Microsoft AZ-500 Practice Test 8
Question 70
A privileged cloud app permits account access from untrusted sessions without the organization's required authentication strength. A review identifies this consequence: A user may authenticate successfully while an intended MFA requirement never applies to that session. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to enable security defaults and ignore conflicting or excluded policy scope.
- The controlled remediation is to fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
- The controlled remediation is to change an Azure resource group's Contributor permission to force MFA at login.
- The controlled remediation is to set a network security group port rule as the only identity challenge.
Explanation
Correct Answer
B:Test using these records: Policy assignments and exclusions, sign-in log result, authentication details and policy test. Conditional Access evaluates sign-in conditions and applies configured grant or session controls.
Incorrect Answers
A:Enable security defaults and ignore conflicting or excluded policy scope. This would not reliably restore the intended security boundary. A user may authenticate successfully while an intended MFA requirement never applies to that session. The appropriate controlled recovery is: Fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
C:Change an Azure resource group's Contributor permission to force MFA at login. This would not reliably restore the intended security boundary. A user may authenticate successfully while an intended MFA requirement never applies to that session. The appropriate controlled recovery is: Fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
D:Set a network security group port rule as the only identity challenge. This would not reliably restore the intended security boundary. A user may authenticate successfully while an intended MFA requirement never applies to that session. The appropriate controlled recovery is: Fix the target app and user scope and confirm the expected MFA challenge in sign-in results.
Question 71
A tenant-wide Conditional Access rule locks every administrator out during an identity provider outage. What is the most defensible Azure security action?
- Exclude every employee from Conditional Access to avoid lockouts.
- Use one shared everyday administrator account as the break-glass identity.
- Disable audit logs for emergency identities.
- Maintain monitored emergency access accounts under controlled exclusions and test recovery.
Explanation
Correct Answer
D:Confirm the change against these records: Emergency account sign-in validation, policy exclusions, alerting and recovery runbook. Well-governed emergency access identities protect tenant recovery when normal policy paths fail.
Incorrect Answers
A:A policy that blocks every recovery identity can render tenant administration inaccessible. Exclude every employee from Conditional Access to avoid lockouts.
B:Use one shared everyday administrator account as the break-glass identity. The proposed change targets the wrong mechanism or lacks essential validation. Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Relevant evidence is emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
C:A policy that blocks every recovery identity can render tenant administration inaccessible. The intended action is: Maintain monitored emergency access accounts under controlled exclusions and test recovery.
Question 72
A tenant-wide Conditional Access rule locks every administrator out during an identity provider outage. Which diagnostic record would most strongly confirm the result?
- An old tenant role export without a current role scope or effective assignment.
- Emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
- A user display name without the access-token claims or authorization decision.
- A historical sign-in screenshot with no target resource or principal ID.
Explanation
Correct Answer
B:These records test the actual Conditional Access emergency access exclusions behavior rather than an unrelated dashboard state. Well-governed emergency access identities protect tenant recovery when normal policy paths fail.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
C:On its own, that evidence does not prove the specified security control works. Well-governed emergency access identities protect tenant recovery when normal policy paths fail.
D:On its own, that evidence does not prove the specified security control works. In the given case, a tenant-wide Conditional Access rule locks every administrator out during an identity provider outage.
Question 73
A tenant-wide Conditional Access rule locks every administrator out during an identity provider outage. Which platform concept should guide the engineer’s assessment?
- A valid sign-in eliminates all requirements for scoped authorization.
- Well-governed emergency access identities protect tenant recovery when normal policy paths fail.
- Adding a requested API scope automatically grants tenant-wide consent.
- An Azure resource role automatically grants all Microsoft Entra directory privileges.
