AZ-500 Secure identity and access Practice Test 8 — 15 Questions

Question 1

A company is implementing Privileged Identity Management (PIM) in Microsoft Entra ID for Azure resources. The security team wants to ensure that all privileged role activations require approval and are logged. They also want to require Azure MFA during activation. However, they notice that some users are able to activate roles without approval. What is the most likely cause?

Accepted Answer

The role settings for approval are not configured at the resource scope, and the users are using inherited settings from a management group. Option D is correct because PIM role settings for Azure resources can be configured at the management group, subscription, or resource group scope. If approval is required only at the subscription scope but users activate roles at a resource group scope that inherits from a management group where approval is not configured, the activation will proceed without approval. This is a common misconfiguration where the approval requirement is not applied at the correct scope.

Answer

Users have permanent eligible assignments that bypass approval

Answer

The audit log is not enabled for PIM

Answer

Users are assigned the role directly instead of through eligibility

Question 2

Your organization uses Microsoft Entra ID and has deployed Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud applications based on user behavior and device health. Which feature should you use?

Accepted Answer

Conditional Access App Control. Option A is correct because Conditional Access App Control in Defender for Cloud Apps allows session-level monitoring and control based on user and device conditions. Option B is wrong because Cloud App Discovery only discovers shadow IT. Option C is wrong because OAuth app policies govern third-party app permissions. Option D is wrong because Information Protection is for data classification and labeling.

Answer

Microsoft Purview Information Protection

Answer

Cloud App Discovery

Answer

OAuth app policies

Question 3

You are managing a Microsoft Entra ID tenant with external collaboration enabled. You need to restrict external user access to only the groups and applications they are explicitly granted. You also want to prevent external users from seeing other external users in the tenant directory. Which settings should you configure?

Accepted Answer

Set 'Guest user access restrictions' to 'Guest users have limited access...' and configure 'External collaboration settings' to restrict external user visibility. Option D is correct because collaboration restrictions limit external user visibility to groups and apps they are assigned, and external users can be restricted from seeing other users. Option A is wrong because guest user access restrictions control permissions but not visibility. Option B is wrong because cross-tenant access settings are for inbound/outbound trust. Option C is wrong because entitlement management is for access packages.

Answer

Use Microsoft Entra entitlement management to create access packages for external users

Answer

Configure cross-tenant access settings to block all external collaboration

Answer

Set 'Guest user access restrictions' to 'Guest users have same access as members'

Question 4

Your company uses Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with company policies can access corporate resources. You have configured compliance policies in Intune. What additional step is required to enforce access control based on device compliance?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant. Option B is correct because Conditional Access policies in Entra ID enforce access based on device compliance status. Option A is wrong because device configuration profiles apply settings but do not enforce access. Option C is wrong because app protection policies manage data within apps. Option D is wrong because certificates are for authentication, not compliance enforcement.

Answer

Enable certificate-based authentication for all devices

Answer

Deploy device configuration profiles to all devices

Answer

Configure app protection policies in Microsoft Defender for Cloud Apps

Question 5

You are a security administrator for a financial institution. You need to implement a solution that allows users to authenticate using biometrics and prevents password-based attacks. Which Microsoft Entra ID feature should you enable?

Accepted Answer

Passwordless authentication (FIDO2 or Windows Hello for Business). Option A is correct because Passwordless authentication methods like FIDO2 security keys or Windows Hello for Business eliminate passwords and support biometrics. Option B is wrong because password hash sync still uses passwords. Option C is wrong because MFA requires something you know (password) and something you have, but still uses passwords. Option D is wrong because Identity Protection detects risks but does not eliminate passwords.

Answer

Microsoft Entra ID Protection

Answer

Password hash synchronization

Answer

Azure Multi-Factor Authentication

Question 6

Which THREE of the following are valid methods to secure service principals in Microsoft Entra ID?

