AZ-500 Secure identity and access Practice Test 9 — 15 Questions

Question 1

Which TWO methods can be used to protect privileged accounts in Microsoft Entra ID? (Choose two.)

Accepted Answer

Create a Conditional Access policy that requires MFA for privileged roles. Option D is correct because a Conditional Access policy that requires multifactor authentication for privileged roles enforces an additional authentication factor specifically when members of highly privileged directory roles (such as Global Administrator) sign in, directly reducing the risk of credential compromise for those accounts. Option E is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time role activation, so privileged roles are not permanently assigned; users must activate eligibility with justification, approval, and MFA, and access expires after a set duration, which minimizes standing administrative access. Option A is not correct because enabling external identities for guest users governs B2B collaboration and does not protect privileged administrative accounts. Option B is not correct because self-service password reset for all users is a general account-recovery feature and does not specifically secure privileged roles. Option C is not correct because registering devices with Microsoft Entra ID (now Microsoft Entra ID) supports device-based Conditional Access but by itself does not protect privileged accounts.

Answer

Enable external identities for guest users

Answer

Enable self-service password reset for all users

Answer

Register all devices with Azure AD

Question 2

You are the security administrator for a company that uses Microsoft Entra ID. You need to configure a Conditional Access policy that applies to all users except the emergency break-glass accounts. The policy must require multi-factor authentication (MFA) when accessing the Azure portal from a location that is not trusted. What should you include in the policy?

Accepted Answer

Include all users, exclude break-glass accounts, require MFA for Azure portal, and use 'Locations' condition to specify untrusted locations. It includes all users, excludes the emergency break-glass accounts to ensure they remain accessible during outages, requires MFA for the Azure portal, and uses the 'Locations' condition to target untrusted locations. This configuration aligns with the requirement to enforce MFA only when accessing Azure portal from untrusted locations, while preserving access for break-glass accounts.

Answer

Include all users, require MFA for Azure portal, and exclude all administrators

Answer

Include break-glass accounts, require MFA for Azure portal, and block access from untrusted locations

Answer

Include all users, require MFA for Azure portal, and exclude break-glass accounts

Question 3

Your organization uses Microsoft Entra ID and has deployed Microsoft Defender for Cloud Apps. You need to monitor and control access to cloud applications based on user behavior and device health. Which feature should you use?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is a feature of Microsoft Defender for Cloud Apps that integrates with Microsoft Entra ID Conditional Access policies to monitor and control access to cloud applications in real time. It enforces access controls based on user behavior (e.g., risky sign-ins) and device health (e.g., compliance status from Intune), allowing actions like blocking downloads or requiring session monitoring. This directly meets the requirement to monitor and control access based on user behavior and device health.

Answer

Microsoft Purview Information Protection

Answer

Cloud App Discovery

Answer

OAuth app policies

Question 4

Your company uses Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with company policies can access corporate resources. You have configured compliance policies in Intune. What additional step is required to enforce access control based on device compliance?

Accepted Answer

Create a Conditional Access policy that requires device to be marked as compliant. A is correct because Conditional Access in Microsoft Entra ID is the policy engine that enforces access control decisions based on signals like device compliance. Even after Intune compliance policies are configured, you must create a Conditional Access policy that requires the device to be marked as compliant. This policy blocks or grants access to corporate resources (e.g., Exchange Online, SharePoint) based on the compliance state reported by Intune to Microsoft Entra ID.

Answer

Enable certificate-based authentication for all devices

Answer

Deploy device configuration profiles to all devices

Answer

Configure app protection policies in Microsoft Defender for Cloud Apps

Question 5

You are a security administrator for a financial institution. You need to implement a solution that allows users to authenticate using biometrics and prevents password-based attacks. Which Microsoft Entra ID feature should you enable?

Accepted Answer

Passwordless authentication (FIDO2 or Windows Hello for Business). Passwordless authentication methods like FIDO2 and Windows Hello for Business eliminate the use of passwords entirely, thereby preventing password-based attacks such as brute force, phishing, and credential stuffing. Biometric verification (e.g., fingerprint or facial recognition) is a core component of these methods, meeting the requirement for biometric authentication. This aligns with the Zero Trust principle of reducing the attack surface by removing shared secrets.