Explanation
Correct Answer
B:This principle supports the security response: Maintain monitored emergency access accounts under controlled exclusions and test recovery. Confirmation depends on Emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
Incorrect Answers
A:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for Conditional Access emergency access exclusions. The relevant security behavior is: Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Check evidence such as emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
C:Adding a requested API scope automatically grants tenant-wide consent. This is an incorrect assumption for Conditional Access emergency access exclusions. The relevant security behavior is: Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Check evidence such as emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
D:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Conditional Access emergency access exclusions. The relevant security behavior is: Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Check evidence such as emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
Question 74
A tenant-wide Conditional Access rule locks every administrator out during an identity provider outage. Suppose the operator instead follows this unsafe shortcut: Exclude every employee from Conditional Access to avoid lockouts. Which root-cause observation follows from that incorrect change?
- Testing a least-privilege login disables the normal authentication platform.
- Removing excessive admin permissions caused the original unauthorized elevation.
- A policy that blocks every recovery identity can render tenant administration inaccessible.
- Recording a sign-in audit trail is the reason the identity was overprivileged.
Explanation
Correct Answer
C:The suitable control is: Maintain monitored emergency access accounts under controlled exclusions and test recovery. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real Conditional Access emergency access exclusions weakness after the shortcut. The material failure is: A policy that blocks every recovery identity can render tenant administration inaccessible.
B:This does not explain the real Conditional Access emergency access exclusions weakness after the shortcut. Inspect evidence such as emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
D:This does not explain the real Conditional Access emergency access exclusions weakness after the shortcut. Recording a sign-in audit trail is the reason the identity was overprivileged.
Question 75
A tenant-wide Conditional Access rule locks every administrator out during an identity provider outage. A review identifies this consequence: A policy that blocks every recovery identity can render tenant administration inaccessible. Which recovery action addresses the underlying technical fault?
- Use one shared everyday administrator account as the break-glass identity.
- Disable audit logs for emergency identities.
- Add approved emergency exceptions and monitor every emergency account sign-in.
- Exclude every employee from Conditional Access to avoid lockouts.
Explanation
Correct Answer
C:This addresses the observed security problem while providing a verifiable outcome. Test using these records: Emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
Incorrect Answers
A:Use one shared everyday administrator account as the break-glass identity. This would not reliably restore the intended security boundary. A policy that blocks every recovery identity can render tenant administration inaccessible. The appropriate controlled recovery is: Add approved emergency exceptions and monitor every emergency account sign-in.
B:Disable audit logs for emergency identities. This would not reliably restore the intended security boundary. A policy that blocks every recovery identity can render tenant administration inaccessible. The appropriate controlled recovery is: Add approved emergency exceptions and monitor every emergency account sign-in.
D:Exclude every employee from Conditional Access to avoid lockouts. This would not reliably restore the intended security boundary. A policy that blocks every recovery identity can render tenant administration inaccessible. The appropriate controlled recovery is: Add approved emergency exceptions and monitor every emergency account sign-in.
Question 76
A rollout targets all privileged accounts without a documented break-glass access strategy. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should use one shared everyday administrator account as the break-glass identity.
- For this Azure workload, the team should disable audit logs for emergency identities.
- For this Azure workload, the team should exclude every employee from Conditional Access to avoid lockouts.
- For this Azure workload, the team should maintain monitored emergency access accounts under controlled exclusions and test recovery.
Explanation
Correct Answer
D:Confirm the change against these records: Emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
Incorrect Answers
A:Use one shared everyday administrator account as the break-glass identity. The proposed change targets the wrong mechanism or lacks essential validation. Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Relevant evidence is emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
B:A policy that blocks every recovery identity can render tenant administration inaccessible. In the given case, a rollout targets all privileged accounts without a documented break-glass access strategy.
C:In the given case, a rollout targets all privileged accounts without a documented break-glass access strategy.
Question 77
A rollout targets all privileged accounts without a documented break-glass access strategy. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a successful login to another unrelated cloud application.
- In this security review, examine an old tenant role export without a current role scope or effective assignment.
- In this security review, examine a user display name without the access-token claims or authorization decision.
- In this security review, examine emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
Explanation
Correct Answer
D:These records test the actual Conditional Access emergency access exclusions behavior rather than an unrelated dashboard state. The intended action is: Maintain monitored emergency access accounts under controlled exclusions and test recovery.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a rollout targets all privileged accounts without a documented break-glass access strategy.
