AZ-500 practice questions 31–40

1. Question 31 · 496 in bank

   You have been tasked with making sure that you are able to modify the operating system security configurations via Azure Security Center. To achieve your goal, you need to have the correct pricing tier for Azure Security Center in place. Which of the following is the pricing tier required?

   • AAdvanced
   • BPremium
   • CStandard
   • DFree

   Show answer

   Answer: C

   Explanation

   This question is no longer relevant as the pricing model has changed. It's now offered in two modes: defender on or defender off.

   Source: Adapted from community discussion — ad7399

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 32 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant. After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf. Solution: You configure a delegated permission with admin consent. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   This question is regarding compound identities (Application-plus-user) and Key Vault Authentication. Compound Identity requires the Principal (User)and Authorised Application to be used for a Key Vault Access Policy. This requires the application to be registered in Azure AD and given permission to read the key vault on behalf of the user (Delegated) a.k.a Impersonation. There is a permission for this under the Azure Key Vault permissions called "user_impersonation" with the description "Allow the application full access to the Azure Key Vault service on behalf of the signed-in user". This is a delegated permission. Reference - https://docs.microsoft.com/en-us/azure/key-vault/general/security-features#key-vault-authentication-options

   Source: Adapted from community discussion — Joshing

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 33 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant. After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf. Solution: You configure a delegated permission with no admin consent. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   Just register an Azure AD App then go to API Permissions and select Azure Key Vault, you will find a single permission to add "user_impersonation" under Delegated Permissions and Admin Consent is not required. You will notice that Application Permissions is dimmed out

   Source: Adapted from community discussion — somenick

   References

   • Microsoft Learn

   Next question

4. Question 34 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of password hash synchronization and seamless SSO. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Answer should be "No" password hash synchronization cannot support the password policies and user logon limitations For this you need to implement Pass-through authentication

   Source: Adapted from community discussion — Dushank

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 35 · 496 in bank

   You need to consider the underlined segment to establish whether it is accurate. Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it. Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type. The mobile application must be registered in Azure AD. You require a redirect URI from the developer for registration purposes. Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

   • ANo adjustment required
   • Ba secret
   • Ca login hint
   • Da client ID

   Show answer

   Answer: A

   Explanation

   In your link the Client ID is the registration ID assigned in Azure AD : (Client ID = The Application (client) ID that the Azure portal - App registrations page assigned to your app.) But that's what we a trying to do (The mobile application must be registered in Azure AD.) You cannot get what is not yet created

   Source: Adapted from community discussion — zorglub

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 36 · 496 in bank

   You are in the process of configuring an Azure policy via the Azure portal. Your policy will include an effect that will need a managed identity for it to be assigned. Which of the following is the effect in question?

   • AAuditIfNotExist
   • BDisabled
   • CDeployIfNotExist
   • DEnforceOPAConstraint

   Show answer

   Answer: C

   Explanation

   Correct answer C. DeployIfNotExist https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure Azure Policy supports the following types of effect: Append: adds the defined set of fields to the request Audit: generates a warning event in activity log but doesn't fail the request AuditIfNotExists: generates a warning event in activity log if a related resource doesn't exist Deny: generates an event in the activity log and fails the request DeployIfNotExists: deploys a related resource if it doesn't already exist Disabled: doesn't evaluate resources for compliance to the policy rule Modify: adds, updates, or removes the defined set of fields in the request EnforceOPAConstraint (deprecated): configures the Open Policy Agent admissions controller with Gatekeeper v3 for self-managed Kubernetes clusters on Azure EnforceRegoPolicy (deprecated): configures the Open Policy Agent admissions controller with Gatekeeper v2 in Azure Kubernetes Service

   Source: Adapted from community discussion — Ruffyit

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 37 · 496 in bank

   Select 2

   You have been tasked with creating an Azure key vault using PowerShell. You have been informed that objects deleted from the key vault must be kept for a set period of 90 days. Which two of the following parameters must be used in conjunction to meet the requirement? (Choose two.)

   • AEnabledForDeployment
   • BEnablePurgeProtection
   • CEnabledForTemplateDeployment
   • DEnableSoftDelete

   Show answer

   Answer: BD

   Explanation

   https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview#purge-protection Purge protection is an optional Key Vault behavior and is not enabled by default. Purge protection can only be enabled once soft-delete is enabled. It can be turned on via CLI or PowerShell. Purge protection is recommended when using keys for encryption to prevent data loss. Most Azure services that integrate with Azure Key Vault, such as Storage, require purge protection to prevent data loss. When purge protection is on, a vault or an object in the deleted state cannot be purged until the retention period has passed. Soft-deleted vaults and objects can still be recovered, ensuring that the retention policy will be followed. The default retention period is 90 days, but it is possible to set the retention policy interval to a value from 7 to 90 days through the Azure portal. Once the retention policy interval is set and saved it cannot be changed for that vault.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 38 · 496 in bank

   DRAG DROP - Your company has an Azure SQL database that has Always Encrypted enabled. You are required to make the relevant information available to application developers to allow them to access data in the database. Which two of the following options should be made available? Answer by dragging the correct options from the list to the answer area. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Always Encrypted uses two types of keys: column encryption keys and column master keys. A column encryption key is used to encrypt data in an encrypted column. A column master key is a key-protecting key that encrypts one or more column encryption keys. Reference: https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 39 · 496 in bank

   Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. After syncing all on-premises identities to Azure AD, you are informed that users with a givenName attribute starting with LAB should not be allowed to sync to Azure AD. Which of the following actions should you take?

   • AYou should make use of the Synchronization Rules Editor to create an attribute-based filtering rule.
   • BYou should configure a DNAT rule on the Firewall.
   • CYou should configure a network traffic filtering rule on the Firewall.
   • DYou should make use of Active Directory Users and Computers to create an attribute-based filtering rule.

   Show answer

   Answer: A

   Explanation

   40 Questions 1 Case Study = 6 Questions 1 Lab = 10 Tasks - You need to be comfortable navigating in Azure Total 56 Questions Some new questions, most are from this site. Big thank you to Exam Topics and everyone for their comments. Rule of thumb, go with the most votes.

   Source: Adapted from community discussion — CK9797

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 40 · 496 in bank

    You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD). The process involves assessing the risk events and risk levels. Which of the following is the risk level that should be configured for users that have leaked credentials?

    • ANone
    • BLow
    • CMedium
    • DHigh

    Show answer

    Answer: D

    Explanation

    D. High Note: It is very unlikely the Microsoft will require the memorization of specific risk levels given that they have changed the documentation. Previously the risk levels were very well defined, however they now provide this very vague paragraph: "Microsoft doesn't provide specific details about how risk is calculated. Each level of risk brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user." Modern Documentation: https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection#investigate-risk Legacy Documentation: https://web.archive.org/web/20190419234045/https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risk-events

    Source: Adapted from community discussion — awfnewf1q243

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 31. 496 questions available.