Answer

Microsoft Entra ID Protection

Answer

Password hash synchronization

Answer

Azure Multi-Factor Authentication

Question 6

Which THREE of the following are valid methods to secure service principals in Microsoft Entra ID?

Accepted Answer

Use certificate-based credentials instead of client secrets. Option A is correct because certificate-based credentials are a more secure alternative to client secrets for service principals; the public key is registered in Microsoft Entra ID and the private key is held by the app, so no shared secret is transmitted or stored, reducing the risk of credential theft. Option C is correct because Conditional Access for workload identities is a policy engine specifically designed to evaluate service principal sign-ins and can block or restrict them based on conditions such as location, risk, or IP range, which helps protect non-human identities. Option E is correct because Managed Identities for Azure resources let Azure create and rotate the service principal's credentials automatically, eliminating the need to store and manage secrets or certificates in code or configuration. Option B is not appropriate because assigning a service principal the Global Administrator role grants excessive, unnecessary privileges and does not secure the principal; it increases risk. Option D is not valid because Azure Multi-Factor Authentication applies to interactive user sign-ins and cannot be enforced for a service principal, which authenticates non-interactively with secrets, certificates, or federated credentials.

Answer

Assign the service principal to the Global Administrator role to monitor its activity

Answer

Enable Azure Multi-Factor Authentication for the service principal sign-in

Question 7

Which TWO of the following are required to implement a successful Just-In-Time (JIT) access strategy using Microsoft Entra Privileged Identity Management (PIM) for Azure resources?

Accepted Answer

Configure role settings to specify activation duration and require approval if needed. Option C is correct because PIM role settings define the activation parameters that make access just-in-time, such as maximum activation duration, whether approval is required, and whether justification or MFA is needed at activation; without configuring these settings, eligible assignments would not enforce time-bound, controlled activation. Option D is correct because JIT access in PIM for Azure resources requires users to be assigned as eligible for the Azure RBAC roles they need, so they can activate the role only when required rather than holding standing access. Option A is not required for the JIT strategy itself, since MFA can be enforced as a role setting at activation rather than mandating MFA for all tenant users. Option B is not required because PIM works with built-in Azure RBAC roles and custom roles are not a prerequisite for JIT access. Option E is incorrect because permanently active assignments provide standing access, which is the opposite of just-in-time access.

Answer

Enable Azure Multi-Factor Authentication for all users in the tenant

Answer

Create custom RBAC roles for the JIT access

Answer

Assign users as permanently active for the roles they need

Question 8

You are the security architect for a large enterprise that uses Microsoft Entra ID with 50,000 users. The company recently adopted a cloud-first strategy and is migrating on-premises applications to Azure. You need to design a secure identity and access solution that meets the following requirements:

- All access to cloud applications must be authenticated using modern authentication protocols.
- Legacy authentication protocols (such as POP3, IMAP4, SMTP, and basic authentication) must be blocked.
- Users must be required to use multi-factor authentication (MFA) when accessing any application from outside the corporate network.
- Administrative access to Azure resources must be time-bound and require approval.
- The solution must minimize user friction for internal users on the corporate network.
- All sign-in risks must be detected and automatically remediated.

You have deployed Microsoft Entra ID P2 licensing and configured Microsoft Defender for Cloud Apps. Which of the following is the most appropriate combination of actions to meet all requirements?

Accepted Answer

Create a Conditional Access policy to block legacy authentication and require MFA for all users when accessing from outside the corporate network. Exclude trusted locations from MFA. Use PIM with approval for admin roles. Enable Identity Protection for risk detection and automatic remediation.. Option D is correct because it directly satisfies every stated requirement: a Conditional Access policy blocking legacy authentication eliminates POP3, IMAP4, SMTP, and basic authentication; requiring MFA for all users outside the corporate network with trusted locations excluded minimizes friction for internal users; PIM with approval provides time-bound, approved administrative access to Azure resources; and Microsoft Entra ID Protection (included with Entra ID P2) detects sign-in risk and enables automatic remediation via risk-based Conditional Access. Option A is wrong because Security defaults cannot enforce the granular legacy-auth blocking, trusted-location MFA exclusions, or risk-based remediation required here, and it does not scope MFA by network location. Option B is wrong because it omits blocking legacy authentication and omits approval for PIM activation, and device compliance alone does not meet the MFA-from-outside requirement. Option C is wrong because it explicitly allows legacy authentication for service accounts and uses PIM without approval, violating two requirements.

