AZ-500 practice questions 131–140

1. Question 131 · 496 in bank

   Your network contains an on-premises Active Directory domain named corp.contoso.com. You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You sync all on-premises identities to Azure AD. You need to prevent users who have a givenName attribute that starts with TEST from being synced to Azure AD. The solution must minimize administrative effort. What should you use?

   • ASynchronization Rules Editor
   • BWeb Service Configuration Tool
   • Cthe Azure AD Connect wizard
   • DActive Directory Users and Computers

   Show answer

   Answer: A

   Explanation

   I have implemented editing attributes synchronization in Azure AD Connect. And this possible with the Azure AD connect rules editor, which edits the synchronization rules.

   Source: Adapted from community discussion — kristiann21

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 132 · 496 in bank

   You have an Azure subscription that contains the users shown in the following table.

   

   Which users can enable Azure AD Privileged Identity Management (PIM)?

   • AUser2 and User3 only
   • BUser1 and User2 only
   • CUser2 only
   • DUser1 only

   Show answer

   Answer: A

   Explanation

   The given answer is incorrect. This question is asking who can enable PIM? To enable PIM there are 3 main steps: - Login to Azure Portal as a Global Admin. - Consent to PIM - You are asked to verify your identity with MFA. If you haven't set up MFA yet you are asked to complete MFA setup before you can consent PIM. Reference: https://github.com/MicrosoftDocs/azure-docs/commit/755069f4ff7430f739b1933dc082dffe9b6d564f#diff-38273a45d682dbc4e8ca5cb8548a045af63218005855ec067b0707aaa9d406f0 In this case, User2 can enable Azure PIM. How about user3? Yes it can because when MFA is asked the MFA state is changed to Enabled and User3 just needs to complete MFA setup before it can consent and enable PIM. The correct answer is A - User2 and User3 only.

   Source: Adapted from community discussion — teehex

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 133 · 496 in bank

   You have an Azure subscription. You plan to create a custom role-based access control (RBAC) role that will provide permission to read the Azure Storage account. Which property of the RBAC role definition should you configure?

   • ANotActions []
   • BDataActions []
   • CAssignableScopes []
   • DActions []

   Show answer

   Answer: D

   Explanation

   The Actions permission specifies the management operations that the role allows to be performed. It is a collection of operation strings that identify securable operations of Azure resource providers (in this case it is Microsoft.Storage). The DataActions permission specifies the data operations that the role allows to be performed to your data within that object. Correct answer is D - Action[]

   Source: Adapted from community discussion — teehex

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 134 · 496 in bank

   HOTSPOT - You have a Microsoft Entra tenant named contoso.com. You collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com. Fabrikam.com has multi-factor authentication (MFA) enabled for all users. Contoso.com has the Cross-tenant access settings configured as shown in the Cross-tenant access settings exhibit. (Click the Cross-tenant access settings tab.)

   

   Contoso.com has the External collaboration settings configured as shown in the External collaboration settings exhibit. (Click the External collaboration settings tab.)

   

   You create a Conditional Access policy that has the following settings: • Name: CAPolicy1 • Assignments o Guest or external users: B2B collaboration guest users o Target resources - Include: All cloud apps • Access controls - Grant access • Require device to be marked as compliant • Require multi-factor authentication - Enable policy: On For each of the following statements, select Yes if the statement is true, otherwise select No. NOTE: Each correct section is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1: yes; 2: no; 3: yes 1: allowed by the Conditional Policy; 2: enable the Trust Settings would be correct, but the Conditional Policy requires MFA; 3: because of the Guest User Access Restrictions -> … have the same Access as Members …

   Source: Adapted from community discussion — Andreas_Czech

   

   Next question

5. Question 135 · 496 in bank

   HOTSPOT - You have the hierarchy of Azure resources shown in the following exhibit.

   

   RG1, RG2, and RG3 are resource groups. RG2 contains a virtual machine named VM2. You assign role-based access control (RBAC) roles to the users shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct answers. 1) Yes Source : https://docs.microsoft.com/fr-fr/azure/governance/management-groups/overview 2) Yes The role has this rights : Microsoft.Compute/virtualMachines/* Perform all virtual machine actions including create, update, delete, start, restart, and power off virtual machines. Execute predefined scripts on virtual machines. Source : https://docs.microsoft.com/fr-fr/azure/role-based-access-control/built-in-roles#virtual-machine-contributor 3) No Virtual Machine Administrator Login -> View Virtual Machines in the portal and login as administrator Source : https://docs.microsoft.com/fr-fr/azure/role-based-access-control/built-in-roles

   Source: Adapted from community discussion — Geeky93

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 136 · 496 in bank

   HOTSPOT - You plan to implement an Azure function named Function1 that will create new storage accounts for containerized application instances. You need to grant Function1 the minimum required privileges to create the storage accounts. The solution must minimize administrative effort. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/howto-assign-access-portal

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 137 · 496 in bank

   You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant. From the Azure portal, you register an enterprise application. Which additional resource will be created in Azure AD?

   • Aa service principal
   • Ban X.509 certificate
   • Ca managed identity
   • Da user account

   Show answer

   Answer: A

   Explanation

   https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal#app-registration-app-objects-and-service-principals "There is no way to directly create a service principal using the Azure portal. When you register an application through the Azure portal, an application object and service principal are automatically created in your home directory or tenant."

   Source: Adapted from community discussion — examtopics6969

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 138 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains the resources shown in the following table.

   

   User2 is the owner of Group2. The user and group settings for App1 are configured as shown in the following exhibit.

   

   You enable self-service application access for App1 as shown in the following exhibit.

   

   User3 is configured to approve access to App1. After you enable self-service application access for App1, who will be configured as the Group2 owner and who will be configured as the App1 users? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/manage-self-service-access

   Source: Adapted from community discussion — Crawfork

   

   Next question

9. Question 139 · 496 in bank

   HOTSPOT - You have a management group named Group1 that contains an Azure subscription named sub1. Sub1 has a subscription ID of 11111111-1234-1234-1234- 1111111111. You need to create a custom Azure role-based access control (RBAC) role that will delegate permissions to manage the tags on all the objects in Group1. What should you include in the role definition of Role1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Note: Assigning a custom RBAC role as the Management Group level is currently in preview only. So, for now the answer to the assignable scope is the subscription level. Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal#step-5-assignable-scopes

   Source: Adapted from community discussion — NarenderSingh

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 140 · 496 in bank

    HOTSPOT - You have an Azure subscription that contains the custom roles shown in the following table.

    

    In the Azure portal, you plan to create new custom roles by cloning existing roles. The new roles will be configured as shown in the following table.

    

    Which roles can you clone to create each new role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-create https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal

    Source: Adapted from community discussion — vaaws

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 131. 496 questions available.