B:The more relevant observations are: Emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
C:Well-governed emergency access identities protect tenant recovery when normal policy paths fail.
Question 78
A rollout targets all privileged accounts without a documented break-glass access strategy. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that well-governed emergency access identities protect tenant recovery when normal policy paths fail.
- The applicable security principle is that an Azure resource role automatically grants all Microsoft Entra directory privileges.
- The applicable security principle is that a valid sign-in eliminates all requirements for scoped authorization.
- The applicable security principle is that long-lived shared application secrets are always more secure than managed identities.
Explanation
Correct Answer
A:This principle supports the security response: Maintain monitored emergency access accounts under controlled exclusions and test recovery.
Incorrect Answers
B:An Azure resource role automatically grants all Microsoft Entra directory privileges. This is an incorrect assumption for Conditional Access emergency access exclusions. The relevant security behavior is: Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Check evidence such as emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
C:A valid sign-in eliminates all requirements for scoped authorization. This is an incorrect assumption for Conditional Access emergency access exclusions. The relevant security behavior is: Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Check evidence such as emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
D:Long-lived shared application secrets are always more secure than managed identities. This is an incorrect assumption for Conditional Access emergency access exclusions. The relevant security behavior is: Well-governed emergency access identities protect tenant recovery when normal policy paths fail. Check evidence such as emergency account sign-in validation, policy exclusions, alerting and recovery runbook.
Question 79
A rollout targets all privileged accounts without a documented break-glass access strategy. Suppose the operator instead follows this unsafe shortcut: Exclude every employee from Conditional Access to avoid lockouts. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that recording a sign-in audit trail is the reason the identity was overprivileged.
- The resulting security weakness is that the only harm is a cosmetic app display-name difference.
- The resulting security weakness is that removing excessive admin permissions caused the original unauthorized elevation.
- The resulting security weakness is that a policy that blocks every recovery identity can render tenant administration inaccessible.
Explanation
Correct Answer
D:The suitable control is: Maintain monitored emergency access accounts under controlled exclusions and test recovery. Well-governed emergency access identities protect tenant recovery when normal policy paths fail.
Incorrect Answers
A:This does not explain the real Conditional Access emergency access exclusions weakness after the shortcut. In the given case, a rollout targets all privileged accounts without a documented break-glass access strategy.
B:This does not explain the real Conditional Access emergency access exclusions weakness after the shortcut. The only harm is a cosmetic app display-name difference.
C:This does not explain the real Conditional Access emergency access exclusions weakness after the shortcut. Removing excessive admin permissions caused the original unauthorized elevation.
Question 80
A rollout targets all privileged accounts without a documented break-glass access strategy. A review identifies this consequence: A policy that blocks every recovery identity can render tenant administration inaccessible. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to disable audit logs for emergency identities.
- The controlled remediation is to exclude every employee from Conditional Access to avoid lockouts.
- The controlled remediation is to add approved emergency exceptions and monitor every emergency account sign-in.
- The controlled remediation is to use one shared everyday administrator account as the break-glass identity.
Explanation
Correct Answer
C:This addresses the observed security problem while providing a verifiable outcome. Well-governed emergency access identities protect tenant recovery when normal policy paths fail.
Incorrect Answers
A:Disable audit logs for emergency identities. This would not reliably restore the intended security boundary. A policy that blocks every recovery identity can render tenant administration inaccessible. The appropriate controlled recovery is: Add approved emergency exceptions and monitor every emergency account sign-in.
B:Exclude every employee from Conditional Access to avoid lockouts. This would not reliably restore the intended security boundary. A policy that blocks every recovery identity can render tenant administration inaccessible. The appropriate controlled recovery is: Add approved emergency exceptions and monitor every emergency account sign-in.
D:Use one shared everyday administrator account as the break-glass identity. This would not reliably restore the intended security boundary. A policy that blocks every recovery identity can render tenant administration inaccessible. The appropriate controlled recovery is: Add approved emergency exceptions and monitor every emergency account sign-in.
