AZ-500 practice questions 421–430

1. Question 421 · 496 in bank

   You have an Azure Active Directory (Azure AD) tenant that contains a group named Group1. You need to ensure that the members of Group1 sign in by using passwordless authentication. What should you do?

   • AConfigure the sign-in risk policy.
   • BCreate a Conditional Access policy.
   • CConfigure the Microsoft Authenticator authentication method policy.
   • DConfigure the certificate-based authentication (CBA) policy.

   Show answer

   Answer: C

   Explanation

   C is the answer. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods-manage#authentication-methods-policy The Authentication methods policy is the recommended way to manage authentication methods, including modern methods like passwordless authentication. Authentication Policy Administrators can edit this policy to enable authentication methods for all users or specific groups.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 422 · 496 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You need to configure storage1 to regenerate keys automatically every 90 days. Which cmdlet should you run?

   • AAdd-AzKeyVaultflanagedStorageAccount
   • BSet-AzStorageAccountManagementPolicy
   • CSet-AzStorageAccount
   • DAdd-AzStorageAccountManagementPolicyAction

   Show answer

   Answer: A

   Explanation

   If you get here you notice that there are a lot of trolls or people who does not have idea about anything. Don loose your time and find different questions since mostly of these ones are wrongly wording, bad answers , outdated and with a lot of trolling people who i dont understand what is their intention to confuse students.

   Source: Adapted from community discussion — jvallespin

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 423 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the key vaults shown in the following table.

   

   The subscription contains the users shown in the following table.

   

   On June 1, you perform the following actions: • Delete a key named key1 from KeyVault1. • Delete a secret named secret1 from KeyVault2. For each of the following statements, select Yes If the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I thought that it would be Yes No No Box1: Yes Admin1 is Key Vault Contributor on KeyVault1, in which has 10 days to retain deleted vaults, and Key1 from KeyVault1 was deleted on Jun 1st. Hence on Jun 5th, Admin1 can recover Key1 Box2: No On Jun 1st, secret1 has already been deleted. Hence it cannot be purged again on Jun 12th Box3: No KeyVault1 has 10 days to retain deleted vaults, and Key1 from KeyVault1 was deleted on Jun 1st. Hence on Jun 17th it cannot be recovered

   Source: Adapted from community discussion — AzureJobsTillRetire

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 424 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains two administrative units named AU1 and AU2. Users are assigned to the administrative units as shown in the following table.

   

   Users are assigned the roles shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. yes - Helpdesk Administrator can reset password for non-administrators. 2. no - Group Admin cannot reset password from any user. 3. no - Password Administrator cannot reset password from User Administrator. Ref: https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#who-can-reset-passwords

   Source: Adapted from community discussion — marpengar1

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 425 · 496 in bank

   HOTSPOT - You have the Azure Information Protection labels as shown in the following table.

   

   You have the Azure Information Protection policies as shown in the following table.

   

   You need to identify how Azure Information Protection will label files. What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Label 2 only - How multiple conditions are evaluated when they apply to more than one label 1. The labels are ordered for evaluation, according to their position that you specify in the policy: The label positioned first has the lowest position (least sensitive) and the label positioned last has the highest position (most sensitive). 2. The most sensitive label is applied. 3. The last sublabel is applied. Box 2: No Label - Automatic classification applies to Word, Excel, and PowerPoint when documents are saved, and apply to Outlook when emails are sent. Automatic classification does not apply to Microsoft Notepad. Reference: https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-classification

   Source: Adapted from community discussion — smruk12

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 426 · 496 in bank

   You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 has the Key Vault VM extension installed. For Vault1, you rotate the keys, secrets, and certificates. What will be updated automatically on VM1?

   • Athe keys only
   • Bthe secrets only
   • Cthe certificates only
   • Dthe keys and secrets only
   • Ethe secrets and certificates only
   • Fthe keys, secrets, and certificates

   Show answer

   Answer: C

   Explanation

   C is the answer. https://learn.microsoft.com/en-us/azure/cloud-services-extended-support/enable-key-vault-virtual-machine The Key Vault VM extension provides automatic refresh of certificates stored in an Azure key vault. Specifically, the extension monitors a list of observed certificates stored in key vaults. When the extension detects a change, it retrieves and installs the corresponding certificates.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 427 · 496 in bank

   HOTSPOT - You have an Azure SQL database named DB1 that contains a table named Tablet. You need to configure DB1 to meet the following requirements: • Sensitive data in Table1 must be identified automatically. • Only the first character and last character of the sensitive data must be displayed in query results. Which two features should you configure? To answer, select the features in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Data Discovery & Classification 2. Dynamic Data Masking https://learn.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview?view=azuresql Data Discovery & Classification is built into Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics. It provides basic capabilities for discovering, classifying, labeling, and reporting the sensitive data in your databases.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 428 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains two users named User1 and User2 and the blob containers shown in the following table.

   

   Policy1 is configured as shown in the following exhibit.

   

   You assign the roles for storage1 as shown in the following table.

   

   The storage1 account has the following shared access signature (SAS) named SAS1: • Allowed services: Blob • Allowed resource types: Container • Allowed permissions: Read, Write, List, Add, Create • Blob versioning permissions: enables deletion of versions • Allowed blob index permissions: Read/Write • Starr and expiry date/time: o Start: 12/1/2021 o End: 12/31/2021 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Y: container 2 doesn't have policy applied to SAS is in full effect N: policy is applied to container 1 and limits permissions to READ N: SAS has expired on Dec 31/2021 so it's invalid. RBAC roles are irrelevant here since statements say WHEN USING SAS1. Using has SAS in a URL has nothing to do with user RBAC assignments.

   Source: Adapted from community discussion — tutonata

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 429 · 496 in bank

   HOTSPOT - Your on-premises network contains the servers shown in the following table.

   

   You have an Azure subscription that contains multiple virtual machines that run either Windows Server 2019 or SLES. You plan to implement adaptive application controls in Microsoft Defender for Cloud. Which operating systems and platforms can you monitor? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. SLES and Windows Servers 2. Azure Arc-enabled servers and Azure VMs only https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls#availability Supported machines: - Azure and non-Azure machines running Windows and Linux - Azure Arc machines

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   

   Next question

10. Question 430 · 496 in bank

    You have an Azure subscription that contains the resources shown in the following table.

    

    Both VM1 and VM2 connect to VNET1 and are configured to use NSG1. You need to ensure that only VM1 and VM2 can access DB1. What should you do?

    • AFor NSG1, configure a rule that has a service tag.
    • BAdd the IP address range of VNET1 to the Firewall settings of DB1.
    • CCreate an application security group.
    • DConfigure DB1 to allow access from only VNET1.

    Show answer

    Answer: D

    Explanation

    D. Configure DB1 to allow access from only VNET1. I would go with D. How would configuring the NSG that VM1 and VM2 are attached to influence who is allowed to access DB1? You have to configure DB1 in a way that I only allows VM1 & VM2, one possible option would be allowing the VNET1 to access DB1

    Source: Adapted from community discussion — Ajdlfasudfo0

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 421. 496 questions available.