Microsoft AZ-500 Practice Test 7
Question 60
An elevated account remains active beyond a maintenance window after its assignment duration was configured incorrectly. A review identifies this consequence: Missing approval or excessive activation duration extends sensitive access without required oversight. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to assume PIM activation can never require approval or a maximum duration.
- The controlled remediation is to depend only on a monthly email instead of enforcing approval.
- The controlled remediation is to give every operator permanent Owner to remove activation delays.
- The controlled remediation is to correct the PIM policy and test an approval-gated activation that expires as configured.
Explanation
Correct Answer
D:This addresses the observed security problem while providing a verifiable outcome. Test using these records: PIM role settings, activation history, approver decision and automatic expiration.
Incorrect Answers
A:Assume PIM activation can never require approval or a maximum duration. This would not reliably restore the intended security boundary. Missing approval or excessive activation duration extends sensitive access without required oversight. The appropriate controlled recovery is: Correct the PIM policy and test an approval-gated activation that expires as configured.
B:Depend only on a monthly email instead of enforcing approval. This would not reliably restore the intended security boundary. Missing approval or excessive activation duration extends sensitive access without required oversight. The appropriate controlled recovery is: Correct the PIM policy and test an approval-gated activation that expires as configured.
C:Give every operator permanent Owner to remove activation delays. This would not reliably restore the intended security boundary. Missing approval or excessive activation duration extends sensitive access without required oversight. The appropriate controlled recovery is: Correct the PIM policy and test an approval-gated activation that expires as configured.
Question 61
An Azure portal administrator can sign in with a password even though the organization intends to require phishing-resistant or multifactor authentication. Which operator action best meets this technical requirement?
- Apply a targeted Conditional Access policy requiring the approved authentication strength for the relevant sign-ins.
- Change an Azure resource group's Contributor permission to force MFA at login.
- Set a network security group port rule as the only identity challenge.
- Enable security defaults and ignore conflicting or excluded policy scope.
Explanation
Correct Answer
A:Confirm the change against these records: Policy assignments and exclusions, sign-in log result, authentication details and policy test. Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
Incorrect Answers
B:A user may authenticate successfully while an intended MFA requirement never applies to that session.
C:Set a network security group port rule as the only identity challenge. The proposed change targets the wrong mechanism or lacks essential validation. Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Relevant evidence is policy assignments and exclusions, sign-in log result, authentication details and policy test.
D:A user may authenticate successfully while an intended MFA requirement never applies to that session. The intended action is: Apply a targeted Conditional Access policy requiring the approved authentication strength for the relevant sign-ins.
Question 62
An Azure portal administrator can sign in with a password even though the organization intends to require phishing-resistant or multifactor authentication. Which collection of observations most directly tests the suspected cause?
- The expected access policy written in a design note but not assigned.
- A historical sign-in screenshot with no target resource or principal ID.
- Policy assignments and exclusions, sign-in log result, authentication details and policy test.
- A successful login to another unrelated cloud application.
Explanation
Correct Answer
C:These records test the actual Conditional Access MFA enforcement behavior rather than an unrelated dashboard state. Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Policy assignments and exclusions, sign-in log result, authentication details and policy test.
B:On its own, that evidence does not prove the specified security control works. Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
D:On its own, that evidence does not prove the specified security control works. In the given case, an Azure portal administrator can sign in with a password even though the organization intends to require phishing-resistant or multifactor authentication.
Question 63
An Azure portal administrator can sign in with a password even though the organization intends to require phishing-resistant or multifactor authentication. Which statement most accurately explains this scenario?
- Adding a requested API scope automatically grants tenant-wide consent.
- Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
- Long-lived shared application secrets are always more secure than managed identities.
- Assigning a role to a group means every resource ignores its narrower permissions.
Explanation
Correct Answer
B:Confirmation depends on Policy assignments and exclusions, sign-in log result, authentication details and policy test. This principle supports the security response: Apply a targeted Conditional Access policy requiring the approved authentication strength for the relevant sign-ins.
Incorrect Answers
A:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Conditional Access MFA enforcement. The relevant security behavior is: Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Check evidence such as policy assignments and exclusions, sign-in log result, authentication details and policy test.
C:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for Conditional Access MFA enforcement. The relevant security behavior is: Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Check evidence such as policy assignments and exclusions, sign-in log result, authentication details and policy test.
D:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for Conditional Access MFA enforcement. The relevant security behavior is: Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Check evidence such as policy assignments and exclusions, sign-in log result, authentication details and policy test.
Question 64
An Azure portal administrator can sign in with a password even though the organization intends to require phishing-resistant or multifactor authentication. Suppose the operator instead follows this unsafe shortcut: Change an Azure resource group's Contributor permission to force MFA at login. What is the principal technical consequence of the mistaken choice?
- A user may authenticate successfully while an intended MFA requirement never applies to that session.
- The only harm is a cosmetic app display-name difference.
- Reviewing current access tokens creates missing authorization scopes.
- Testing a least-privilege login disables the normal authentication platform.
Explanation
Correct Answer
A:The suitable control is: Apply a targeted Conditional Access policy requiring the approved authentication strength for the relevant sign-ins. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Conditional Access MFA enforcement weakness after the shortcut. The material failure is: A user may authenticate successfully while an intended MFA requirement never applies to that session.
C:This does not explain the real Conditional Access MFA enforcement weakness after the shortcut. Inspect evidence such as policy assignments and exclusions, sign-in log result, authentication details and policy test.
