AZ-500 practice questions 111–120

1. Question 111 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings: ✑ Assignments: Include Group1, exclude Group2 ✑ Conditions: Sign-in risk level: Medium and above ✑ Access: Allow access, Require multi-factor authentication You need to identify what occurs when the users sign in to Azure AD. What should you identify for each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   References: http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/ https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

   Source: Adapted from community discussion — Bjarki2330

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 112 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   In Azure AD Privileged Identity Management (PIM), the Role settings for the Contributor role are configured as shown in the exhibit. (Click the Exhibit tab.)

   

   You assign users the Contributor role on May 1, 2019 as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   References: https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-resource-roles-assign-roles

   Source: Adapted from community discussion — hang10z

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 113 · 496 in bank

   HOTSPOT - You work at a company named Contoso, Ltd. that has the offices shown in the following table.

   

   Contoso has an Azure Active Directory (Azure AD) tenant named contoso.com. All contoso.com users have Azure Multi-Factor Authentication (MFA) enabled. The tenant contains the users shown in the following table.

   

   The multi-factor authentication settings for contoso.com are configured as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box1: No. because user1 had already signed in from device1 and had selected the 14 day period hence, won't be asked for MFA. Box2: No because Boston IP range is trusted. Box3: Yes because new device and Seattle IP is not trusted.

   Source: Adapted from community discussion — Pinto

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 114 · 496 in bank

   Select 2

   You have an Azure subscription. You configure the subscription to use a different Azure Active Directory (Azure AD) tenant. What are two possible effects of the change? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ARole assignments at the subscription level are lost.
   • BVirtual machine managed identities are lost.
   • CVirtual machine disk snapshots are lost.
   • DExisting Azure resources are deleted.

   Show answer

   Answer: AB

   Explanation

   Review the following list of changes that will occur after you associate or add your subscription, and how you might be affected: Users that have been assigned roles using RBAC will lose their access Service Administrator and Co-Administrators will lose access If you have any key vaults, they'll be inaccessible and you'll have to fix them after association If you have any managed identities for resources such as Virtual Machines or Logic Apps, you must re-enable or recreate them after the association If you have a registered Azure Stack, you'll have to re-register it after association https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-subscriptions-associated-directory

   Source: Adapted from community discussion — Exam_Master_Me

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 115 · 496 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You generate new SASs. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   I agree with B as just creating a new one does not effect the currently created SASs - so either delete, rename as stated or you could also regenerate the KEY used to create the SAS which would have teh effect of disabling all SASs created with that previous generated key.

   Source: Adapted from community discussion — PDR

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 116 · 496 in bank

   You have an Azure subscription that contains virtual machines. You enable just in time (JIT) VM access to all the virtual machines. You need to connect to a virtual machine by using Remote Desktop. What should you do first?

   • AFrom Azure Directory (Azure AD) Privileged Identity Management (PIM), activate the Security administrator user role.
   • BFrom Azure Active Directory (Azure AD) Privileged Identity Management (PIM), activate the Owner role for the virtual machine.
   • CFrom the Azure portal, select the virtual machine, select Connect, and then select Request access.
   • DFrom the Azure portal, select the virtual machine and add the Network Watcher Agent virtual machine extension.

   Show answer

   Answer: C

   Explanation

   But the question is not mentioning any changes to any NSG that might affect the VM, just an access request after configuring JIT

   Source: Adapted from community discussion — OpsecDude

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 117 · 496 in bank

   HOTSPOT - Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.

   

   The tenant contains the groups shown in the following table.

   

   You configure a multi-factor authentication (MFA) registration policy that has the following settings: ✑ Assignments: - Include: Group1 - Exclude: Group2 ✑ Controls: Require Azure MFA registration ✑ Enforce Policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Y = USER 1 IS ONLY ASSIGNED TO GROUP 1 WHICH ENFORCES MFA REGISTRATION. N = USER 2 BELONGS TO, BOTH, GROUP 1 AND 2 WHICH IS EXCLUDED. WHEN THERE IS A CONFLICT THE EXCLUSION WINS OUT. Y = USER 3 BELONGS SOLELY TO GROUP 1 AS DOES USER 1 AND WILL NEED TO REGISTER WITH MFA DO TO THE ENFORECMENT.

   Source: Adapted from community discussion — heatfan900

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 118 · 496 in bank

   SIMULATION - The developers at your company plan to publish an app named App12345678 to Azure. You need to ensure that the app is registered to Azure Active Directory (Azure AD). The registration must use the sign-on URLs of https://app.contoso.com. To complete this task, sign in to the Azure portal and modify the Azure resources.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Register the Application 1. Sign in to your Azure Account through the Azure portal. 2. Select Azure Active Directory. 3. Select App registrations. 4. Select New registration. 5. Name the application App12345678. Select a supported account type, which determines who can use the application. Under Redirect URI, select Web for the type of application you want to create. Enter the URI: https://app.contoso.com , where the access token is sent to. 6. Click Register Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

   Source: Adapted from community discussion — somenick

   

   Next question

9. Question 119 · 496 in bank

   You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. The User administrator role is assigned to a user named Admin1. An external partner has a Microsoft account that uses the user1@outlook.com sign in. Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: `Unable to invite user user1@outlook.com Generic authorization exception.` You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant. What should you do?

   • AFrom the Roles and administrators blade, assign the Security administrator role to Admin1.
   • BFrom the Organizational relationships blade, add an identity provider.
   • CFrom the Custom domain names blade, add a custom domain.
   • DFrom the Users blade, modify the External collaboration settings.

   Show answer

   Answer: D

   Explanation

   Right ans, Go to AAD -> Users -> User Settings -> "Manage External Collaboration Settings", here you need to allow "Guest Invite"

   Source: Adapted from community discussion — milind8451

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 120 · 496 in bank

    Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant. You need to recommend an integration solution that meets the following requirements: ✑ Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant ✑ Minimizes the number of servers required for the solution. Which authentication method should you include in the recommendation?

    • Afederated identity with Active Directory Federation Services (AD FS)
    • Bpassword hash synchronization with seamless single sign-on (SSO)
    • Cpass-through authentication with seamless single sign-on (SSO)

    Show answer

    Answer: C

    Explanation

    This is the breaking point, actually password policies is not like GPO(GPOs are only in AADDS and ADDS, no such thing like GPOs in AAD) ---- ✑ Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant Also, we need to have less servers to manage ✑ Minimizes the number of servers required for the solution. Which authentication method should you include in the recommendation? A. federated identity with Active Directory Federation Services (AD FS) - completely not matching our requirements. B. password hash synchronization with seamless single sign-on (SSO) - this is match C. pass-through authentication with seamless single sign-on (SSO) - this is match as well. Why B is more correct? Because both authentication methods enforce password policies, but with B we do not have to manage large on prem infrastructure in order to protect sign in process. Which meets the second requirements in the question - minimize the servers required. At first I got confused as well, but in question they are talking about password policies not GPOs. Which make sense why B is the correct one.

    Source: Adapted from community discussion — Ilko

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 111. 496 questions available.