AZ-500 practice questions 181–190

1. Question 181 · 496 in bank

   DRAG DROP - You have an Azure AD tenant that contains the users shown in the following table.

   

   You enable passwordless authentication for the tenant. Which authentication method can each user use for passwordless authentication? To answer, drag the appropriate authentication methods to the correct users. Each authentication method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless#choose-a-passwordless-method Assigned Windows 10 device: Windows Hello for Business and/or FIDO2 security key Mobile or non-windows device: Passwordless sign-in with the Authenticator app

   Source: Adapted from community discussion — ITTesters

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 182 · 496 in bank

   DRAG DROP - You have an Azure AD tenant and an application named App1. You need to ensure that App1 can use Microsoft Entra Verified ID to verify credentials. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   There was a new questions similar to this but with different answer choices on exam Aug 06 2024. It asked what are the three steps to configure Microsoft Entra Verified ID in your org.

   Source: Adapted from community discussion — 91743b3

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 183 · 496 in bank

   DRAG DROP - You have an Azure subscription that contains an Azure web app named App1. You plan to configure a Conditional Access policy for App1. The solution must meet the following requirements: • Only allow access to App1 from Windows devices. • Only allow devices that are marked as compliant to access App1. Which Conditional Access policy settings should you configure? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   For the scenario described, the correct Conditional Access policy settings would be: Only allow access to App1 from Windows devices: Policy Setting: Conditions -> Device platforms -> select Windows Only allow devices that are marked as compliant to access App1: Policy Setting: Grant -> Grant access -> Require device to be marked as compliant These settings will ensure that only devices running Windows and marked as compliant can access the application, aligning with the described requirements.

   Source: Adapted from community discussion — Obama_boy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 184 · 496 in bank

   Select 2

   You have an Azure subscription that contains a web app named App1. Users must be able to select between a Google identity or a Microsoft identity when authenticating to App1. You need to add Google as an identity provider in Azure AD. Which two pieces of information should you configure? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aa client ID
   • Ba tenant name
   • Cthe endpoint URL of an application
   • Da tenant ID
   • Ea client secret

   Show answer

   Answer: AE

   Explanation

   Configure Google as an identity provider Sign in to the Azure portal as the global administrator of your Azure AD B2C tenant. If you have access to multiple tenants, select the Settings icon in the top menu to switch to your Azure AD B2C tenant from the Directories + subscriptions menu. Choose All services in the top-left corner of the Azure portal, search for and select Azure AD B2C. Select Identity providers, then select Google. Enter a Name. For example, Google. For the Client ID, enter the Client ID of the Google application that you created earlier. For the Client secret, enter the Client Secret that you recorded. Select Save. https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-google?pivots=b2c-user-flow

   Source: Adapted from community discussion — [Removed]

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 185 · 496 in bank

   You have an Azure subscription that contains a user named User1. You need to ensure that User1 can perform the following tasks: • Create groups. • Create access reviews for role-assignable groups. • Assign Azure AD roles to groups. The solution must use the principle of least privilege. Which role should you assign to User1?

   • AGroups administrator
   • BAuthentication administrator
   • CIdentity Governance Administrator
   • DPrivileged role administrator

   Show answer

   Answer: D

   Explanation

   Answer is D https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-role-administrator None of the other three roles has the privileges to perform ALL mentioned tasks https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#identity-governance-administrator https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#authentication-administrator https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#groups-administrator

   Source: Adapted from community discussion — MohCert

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 186 · 496 in bank

   Select 2

   You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ContReg1. You enable content trust for ContReg1. You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege. Which two roles should you assign to User1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAcrQuarantineReader
   • BContributor
   • CAcrPush
   • DAcrImageSigner
   • EAcrQuarantineWriter

   Show answer

   Answer: CD

   Explanation

   Correct it should be ArcPush and AcrImageSigner Because the question states that we should follow the principle of least priviledge

   Source: Adapted from community discussion — gboyega

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 187 · 496 in bank

   You have an Azure subscription that contains the virtual machines shown in the following table.

   

   All the virtual networks are peered. You deploy Azure Bastion to VNET2. Which virtual machines can be protected by the bastion host?

   • AVM1, VM2, VM3, and VM4
   • BVM1, VM2, and VM3 only
   • CVM2 and VM4 only
   • DVM2 only

   Show answer

   Answer: A

   Explanation

   Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don't have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it can be used to connect to VMs deployed in a peered VNet without deploying an additional bastion host.

   Source: Adapted from community discussion — gabrialtonka

   References

   • Microsoft Learn

   Next question

8. Question 188 · 496 in bank

   You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?

   • Adevice configuration policies in Microsoft Intune
   • BAzure Automation State Configuration
   • Csecurity policies in Azure Security Center
   • Ddevice compliance policies in Microsoft Intune

   Show answer

   Answer: B

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 189 · 496 in bank

   You have an Azure subscription named Sub1. Sub1 contains a virtual network named VNet1 that contains one subnet named Subnet1. Subnet1 contains an Azure virtual machine named VM1 that runs Ubuntu Server 18.04. You create a service endpoint for Microsoft.Storage in Subnet1. You need to ensure that when you deploy Docker containers to VM1, the containers can access Azure Storage resources by using the service endpoint. What should you do on VM1 before you deploy the container?

   • ACreate an application security group and a network security group (NSG).
   • BEdit the docker-compose.yml file.
   • CInstall the container network interface (CNI) plug-in.

   Show answer

   Answer: C

   Explanation

   Correct. When a Pod comes up in the virtual machine, Azure CNI assigns an available IP address from the pool and connects the Pod to a software bridge in the virtual machine. When the Pod terminates, the IP address is added back to the pool.

   Source: Adapted from community discussion — DA0410

   References

   • Microsoft Learn

   Next question

10. Question 190 · 496 in bank

    DRAG DROP - You have an Azure subscription that contains the virtual networks shown in the following table.

    

    The Azure virtual machines on SpokeVNetSubnet0 can communicate with the computers on the on-premises network. You plan to deploy an Azure firewall to HubVNet. You create the following two routing tables: ✑ RT1: Includes a user-defined route that points to the private IP address of the Azure firewall as a next hop address ✑ RT2: Disables BGP route propagation and defines the private IP address of the Azure firewall as the default gateway You need to ensure that traffic between SpokeVNetSubnet0 and the on-premises network flows through the Azure firewall. To which subnet should you associate each route table? To answer, drag the appropriate subnets to the correct route tables. Each subnet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal#create-the-routes

    Source: Adapted from community discussion — rsharma007

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 181. 496 questions available.