AZ-500 practice questions 81–90

1. Question 81 · 496 in bank

   DRAG DROP - You have an Azure subscription that contains an Azure web app named App1. You plan to configure a Conditional Access policy for App1. The solution must meet the following requirements: • Only allow access to App1 from Windows devices. • Only allow devices that are marked as compliant to access App1. Which Conditional Access policy settings should you configure? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Think the correct answers should be : Box 1: Conditions Next, configure Conditions. Select the signals you want to use as conditions for this policy. Options include: • User risk • Sign-in risk • Device platforms • Locations • Client apps • Filter for devices Box2: Grant Grant access: The users specified in this policy are granted access, but you can require any of the following further actions: o Require multi-factor authentication o Require authentication strength o Require device to be marked as compliant - This option is required for the policy to use device compliance status. o Require Microsoft Entra hybrid joined device o Require approved client app o Require app protection policy o Require password change Reference: Reference: https://learn.microsoft.com/en-us/mem/intune/protect/create-conditional-access-intune

   Source: Adapted from community discussion — chiquito

   References

   • Microsoft Learn

   

   Next question

2. Question 82 · 496 in bank

   HOTSPOT - Your network contains an on-premises Active Directory domain that syncs to a Microsoft Entra tenant. The tenant contains the users shown in the following table.

   

   The tenant contains the groups shown in the following table.

   

   You configure a multi-factor authentication (MFA) registration policy that has the following settings: • Assignments: o Include: Group1 o Exclude: Group2 • Controls: Require Azure MFA registration • Enforce Policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think answer should be Yes,No,Yes. Here On-premisses sync does not make any sense as MFA applies user in the Azure if users already synced to Azure we are free to enforce mfa to them (question says users are already in Entra Id) So feel free to Mfa

   Source: Adapted from community discussion — Jimmy500

   References

   • Microsoft Learn

   

   Next question

3. Question 83 · 496 in bank

   You have a Microsoft Entra tenant named contoso.com. You plan to collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com. Fabrikam.com uses the following identity providers: • Google Cloud Platform (GCP) • Microsoft accounts • Microsoft Entra ID You need to configure the Cross-tenant access settings for B2B collaboration. Which identity providers support cross-tenant access?

   • AMicrosoft Entra ID only
   • BGCP and Microsoft Entra ID only
   • CMicrosoft accounts and Microsoft Entra ID only
   • DGCP, Microsoft accounts, and Microsoft Entra ID

   Show answer

   Answer: A

   Explanation

   To support the Answer: fabrikam.com uses multiple identity providers (GCP, Microsoft accounts, and Microsoft Entra ID), only their Microsoft Entra ID identities will be able to leverage the cross-tenant access settings for B2B collaboration with your contoso.com tenant. Google Cloud Platform (GCP) and Microsoft accounts are not directly supported for cross-tenant access in this context. For cross-tenant access settings in B2B collaboration between your Microsoft Entra tenant (contoso.com) and the partner organization's tenant (fabrikam.com), only Microsoft Entra ID is supported as the identity provider. Cross-tenant access settings are specifically designed for collaboration between Microsoft Entra organizations. They allow you to configure inbound and outbound access policies, trust multifactor authentication (MFA), and device claims from other Microsoft Entra tenants. Answer = A

   Source: Adapted from community discussion — ITFranz

   References

   • Microsoft Learn

   Next question

4. Question 84 · 496 in bank

   You have a Microsoft Entra tenant named contoso.com. You have a partner company that has a Microsoft Entra tenant named fabrikam.com. You need to ensure that when a user in fabrikam.com attempts to access the resources in contoso.com, the user only receives a single Microsoft Entra Multi-Factor Authentication (MFA) prompt. The solution must minimize administrative effort. What should you do?

   • AFrom the Azure portal of contoso.com, configure the inbound access default settings.
   • BFrom the Azure portal of contoso.com, configure the External collaboration settings.
   • CFrom the Azure portal of contoso.com, configure the outbound access default settings.
   • DFrom the Azure portal of fabrikam.com, configure the outbound access default settings.

