AZ-500 Secure identity and access Practice Test 8 — 15 Questions

Question 1

You have configured the Conditional Access policy shown in the exhibit. Users report that they can still access Exchange Online using legacy authentication protocols. What is the most likely reason?

Accepted Answer

The policy state is set to reporting mode. The policy state is set to 'Report-only' (reporting mode), which means the Conditional Access policy is evaluated but not enforced. Users can still access Exchange Online using legacy authentication because the policy only logs the outcome without blocking access. To enforce the block, the policy state must be set to 'On'.

Answer

The policy should use 'Require MFA' instead of 'Block'

Answer

The policy does not include the correct client app types

Answer

The policy should include 'mobileAppsAndDesktopClients' instead

Question 2

You need to ensure that external users who are invited to your Microsoft Entra ID tenant via B2B collaboration can only access a specific SaaS application. What should you configure?

Accepted Answer

Create a Conditional Access policy targeting the SaaS application and apply it to 'Guest or external users'.. A Conditional Access policy can be scoped to a specific SaaS application and applied to 'Guest or external users'. This ensures that only invited B2B collaboration users are subject to the access control for that application, while all other users and apps remain unaffected. The policy enforces authentication and authorization rules exclusively for the targeted SaaS app and guest identity type.

Answer

Configure SharePoint Online external sharing settings.

Answer

Create a Conditional Access policy targeting 'All cloud apps' and include guest users.

Answer

Use Microsoft Entra application proxy.

Question 3

You need to ensure that when a user's role in Microsoft Entra ID is changed (e.g., from User to Global Administrator), the change is approved by a manager before it takes effect. Additionally, you need to enforce just-in-time (JIT) access for that role. What should you use?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) for the role with approval required and JIT activation.. Microsoft Entra Privileged Identity Management (PIM) is the correct choice because it is the only service that provides just-in-time (JIT) role activation with an approval workflow, allowing you to require a manager's approval before a role assignment becomes active. In PIM, you configure the role's settings to require approval for activation and set the maximum activation duration, so the user is eligible but not permanently assigned until approved. Access reviews (B) only recertify existing assignments periodically and do not gate activation or provide JIT. Conditional Access (C) controls access to resources based on signals like user, device, and location, but it cannot require manager approval for a directory role assignment. Azure RBAC custom roles (D) scope permissions on Azure resources but do not provide approval workflows or JIT activation for Microsoft Entra ID roles.

Answer

Use Microsoft Entra access reviews to review role assignments monthly.

Answer

Create a Conditional Access policy requiring manager approval for role assignment.

Answer

Assign the role via Azure RBAC with a custom role.

Question 4

Your organization uses Microsoft Entra ID and wants to implement a secure passwordless authentication strategy. Which TWO solutions can be used natively in Microsoft Entra ID for passwordless sign-in?

Accepted Answer

FIDO2 security keys. FIDO2 security keys are a native passwordless authentication method in Microsoft Entra ID, leveraging the WebAuthn standard to provide phishing-resistant, hardware-based credential verification. They eliminate passwords entirely by using public-key cryptography, where the private key never leaves the device, ensuring strong security against credential theft.

Answer

Microsoft Authenticator app with OTP

Answer

Third-party password managers

Answer

Duo Security push notifications

Question 5

You are designing a security baseline for Microsoft Entra ID. Which THREE settings are recommended by Microsoft as part of the identity security baseline?

Accepted Answer

Enable risk-based Conditional Access policies. Risk-based Conditional Access policies are a core recommendation in the Microsoft identity security baseline. These policies automatically respond to detected user or sign-in risks (e.g., anonymous IP, leaked credentials) by requiring MFA or blocking access, aligning with the Zero Trust principle of continuous verification. Microsoft explicitly includes risk-based policies in its security baseline to proactively mitigate identity threats.

Answer

Allow self-service group management for all users

Answer

Set sign-in session timeout to 8 hours

Question 6

Your company wants to implement a least-privilege model for administrative roles in Microsoft Entra ID. Which TWO features should you use?

Accepted Answer

Custom roles in Microsoft Entra ID. Custom roles in Microsoft Entra ID (option B) are correct because they let you define a precise set of directory permissions (for example, scoping actions like microsoft.directory/users/read) so administrators get only the access they need, which is the essence of least privilege. Privileged Identity Management (option E) is also correct because it enforces just-in-time activation of eligible directory roles with approval, MFA, and time-bound assignments, eliminating standing privileged access. Azure RBAC roles (option A) govern Azure resource-plane access, not Microsoft Entra ID administrative roles, so they don't address the directory role model in scope. Conditional Access policies (option C) control sign-in conditions and access to resources but do not define or limit administrative role permissions. Microsoft Entra B2B external identities (option D) is about collaborating with external users, not about constraining administrative privileges.

Answer

Azure RBAC roles

Answer

Conditional Access policies

Answer

Microsoft Entra B2B external identities

Question 7

Your organization wants to ensure that users accessing Office 365 from outside the corporate network must use MFA. What is the most efficient way to enforce this?

Accepted Answer

Create a Conditional Access policy for Office 365 with location condition and require MFA.. It specifically targets Office 365 cloud apps and uses the location condition to restrict MFA enforcement to access from outside the corporate network. This is the most efficient approach as it applies only to the relevant application and network location, minimizing user friction while meeting the requirement exactly.

Answer

Enable MFA for all users in Microsoft Entra ID.

Answer

Create a Conditional Access policy for all cloud apps with location condition.

Answer

Use Conditional Access with device compliance condition.

Question 8

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users accessing sensitive data from unmanaged devices are required to use a compliant device. What should you configure?

