, which are then accessible for security investigations via the Purview compliance portal or through the Office 365 Management Activity API. This is the designated mechanism for logging Copilot activity, as Copilot interactions are considered Microsoft 365 workload events.

Answer

Configure Microsoft Sentinel to collect Copilot logs via the Office 365 connector

Answer

Enable diagnostic settings in Azure Monitor to collect Copilot logs

Answer

Deploy Microsoft Defender for Cloud Apps to monitor Copilot usage

Question 9

You need to grant a group of users the ability to read Microsoft Entra ID sign-in logs in the Azure portal. Which role should you assign?

Accepted Answer

Reports Reader. The Reports Reader role is specifically designed to grant read-only access to monitoring data, including Microsoft Entra ID sign-in logs and audit logs, without granting broader read permissions to the entire directory. This role is the least-privileged option that directly meets the requirement to read sign-in logs in the Azure portal.

Answer

Security Reader

Answer

Global Reader

Answer

Global Administrator

Question 10

Which TWO actions should you take to implement a zero-trust identity model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Configure Privileged Identity Management to require approval for role activation. Options B and D are correct. B is correct because Conditional Access policies are a core component of zero-trust, verifying identity and device health. D is correct because PIM enforces just-in-time access, reducing standing privileges. A is incorrect because password expiration does not enhance zero-trust. C is incorrect because permanent role assignments oppose zero-trust. E is incorrect because synchronization alone does not enforce zero-trust.

Answer

Configure password expiration policies to force frequent changes

Answer

Enable password hash synchronization to Azure AD

Answer

Assign permanent Global Administrator roles to IT staff

Question 11

Which THREE components are part of Microsoft Entra Conditional Access? (Choose three.)

Accepted Answer

Conditions (sign-in risk, device state, location). Microsoft Entra Conditional Access is a policy-based engine that evaluates signals to enforce access decisions. The three core components are Assignments (who the policy applies to, such as users, groups, or workload identities), Conditions (the signals evaluated, like sign-in risk, device state, or location), and Access Controls (the enforcement actions, such as grant or block access, and session controls). These three elements form the complete structure of a Conditional Access policy.

Answer

Multi-factor authentication service settings

Answer

Role assignments

Question 12

Which TWO methods can be used to protect privileged accounts in Microsoft Entra ID? (Choose two.)

Accepted Answer

Create a Conditional Access policy that requires MFA for privileged roles. Option D is correct because requiring MFA for privileged roles via a Conditional Access policy adds a critical layer of security, ensuring that even if credentials are compromised, an attacker cannot authenticate without the second factor. This directly mitigates the risk of credential theft for high-privilege accounts. Option E is correct because Privileged Identity Management (PIM) provides just-in-time (JIT) access, reducing the attack surface by granting administrative roles only when needed and for a limited duration, with approval workflows and auditing.

Answer

Enable external identities for guest users

Answer

Enable self-service password reset for all users

Answer

Register all devices with Azure AD

Question 13

You are the security engineer for Contoso, a multinational company with 50,000 users in Microsoft Entra ID Premium P2. The company has a strict security policy requiring that all administrative actions be performed using just-in-time (JIT) access with approval, and that all privileged role activations be audited. Additionally, you need to ensure that Global Administrators are required to use phishing-resistant MFA (e.g., FIDO2 security keys) when activating their role. You have already configured Privileged Identity Management (PIM) for Azure AD roles. However, during a recent audit, you discovered that several Global Administrators were able to activate their role using only a text message (SMS) for MFA, violating the policy. You need to enforce the use of phishing-resistant MFA for all privileged role activations. What should you do?

Accepted Answer

Create a Conditional Access policy that targets the 'Azure AD Privileged Identity Management' app and requires authentication strength 'Phishing-resistant MFA'. Option C is correct because Privileged Identity Management (PIM) role activation is triggered by signing in to the Azure AD Privileged Identity Management application (the PIM blade or API). By creating a Conditional Access policy that targets this specific app and requires the 'Phishing-resistant MFA' authentication strength, you enforce FIDO2 or Windows Hello for Business during the activation step, regardless of the user's baseline MFA method. This directly addresses the audit finding that Global Administrators were using SMS to activate their roles.

Answer

Create a Conditional Access policy that targets all cloud apps and requires authentication strength 'Phishing-resistant MFA'

Answer

In PIM, configure the role settings to require Azure MFA and set the authentication method to FIDO2

Answer

Configure authentication methods policy to allow only FIDO2 security keys for all users

Question 14

Your organization, Fabrikam, uses Microsoft Entra ID and has recently deployed Microsoft Copilot for Azure to assist administrators with troubleshooting. You need to ensure that access to Copilot for Azure is restricted to a specific group of security administrators and that all interactions are logged for compliance. You have created a security group named 'Copilot-Admins' and assigned it the appropriate role. However, you notice that users outside this group can still access Copilot for Azure. Additionally, you need to ensure that all Copilot interactions are stored in a Log Analytics workspace for analysis. What should you do?

Accepted Answer

Create a Conditional Access policy that requires the user to be a member of 'Copilot-Admins' and enable diagnostic settings for Copilot to send logs to Log Analytics. Option B is correct because Conditional Access policies in Microsoft Entra ID can enforce access controls based on group membership, ensuring only members of 'Copilot-Admins' can access Copilot for Azure. Additionally, diagnostic settings for Copilot can be configured to stream all interaction logs to a Log Analytics workspace, meeting the compliance requirement for logging and analysis.

Answer

Configure PIM to require approval for Copilot access

Answer

Use Azure Policy to deny access to Copilot for users not in the group

Answer

Assign the 'Copilot-Admins' group the 'Reader' role to the Copilot service

Question 15

You are the security administrator for a company that uses Microsoft Entra ID. You need to configure a Conditional Access policy that applies to all users except the emergency break-glass accounts. The policy must require multi-factor authentication (MFA) when accessing the Azure portal from a location that is not trusted. What should you include in the policy?

Accepted Answer

Include all users, exclude break-glass accounts, require MFA for Azure portal, and use 'Locations' condition to specify untrusted locations. Option A is correct because it includes all users, excludes the emergency break-glass accounts to ensure they remain accessible during outages, requires MFA for the Azure portal, and uses the 'Locations' condition to target untrusted locations. This configuration aligns with the requirement to enforce MFA only when accessing Azure portal from untrusted locations, while preserving access for break-glass accounts.

Answer

Include all users, require MFA for Azure portal, and exclude all administrators

Answer

Include break-glass accounts, require MFA for Azure portal, and block access from untrusted locations

Answer

Include all users, require MFA for Azure portal, and exclude break-glass accounts