Microsoft AZ-500 Practice Test 10
Question 90
A new sign-in risk policy is planned for every engineer but its effect has not been simulated. A review identifies this consequence: Enforcing an untested policy can interrupt legitimate access before required exemptions are validated. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume report-only policies already deny users in production.
- The controlled remediation is to enable a blanket block immediately without assessing sign-in logs.
- The controlled remediation is to fix policy scope from report-only evidence and deploy with monitored staged enforcement.
- The controlled remediation is to use the Azure Firewall logs alone to validate Entra Conditional Access.
Explanation
Correct Answer
C:Test using these records: Report-only policy results, affected identities, excluded break-glass accounts and remediation plan. Conditional Access report-only evaluates policy effects without enforcing its new grant restrictions.
Incorrect Answers
A:Assume report-only policies already deny users in production. This would not reliably restore the intended security boundary. Enforcing an untested policy can interrupt legitimate access before required exemptions are validated. The appropriate controlled recovery is: Fix policy scope from report-only evidence and deploy with monitored staged enforcement.
B:Enable a blanket block immediately without assessing sign-in logs. This would not reliably restore the intended security boundary. Enforcing an untested policy can interrupt legitimate access before required exemptions are validated. The appropriate controlled recovery is: Fix policy scope from report-only evidence and deploy with monitored staged enforcement.
D:Use the Azure Firewall logs alone to validate Entra Conditional Access. This would not reliably restore the intended security boundary. Enforcing an untested policy can interrupt legitimate access before required exemptions are validated. The appropriate controlled recovery is: Fix policy scope from report-only evidence and deploy with monitored staged enforcement.
Question 91
A company requires corporate devices to meet compliance policy before accessing a sensitive admin application. Which configuration decision MOST directly resolves the issue?
- Configure a Conditional Access grant control requiring a device marked compliant and validate enrollment prerequisites.
- Use an NSG rule to mark the laptop compliant in Entra.
- Assume the browser user agent alone proves Intune compliance.
- Require compliant devices without considering supported clients and exclusions.
Explanation
Correct Answer
A:Confirm the change against these records: Intune compliance status, Entra device identity, Conditional Access result and affected application. Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
Incorrect Answers
B:An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities.
C:Assume the browser user agent alone proves Intune compliance. The proposed change targets the wrong mechanism or lacks essential validation. Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Relevant evidence is intune compliance status, Entra device identity, Conditional Access result and affected application.
D:An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. The intended action is: Configure a Conditional Access grant control requiring a device marked compliant and validate enrollment prerequisites.
Question 92
A company requires corporate devices to meet compliance policy before accessing a sensitive admin application. What evidence most directly confirms the intended security behavior?
- A historical sign-in screenshot with no target resource or principal ID.
- Intune compliance status, Entra device identity, Conditional Access result and affected application.
- An old tenant role export without a current role scope or effective assignment.
- The expected access policy written in a design note but not assigned.
Explanation
Correct Answer
B:These records test the actual Conditional Access device compliance requirement behavior rather than an unrelated dashboard state. Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Intune compliance status, Entra device identity, Conditional Access result and affected application.
D:On its own, that evidence does not prove the specified security control works. In the given case, a company requires corporate devices to meet compliance policy before accessing a sensitive admin application.
Question 93
A company requires corporate devices to meet compliance policy before accessing a sensitive admin application. Which security principle best explains the intended decision?
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
- Assigning a role to a group means every resource ignores its narrower permissions.
- Adding a requested API scope automatically grants tenant-wide consent.
- Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
Explanation
Correct Answer
D:Confirmation depends on Intune compliance status, Entra device identity, Conditional Access result and affected application. This principle supports the security response: Configure a Conditional Access grant control requiring a device marked compliant and validate enrollment prerequisites.
Incorrect Answers
A:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Conditional Access device compliance requirement. The relevant security behavior is: Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Check evidence such as intune compliance status, Entra device identity, Conditional Access result and affected application.
B:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for Conditional Access device compliance requirement. The relevant security behavior is: Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Check evidence such as intune compliance status, Entra device identity, Conditional Access result and affected application.
C:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Conditional Access device compliance requirement. The relevant security behavior is: Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Check evidence such as intune compliance status, Entra device identity, Conditional Access result and affected application.
Question 94
A company requires corporate devices to meet compliance policy before accessing a sensitive admin application. Suppose the operator instead follows this unsafe shortcut: Use an NSG rule to mark the laptop compliant in Entra. Which resulting risk or fault should the reviewer identify?
- Reviewing current access tokens creates missing authorization scopes.
- An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities.
- Testing a least-privilege login disables the normal authentication platform.
- Removing excessive admin permissions caused the original unauthorized elevation.
Explanation
Correct Answer
B:The suitable control is: Configure a Conditional Access grant control requiring a device marked compliant and validate enrollment prerequisites. Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
Incorrect Answers
A:This does not explain the real Conditional Access device compliance requirement weakness after the shortcut. The material failure is: An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities.
C:This does not explain the real Conditional Access device compliance requirement weakness after the shortcut. Inspect evidence such as intune compliance status, Entra device identity, Conditional Access result and affected application.
D:This does not explain the real Conditional Access device compliance requirement weakness after the shortcut. In the given case, a company requires corporate devices to meet compliance policy before accessing a sensitive admin application.
