Your company uses Microsoft Entra Privileged Identity Management (PIM) to manage the Global Administrator role. The security team wants to ensure that when an administrator activates the role, they must provide a business justification and the activation should expire after 4 hours. The activation should also require Azure AD Multi-Factor Authentication. What should you configure in PIM?

Modify the Global Administrator role assignment to be eligible for 4 hours and require MFA at assignment time.

Enable PIM and configure an access review for the Global Administrator role with a 4-hour review period.

Edit the role settings for Global Administrator to require MFA on activation, set maximum activation duration to 4 hours, and require justification on activation.

Create a Conditional Access policy that requires MFA for the Global Administrator role and set the session timeout to 4 hours.

A company has an existing Conditional Access policy that requires MFA for all users when accessing Microsoft 365 apps. They now want to add a policy that blocks access from untrusted locations for the same apps. What should they do?

Create a new Conditional Access policy that targets Microsoft 365 apps, includes a condition for untrusted locations, and sets the grant control to 'Block access'.

Add the untrusted locations to the existing policy's 'Exclude' list.

Modify the existing policy to add a condition for locations and change the grant control to 'Block access'.

Disable the existing MFA policy and create a new policy that requires MFA and blocks untrusted locations.

Microsoft Certified:Azure Security Engineer Associate

Domain 1Objective 1

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 5)

Part of the Secure identity and access domain, which accounts for 15–20% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~6–13 in this domain), expect 3–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

8concepts

15–20%of the exam

Questions 21–25

21foundation · easy
You need to assign a built-in role to a group so that the group's members can view all resources in a subscription but cannot make any changes. Which built-in role should you assign?
Select an answer first
22foundation · easy
You are creating a custom Azure role definition using Azure PowerShell. Which cmdlet should you use to create the role definition?
Select an answer first
23application · medium
Your company uses Microsoft Entra Privileged Identity Management (PIM) to manage the Global Administrator role. The security team wants to ensure that when an administrator activates the role, they must provide a business justification and the activation should expire after 4 hours. The activation should also require Azure AD Multi-Factor Authentication. What should you configure in PIM?
Select an answer first
24foundation · easy
You need to create a Conditional Access policy that blocks access to the Azure portal for users located in a specific country. Which condition should you configure in the policy?
Select an answer first
25application · medium
A company has an existing Conditional Access policy that requires MFA for all users when accessing Microsoft 365 apps. They now want to add a policy that blocks access from untrusted locations for the same apps. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Manage Security Controls for Identity and Access AZ-500 Practice Questions (Page 5)

Questions 21–25

You need to assign a built-in role to a group so that the group's members can view all resources in a subscription but cannot make any changes. Which built-in role should you assign?

You are creating a custom Azure role definition using Azure PowerShell. Which cmdlet should you use to create the role definition?

You need to create a Conditional Access policy that blocks access to the Azure portal for users located in a specific country. Which condition should you configure in the policy?

A company has an existing Conditional Access policy that requires MFA for all users when accessing Microsoft 365 apps. They now want to add a policy that blocks access from untrusted locations for the same apps. What should they do?

Keep studying — Secure identity and access