AZ-500 practice questions 161–170

1. Question 161 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains a resource group named RG1. RG1 contains a storage account named storage1. You have two custom Azure roles named Role1 and Role2 that are scoped to RG1. The permissions for Role1 are shown in the following JSON code.

   

   The permissions for Role2 are shown in the following JSON code.

   

   You assign the roles to the users shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles

   Source: Adapted from community discussion — damtrx

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 162 · 496 in bank

   You have an Azure subscription that contains a storage account named storage1 and two web apps named app1 and app2. Both apps will write data to storage1. You need to ensure that each app can read only the data that it has written. What should you do?

   • AProvide each app with a system-assigned identity and configure storage1 to use Azure AD User account authentication.
   • BProvide each app with a separate Storage account key and configure the app to send the key with each request.
   • CProvide each app with a user-managed identity and configure storage1 to use Azure AD User account authentication.
   • DProvide each app with a unique Base64-encoded AES-256 encryption key and configure the app to send the key with each request.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-overview Encryption scopes enable you to manage encryption with a key that is scoped to a container or an individual blob. You can use encryption scopes to create secure boundaries between data that resides in the same storage account but belongs to different customers.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 163 · 496 in bank

   You have an Azure subscription that contains an Azure Files share named share1 and a user named User1. Identity-based authentication is configured for share1. User1 attempts to access share1 from a Windows 10 device by using SMB. Which type of token will Azure Files use to authorize the request?

   • AOAuth 2.0
   • BJSON Web Token (JWT)
   • CSAML
   • DKerberos

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

4. Question 164 · 496 in bank

   DRAG DROP - You need to configure an access review. The review will be assigned to a new collection of reviews and reviewed by resource owners. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Create an access review program Step 2: Create an access review control Step 3: Set Reviewers to Group owners In the Reviewers section, select either one or more people to review all the users in scope. Or you can select to have the members review their own access. If the resource is a group, you can ask the group owners to review. References: https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review https://docs.microsoft.com/en-us/azure/active-directory/governance/manage-programs-controls

   Source: Adapted from community discussion — PDR

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 165 · 496 in bank

   DRAG DROP - You have an Azure subscription. You plan to create two custom roles named Role1 and Role2. The custom roles will be used to perform the following tasks: • Members of Role1 will manage application security groups. • Members of Role2 will manage Azure Bastion. You need to add permissions to the custom roles. Which resource provider should you use for each role? To answer, drag the appropriate resource providers to the correct roles. Each resource provider may be used, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 166 · 496 in bank

   You have an Azure subscription linked to an Azure Active Directory Premium Plan 1 tenant. You plan to implement Azure Active Directory (Azure AD) Identity Protection. You need to ensure that you can configure a user risk policy and a sign-in risk policy. What should you do first?

   • APurchase Azure Active Directory Premium Plan 2 licenses for all users.
   • BRegister all users for Azure Multi-Factor Authentication (MFA).
   • CEnable security defaults for Azure Active Directory.
   • DEnable enhanced security features in Microsoft Defender for Cloud.

   Show answer

   Answer: A

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 167 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You perform the following tasks: • Create a managed identity named Managed1. • Create a Microsoft 365 group named Group1. • Register an enterprise application named App1. • Enable a system-assigned managed identity for VM1. You need to identify which service principals were created and which identities can be assigned the Reader role for RG1. What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Tested in the Portal; second answer looks to be incorrect. Service Principals: Managed1, VM1, and App1 only Identities: Managed1, VM1, App1, and Group1

   Source: Adapted from community discussion — undecided

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 168 · 496 in bank

   HOTSPOT - You have an Azure Active directory tenant that syncs with an Active Directory Domain Services (AD DS) domain. You plan to create an Azure file share that will contain folders and files. Which identity store can you use to assign permissions to the Azure file share and folders within the share? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box1 and Box2: AD DS Only Azure Files supports identity-based authentication for Windows file shares over Server Message Block (SMB) using the Kerberos authentication protocol through the following three methods: • On-premises Active Directory Domain Services (AD DS) • Azure Active Directory Domain Services (Azure AD DS) • Azure Active Directory (Azure AD) Kerberos for hybrid user identities Note Azure Files supports authentication for Azure AD DS with full or partial (scoped) synchronization with Azure AD. For environments with scoped synchronization present, administrators should be aware that Azure Files only honors Azure RBAC role assignments granted to principals that are synchronized. Role assignments granted to identities not synchronized from Azure AD to Azure AD DS will be ignored by the Azure Files service.

   Source: Adapted from community discussion — Nick66

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 169 · 496 in bank

   You have an Azure subscription. You plan to deploy a new Conditional Access policy named CAPolicy1. You need to use the What if tool to evaluate how CAPolicy1 wall affect users. The solution must minimize the impact of CAPolicy1 on the users. To what should you set the Enable policy setting for CAPolicy1?

   • AOff
   • BOn
   • CReport only

   Show answer

   Answer: C

   Explanation

   C is the answer. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-report-only Conditional Access is widely used by our customers to stay secure by applying the right access controls in the right circumstances. However one of the challenges with deploying a Conditional Access policy in your organization is determining the impact to end users. It can be difficult to anticipate the number and names of users impacted by common deployment initiatives such as blocking legacy authentication, requiring multifactor authentication for a population of users, or implementing sign-in risk policies. Report-only mode is a new Conditional Access policy state that allows administrators to evaluate the impact of Conditional Access policies before enabling them in their environment.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

10. Question 170 · 496 in bank

    You have an Azure Active Directory (Azure AD) tenant that contains 500 users and an administrative unit named AU1. From the Azure Active Directory admin center, you plan to add the users to AU1 by using Bulk add members. You need to create and upload a file for the bulk add. What should you include in the file?

    • Aonly the display name of each user
    • Bonly the user principal name (UPN) of each user
    • Conly the user principal name (UPN) and display name of each user
    • Donly the user principal name (UPN) and object identifier of each user
    • Eonly the object identifier of each user

    Show answer

    Answer: B

    Explanation

    B. only the user principal name (UPN) of each user "In the Bulk add members pane, download the comma-separated values (CSV) template. Edit the downloaded CSV template with the list of users you want to add. Add one user principal name (UPN) in each row. Don't remove the first two rows of the template." https://learn.microsoft.com/en-us/azure/active-directory/roles/admin-units-members-add#add-users-to-an-administrative-unit-in-a-bulk-operation

    Source: Adapted from community discussion — r_git

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 161. 496 questions available.