Answer

Enable Security defaults for all users and configure risk-based Conditional Access policies for admin roles. Use PIM for time-bound access.

Answer

Configure device compliance policies in Intune and require compliant devices for access. Use PIM with time-bound roles but without approval. Enable Identity Protection for risk detection.

Answer

Create a Conditional Access policy to require MFA for all cloud apps and allow legacy authentication for non-interactive service accounts. Use PIM without approval for admin roles.

Question 9

You are the identity security engineer for a multinational company that uses Microsoft Entra ID. The company has recently experienced a security breach where an attacker compromised a non-administrator user account and then used that account to enumerate all users in the tenant. The attacker then attempted to brute-force passwords for high-privilege accounts. To prevent such attacks, management requires the following:

- Users with administrative roles must use phishing-resistant MFA.
- Any sign-in from a risky IP address must be blocked.
- Users must not be able to enumerate directory information via the Graph API unless they have a specific role.
- The solution should be implemented using built-in Microsoft Entra ID features.

What should you configure?

Accepted Answer

Configure Conditional Access policy with authentication strength for admins requiring phishing-resistant MFA. Configure Identity Protection sign-in risk policy to block risky sign-ins. Restrict access to the Graph API by requiring a specific role assignment.. Phishing-resistant MFA can be enforced via Conditional Access with authentication strength. Sign-in risk policies in Identity Protection can block sign-ins from risky IPs. To prevent directory enumeration, you can restrict access to the Graph API by requiring a specific role assignment. Option A is wrong because Security defaults enforce MFA but do not block all enumeration. Option C is wrong because PIM does not block enumeration. Option D is wrong because access reviews do not block enumeration.

Answer

Enable Security defaults and configure Identity Protection user risk policy to block high-risk users.

Answer

Configure Conditional Access policy for admins to require phishing-resistant MFA. Use PIM to require approval. Enable Identity Protection sign-in risk policy.

Answer

Configure PIM for all admin roles. Create access reviews for all users. Enable Identity Protection to detect risky sign-ins.

Question 10

You need to ensure that only approved iOS devices can access corporate email. Which Microsoft Intune policy should you configure?

Accepted Answer

Device compliance policy. The correct option is D, Device compliance policy. A compliance policy defines the rules a device must meet (for example, requiring a compliant/approved iOS device state) and, combined with Conditional Access, blocks noncompliant devices from accessing corporate email such as Exchange Online. Enrollment restrictions (A) only control which devices may enroll or which platforms are allowed, not ongoing email access. Device configuration policies (B) push settings to devices but do not gate access, and app protection policies (C) protect app data on enrolled or unenrolled devices without enforcing device-level approval for email access.

Answer

Enrollment restriction

Answer

Device configuration policy

Answer

App protection policy

Question 11

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that automatically detects and remediates identity risks such as leaked credentials and impossible travel. The solution must use built-in Microsoft Entra capabilities without additional licensing beyond Microsoft Entra ID P2. What should you configure?

Accepted Answer

Configure Identity Protection policies for sign-in risk and user risk.. Configure Identity Protection policies for sign-in risk and user risk. Microsoft Entra ID Protection is the built-in P2 capability that detects identity risks such as leaked credentials (user risk) and impossible travel (sign-in risk), and it can automatically remediate them by requiring MFA or password change through risk-based Conditional Access policies. PIM (A) governs just-in-time privileged role activation and does not detect leaked credentials or impossible travel. Conditional Access requiring MFA for all users (B) enforces a static control and does not perform risk detection or risk-based remediation. Access Reviews for guest users (C) handle periodic attestation of guest access, not identity risk detection or remediation.