Question 95
A company requires corporate devices to meet compliance policy before accessing a sensitive admin application. A review identifies this consequence: An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. Which remediation most directly restores the intended behavior?
- Assume the browser user agent alone proves Intune compliance.
- Require compliant devices without considering supported clients and exclusions.
- Correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
- Use an NSG rule to mark the laptop compliant in Entra.
Explanation
Correct Answer
C:Test using these records: Intune compliance status, Entra device identity, Conditional Access result and affected application. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume the browser user agent alone proves Intune compliance. This would not reliably restore the intended security boundary. An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. The appropriate controlled recovery is: Correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
B:Require compliant devices without considering supported clients and exclusions. This would not reliably restore the intended security boundary. An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. The appropriate controlled recovery is: Correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
D:Use an NSG rule to mark the laptop compliant in Entra. This would not reliably restore the intended security boundary. An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. The appropriate controlled recovery is: Correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
Question 96
An engineer signs in from an unmanaged endpoint and the tenant is expected to reject the request based on device status. Which operator action best meets this technical requirement?
- For this Azure workload, the team should assume the browser user agent alone proves Intune compliance.
- For this Azure workload, the team should configure a Conditional Access grant control requiring a device marked compliant and validate enrollment prerequisites.
- For this Azure workload, the team should require compliant devices without considering supported clients and exclusions.
- For this Azure workload, the team should use an NSG rule to mark the laptop compliant in Entra.
Explanation
Correct Answer
B:Confirm the change against these records: Intune compliance status, Entra device identity, Conditional Access result and affected application.
Incorrect Answers
A:Assume the browser user agent alone proves Intune compliance. The proposed change targets the wrong mechanism or lacks essential validation. Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Relevant evidence is intune compliance status, Entra device identity, Conditional Access result and affected application.
C:An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. Require compliant devices without considering supported clients and exclusions.
D:An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. Use an NSG rule to mark the laptop compliant in Entra.
Question 97
An engineer signs in from an unmanaged endpoint and the tenant is expected to reject the request based on device status. Which collection of observations most directly tests the suspected cause?
- In this security review, examine intune compliance status, Entra device identity, Conditional Access result and affected application.
- In this security review, examine a user display name without the access-token claims or authorization decision.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
Explanation
Correct Answer
A:These records test the actual Conditional Access device compliance requirement behavior rather than an unrelated dashboard state. The intended action is: Configure a Conditional Access grant control requiring a device marked compliant and validate enrollment prerequisites.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, an engineer signs in from an unmanaged endpoint and the tenant is expected to reject the request based on device status.
C:Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
D:The more relevant observations are: Intune compliance status, Entra device identity, Conditional Access result and affected application.
Question 98
An engineer signs in from an unmanaged endpoint and the tenant is expected to reject the request based on device status. Which statement most accurately explains this scenario?
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that device-compliance grant controls depend on registered identities and a matching compliance evaluation.
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
Explanation
Correct Answer
C:Confirmation depends on Intune compliance status, Entra device identity, Conditional Access result and affected application. Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
Incorrect Answers
A:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Conditional Access device compliance requirement. The relevant security behavior is: Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Check evidence such as intune compliance status, Entra device identity, Conditional Access result and affected application.
B:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Conditional Access device compliance requirement. The relevant security behavior is: Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Check evidence such as intune compliance status, Entra device identity, Conditional Access result and affected application.
D:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for Conditional Access device compliance requirement. The relevant security behavior is: Device-compliance grant controls depend on registered identities and a matching compliance evaluation. Check evidence such as intune compliance status, Entra device identity, Conditional Access result and affected application.
Question 99
An engineer signs in from an unmanaged endpoint and the tenant is expected to reject the request based on device status. Suppose the operator instead follows this unsafe shortcut: Use an NSG rule to mark the laptop compliant in Entra. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that an unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
Explanation
Correct Answer
A:The suitable control is: Configure a Conditional Access grant control requiring a device marked compliant and validate enrollment prerequisites. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Conditional Access device compliance requirement weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
C:This does not explain the real Conditional Access device compliance requirement weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
D:This does not explain the real Conditional Access device compliance requirement weakness after the shortcut. Testing a least-privilege login disables the normal authentication platform.
Question 100
An engineer signs in from an unmanaged endpoint and the tenant is expected to reject the request based on device status. A review identifies this consequence: An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to require compliant devices without considering supported clients and exclusions.
- The controlled remediation is to use an NSG rule to mark the laptop compliant in Entra.
- The controlled remediation is to correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
- The controlled remediation is to assume the browser user agent alone proves Intune compliance.
Explanation
Correct Answer
C:Test using these records: Intune compliance status, Entra device identity, Conditional Access result and affected application. Device-compliance grant controls depend on registered identities and a matching compliance evaluation.
Incorrect Answers
A:Require compliant devices without considering supported clients and exclusions. This would not reliably restore the intended security boundary. An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. The appropriate controlled recovery is: Correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
B:Use an NSG rule to mark the laptop compliant in Entra. This would not reliably restore the intended security boundary. An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. The appropriate controlled recovery is: Correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
D:Assume the browser user agent alone proves Intune compliance. This would not reliably restore the intended security boundary. An unmanaged device can bypass intent if the policy is not assigned to the relevant app and identities. The appropriate controlled recovery is: Correct device compliance and policy scope and verify compliant versus noncompliant sign-ins.
