AZ-500 practice questions 151–160

1. Question 151 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   The subscription is linked to an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   You create the groups shown in the following table.

   

   The membership rules for Group1 and Group2 are configured as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

   Source: Adapted from community discussion — SeNsE

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 152 · 496 in bank

   You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect. You create a new Azure subscription. You discover that the synced on-premises user accounts cannot be assigned roles in the new subscription. You need to ensure that you can assign Azure and Microsoft 365 roles to the synced Azure AD user accounts. What should you do fist?

   • AConfigure the Azure AD tenant used by the new subscription to use pass-through authentication.
   • BConfigure the Azure AD tenant used by the new subscription to use federated authentication.
   • CChange the Azure AD tenant used by the new subscription.
   • DConfigure a second instance of Azure AD Connect.

   Show answer

   Answer: C

   Explanation

   C, When you create a new Azure subscription, it is associated with an Azure AD tenant. If the synced on-premises user accounts cannot be assigned roles in the new subscription, it might be because the Azure AD tenant associated with the new subscription is not the same as the one you've been synchronizing with using Azure AD Connect. Changing the Azure AD tenant to match the one you've been synchronizing with will allow you to assign roles to synced user accounts correctly.

   Source: Adapted from community discussion — Sujeeth

   References

   • Microsoft Learn

   Next question

3. Question 153 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

   

   You create and enforce an Azure AD Identity Protection user risk policy that has the following settings: ✑ Assignment: Include Group1, Exclude Group2 ✑ Conditions: Sign-in risk of Medium and above ✑ Access: Allow access, Require password change For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - User1 is member of Group1. Sign in from unfamiliar location is risk level Medium. Box 2: Yes - User2 is member of Group1. Sign in from anonymous IP address is risk level Medium. Box 3: No - Sign-ins from IP addresses with suspicious activity is low. Note: Azure AD Identity protection can detect six types of suspicious sign-in activities: ✑ Users with leaked credentials ✑ Sign-ins from anonymous IP addresses ✑ Impossible travel to atypical locations ✑ Sign-ins from infected devices ✑ Sign-ins from IP addresses with suspicious activity ✑ Sign-ins from unfamiliar locations These six types of events are categorized in to 3 levels of risks ג€" High, Medium & Low: References: http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

   Source: Adapted from community discussion — Geeky93

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 154 · 496 in bank

   You have an Azure subscription that contains an app named App1. App1 has the app registration shown in the following table.

   

   You need to ensure that App1 can read all user calendars and create appointments. The solution must use the principle of least privilege. What should you do?

   • AAdd a new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.
   • BAdd a new Application API permission for Microsoft.Graph Calendars.ReadWrite.
   • CSelect Grant admin consent.
   • DAdd new Delegated API permission for Microsoft.Graph Calendars.ReadWrite.Shared.

   Show answer

   Answer: B

   Explanation

   Answer: B The question is about reading and writing ALL user calendars. Delegated permissions only works for the logged in user. https://docs.microsoft.com/en-us/graph/permissions-reference#application-permissions-8

   Source: Adapted from community discussion — BillBaits

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 155 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

   

   You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings: ✑ Assignments: Include Group1, exclude Group2 ✑ Conditions: Sign-in risk level: Low and above ✑ Access: Allow access, Require multi-factor authentication You need to identify what occurs when the users sign in to Azure AD. What should you identify for each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/ https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

   Source: Adapted from community discussion — Pitch09

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 156 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure SQL database named SQL1. You plan to deploy a web app named App1. You need to provide App1 with read and write access to SQL1. The solution must meet the following requirements: ✑ Provide App1 with access to SQL1 without storing a password. ✑ Use the principle of least privilege. ✑ Minimize administrative effort. Which type of account should App1 use to access SQL1, and which database roles should you assign to App1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/app-service/tutorial-connect-msi-sql-database?tabs=windowsclient%2Cdotnet

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 157 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains two users named User1 and User2 and a registered app named App1. You create an app-specific role named Role1. You need to assign Role1 to User1 and enable User2 to request access to App1. Which two settings should you modify? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Roles and administrators - Here you will find Role1 and be able to assign User1 to the role. Box 2: Self Service - Under Self Service, there is an option to ג€Allow users to request access to this applicationג€.

   Source: Adapted from community discussion — ParabJWalia_123

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 158 · 496 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to deploy the virtual machines shown in the following table.

   

   You need to assign managed identities to the virtual machines. The solution must meet the following requirements: ✑ Assign each virtual machine the required roles. ✑ Use the principle of least privilege. What is the minimum number of managed identities required?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: B

   Explanation

   If it's a system assigned managed id, it can only be tied to one resource. If you use a user assigned managed ID, it can be tied to multiple resources. Since there are 2 separate policies required, you can assign a user assigned managed ID for each policies. B is correct

   Source: Adapted from community discussion — ltjones12

   References

   • Microsoft Learn

   Next question

9. Question 159 · 496 in bank

   SIMULATION - You need to ensure that a user named user2-12345678 can manage the properties of the virtual machines in the RG1lod12345678 resource group. The solution must use the principle of least privilege. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   1. Sign in to the Azure portal. 2. Browse to Resource Groups. 3. Select the RG1lod12345678 resource group. 4. Select Access control (IAM). 5. Select Add > role assignment. 6. Select Virtual Machine Contributor (you can filter the list of available roles by typing 'virtual' in the search box) then click Next. 7. Select the +Select members option and select user2-12345678 then click the Select button. 8. Click the Review + assign button twice. Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal?tabs=current

   Source: Adapted from community discussion — Drummer

   Next question

10. Question 160 · 496 in bank

    SIMULATION - You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com. The new directory must contain a new user named user1@12345678.onmicrosoft.com. To complete this task, sign in to the Azure portal.

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer:

    Explanation

    The first step is to create the Azure Active Directory tenant. 1. Sign in to the Azure portal. 2. From the Azure portal menu, select Azure Active Directory. 3. On the overview page, select Manage tenants. 4. Select +Create. 5. On the Basics tab, select Azure Active Directory. 6. Select Next: Configuration to move on to the Configuration tab. 7. For Organization name, enter 12345678. 8. For the Initial domain name, enter 12345678. 9. Leave the Country/Region as the default. The next step is to create the user. 1. From the Azure portal menu, select Azure Active Directory. 2. Select Users then select New user. 3. Enter User1 in the User name and Name fields. 4. Leave the default option of Auto-generate password. 5. Click the Create button. Reference: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 151. 496 questions available.