   Show answer

   Answer: A

   Explanation

   I would go with A Trust multi-factor authentication from Microsoft Entra tenants: Select this checkbox to allow your Conditional Access policies to trust MFA claims from external organizations. During authentication, Microsoft Entra ID checks a user's credentials for a claim that the user completed MFA. If not, an MFA challenge is initiated in the user's home tenant. Link: https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-settings-b2b-collaboration#to-change-inbound-trust-settings-for-mfa-and-device-claims

   Source: Adapted from community discussion — Pamban

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 85 · 496 in bank

   DRAG DROP - You have a Microsoft Entra tenant. On January 1, you configure a multi-factor authentication (MFA) registration policy that has the following settings: • Assignments: All users • Require Microsoft Entra ID multifactor authentication registration: Enabled • Enforce policy: On On January 3, you create two new users named User1 and User2. On January 5, User1 authenticates to Microsoft Entra ID for the first time. On January 7, User2 authenticates to Microsoft Entra ID for the first time. On which date will User1 and User2 be forced to register for MFA? To answer, drag the appropriate dates to the correct users. Each date may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   From 2025 January: ""We're removing the option to skip multifactor authentication (MFA) registration for 14 days when security defaults are enabled. This means all users will be required to register for MFA on their first login after security defaults are turned on" https://techcommunity.microsoft.com/blog/microsoft-entra-blog/update-to-security-defaults/4044868

   Source: Adapted from community discussion — golitech

   References

   • Microsoft Learn

   

   Next question

6. Question 86 · 496 in bank

   Your company plans to create separate subscriptions for each department. Each subscription will be associated to the same Azure Active Directory (Azure AD) tenant. You need to configure each subscription to have the same role assignments. What should you use?

   • AAzure Security Center
   • BAzure Policy
   • CAzure AD Privileged Identity Management (PIM)
   • DAzure Blueprints

   Show answer

   Answer: D

   Explanation

   Correct Answer is D - Azure Blueprints. You can create a blueprint at Management Group which contains two subscriptions and deploy it to both.

   Source: Adapted from community discussion — teehex

   Next question

7. Question 87 · 496 in bank

   HOTSPOT - You have a Microsoft Entra tenant that contains the groups shown in the following table.

   

   From the Azure portal, you configure a group expiration policy that has a lifetime of 180 days. Which groups will be deleted after 180 days of inactivity, and what is the maximum amount of time you have to restore a deleted group? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Group 3 only 30 days You can set an expiration policy only for Microsoft 365 groups in Microsoft Entra ID. Any Microsoft 365 group that was deleted can be restored within 30 days by the group owners or the administrator. https://learn.microsoft.com/en-us/entra/identity/users/groups-lifecycle

   Source: Adapted from community discussion — obaemf

   References

   • Microsoft Learn

   

   Next question

8. Question 88 · 496 in bank

   You have a Microsoft Entra tenant that uses Microsoft Entra Permissions Management and contains the accounts shown in the following table:

   

   Which accounts will be listed as assigned to highly privileged roles on the Azure AD insights tab in the Entra Permissions Management portal?

   • AAdmin1 only
   • BAdmin2 and Admin3 only
   • CAdmin2 and Admin4 only
   • DAdmin1, Admin2, and Admin3 only
   • EAdmin2, Admin3, and Admin4 only
   • FAdmin1, Admin2, Admin3, and Admin4

   Show answer

   Answer: C

   Explanation

   I go with D https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference https://learn.microsoft.com/en-us/entra/permissions-management/product-privileged-role-insights Microsoft recommends that organizations have two cloud-only emergency access accounts permanently assigned the Global Administrator role. These accounts are highly privileged and aren't assigned to specific individuals. So I would say Global Administrator role is highly privileged.

   Source: Adapted from community discussion — obaemf

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 89 · 496 in bank

   HOTSPOT - You have a Microsoft Entra tenant that contains the user shown in the following table.

   

   You configure a Conditional Access policy that has the following settings: • Name:CAPolicy1 • Assignments o Users or workload identities: Group1 o Target resources: All cloud apps • Access controls o Grant access: Require multifactor authentication From Microsoft Authenticator settings for the tenant, the Enable and Target settings are configured as shown in the Enable and Target exhibit. (Click the Enable and Target tab.)

   

   From Microsoft Authenticator settings for the tenant, the Configure settings are configured as shown in the Configure exhibit. (Click the Configure tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

10. Question 90 · 496 in bank

    You have a Microsoft Entra tenant that contains three users named User1, User2, and User3. You configure Microsoft Entra Password Protection as shown in the following exhibit.

    

    The users perform the following tasks: • User1 attempts to reset her password to C0nt0s0. • User2 attempts to reset her password to F@brikamHQ. • User3 attempts to reset her password to Pr0duct123. Which password reset attempts fail?

    • AUser1 only
    • BUser2 only
    • CUser3 only
    • DUser1 and User 3 only
    • EUser1, User2, and User3

    Show answer

    Answer: E

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 81. 496 questions available.