ExamGecko
Login
Home / Microsoft / AZ-500 / List of questions
Ask Question

Microsoft AZ-500 Practice Test - Questions Answers, Page 28

List of questions

Question 271

Report
Export
Collapse

You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM). A PIM user that is assigned the User Access Administrator role reports receiving an authorization error when performing a role assignment or viewing the list of assignments.

You need to resolve the issue by ensuring that the PIM service principal has the correct permissions for the subscription. The solution must use the principle of least privilege.

Which role should you assign to the PIM service principle?

Contributor
Contributor
User Access Administrator
User Access Administrator
Managed Application Operator
Managed Application Operator
Resource Policy Contributor
Resource Policy Contributor
Suggested answer: B
asked 02/10/2024
Quoc Nguyen
43 questions

Question 272

Report
Export
Collapse

You have an Azure Active Directory (Azure AD) tenant that contains a user named Admin1. Admin1 is assigned the Application developer role.

You purchase a cloud app named App1 and register App1 in Azure AD.

Admin1 reports that the option to enable token encryption for App1 is unavailable.

You need to ensure that Admin1 can enable token encryption for App1 in the Azure portal.

What should you do?

Upload a certificate for App1.
Upload a certificate for App1.
Modify the API permissions of App1.
Modify the API permissions of App1.
Add App1 as an enterprise application
Add App1 as an enterprise application
Assign Admin1 the Cloud application administrator role.
Assign Admin1 the Cloud application administrator role.
Suggested answer: C

Explanation:

This is a tricky one because uploading a certificate is also required. However, the question states that the Token Encryption option is unavailable. This is because the app is not added as an enterprise application. When the app is added as an enterprise application, the Token Encryption option will be available. Then you can upload the certificate.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption

asked 02/10/2024
Sébastien PIERRE
48 questions

Question 273

Report
Export
Collapse

You plan to deploy an app that will modify the properties of Azure Active Directory (Azure AD) users by using Microsoft Graph.

You need to ensure that the app can access Azure AD.

What should you configure first?

an app registration
an app registration
an external identity
an external identity
a custom role-based access control (RBAC) role
a custom role-based access control (RBAC) role
an Azure AD Application Proxy
an Azure AD Application Proxy
Suggested answer: A

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-areadded

asked 02/10/2024
Demilson Mantegazine
37 questions

Question 274

Report
Export
Collapse

HOTSPOT

You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

Microsoft AZ-500 image Question 4 87515 10022024015441000000

You create a custom RBAC role in Subscription1 by using the following JSON file.

Microsoft AZ-500 image Question 4 87515 10022024015441000000

You assign Role1 to User1 on RG1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 274 87515 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 274 87515 10022024015441000

Explanation:

https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provideroperations#microsoftcompute

asked 02/10/2024
Josefa Vera Gago
39 questions

Question 275

Report
Export
Collapse

HOTSPOT

You have an Azure subscription that contains the resources shown in the following table.

Microsoft AZ-500 image Question 5 87516 10022024015441000000

The subscription is linked to an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

Microsoft AZ-500 image Question 5 87516 10022024015441000000

You create the groups shown in the following table.

Microsoft AZ-500 image Question 5 87516 10022024015441000000

The membership rules for Group1 and Group2 are configured as shown in the following exhibit.

Microsoft AZ-500 image Question 5 87516 10022024015441000000

or each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 275 87516 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 275 87516 10022024015441000

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

asked 02/10/2024
Laura Archilla
36 questions

Question 276

Report
Export
Collapse

You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect.

You create a new Azure subscription.

You discover that the synced on-premises user accounts cannot be assigned roles in the new subscription. You need to ensure that you can assign Azure and Microsoft 365 roles to the synced Azure AD user accounts. What should you do fist?

Configure the Azure AD tenant used by the new subscription to use pass-through authentication.
Configure the Azure AD tenant used by the new subscription to use pass-through authentication.
Configure the Azure AD tenant used by the new subscription to use federated authentication.
Configure the Azure AD tenant used by the new subscription to use federated authentication.
Change the Azure AD tenant used by the new subscription.
Change the Azure AD tenant used by the new subscription.
Configure a second instance of Azure AD Connect.
Configure a second instance of Azure AD Connect.
Suggested answer: C
asked 02/10/2024
frederic dohen
36 questions

Question 277

Report
Export
Collapse

You have an Azure subscription that contains an app named App1. App1 has the app registration shown in the following table.

Microsoft AZ-500 image Question 7 87518 10022024015441000000

You need to ensure that App1 can read all user calendars and create appointments. The solution must use the principle of least privilege.