D:This does not explain the real Conditional Access MFA enforcement weakness after the shortcut. In the given case, an Azure portal administrator can sign in with a password even though the organization intends to require phishing-resistant or multifactor authentication.
Question 65
An Azure portal administrator can sign in with a password even though the organization intends to require phishing-resistant or multifactor authentication. A review identifies this consequence: A user may authenticate successfully while an intended MFA requirement never applies to that session. Which recovery action restores the intended control and validates its effect?
- Set a network security group port rule as the only identity challenge.
- Fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
- Enable security defaults and ignore conflicting or excluded policy scope.
- Change an Azure resource group's Contributor permission to force MFA at login.
Explanation
Correct Answer
B:Test using these records: Policy assignments and exclusions, sign-in log result, authentication details and policy test. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:That option would set a network security group port rule as the only identity challenge, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
C:That option would enable security defaults and ignore conflicting or excluded policy scope, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
D:That option would change an Azure resource group's Contributor permission to force MFA at login, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 66
A privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength. What is the most defensible Azure security action?
- For this Azure workload, the team should set a network security group port rule as the only identity challenge.
- For this Azure workload, the team should enable security defaults and ignore conflicting or excluded policy scope.
- For this Azure workload, the team should change an Azure resource group's Contributor permission to force MFA at login.
- For this Azure workload, the team should apply a targeted Conditional Access policy requiring the approved authentication strength for the relevant sign-ins.
Explanation
Correct Answer
D:Confirm the change against these records: Policy assignments and exclusions, sign-in log result, authentication details and policy test.
Incorrect Answers
A:Set a network security group port rule as the only identity challenge. The proposed change targets the wrong mechanism or lacks essential validation. Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Relevant evidence is policy assignments and exclusions, sign-in log result, authentication details and policy test.
B:A user may authenticate successfully while an intended MFA requirement never applies to that session.
C:A user may authenticate successfully while an intended MFA requirement never applies to that session. Change an Azure resource group's Contributor permission to force MFA at login.
Question 67
A privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength. Which diagnostic record would most strongly confirm the result?
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine the expected access policy written in a design note but not assigned.
- In this security review, examine policy assignments and exclusions, sign-in log result, authentication details and policy test.
- In this security review, examine a historical sign-in screenshot with no target resource or principal ID.
Explanation
Correct Answer
C:These records test the actual Conditional Access MFA enforcement behavior rather than an unrelated dashboard state. The intended action is: Apply a targeted Conditional Access policy requiring the approved authentication strength for the relevant sign-ins.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength.
B:The more relevant observations are: Policy assignments and exclusions, sign-in log result, authentication details and policy test.
D:Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
Question 68
A privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that assigning a role to a group means every resource ignores its narrower permissions.
- The applicable security principle is that Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
- The applicable security principle is that adding a requested API scope automatically grants tenant-wide consent.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
Explanation
Correct Answer
B:Confirmation depends on Policy assignments and exclusions, sign-in log result, authentication details and policy test.
Incorrect Answers
A:Assigning a role to a group means every resource ignores its narrower permissions. This is an incorrect assumption for Conditional Access MFA enforcement. The relevant security behavior is: Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Check evidence such as policy assignments and exclusions, sign-in log result, authentication details and policy test.
C:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Conditional Access MFA enforcement. The relevant security behavior is: Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Check evidence such as policy assignments and exclusions, sign-in log result, authentication details and policy test.
D:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Conditional Access MFA enforcement. The relevant security behavior is: Conditional Access evaluates sign-in conditions and applies configured grant or session controls. Check evidence such as policy assignments and exclusions, sign-in log result, authentication details and policy test.
Question 69
A privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength. Suppose the operator instead follows this unsafe shortcut: Change an Azure resource group's Contributor permission to force MFA at login. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that testing a least-privilege login disables the normal authentication platform.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that a user may authenticate successfully while an intended MFA requirement never applies to that session.
- The resulting security weakness is that reviewing current access tokens creates missing authorization scopes.
Explanation
Correct Answer
C:The suitable control is: Apply a targeted Conditional Access policy requiring the approved authentication strength for the relevant sign-ins. Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
Incorrect Answers
A:This does not explain the real Conditional Access MFA enforcement weakness after the shortcut. In the given case, a privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength.
B:This does not explain the real Conditional Access MFA enforcement weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
D:The material failure is: A user may authenticate successfully while an intended MFA requirement never applies to that session.
Question 70
A privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength. A review identifies this consequence: A user may authenticate successfully while an intended MFA requirement never applies to that session. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to enable security defaults and ignore conflicting or excluded policy scope.
- The controlled remediation is to fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
- The controlled remediation is to change an Azure resource group's Contributor permission to force MFA at login.
- The controlled remediation is to set a network security group port rule as the only identity challenge.
Explanation
Correct Answer
B:Test using these records: Policy assignments and exclusions, sign-in log result, authentication details and policy test. Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
Incorrect Answers
A:Enable security defaults and ignore conflicting or excluded policy scope. This would not reliably restore the intended security boundary. A user may authenticate successfully while an intended MFA requirement never applies to that session. The appropriate controlled recovery is: Fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
C:Change an Azure resource group's Contributor permission to force MFA at login. This would not reliably restore the intended security boundary. A user may authenticate successfully while an intended MFA requirement never applies to that session. The appropriate controlled recovery is: Fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
D:Set a network security group port rule as the only identity challenge. This would not reliably restore the intended security boundary. A user may authenticate successfully while an intended MFA requirement never applies to that session. The appropriate controlled recovery is: Fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
