AZ-500 practice questions 141–150

1. Question 141 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the Azure Active Directory (Azure AD) resources shown in the following table.

   

   You create the groups shown in the following table.

   

   Which resources can you add to Group5 and Group6? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is Group5: User1, Group1, Managed1 Group6: User1 Here is why: https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-learn-about-groups#group-types Members of a security group can include users, devices, other groups, and service principals, which define access policy and permissions. Owners of a security group can include users and service principals. Members of a Microsoft 365 group can only include users.

   Source: Adapted from community discussion — orcnylmz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 142 · 496 in bank

   DRAG DROP - You are implementing conditional access policies. You must evaluate the existing Azure Active Directory (Azure AD) risk events and risk levels to configure and implement the policies. You need to identify the risk level of the following risk events: ✑ Users with leaked credentials ✑ Impossible travel to atypical locations ✑ Sign-ins from IP addresses with suspicious activity Which level should you identify for each risk event? To answer, drag the appropriate levels to the correct risk events. Each level may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Azure AD Identity protection can detect six types of suspicious sign-in activities: ✑ Users with leaked credentials ✑ Sign-ins from anonymous IP addresses ✑ Impossible travel to atypical locations Sign-ins from infected devices - ✑ Sign-ins from IP addresses with suspicious activity ✑ Sign-ins from unfamiliar locations These six types of events are categorized in to 3 levels of risks ג€" High, Medium & Low: References: http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

   Source: Adapted from community discussion — awfnewf1q243

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 143 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains three security groups named Group1, Group2, and Group3 and the users shown in the following table.

   

   Group3 is a member of Group2. In contoso.com, you register an enterprise application named App1 that has the following settings: ✑ Owners: User1 ✑ Users and groups: Group2 You configure the properties of App1 as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select no. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/assign-user-or-group-access-portal

   Source: Adapted from community discussion — Joshing

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 144 · 496 in bank

   Select 2

   You have an Azure subscription that contains the resources shown in the following table.

   

   You need to ensure that ServerAdmins can perform the following tasks: ✑ Create virtual machines in RG1 only. ✑ Connect the virtual machines to the existing virtual networks in RG2 only. The solution must use the principle of least privilege. Which two role-based access control (RBAC) roles should you assign to ServerAdmins? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aa custom RBAC role for RG2
   • Bthe Network Contributor role for RG2
   • Cthe Contributor role for the subscription
   • Da custom RBAC role for the subscription
   • Ethe Network Contributor role for RG1
   • Fthe Virtual Machine Contributor role for RG1

   Show answer

   Answer: AF

   Explanation

   A. a custom RBAC role for RG2 - would provide least priv over RG2 B. the Network Contributor role for RG2 - provides too much priv over RG2 C. the Contributor role for the subscription - Cannot be C D. a custom RBAC role for the subscription - to much permission E. the Network Contributor role for RG1 - Cannot be E F. the Virtual Machine Contributor role for RG1 - required to create VM's Therefore A and F would provide least priv to perform tasks.

   Source: Adapted from community discussion — Eltooth

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 145 · 496 in bank

   HOTSPOT - Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD). The Azure AD tenant contains the users shown in the following table.

   

   You configure the Authentication methods `" Password Protection settings for adatum.com as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad

   Source: Adapted from community discussion — maylevi

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 146 · 496 in bank

   HOTSPOT - Your company has an Azure subscription named Subscription1. Subscription1 is associated with the Azure Active Directory tenant that includes the users shown in the following table.

   

   The company is sold to a new owner. The company needs to transfer ownership of Subscription1. Which user can transfer the ownership and which tool should the user use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/billing-subscription-transfer

   Source: Adapted from community discussion — Ikazimirs

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 147 · 496 in bank

   You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM). A PIM user that is assigned the User Access Administrator role reports receiving an authorization error when performing a role assignment or viewing the list of assignments. You need to resolve the issue by ensuring that the PIM service principal has the correct permissions for the subscription. The solution must use the principle of least privilege. Which role should you assign to the PIM service principle?

   • AContributor
   • BUser Access Administrator
   • CManaged Application Operator
   • DResource Policy Contributor

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-troubleshoot#access-to-azure-resources-denied Assign the User Access Administrator role to the Privileged identity Management service principal name (MS–PIM) at the subscription level. This assignment should allow the Privileged identity Management service to access the Azure resources.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 148 · 496 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains a user named Admin1. Admin1 is assigned the Application developer role. You purchase a cloud app named App1 and register App1 in Azure AD. Admin1 reports that the option to enable token encryption for App1 is unavailable. You need to ensure that Admin1 can enable token encryption for App1 in the Azure portal. What should you do?

   • AUpload a certificate for App1.
   • BModify the API permissions of App1.
   • CAdd App1 as an enterprise application.
   • DAssign Admin1 the Cloud application administrator role.

   Show answer

   Answer: A

   Explanation

   Yes, but the option is only available in portal for Enterprise Apps created as such from start: "The Token encryption option is only available for SAML applications that have been set up from the Enterprise applications blade in the Azure portal, either from the Application Gallery or a Non-Gallery app. For other applications, this menu option is disabled." https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption?tabs=azure-portal For plain App Registratrions you edit the application manifest under Manifest (see the same doc above). "Set the value for the tokenEncryptionKeyId attribute."

   Source: Adapted from community discussion — ConanBarb

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 149 · 496 in bank

   You plan to deploy an app that will modify the properties of Azure Active Directory (Azure AD) users by using Microsoft Graph. You need to ensure that the app can access Azure AD. What should you configure first?

   • Aan app registration
   • Ban external identity
   • Ca custom role-based access control (RBAC) role
   • Dan Azure AD Application Proxy

   Show answer

   Answer: A

   Next question

10. Question 150 · 496 in bank

    HOTSPOT - You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

    

    You create a custom RBAC role in Subscription1 by using the following JSON file.

    

    You assign Role1 to User1 on RG1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftcompute

    Source: Adapted from community discussion — wsrudmen

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 141. 496 questions available.