AZ-500 practice questions 171–180

1. Question 171 · 496 in bank

   HOTSPOT - You have the role assignments shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Is the question complete? I can only see Admin1 being an owner of RG1 and Admin4 being a security reader. It the question is complete, obviously only Admin1 could possibly delete or create something.

   Source: Adapted from community discussion — AzureJobsTillRetire

   References

   • Microsoft Learn

   

   Next question

2. Question 172 · 496 in bank

   You have an Azure subscription that contains a user named User1. You need to ensure that User1 can create managed identities. The solution must use the principle of least privilege. What should you do?

   • ACreate a management group and assign User1 the Hybrid Identity Administrator Azure Active Directory (Azure AD) role.
   • BCreate a management group and assign User1 the Managed Identity Operator role.
   • CCreate a resource group and assign User1 to the Managed Identity Contributor role.
   • DCreate an organizational unit (OU) and assign User1 the User administrator Azure Active Directory (Azure AD) role.

   Show answer

   Answer: C

   Explanation

   A - Wrong - Hybrid Identity Admin cannot create managed identities. Permissions are: Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings. B - wrong - Managed Identity Operator cannot create managed identities. Permissions are: Read and Assign User Assigned Identity C - correct: Managed Identity Contributor can Create, Read, Update, and Delete User Assigned Identity. D - incorrect - can create users, but does not follow the principal of least privilege, as the permission set is comprehensive. User administrator can manage all aspects of users and groups. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

   Source: Adapted from community discussion — Seelearndo

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 173 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains a resource group named RG1. RG1 contains a virtual machine named VM1 that uses Azure Active Directory (Azure AD) authentication. You have two custom Azure roles named Role1 and Role2 that are scoped to RG1. The permissions for Role1 are shown in the following JSON code.

   

   The permissions for Role2 are shown in the following JSON code.

   

   You assign the roles to the users shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I thought the answers could be No Yes No Box1: User1 can delete VM1 - No User1 only has Role1, and Roles has notActions of VM delete. Box2: User2 can delete VM - Yes User2 has both Role1 and Role2 assigned. Role2 gives User2 the ability to delete VM. Box3: User3 can sign in to VM by using Azure AD credentials - No To be able to sign in to VM by using Azure AD credentials, User3 needs to have either Virtual Machine Administrator Login or Virtual Machine User Login. Those logins have actions defined in the dataActions section. For example, Microsoft.Compute/virtualMachines/login/action provides Log in to a virtual machine as a regular user. In both Role1 and Role2, the dataActions is not defined. Refs: https://learn.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-administrator-login

   Source: Adapted from community discussion — AzureJobsTillRetire

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 174 · 496 in bank

   DRAG DROP - You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to perform the following actions: • Deploy a new app named App1 that will require access to Vault1. • Configure a shared identity for VM1 and VM2 to access st1. You need to configure identities for each requirement. The solution must minimize administrative effort. Which type of identity should you configure for each requirement? To answer, drag the appropriate identity types to the correct requirements. Each identity type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box1: VM1 and VM2 access to st1 - User-assigned managed identity Requirement: Configure a shared identity for VM1 and VM2 to access st1 We have to create a User-assigned managed identity to be shared with VM1 and VM2 Box2: App1 access to Vault1 - System-assigned managed identity

   Source: Adapted from community discussion — AzureJobsTillRetire

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 175 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

   

   You configure an access review named Review1 as shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: User3 only - Use the Members (self) option to have the users review their own role assignments. Box 2: User3 will receive a confirmation request Use the Should reviewer not respond list to specify what happens for users that are not reviewed by the reviewer within the review period. This setting does not impact users who have been reviewed by the reviewers manually. If the final reviewer's decision is Deny, then the user's access will be removed. No change - Leave user's access unchanged Remove access - Remove user's access Approve access - Approve user's access Take recommendations - Take the system's recommendation on denying or approving the user's continued access Reference: https://docs.microsoft.com/bs-latn-ba/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review

   Source: Adapted from community discussion — jantoniocesargatica

   References

   • Microsoft Learn

   

   Next question

6. Question 176 · 496 in bank

   You have an Azure AD tenant. The tenant contains users that are assigned Azure AD Premium P2 licenses. You have a partner company that has a domain named fabrikam.com. The fabrikam.com domain contains a user named User1. User1 has an email address of user1@fabrikam.com You need to provide User1 with access to the resources in the tenant. The solution must meet the following requirements: • User1 must be able to sign in by using the user1@fabrikam.com credentials. • You must be able to grant User1 access to the resources in the tenant. • Administrative effort must be minimized. What should you do?

   • ACreate a user account for User1.
   • BTo the tenant, add fabrikam.com as a custom domain.
   • CCreate an invite for User1.
   • DSet Enable guest self-service sign up via user flows to Yes for the tenant.

   Show answer

   Answer: C

   Explanation

   You should create an invite for User1 to join your Azure AD tenant as a guest user. This will allow him to sign in with his existing credentials (user1@fabrikam.com), and you can then grant him access to the resources in the tenant. This option also minimizes administrative effort as it is a simple process to invite a guest user.

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn

   Next question

7. Question 177 · 496 in bank

   You have an Azure AD tenant that contains the identities shown in the following table.

   

   You plan to implement Azure AD Identity Protection. What is the maximum number of user risk policies you can configure?

   • A1
   • B90
   • C200
   • D265
   • E1000

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa#overview-of-azure-ad-identity-protection The following three policies are available in Azure AD Identity Protection to protect users and respond to suspicious activity. You can choose to turn the policy enforcement on or off, select users or groups for the policy to apply to, and decide if you want to block access at sign-in or prompt for additional action. - User risk policy - Sign in risk policy - MFA registration policy

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 178 · 496 in bank

   You have an Azure subscription that contains a resource group named RG1 and the identities shown in the following table.

   

   You assign Group4 the Contributor role for RG1. Which identities can you add to Group4 as members?

   • AUser1 only
   • BUser1 and Group3 only
   • CUser1, Group1, and Group3 only
   • DUser1, Group2, and Group3 only
   • EUser1, Group1, Group2, and Group3

   Show answer

   Answer: A

   Explanation

   This exam question test about role-assignable group feature in Azure Active Directory. Refer to Microsoft document on role-assignable group: “Group nesting is not supported. A group can't be added as a member of a role-assignable group.” Reference Create a role-assignable group in Azure Active Directory https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-create-eligible Use Azure AD groups to manage role assignments https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 179 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains a storage account named contoso2023. You need to perform the following tasks: • Verify that identity-based authentication over SMB is enabled. • Only grant users access to contoso2023 in the year 2023. Which two settings should you use? To answer, select the appropriate settings in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The given answers are correct. 1. File Shares Requirement: Verify that identity-based authentication over SMB is enabled Go there to configure Identity-based authentication (Active Directory) for Azure file shares. Ref: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview 2. Share access signature Requirement: Only grant users access to contoso2023 in the year 2023

   Source: Adapted from community discussion — AzureJobsTillRetire

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 180 · 496 in bank

    You have an Azure subscription that is linked to an Azure AD tenant and contains the resources shown in the following table.

    

    Which resources can be assigned the Contributor role for VM1?

    • AManaged1 and App1 only
    • BGroup1 and Managed1 only
    • CGroup1, Managed1, and VM2 only
    • DGroup1, Managed1, VM1, and App1 only

    Show answer

    Answer: A

    Explanation

    D. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps "You can assign a role to a user, group, service principal, or managed identity. " App1 has service principal. https://learn.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

    Source: Adapted from community discussion — 973b658

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 171. 496 questions available.