AZ-500 practice questions 371–380

1. Question 371 · 496 in bank

   HOTSPOT - You have the Azure key vaults shown in the following table.

   

   KV1 stores a secret named Secret1 and a key for a managed storage account named Key1. You back up Secret1 and Key1. To which key vaults can you restore each backup? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The backups can only be restored to key vaults in the same subscription and same geography. You can restore to a different region in the same geography.

   Source: Adapted from community discussion — Sethoo

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   

   Next question

2. Question 372 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure key vault named Vault1. On January 1, 2019, Vault1 stores the following secrets. All dates are in mm/dd/yy format.

   

   When can each secret be used by an application? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Never - Password1 is disabled. Box 2: Only between March 1, 2019 and May 1, Password2: Reference: https://docs.microsoft.com/en-us/powershell/module/azurerm.keyvault/set-azurekeyvaultsecretattribute

   Source: Adapted from community discussion — wooyourdaddy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 373 · 496 in bank

   You have an Azure web app named webapp1. You need to configure continuous deployment for webapp1 by using an Azure Repo. What should you create first?

   • Aan Azure Application Insights service
   • Ban Azure DevOps organization
   • Can Azure Storage account
   • Dan Azure DevTest Labs lab

   Show answer

   Answer: B

   Explanation

   To use Azure Repos, make sure your Azure DevOps organization is linked to your Azure subscription. Reference: https://docs.microsoft.com/en-us/azure/app-service/deploy-continuous-deployment

   Source: Adapted from community discussion — barchetta

   References

   • Microsoft Learn

   Next question

4. Question 374 · 496 in bank

   Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The company develops an application named App1. App1 is registered in Azure AD. You need to ensure that App1 can access secrets in Azure Key Vault on behalf of the application users. What should you configure?

   • Aan application permission without admin consent
   • Ba delegated permission without admin consent
   • Ca delegated permission that requires admin consent
   • Dan application permission that requires admin consent

   Show answer

   Answer: B

   Explanation

   https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent Delegated permissions are used by apps that have a signed-in user present. For these apps, either the user or an administrator consents to the permissions that the app requests, and the app is delegated permission to act as the signed-in user when making calls to the target resource. Some delegated permissions can be consented to by non-administrative users, but some higher-privileged permissions require administrator consent.

   Source: Adapted from community discussion — RupaliS

   References

   • Microsoft Learn

   Next question

5. Question 375 · 496 in bank

   DRAG DROP - Your company has an Azure Active Directory (Azure AD) tenant named contoso.com. The company is developing an application named App1. App1 will run as a service on server that runs Windows Server 2016. App1 will authenticate to contoso.com and access Microsoft Graph to read directory data. You need to delegate the minimum required permissions to App1. Which three actions should you perform in sequence from the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Create an app registration First the application must be created/registered. Step 2: Add an application permission Application permissions are used by apps that run without a signed-in user present. Step 3: Grant permissions - Incorrect Answers: Delegated permission - Delegated permissions are used by apps that have a signed-in user present. Application Proxy: Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications. Reference: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent

   Source: Adapted from community discussion — gfhbox0083

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 376 · 496 in bank

   Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The company develops a mobile application named App1. App1 uses the OAuth 2 implicit grant type to acquire Azure AD access tokens. You need to register App1 in Azure AD. What information should you obtain from the developer to register the application?

   • Aa redirect URI
   • Ba reply URL
   • Ca key
   • Dan application ID

   Show answer

   Answer: A

   Explanation

   A is correct answer, If the user approves the request, the authorization server will redirect the browser back to the redirect_uri specified by the application, adding a token and state to the fragment part of the URL. Link: https://developer.okta.com/blog/2018/05/24/what-is-the-oauth2-implicit-grant-type

   Source: Adapted from community discussion — cfsxtuv33

   References

   • Microsoft Learn

   Next question

7. Question 377 · 496 in bank

   From the Azure portal, you are configuring an Azure policy. You plan to assign policies that use the DeployIfNotExist, AuditIfNotExist, Append, and Deny effects. Which effect requires a managed identity for the assignment?

   • AAuditIfNotExist
   • BAppend
   • CDeployIfNotExist
   • DDeny

   Show answer

   Answer: C

   Explanation

   When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity. Reference: https://docs.microsoft.com/bs-latn-ba/azure/governance/policy/how-to/remediate-resources

   Source: Adapted from community discussion — deegadaze1

   References

   • Microsoft Learn

   Next question

8. Question 378 · 496 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to implement an application that will consist of the resources shown in the following table.

   

   Users will authenticate by using their Azure AD user account and access the Cosmos DB account by using resource tokens. You need to identify which tasks will be implemented in CosmosDB1 and WebApp1. Which task should you identify for each resource? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   CosmosDB1: Create database users and generate resource tokens. Azure Cosmos DB resource tokens provide a safe mechanism for allowing clients to read, write, and delete specific resources in an Azure Cosmos DB account according to the granted permissions. WebApp1: Authenticate Azure AD users and relay resource tokens A typical approach to requesting, generating, and delivering resource tokens to a mobile application is to use a resource token broker. The following diagram shows a high-level overview of how the sample application uses a resource token broker to manage access to the document database data: Reference: https://docs.microsoft.com/en-us/xamarin/xamarin-forms/data-cloud/cosmosdb/authentication

   Source: Adapted from community discussion — Exam_Master_Me

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 379 · 496 in bank

   HOTSPOT - You need to create an Azure key vault. The solution must ensure that any object deleted from the key vault be retained for 90 days. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: -EnablePurgeProtection - If specified, protection against immediate deletion is enabled for this vault; requires soft delete to be enabled as well. Box 2: -EnableSoftDelete - Specifies that the soft-delete functionality is enabled for this key vault. When soft-delete is enabled, for a grace period, you can recover this key vault and its contents after it is deleted. Reference: https://docs.microsoft.com/en-us/powershell/module/azurerm.keyvault/new-azurermkeyvault

   Source: Adapted from community discussion — macco455

   References

   • Microsoft Learn

   

   Next question

10. Question 380 · 496 in bank

    You have an Azure subscription that contains an Azure key vault named Vault1. In Vault1, you create a secret named Secret1. An application developer registers an application in Azure Active Directory (Azure AD). You need to ensure that the application can use Secret1. What should you do?

    • AIn Azure AD, create a role.
    • BIn Azure Key Vault, create a key.
    • CIn Azure Key Vault, create an access policy.
    • DIn Azure AD, enable Azure AD Application Proxy.

    Show answer

    Answer: C

    Explanation

    Ref: https://docs.microsoft.com/en-us/azure/key-vault/tutorial-net-create-vault-azure-web-app The correct answer is "set access policy" to the managed identity that app will use. Example: az keyvault set-policy --name ' ' --object-id --secret-permissions get list This command gives the identity (MSI) of the app service permission to do get and list operations on your key vault.

    Source: Adapted from community discussion — Oz

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 371. 496 questions available.