An administrator at your company created a Conditional Access policy that blocks access to the Azure portal for users in the 'Contractors' group. The policy is in 'Report-only' mode. The security team wants to enforce this policy after a testing period. What should you do?

Assign the policy to the Contractors group in addition to the existing assignment.

Change the policy's mode from 'Report-only' to 'On'.

Delete the report-only policy and recreate it as an enabled policy.

Create a new policy with the same settings and set it to 'On'.

You need to update a custom role definition in Microsoft Entra ID to change the permissions of an administrative role. Which tool should you use?

Azure CLI with az role definition update

Azure portal (subscription blade)

Your organization has a Conditional Access policy that requires MFA for all users when accessing the Azure portal. A group of users in the 'IT' department reports that they are not prompted for MFA when accessing the Azure portal from a specific IP address. You need to determine why the policy is not applying. What should you do first?

Check if the IP address is included in the policy's location condition as a trusted location.

Check if the IT users are excluded from the policy.

Verify that the users have registered for MFA.

Check the sign-in logs for the users to see if MFA was required.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 1

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 1)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

15–20%of the exam

Questions 1–5

1application · easy
An administrator at your company created a Conditional Access policy that blocks access to the Azure portal for users in the 'Contractors' group. The policy is in 'Report-only' mode. The security team wants to enforce this policy after a testing period. What should you do?
Select an answer first
2foundation · easy
You need to enforce multi-factor authentication for all users accessing the Azure portal. Which Microsoft Entra feature should you configure?
Select an answer first
3foundation · easy
You need to update a custom role definition in Microsoft Entra ID to change the permissions of an administrative role. Which tool should you use?
Select an answer first
4foundation · easy
You need to create a custom Azure role that allows a user to restart virtual machines but not create or delete them. Which JSON element is required to define the allowed actions in a custom role definition?
Select an answer first
5expert · hard
Your organization has a Conditional Access policy that requires MFA for all users when accessing the Azure portal. A group of users in the 'IT' department reports that they are not prompted for MFA when accessing the Azure portal from a specific IP address. You need to determine why the policy is not applying. What should you do first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 1)

Questions 1–5

An administrator at your company created a Conditional Access policy that blocks access to the Azure portal for users in the 'Contractors' group. The policy is in 'Report-only' mode. The security team wants to enforce this policy after a testing period. What should you do?

You need to enforce multi-factor authentication for all users accessing the Azure portal. Which Microsoft Entra feature should you configure?

You need to update a custom role definition in Microsoft Entra ID to change the permissions of an administrative role. Which tool should you use?

You need to create a custom Azure role that allows a user to restart virtual machines but not create or delete them. Which JSON element is required to define the allowed actions in a custom role definition?

Keep studying — Secure identity and access