AZ-500 practice questions 351–360

1. Question 351 · 496 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains a user named User1. You plan to enable passwordless authentication for the tenant. You need to ensure that User1 can enable the combined registration experience. The solution must use the principle of least privilege. Which role should you assign to User1?

   • ASecurity administrator
   • BPrivileged role administrator
   • CAuthentication administrator
   • DGlobal administrator

   Show answer

   Answer: D

   Explanation

   Ok, I've figured this one out. The OLD method does require Global Administrator. So, the provided answer is correct. However, the NEW way of doing this require at least Authentication Policy Administrators. "The Authentication methods policy is the recommended way to manage authentication methods, including modern methods like passwordless authentication. Authentication Policy Administrators can edit this policy to enable authentication methods for all users or specific groups." Both scenarios are explained here: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage

   Source: Adapted from community discussion — epomatti

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 352 · 496 in bank

   You have the Azure resources shown in the following table.

   

   You need to meet the following requirements: ✑ Internet-facing virtual machines must be protected by using network security groups (NSGs). ✑ All the virtual machines must have disk encryption enabled. What is the minimum number of security policies that you should create in Microsoft Defender for Cloud?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept#what-is-a-security-policy An Azure Policy definition, created in Azure Policy, is a rule about specific security conditions that you want controlled. Built in definitions include things like controlling what type of resources can be deployed or enforcing the use of tags on all resources. You can also create your own custom policy definitions.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 353 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure key vault. The role assignments for the key vault are shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Only User1, User 2, and User4 * Owner (User1) - Has full access to all resources including the right to delegate access to others. * Key Vault Crypto Officer (User2) Perform any action on the keys of a key vault, except manage permissions. * Key Vault Administrator (User 4) Perform all data plane operations on a key vault and all objects in it, including certificates, keys, and secrets Box 2: Only User1, User3, and User 4 * Key Vault Secrets Officer (User 3) Perform any action on the secrets of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model. Reference: https://docs.microsoft.com/en-us/azure/key-vault/general/rbac-guide

   Source: Adapted from community discussion — koreshio

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 354 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains a blob container named cont1. Cont1 has the access policies shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: 4 - A container can have up to 5 stored access policies. Maximum number of stored access policies per blob container: 5 Box 2: 1 - Blob version supports one version-level immutability policy and one legal hold. A policy on a blob version can override a default policy specified on the account or container. Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/scalability-targets https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 355 · 496 in bank

   You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table.

   

   You create the Azure policy shown in the following exhibit.

   

   You assign the policy to RG1. What will occur if you assign the policy to NSG1 and NSG2?

   • AFlow logs will be enabled for NSG2 only.
   • BFlow logs will be disabled for NSG1 and NSG2.
   • CFlow logs will be enabled for NSG1 and NSG2.
   • DFlow logs will be enabled for NSG1 only.

   Show answer

   Answer: B

   Explanation

   This is an audit policy with an exception for NSG1. Since Networrk Flow Log is disabled on NSG1 and NSG2 it remains disabled. You need DeployIfNotExists effect to activate NFL. https://azure.microsoft.com/en-us/updates/nsg-flow-logs-built-in-azure-policy/ We are launching two built-in policies for deploying NSG Flow Logs • An Audit policy: Flag NSGs without Flow logs enabled • A DeployIfNotExists policy: Enable Flow logs on NSGs where it is disabled Get started with our tutorial for using the above policies.

   Source: Adapted from community discussion — Nick66

   References

   • azure.microsoft.com documentation
   • Microsoft Learn

   Next question

6. Question 356 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure Active Directory Premium Plan 1 licenses. You need to create a group named Group1 that will be assigned the Global reader role. Which portal should you use to create Group1, and which type of group should you create? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   There is a catch for Role Assignment in the M365 admin center. You can create M365 groups AND enable Role Assignment ONLY if you uncheck the 'Add MS Teams to you group' checkbox. It's a stupid thing to have checkboxes when two options are mutually exclusive. You also need to make the Privacy of the group to 'Private'not Public otherwise your Role Assignment option gets greyed out. Which Portal: Azure AD and M365 Admin Center works (both tested) Group type: Security or M365 only (both tested).

   Source: Adapted from community discussion — tutonata

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 357 · 496 in bank

   HOTSPOT - You have a management group named MG1 that contains an Azure subscription and a resource group named RG1. RG1 contains a virtual machine named VM1. You have the custom Azure roles shown in the following table.

   

   The permissions for Role1 are shown in the following role definition file.

   

   The permissions for Role2 are shown in the following role definition file.

   

   You assign the roles to the users shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   True, as per MS docs: "If a user is assigned a role that excludes an action in NotActions, and is assigned a second role that grants access to the same action, the user is allowed to perform that action. NotActions is not a deny rule – it is simply a convenient way to create a set of allowed actions when specific actions need to be excluded."

   Source: Adapted from community discussion — dmlists

   References

   • Microsoft Learn

   

   Next question

8. Question 358 · 496 in bank

   You have an Azure Active Directory (Azure AD) tenant. You need to prevent nonprivileged Azure AD users from creating service principles in Azure AD. What should you do in the Azure Active Directory admin center of the tenant?

   • AFrom the User settings blade, set Users can register applications to No.
   • BFrom the Properties blade, set Access management for Azure resources to No.
   • CFrom the User settings blade, set Restrict access to Azure AD administration portal to Yes.
   • DFrom the Properties blade, set Enable Security defaults to Yes.

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles#to-disable-the-default-ability-to-create-application-registrations-or-consent-to-applications On the User settings page for your organization, set the Users can register applications setting to No. This will disable the default ability for users to create application registrations.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

9. Question 359 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the following Azure firewall: • Name: Fw1 • Azure region: UK West • Private IP address: 10.1.3.4 • Public IP address: 23.236.62.147 The subscription contains the virtual networks shown in the following table.

   

   The subscription contains the subnets shown in the following table.

   

   The subscription contains the routes shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Yes: Rt1 will route from Subnet1-1 to any IP (0.0.0.0/0) including Subnet2-1 to the FW (10.1.3.4) Yes: Rt3 will route from Subnet2-1 to Subnet1-1 (10.1.1.0/24) to the FW (10.1.3.4) No: There is no configured route from Subnet3-1 to the internet via FW, thus it will go directly to the internet bypassing the FW

   Source: Adapted from community discussion — juandmi

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 360 · 496 in bank

    HOTSPOT - You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.

    

    In storage1, you create a shared access signature (SAS) named SAS1 as shown in the following exhibit.

    

    To which resources can User1 write on July 1, 2022 by using SAS1 and key1? To answer select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    SAS1: folder1 KEY1: container1, folder1, table1 https://stackoverflow.com/questions/43446426/relationship-between-azure-sas-allowed-services-and-allowed-resource-types Don't think of a container mentioned there as blob container. Think of it as something that will have child elements (objects in this case). In context of blobs, container will refer to blob container which will contain blobs. In context of file service, container will refer to share which will contain files & directories. In context of table service, container will refer to table which will contain entities. In context of queue service, container will refer to queue which will contain messages.

    Source: Adapted from community discussion — Nick66

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 351. 496 questions available.