Accepted Answer

Use certificate-based credentials instead of client secrets. A, C, and E are correct. Option A is correct because certificate-based credentials are more secure than client secrets. Option B is wrong because managed identities are not 'assigning roles to a service principal' but rather an identity for Azure resources. Option D is wrong because enabling MFA for service principals is not supported; service principals are non-interactive. Option E is correct because Conditional Access for workload identities can restrict service principal access based on conditions.

Answer

Assign the service principal to the Global Administrator role to monitor its activity

Answer

Enable Azure Multi-Factor Authentication for the service principal sign-in

Question 7

Which TWO of the following are required to implement a successful Just-In-Time (JIT) access strategy using Microsoft Entra Privileged Identity Management (PIM) for Azure resources?

Accepted Answer

Configure role settings to specify activation duration and require approval if needed. Option C is correct because configuring role settings in Microsoft Entra PIM, such as activation duration and requiring approval, is essential to control how and when eligible users activate their JIT access. These settings enforce security policies like time-bound activation and multi-step approval, which are core to a successful JIT strategy.

Answer

Enable Azure Multi-Factor Authentication for all users in the tenant

Answer

Create custom RBAC roles for the JIT access

Answer

Assign users as permanently active for the roles they need

Question 8

Which THREE of the following are recommended practices for securing administrative accounts in Microsoft Entra ID?

Accepted Answer

Use separate administrative accounts for day-to-day administration. A, B, and E are correct. Option A is correct because break-glass accounts should be excluded from MFA to ensure access during emergencies. Option B is correct because using dedicated admin accounts reduces risk. Option C is wrong because registering all admins for self-service password reset is not a security practice for admin accounts. Option D is wrong because permanent assignment defeats JIT. Option E is correct because Conditional Access should require MFA for admins.

Answer

Register all administrative accounts for self-service password reset (SSPR)

Answer

Assign Global Administrator role permanently to all IT staff

Question 9

Refer to the exhibit. You are reviewing the external collaboration settings for your Microsoft Entra ID tenant. Based on the exhibit, which of the following statements is true about the current configuration?

Accepted Answer

External users will receive a one-time passcode via email when they are invited.. Option C is correct because enableB2BEmailOneTimePasscode is true, allowing guests to authenticate using a one-time passcode if they cannot use other identity providers. Option A is wrong because allowInvitationsFrom is set to 'adminsAndGuestInviters', meaning guests can also invite. Option B is wrong because allowEmailVerifiedUsersToJoinOrganization is false, so email-verified users cannot join automatically. Option D is wrong because enableB2BDirectConnect is false, so Teams external access is not enabled.

Answer

Only administrators can invite external users.

Answer

B2B direct connect is enabled for Teams external access.

Answer

Users with email-verified accounts can join the organization automatically.

Question 10

You are the security architect for a large enterprise that uses Microsoft Entra ID with 50,000 users. The company recently adopted a cloud-first strategy and is migrating on-premises applications to Azure. You need to design a secure identity and access solution that meets the following requirements:

- All access to cloud applications must be authenticated using modern authentication protocols.
- Legacy authentication protocols (such as POP3, IMAP4, SMTP, and basic authentication) must be blocked.
- Users must be required to use multi-factor authentication (MFA) when accessing any application from outside the corporate network.
- Administrative access to Azure resources must be time-bound and require approval.
- The solution must minimize user friction for internal users on the corporate network.
- All sign-in risks must be detected and automatically remediated.

You have deployed Microsoft Entra ID P2 licensing and configured Microsoft Defender for Cloud Apps. Which of the following is the most appropriate combination of actions to meet all requirements?