Accepted Answer

Configure a Conditional Access policy that requires that the device be marked as compliant. A Conditional Access policy that requires the device to be marked as compliant ensures that only devices meeting your organization's compliance standards (e.g., antivirus enabled, encryption active) can access sensitive data. This policy evaluates device compliance status reported by Microsoft Intune or another MDM provider, and blocks or grants access based on that status. It directly addresses the requirement to enforce compliant device access from unmanaged devices.

Answer

Configure a device registration policy

Answer

Configure an Identity Protection policy for user risk

Answer

Configure a Conditional Access policy that requires multi-factor authentication

Question 9

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user accounts and enable self-service password reset (SSPR) for cloud users. You have set up Microsoft Entra Connect Sync. Which additional configuration is required to allow password writeback for SSPR?

Accepted Answer

Enable password writeback in Microsoft Entra Connect and assign Azure AD Premium licenses. Password writeback requires both the feature to be enabled in Microsoft Entra Connect (via the synchronization settings) and Microsoft Entra ID Premium licenses (P1 or P2) assigned to users. Without the license, the SSPR writeback functionality is not available, even if the feature is enabled in the sync tool. This combination allows password changes from the cloud to be written back to on-premises Active Directory.

Answer

Configure pass-through authentication

Answer

Enable password hash synchronization

Answer

Install the Azure AD Password Protection proxy

Question 10

Your organization uses Microsoft Entra ID. You need to manage access to a line-of-business application that supports SAML 2.0. The application should be integrated as an enterprise application in Entra ID. What steps must you take?

Accepted Answer

Create a new enterprise application as a non-gallery app, configure SAML, assign users, and test. To integrate a line-of-business application that supports SAML 2.0 as an enterprise application in Microsoft Entra ID, you must create a new enterprise application using the 'Non-gallery application' option, configure SAML-based sign-on with the application's metadata, assign users or groups, and test the integration. This process allows you to define custom SAML attributes and claims specific to the application, which is necessary for non-gallery apps that are not pre-integrated.

Answer

Configure user consent settings for the application

Answer

Register the application in App Registrations and configure SAML

Answer

Add the application from the Azure AD gallery

Question 11

Your organization uses Microsoft Entra ID and needs to implement a policy that blocks all sign-ins from countries that are not approved. What should you configure?

Accepted Answer

Create a Conditional Access policy with a location condition set to block. A Conditional Access policy in Microsoft Entra ID allows you to define location conditions based on IP ranges, countries, or regions. By configuring the location condition to include all countries except the approved ones and setting the access control to 'Block access', you can effectively block sign-ins from non-approved countries. This is the native, policy-driven approach to enforce geographic restrictions without manual intervention.

Answer

Enable multi-factor authentication for all users

Answer

Review sign-in logs and manually block IPs

Answer

Configure an Identity Protection risk policy

Question 12

You are designing a privileged identity management strategy for Microsoft Entra ID. You need to ensure that eligible role assignments require approval from a designated group before activation. What configuration is required?

Accepted Answer

In PIM, configure the role settings to require approval and specify an approver group. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role settings to require approval for activation. By specifying an approver group, you ensure that eligible role assignments cannot be activated without explicit approval from designated members, enforcing a just-in-time (JIT) access control model.

Answer

Configure the role as eligible and set activation duration

Answer

Configure a Conditional Access policy with approval control

Answer

Create an access review for the role

Question 13

Your organization has Microsoft Entra ID and uses Microsoft Copilot for Microsoft 365. You need to ensure that Copilot interactions are logged and accessible for security investigations. What should you configure?

Accepted Answer

Ensure that auditing is enabled in Microsoft Purview to capture Copilot interactions. Microsoft Copilot for Microsoft 365 interactions are audited through the Microsoft Purview audit log. Enabling auditing in Purview captures detailed records of Copilot prompts and responses, which are then accessible for security investigations via the Purview compliance portal or through the Office 365 Management Activity API. This is the designated mechanism for logging Copilot activity, as Copilot interactions are considered Microsoft 365 workload events.

Answer

Configure Microsoft Sentinel to collect Copilot logs via the Office 365 connector

Answer

Enable diagnostic settings in Azure Monitor to collect Copilot logs

Answer

Deploy Microsoft Defender for Cloud Apps to monitor Copilot usage

Question 14

Which TWO actions should you take to implement a zero-trust identity model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Configure Privileged Identity Management to require approval for role activation. Privileged Identity Management (PIM) enforces just-in-time (JIT) access by requiring approval for role activation, which aligns with the zero-trust principle of 'never trust, always verify' by eliminating standing privileges. Option E is correct because Conditional Access policies that require MFA and device compliance enforce continuous verification of user identity and device health before granting access, a core tenet of zero-trust identity.

Answer

Configure password expiration policies to force frequent changes

Answer

Enable password hash synchronization to Azure AD

Answer

Assign permanent Global Administrator roles to IT staff

Question 15

Which THREE components are part of Microsoft Entra Conditional Access? (Choose three.)

Accepted Answer

Conditions (sign-in risk, device state, location). Conditional Access in Microsoft Entra is built on an if-then policy model, and option B correctly identifies the 'if' side: Conditions such as sign-in risk, user risk, device state/platform, location, and client app that determine when a policy applies. Option C correctly identifies the 'then' side: Access controls, which include grant controls (for example require MFA or compliant device), block controls, and session controls (such as app-enforced restrictions or sign-in frequency). Option E correctly identifies Assignments, which scope the policy to specific users, groups, directory roles, or workload identities (service principals) as the target of the policy. Option A is not a component of Conditional Access; MFA is one possible grant control configured within a policy, not a standalone Conditional Access component. Option D is not a Conditional Access component either; role assignments belong to Entra RBAC and govern administrative permissions, not policy evaluation.

Answer

Multi-factor authentication service settings

Answer

Role assignments