AZ-500 practice questions 121–130

1. Question 121 · 496 in bank

   Select 2

   You have an Azure Active Directory (Azure AD) tenant. You have the deleted objects shown in the following table.

   

   On May 4, 2020, you attempt to restore the deleted objects by using the Azure Active Directory admin center. Which two objects can you restore? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AGroup1
   • BGroup2
   • CUser2
   • DUser1

   Show answer

   Answer: BC

   Explanation

   B and C are correct. If you delete a security group - its gone. Forever. Immediately. User 3 was deleted over 30 days ago, hence no longer within the 30 day AAD "recycle bin". O365 group and user deleted within 30 days so able to restore.

   Source: Adapted from community discussion — Eltooth

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 122 · 496 in bank

   HOTSPOT - You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

   

   You create an Azure role by using the following JSON file.

   

   You assign Role1 to User1 for RG1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#compute

   Source: Adapted from community discussion — Outbreak

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 123 · 496 in bank

   Select 2

   You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1. You plan to publish several apps in the tenant. You need to ensure that User1 can grant admin consent for the published apps. Which two possible user roles can you assign to User1 to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ASecurity administrator
   • BCloud application administrator
   • CApplication administrator
   • DUser administrator
   • EApplication developer

   Show answer

   Answer: BC

   Explanation

   Granting tenant-wide admin consent requires you to sign in as Global Administrator, an Application Administrator, or a Cloud Application Administrator.

   Source: Adapted from community discussion — arunjana

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 124 · 496 in bank

   You have an Azure subscription that is associated with an Azure Active Directory (Azure AD) tenant. When a developer attempts to register an app named App1 in the tenant, the developer receives the error message shown in the following exhibit.

   

   You need to ensure that the developer can register App1 in the tenant. What should you do for the tenant?

   • AModify the Directory properties.
   • BSet Enable Security defaults to Yes.
   • CConfigure the Consent and permissions settings for enterprise applications.
   • DModify the User settings.

   Show answer

   Answer: D

   Explanation

   Answer correct. Microsoft itself uses the default configuration with users able to register applications and consent to applications on their own behalf. To prevent users from registering their own applications: In the Azure portal, go to the User settings section under Azure Active Directory Change Users can register applications to No.

   Source: Adapted from community discussion — JohnYinToronto

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 125 · 496 in bank

   You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant and a user named User1. The App registrations settings for the tenant are configured as shown in the following exhibit.

   

   You plan to deploy an app named App1. You need to ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which role should you assign to User1?

   • AApp Configuration Data Owner for the subscription
   • BManaged Application Contributor for the subscription
   • CCloud application administrator in Azure AD
   • DApplication developer in Azure AD

   Show answer

   Answer: D

   Explanation

   Correct Answer Application Developer Users in this role can create application registrations when the "Users can register applications" setting is set to No. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-developer

   Source: Adapted from community discussion — SIDNASIR

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 126 · 496 in bank

   You have the Azure virtual machines shown in the following table.

   

   Each virtual machine has a single network interface. You add the network interface of VM1 to an application security group named ASG1. You need to identify the network interfaces of which virtual machines you can add to ASG1. What should you identify?

   • AVM2 only
   • BVM2 and VM3 only
   • CVM2, VM3, VM4, and VM5
   • DVM2, VM3, and VM5 only

   Show answer

   Answer: B

   Explanation

   All network interfaces assigned to an application security group have to exist in the same virtual network that the first network interface assigned to the application security group is in. For example, if the first network interface assigned to an application security group named AsgWeb is in the virtual network named VNet1, then all subsequent network interfaces assigned to ASGWeb must exist in VNet1. You cannot add network interfaces from different virtual networks to the same application security group.

   Source: Adapted from community discussion — MarioMK

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 127 · 496 in bank

   SIMULATION - You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com. The new directory must contain a user named user12345678 who is configured to sign in by using Azure Multi-Factor Authentication (MFA).