Answer

Enable Privileged Identity Management (PIM) for role activation.

Answer

Create Conditional Access policies requiring MFA for all users.

Answer

Set up Access Reviews for guest users.

Question 12

Your company uses Microsoft Entra ID (P2 licensed) and requires that all user logins from untrusted networks be blocked unless the user's device is marked as compliant by Microsoft Intune. You need to implement this requirement. Which TWO components should you use together to achieve this? (Choose two.)

Accepted Answer

Conditional Access policy with device compliance condition. Option C is correct because a Conditional Access policy is the mechanism in Microsoft Entra ID that enforces access decisions at sign-in; you configure it with conditions (for example, 'All locations' or 'Any location' excluding trusted named locations) and grant controls requiring a compliant device, so logins from untrusted networks are blocked unless the device meets the compliance requirement. Option D is correct because Microsoft Intune Device Compliance policy defines what 'compliant' actually means (for example, BitLocker enabled, minimum OS version, Defender/antivirus active, no jailbreak/root), and it sets the device's compliance state in Entra ID that the Conditional Access policy evaluates. Together, the Intune compliance policy produces the device compliance signal and the Conditional Access policy consumes it to block non-compliant devices from untrusted networks. Option A (PIM) is for just-in-time privileged role activation and approval, not for device-based sign-in blocking. Option B (Identity Protection) detects and responds to risky users/sign-ins but does not itself enforce device compliance. Option E (Access Reviews) is for periodic attestation of group, role, or application access, not for real-time conditional access enforcement.

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Access Reviews

Question 13

You are the identity security engineer for a company that uses Microsoft Entra ID. A new security policy requires that any user who is assigned the Global Administrator role must use a phishing-resistant authentication method when signing in. You need to enforce this requirement with the least administrative effort. What should you do?

Accepted Answer

Create a Conditional Access policy that targets the Global Administrator directory role and requires an authentication strength of Phishing-resistant MFA.. A Conditional Access policy scoped to directory roles and combined with an authentication strength requirement is the supported way to mandate phishing-resistant MFA for privileged users. Authentication strengths map to method combinations such as FIDO2 security keys and certificate-based authentication, giving you granular, role-based enforcement.

Answer

Configure a per-user MFA setting for each Global Administrator and disable SMS and voice call methods.

Answer

Enable security defaults for the tenant and require all users to register for Microsoft Authenticator.

Answer

Assign a Microsoft Entra ID P1 license to each Global Administrator and enable self-service password reset with number matching.

Question 14

You are the identity security engineer for a company that uses Microsoft Entra ID. You need to reduce the risk of credential theft for administrative accounts. Which TWO controls should you implement? (Choose two.)

Accepted Answer

Require passwordless authentication methods such as FIDO2 security keys for administrators.. Passwordless authentication removes the password as a stealable secret, and banned password lists prevent weak or predictable passwords from being set. Together they reduce the likelihood that an administrative credential can be phished, guessed, or reused, which directly addresses credential theft risk.

Answer

Configure a long password expiration interval of 730 days for administrator accounts.

Answer

Assign the Privileged Authentication Administrator role to a shared helpdesk account.

Answer

Enable self-service password reset for all administrator accounts.

Question 15

You are a security administrator for a company that uses Microsoft Entra ID. You need to provide a partner organization with access to specific resources in your tenant. The partner users must use their own credentials, and you must be able to revoke access without managing their accounts. What should you configure?

Accepted Answer

Configure B2B collaboration with a cross-tenant access policy that allows the partner tenant and grants access to a specific enterprise application.. B2B collaboration with cross-tenant access settings allows partner users to authenticate against their home tenant while you control which applications and resources they can access. Revocation is achieved by modifying or deleting the cross-tenant access policy or the application assignment, without managing partner accounts.

Answer

Configure B2C authentication with a local account for each partner user.

Answer

Create an app registration and share the client secret with the partner organization.

Answer

Create guest user accounts in your tenant and assign them to a security group.