What should you do?

Add a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.
Add a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.
Add a new Application API permission for Microsoft.Graph Calendars.ReadWrite.
Add a new Application API permission for Microsoft.Graph Calendars.ReadWrite.
Select Grant admin consent.
Select Grant admin consent.
Add new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.Shared.
Add new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.Shared.
Suggested answer: A

Explanation:

Reference: https://docs.microsoft.com/en-us/graph/permissions-reference#calendars-permissions

asked 02/10/2024
Brett Tin
37 questions

Question 278

Report
Export
Collapse

HOTSPOT

You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

Microsoft AZ-500 image Question 8 87519 10022024015441000000

You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:

Assignments: Include Group1, exclude Group2

Conditions: Sign-in risk level: Low and above

Access: Allow access, Require multi-factor authentication

You need to identify what occurs when the users sign in to Azure AD.

What should you identify for each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 278 87519 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 278 87519 10022024015441000

Explanation:

Reference: http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-accesspolicies/ https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protectionpolicies https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protectionrisks

asked 02/10/2024
Rajiv Ranjan
52 questions

Question 279

Report
Export
Collapse

You have an Azure subscription name Sub1 that contains an Azure Policy definition named Policy1. Policy1 has the following settings:

Definition location: Tenant Root Group

Category: Monitoring

You need to ensure that resources that are noncompliant with Policy1 are listed in the Azure Security Center dashboard. What should you do first?

Change the Category of Policy1 to Security Center.
Change the Category of Policy1 to Security Center.
Add Policy1 to a custom initiative.
Add Policy1 to a custom initiative.
Change the Definition location of Policy1 to Sub1.
Change the Definition location of Policy1 to Sub1.
Assign Policy1 to Sub1.
Assign Policy1 to Sub1.
Suggested answer: D

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/governance/policy/overview

asked 02/10/2024
Grant Taylor
58 questions

Question 280

Report
Export
Collapse

You have an Azure subscription.

You plan to create a workflow automation in Azure Security Center that will automatically remediate a security vulnerability. What should you create first?

an automation account
an automation account
a managed identity
a managed identity
an Azure logic app
an Azure logic app
an Azure function app
an Azure function app
an alert rule
an alert rule
Suggested answer: C

Explanation:

Reference: https://docs.microsoft.com/en-us/azure/security-center/workflow-automation

asked 02/10/2024
Bianca Duizer
48 questions
Total 442 questions
Go to page: of 45
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016. You need to deploy Microsoft Antimalware to the virtual machines. Solution: You add an extension to each virtual machine. Does this meet the goal?
Simulation LAB Task 1 You need to ensure that connections from the Internet to VNET1\subnet0 are allowed only over TCP port 7777. The solution must use only currently deployed resources.
You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?
You are configuring and securing a network environment. You deploy an Azure virtual machine named VM1 that is configured to analyze network traffic. You need to ensure that all network traffic is routed through VM1. What should you configure?
HOTSPOT You have an Azure subscription that contains the resources shown in the following table. Transparent Data Encryption (TDE) is disabled on SQL1. You assign policies to the resource groups as shown in the following table. You plan to deploy Azure SQL databases by using an Azure Resource Manager (ARM) template. The databases will be configured as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
You have an Azure subscription that contains the Azure virtual machines shown in the following table. You create an MDM Security Baseline profile named Profile1. You need to identify to which virtual machines Profile1 can be applied. Which virtual machines should you identify?
HOTSPOT You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table. You schedule two update deployments named Update1 and Update2. Update1 updates VM3. Update2 updates VM6. Which additional virtual machines can be updated by using Update1 and Update2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.) You plan to deploy the cluster to production. You disable HTTP application routing. You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address. What should you do?
HOTSPOT You have an Azure key vault. You need to delegate administrative access to the key vault to meet the following requirements: Provide a user named User1 with the ability to set advanced access policies for the key vault. Provide a user named User2 with the ability to add and delete certificates in the key vault. Use the principle of least privilege. What should you use to assign access to each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT You have an Azure subscription that contains the following resources: An Azure key vault An Azure SQL database named Database1 Two Azure App Service web apps named AppSrv1 and AppSrv2 that are configured to use system-assigned managed identities and access Database1 You need to implement an encryption solution for Database1 that meets the following requirements: The data in a column named Discount in Database1 must be encrypted so that only AppSrv1 can decrypt the data. AppSrv1 and AppSrv2 must be authorized by using managed identities to obtain cryptographic keys. How should you configure the encryption settings for Database1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.