Accepted Answer

Create a Conditional Access policy to block legacy authentication and require MFA for all users when accessing from outside the corporate network. Exclude trusted locations from MFA. Use PIM with approval for admin roles. Enable Identity Protection for risk detection and automatic remediation.. Option B is correct because it addresses all requirements: Conditional Access policies block legacy auth, require MFA from outside, and include trusted locations for no MFA. PIM provides time-bound admin access with approval. Identity Protection detects and remediates risks. Option A is wrong because Security defaults would block legacy auth but enforce MFA globally, causing friction for internal users. Option C is wrong because allowing legacy auth for some users violates the requirement to block all legacy auth. Option D is wrong because device compliance does not block legacy auth, and PIM without approval does not meet the approval requirement.

Answer

Enable Security defaults for all users and configure risk-based Conditional Access policies for admin roles. Use PIM for time-bound access.

Answer

Configure device compliance policies in Intune and require compliant devices for access. Use PIM with time-bound roles but without approval. Enable Identity Protection for risk detection.

Answer

Create a Conditional Access policy to require MFA for all cloud apps and allow legacy authentication for non-interactive service accounts. Use PIM without approval for admin roles.

Question 11

You are a security administrator for a healthcare organization that uses Microsoft Entra ID and Microsoft 365. The organization must comply with HIPAA regulations, which require that access to protected health information (PHI) is logged and monitored. You need to configure access reviews for all users who have access to SharePoint Online sites containing PHI. The reviews must occur quarterly and be assigned to the respective site owners. Additionally, you need to ensure that inactive guest accounts are automatically removed after 90 days of inactivity. Which actions should you take?

Accepted Answer

Create an access review for the security group containing users with access to PHI sites. Assign reviewers as group owners (site owners). Set frequency to quarterly. Configure external collaboration settings to automatically remove guest accounts that have not signed in for 90 days.. Option A is correct because access reviews can be configured for groups and applications, assigned to site owners, and set to quarterly frequency. Inactive guest cleanup is configured in Entra ID external settings. Option B is wrong because PIM access reviews are for privileged roles, not general access to SharePoint sites. Option C is wrong because Identity Protection does not manage access reviews. Option D is wrong because manual removal of guests is not automated and does not scale.

Answer

Enable Microsoft Entra ID Protection to automatically block guest accounts after 90 days of inactivity. Create manual access reviews for each site using PowerShell.

Answer

Use Microsoft Purview to create an auto-labeling policy for PHI data. Assign site owners as reviewers and manually remove inactive guests.

Answer

Create a PIM access review for the SharePoint administrator role. Set frequency to quarterly. Configure Microsoft Entra ID to automatically delete guest accounts after 90 days of inactivity.

Question 12

You are the identity security engineer for a multinational company that uses Microsoft Entra ID. The company has recently experienced a security breach where an attacker compromised a non-administrator user account and then used that account to enumerate all users in the tenant. The attacker then attempted to brute-force passwords for high-privilege accounts. To prevent such attacks, management requires the following:

- Users with administrative roles must use phishing-resistant MFA.
- Any sign-in from a risky IP address must be blocked.
- Users must not be able to enumerate directory information via the Graph API unless they have a specific role.
- The solution should be implemented using built-in Microsoft Entra ID features.

What should you configure?

Accepted Answer

Configure Conditional Access policy with authentication strength for admins requiring phishing-resistant MFA. Configure Identity Protection sign-in risk policy to block risky sign-ins. Restrict access to the Graph API by requiring a specific role assignment.. Option C is correct. Phishing-resistant MFA can be enforced via Conditional Access with authentication strength. Sign-in risk policies in Identity Protection can block sign-ins from risky IPs. To prevent directory enumeration, you can restrict access to the Graph API using Conditional Access or application permissions. Option A is wrong because Security defaults enforce MFA but do not block all enumeration. Option B is wrong because PIM does not block enumeration. Option D is wrong because access reviews do not block enumeration.

Answer

Enable Security defaults and configure Identity Protection user risk policy to block high-risk users.

Answer

Configure Conditional Access policy for admins to require phishing-resistant MFA. Use PIM to require approval. Enable Identity Protection sign-in risk policy.

