Microsoft AZ-500 QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
,Domain 1: Manage Identity and Access (Questions 1–30)
1. Which Azure AD feature allows conditional access based on device compliance?
A) Azure AD Connect
B) Conditional Access policies
C) Azure AD B2C
D) Privileged Identity Management
Answer: B
Rationale: Conditional Access policies evaluate signals like device compliance, user risk, location, and app
sensitivity to enforce access controls.
2. What is the primary purpose of Azure AD Privileged Identity Management (PIM)?
A) To sync on-premises identities
B) To provide just-in-time privileged access
C) To manage guest users
,D) To enforce MFA
Answer: B
Rationale: PIM enables just-in-time role activation, approval workflows, and time-bound access to privileged
roles.
3. Which authentication method is considered phishing-resistant?
A) SMS OTP
B) Security keys (FIDO2)
C) Voice call
D) Email OTP
Answer: B
Rationale: FIDO2 security keys are phishing-resistant because they are bound to the origin and use public-key
cryptography.
4. Which Azure AD feature provides identity protection by detecting risky sign-ins?
A) Azure AD Identity Protection
B) Azure Sentinel
C) Defender for Identity
, D) Azure Firewall
Answer: A
Rationale: Azure AD Identity Protection detects and remediates identity-based risks like leaked credentials and
risky sign-ins.
5. What does a Conditional Access "grant" control do?
A) Blocks all access
B) Enforces requirements like MFA or compliant device
C) Logs access attempts
D) Assigns roles
Answer: B
Rationale: Grant controls enforce requirements that must be met before access is granted.
6. Which role allows managing all Azure resources but not granting access to others?
A) Owner
B) Contributor
C) Reader
D) User Access Administrator
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
,Domain 1: Manage Identity and Access (Questions 1–30)
1. Which Azure AD feature allows conditional access based on device compliance?
A) Azure AD Connect
B) Conditional Access policies
C) Azure AD B2C
D) Privileged Identity Management
Answer: B
Rationale: Conditional Access policies evaluate signals like device compliance, user risk, location, and app
sensitivity to enforce access controls.
2. What is the primary purpose of Azure AD Privileged Identity Management (PIM)?
A) To sync on-premises identities
B) To provide just-in-time privileged access
C) To manage guest users
,D) To enforce MFA
Answer: B
Rationale: PIM enables just-in-time role activation, approval workflows, and time-bound access to privileged
roles.
3. Which authentication method is considered phishing-resistant?
A) SMS OTP
B) Security keys (FIDO2)
C) Voice call
D) Email OTP
Answer: B
Rationale: FIDO2 security keys are phishing-resistant because they are bound to the origin and use public-key
cryptography.
4. Which Azure AD feature provides identity protection by detecting risky sign-ins?
A) Azure AD Identity Protection
B) Azure Sentinel
C) Defender for Identity
, D) Azure Firewall
Answer: A
Rationale: Azure AD Identity Protection detects and remediates identity-based risks like leaked credentials and
risky sign-ins.
5. What does a Conditional Access "grant" control do?
A) Blocks all access
B) Enforces requirements like MFA or compliant device
C) Logs access attempts
D) Assigns roles
Answer: B
Rationale: Grant controls enforce requirements that must be met before access is granted.
6. Which role allows managing all Azure resources but not granting access to others?
A) Owner
B) Contributor
C) Reader
D) User Access Administrator