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To create a new Azure AD tenant: 1. Browse to the Azure portal and sign in with an account that has an Azure subscription. 2. Select the plus icon (+) and search for Azure Active Directory. 3. Select Azure Active Directory in the search results. 4. Select Create. 5. Provide an Organization name (12345678) and an Initial domain name (12345678). Then select Create. This will create the directory named 12345678.onmicrosoft.com. 6. After directory creation is complete, select the information box to manage your new directory. To create the user: 1. In the Azure portal, make sure you are on the Azure Active Directory fly out. If not, select the Azure Active Directory icon from the left services navigation. 2. Under Manage, select Users. 3. Select All users and then select + New user. 4. Provide a Name and User name (user12345678) for the user. When you're done, select Create. To enable MFA: 1. In the Azure portal, make sure you are on the Azure Active Directory fly out. If not, select the Azure Active Directory icon from the left services navigation. 2. Under Manage, select Users. 3. Click on the Multi-Factor Authentication link. 4. Tick the checkbox next to the user's name and click the Enable link. Reference: https://docs.microsoft.com/en-us/power-bi/developer/create-an-azure-active-directory-tenant

   Source: Adapted from community discussion — cfsxtuv33

   References

   • Microsoft Learn

   

   Next question

8. Question 128 · 496 in bank

   You have an Azure subscription named Subcription1 that contains an Azure Active Directory (Azure AD) tenant named contoso.com and a resource group named RG1. You create a custom role named Role1 for contoso.com. Where you can use Role1 for permission delegation?

   • Acontoso.com only
   • Bcontoso.com and RG1 only
   • Ccontoso.com and Subscription1 only
   • Dcontoso.com, RG1, and Subscription1

   Show answer

   Answer: A

   Explanation

   I don't think so. There are 2 types of roles: 1. Azure roles 2. Azure AD roles. Both of them can be created as custom roles. Since the question says: "You create a custom role named Role1 for contoso.com." - we may assume we are dealing with Azure AD roles here. According MS for AD roles: "Scope can be specified at the tenant level (organization-wide), administrative unit, or on an individual object (for example, a specific application)" See https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#differences-between-azure-roles-and-azure-ad-roles

   Source: Adapted from community discussion — licna

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 129 · 496 in bank

   You have an Azure subscription. You enable Azure Active Directory (Azure AD) Privileged Identity Management (PIM). Your company's security policy for administrator accounts has the following conditions: ✑ The accounts must use multi-factor authentication (MFA). ✑ The accounts must use 20-character complex passwords. ✑ The passwords must be changed every 180 days. ✑ The accounts must be managed by using PIM. You receive multiple alerts about administrators who have not changed their password during the last 90 days. You need to minimize the number of generated alerts. Which PIM alert should you modify?

   • ARoles are being assigned outside of Privileged Identity Management
   • BRoles don't require multi-factor authentication for activation
   • CAdministrators aren't using their privileged roles
   • DPotential stale accounts in a privileged role

   Show answer

   Answer: D

   Explanation

   Outdated question 09/2022. Per Microsoft link "This alert is no longer triggered based on the last password change date of for an account. This alert is for accounts in a privileged role that haven't signed in during the past n days, where n is a number of days that is configurable between 1-365 days."

   Source: Adapted from community discussion — Brodini

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 130 · 496 in bank

    Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD). Azure AD Connect is installed on a domain member server named Server1. You need to ensure that a domain administrator for the adatum.com domain can modify the synchronization options. The solution must use the principle of least privilege. Which Azure AD role should you assign to the domain administrator?

    • ASecurity administrator
    • BGlobal administrator
    • CUser administrator

    Show answer

    Answer: B

    Explanation

    This is an old question. The new role for least privileged is: Hybrid Identity Administrator on the newer versions of AAD. But in this question, B is correct.

    Source: Adapted from community discussion — Pearthfect

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 121. 496 questions available.