Answer

Configure PIM for all admin roles. Create access reviews for all users. Enable Identity Protection to detect risky sign-ins.

Question 13

You work for a software development company that uses GitHub Enterprise and Microsoft Entra ID for identity management. Developers need to access Azure resources from their CI/CD pipelines. You need to configure secure authentication for these service principals used in pipelines. The requirements are:

- No client secrets should be used because they can be leaked.
- The authentication method must be automatically rotated.
- The service principal must have access only to a specific resource group.
- You need to monitor and alert if the service principal is used outside of the expected geographic region.

Which of the following is the most appropriate solution?

Accepted Answer

Use a system-assigned managed identity for the Azure resource running the pipeline. Assign the managed identity the Contributor role at the resource group scope. Configure Conditional Access for workload identities to block sign-ins from unexpected geographic regions.. Option B is correct. Managed identities for Azure resources eliminate secrets and are automatically rotated. They can be scoped to a resource group via RBAC. Conditional Access for workload identities can restrict access based on location. Option A is wrong because certificate-based authentication still requires managing certificates. Option C is wrong because OAuth 2.0 with client credentials uses client secrets. Option D is wrong because PIM is for user identities, not workload identities.

Answer

Create a service principal with a certificate-based credential. Assign the service principal the Contributor role at the resource group scope. Use a custom script to rotate the certificate monthly.

Answer

Use a user-assigned managed identity and configure PIM to require approval for each pipeline run. Assign the identity the Contributor role at the resource group scope.

Answer

Create a service principal and use OAuth 2.0 client credentials grant with a client secret stored in Azure Key Vault. Assign the service principal the Contributor role at the resource group scope. Use Key Vault access policies to control secret access.

Question 14

You are the security administrator for a company that is integrating a third-party SaaS application (AppA) with Microsoft Entra ID for single sign-on (SSO). The application requires the following permissions: read all users, read all groups, and sign in users. The security team is concerned about over-privileged applications. They require that:

- The application must not be able to read users or groups without an admin's explicit consent.
- Users should be able to sign in to the application without admin consent for basic profile access.
- Admin consent must be granted only for the minimal permissions required.
- You must be able to review and audit all permissions granted to applications.

What should you do?

Accepted Answer

In Microsoft Entra ID, configure user consent settings to require admin consent for permissions classified as 'high risk' (e.g., User.Read.All, Group.Read.All). Allow user consent for low-risk permissions. Grant admin consent for the required Graph permissions.. Option A is correct because you can configure user consent settings to require admin consent for high-risk permissions (User.Read.All, Group.Read.All) while allowing user consent for low-risk permissions like profile access. Admin consent must be granted for Graph permissions. Option B is wrong because blocking all user consent would prevent users from signing in for basic profile. Option C is wrong because allowing all user consent would allow users to consent to high-risk permissions. Option D is wrong because blocking all OAuth apps is too restrictive.

Answer

Allow user consent for all permissions. Grant admin consent for Graph permissions.

Answer

Block all user consent and require admin consent for all permissions. Grant admin consent for all required permissions.

Answer

Block all OAuth 2.0 applications and use SAML-based SSO instead.

Question 15

An organization requires that all Azure SQL Database connections from non-corporate networks must be blocked unless initiated through Azure Bastion. Which Microsoft Entra ID Conditional Access policy setting should be configured?

Accepted Answer

Block access. Option A is correct because the requirement is to block all Azure SQL Database connections from non-corporate networks unless they go through Azure Bastion. In Microsoft Entra ID Conditional Access, the 'Block access' control explicitly denies authentication requests that match the policy conditions. By configuring a policy that targets the Azure SQL Database application and includes conditions for non-corporate network locations, the 'Block access' grant effectively enforces the restriction, allowing only connections routed through Azure Bastion (which originates from a corporate network or a trusted IP).

Answer

Require sign-in frequency

Answer

Require multifactor authentication (MFA)

Answer

Require device to be marked as compliant