AZ-500 practice questions 431–440

1. Question 431 · 496 in bank

   You have an Azure AD tenant that contains a user named User1. You purchase an app named App1. User1 needs to publish App1 by using Azure AD Application Proxy. Which role should you assign to User1?

   • ACloud application administrator
   • BApplication administrator
   • CHybrid identity administrator
   • DCloud App Security Administrator

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-add-on-premises-application#prerequisites To add an on-premises application to Azure AD, you need: - A Microsoft Azure AD premium subscription - An application administrator account

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 432 · 496 in bank

   HOTSPOT - You have an Azure AD tenant named contoso.com that contains the users shown in the following table.

   

   You add enterprise applications to contoso.com as shown in the following table.

   

   You need to identify which users can grant admin consent for App1 and App2. Which users should you identify for each application? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box1: User1 only Box2: User1 only To grant tenant-wide admin consent, you need: An Azure AD user account with one of the following roles: 1) Global Administrator or Privileged Role Administrator, for granting consent for apps requesting any permission, for any API. 2) Cloud Application Administrator or Application Administrator, for granting consent for apps requesting any permission for any API, except Azure AD Graph or Microsoft Graph app roles (application permissions). 3) A custom directory role that includes the permission to grant permissions to applications, for the permissions required by the application. https://learn.microsoft.com/EN-US/azure/active-directory/manage-apps/grant-admin-consent?pivots=portal

   Source: Adapted from community discussion — AzureJobsTillRetire

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 433 · 496 in bank

   DRAG DROP - Your network contains an on-premises Active Directory domain named contoso.com. The domain contains a user named User1. You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains an Azure Storage account named storage1. Storage1 contains an Azure file share named share1. Currently, the domain and the tenant are not integrated. You need to ensure that User1 can access share1 by using his domain credentials. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Implement Azure AD Connect 2. Enable an AD source for Azure File shares 3. Assign share-level permissions for share1 https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable#prerequisites Enabling AD DS authentication for your Azure file shares allows you to authenticate to your Azure file shares with your on-premises AD DS credentials. Further, it allows you to better manage your permissions to allow granular access control. Doing this requires synching identities from on-premises AD DS to Azure AD using either the on-premises Azure AD Connect sync application or Azure AD Connect cloud sync, a lightweight agent that can be installed from the Azure Active Directory Admin Center. You assign share-level permissions to hybrid identities synced to Azure AD while managing file/directory-level access using Windows ACLs.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 434 · 496 in bank

   HOTSPOT - You have a Microsoft Sentinel deployment. You need to connect a third-party security solution to the deployment. The third-party solution will send Common Event Format (CEF)-formatted messages. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Linux server and a Syslog forwarder daemon 2. Azure Monitor agent https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format There are two main steps to making this connection, that will be explained below in detail: - Designating a Linux machine or VM as a dedicated log forwarder, installing the Log Analytics agent on it, and configuring the agent to forward the logs to your Microsoft Sentinel workspace. The installation and configuration of the agent are handled by a deployment script. - Configuring your device to send its logs in CEF format to a Syslog server.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 435 · 496 in bank

   You have an Azure subscription that contains the virtual machines shown in the following table.

   

   Which computers will support file integrity monitoring?

   • AComputer2 only
   • BComputer1 and Computer2 only
   • CComputer2 and Computer3 only
   • DComputer1, Computer2, and Computer3

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

6. Question 436 · 496 in bank

   Your company uses Azure DevOps. You need to recommend a method to validate whether the code meets the company's quality standards and code review standards. What should you recommend implementing in Azure DevOps?

   • Abranch folders
   • Bbranch permissions
   • Cbranch policies
   • Dbranch locking

   Show answer

   Answer: C

   Next question

7. Question 437 · 496 in bank

   SIMULATION - The developers at your company plan to create a web app named App28681041 and to publish the app to https://www.contoso.com. You need to perform the following tasks: • Ensure that App28681041 is registered to Azure AD. • Generate a password for App28681041. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Thanks and yes correct. I tested, and here are the steps: 1. search for azure ad in portal 2. under manage -> app registrations -> new registration 3. enter the display name named App28681041 4. specify who can access the app -> leave as default (single tenant). Also leave redirect ui empty (will be done later) 5. register. Also take a note of the app ID and Object ID 6. azure portal -> app regis -> select your app App28681041 7. authentication -> add platform -> add the redirect uri https://www.contoso.com 8. certificates and secrets -> new client secret under client secrets 9. add any description and select an expiration date or specify a custom lifetime (max is 2 year) 10. click add. Save the secret's value to give to your app devs as it can't be displayed again

   Source: Adapted from community discussion — Ofenomeno

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 438 · 496 in bank

   You have an Azure AD tenant that contains the users shown in the following table.

   

   You need to ensure that the users cannot create app passwords. The solution must ensure that User1 can continue to use the Mail and Calendar app. What should you do?

   • AAssign User1 the Authentication Policy Administrator role.
   • BEnable Azure AD Password Protection.
   • CConfigure a multi-factor authentication (MFA) registration policy.
   • DCreate a new app registration.
   • EFrom multi-factor authentication, configure the service settings.

   Show answer

   Answer: E

   Explanation

   Given answer is correct. https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords#allow-users-to-create-app-passwords 1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator. 2. Browse to Conditional Access > Named locations. 3. Click on "Configure MFA trusted IPs" in the bar across the top of the Conditional Access | Named Locations window. 4. On the Multifactor authentication page, within the Service Settings tab, under "app passwords", select the "Do not allow users to create app passwords to sign in to non-browser apps"

   Source: Adapted from community discussion — cris_exam

   References

   • Microsoft Learn

   Next question

9. Question 439 · 496 in bank

   DRAG DROP - You have an Azure subscription named Sub1 that contains the storage accounts shown in the following table.

   

   The storage3 storage account is encrypted by using customer-managed keys. You need to enable Microsoft Defender for Storage to meet the following requirements: • The storage1 and storage2 accounts must be included in the Defender for Storage protections. • The storage3 account must be excluded from the Defender for Storage protections. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 440 · 496 in bank

    You have an Azure subscription that contains the virtual machines shown in the following table.

    

    You are configuring Microsoft Defender for Servers. You plan to enable adaptive application controls to create an allowlist of known-safe apps on the virtual machines. Which virtual machines support the use of adaptive application controls?

    • AVM1 and VM2 only
    • BVM2 and VM4 only
    • CVM2 and VM3 only
    • DVM1, VM2, VM3, and VM4

    Show answer

    Answer: D

    Explanation

    Answer = A (VM1 and VM2 only) -Adaptive application controls help in defining an allowlist of known-safe applications for virtual machines. -Windows Server Core installations, like VM3, are not supported by this feature. -VM4 is configured with an AppLocker policy, which may conflict with adaptive application controls as they perform similar functions for application whitelisting. Thus, the answer will focus on the virtual machines that are neither Server Core nor use AppLocker. That would be VM1 (Windows Server 2019) and VM2 (Windows Server 2022). The correct answer is A. VM1 and VM2 only.

    Source: Adapted from community discussion — ezmoney

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 431. 496 questions available.