AZ-500 practice questions 61–70

1. Question 61 · 496 in bank

   HOTSPOT - You assign User8 the Owner role for RG4, RG5, and RG6. In which resource groups can User8 create virtual networks and NSGs by using the Azure portal? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: RG6 only - The policy does not allow the creation of virtual networks/subnets in RG5. Only NSGs can be created in RG4. Box 2: The policy does not allow the creation of NSGs in RG5. Reference: https://docs.microsoft.com/en-us/azure/governance/policy/overview

   Source: Adapted from community discussion — wsrudmen

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 62 · 496 in bank

   HOTSPOT - Which virtual networks in Sub1 can User9 modify and delete in their current state? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: VNET4 and VNET1 only - RG1 has only Delete lock, while there are no locks on RG4. RG2 and RG3 both have Read-only locks. Box 2: VNET4 only - There are no locks on RG4, while the other resource groups have either Delete or Read-only locks. Note: As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly. In the portal, the locks are called Delete and Read-only respectively. ✑ CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource. ✑ ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role. Scenario: Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6. User9 creates the virtual networks shown in the following table. Sub1 contains the locks shown in the following table. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

   Source: Adapted from community discussion — diirn

   References

   • Microsoft Learn

   

   Next question

3. Question 63 · 496 in bank

   You need to ensure that you can meet the security operations requirements. What should you do first?

   • ATurn on Auto Provisioning in Security Center.
   • BIntegrate Security Center and Microsoft Cloud App Security.
   • CUpgrade the pricing tier of Security Center to Standard.
   • DModify the Security Center workspace configuration.

   Show answer

   Answer: C

   Explanation

   The answer which would make sense is C) but in the scenario they mentioned that ASC is Standard already? I think it is a typo and it should be 'free' which will then make answer c) more logical. Also note this is old way of MS ASC tiers (free, standard) which has now been changed to ASC Free, ASC AD ON

   Source: Adapted from community discussion — dadageer

   References

   • azure.microsoft.com documentation
   • azure.microsoft.com documentation

   Next question

4. Question 64 · 496 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You create a new stored access policy. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   I believe the correct answer to this is "No". You can up to 5 access policies on an object. Creating a new one doesn't revoke the old one. To revoke a stored access policy, you can delete it, rename it by changing the signed identifier, or change the expiry time to a value in the past. Nowhere in the documentation does it say creating a new one revokes the old one.

   Source: Adapted from community discussion — JohnCrawford

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 65 · 496 in bank

   You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. An administrator named Admin1 has access to the following identities: ✑ An OpenID-enabled user account ✑ A Hotmail account ✑ An account in contoso.com ✑ An account in an Azure AD tenant named fabrikam.com You plan to use Azure Account Center to transfer the ownership of Sub1 to Admin1. To which accounts can you transfer the ownership of Sub1?

   • Acontoso.com only
   • Bcontoso.com, fabrikam.com, and Hotmail only
   • Ccontoso.com and fabrikam.com only
   • Dcontoso.com, fabrikam.com, Hotmail, and OpenID-enabled user account

   Show answer

   Answer: A

   Explanation

   Please always make sure that you have read the condition of the question carefully. In this question, questions asks from us to which account can we transfer the ownership of Subscription-1, it does not tell to where can we transfer the subscription, It asks about changing the ownership of subscription within the Entra ID (now called) this case we need to use contonso only. A lot of guys say answer is C, please not that it does not asks about transferring subscription to another tenant it just asks about transferring subscription withing existing tenant that is why answer here is A. Regards,

   Source: Adapted from community discussion — Jimmy500

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 66 · 496 in bank

   SIMULATION - You need to ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group. The solution must use the principle of least privilege. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

7. Question 67 · 496 in bank

   SIMULATION - You need to create a new Azure AD directory named 28681041.onmicrosoft.com. The new directory must contain a new user named user1@28681041.onmicrosoft.com. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

8. Question 68 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains a user named Admin1 and an Azure key vault named Vault1. You plan to implement Microsoft Entra Verified ID. You need to create an access policy to ensure that Admin1 has permissions to Vault1 that support the implementation of the Verified ID service. The solution must use the principle of least privilege. Which three key permissions should you select? To answer, select the appropriate permissions in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   By default, the account that creates a vault is the only one with access (vault creators have by default permissions to create and delete keys). The Verified ID service needs access to the key vault. You must authenticate your key vault, allowing the account used during configuration to create and delete keys. The account used during configuration also requires permissions to sign so that it can create the domain binding for Verified ID. So, if the Admin1 account is not the one that created Vault1, it will need to get the following key permissions: create, delete and sign. https://learn.microsoft.com/en-us/entra/verified-id/verifiable-credentials-configure-tenant

   Source: Adapted from community discussion — workhard

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 69 · 496 in bank

   You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM). A user named User1 is eligible for the Billing administrator role. You need to ensure that the role can only be used for a maximum of two hours. What should you do?

   • ACreate a new access review.
   • BEdit the role assignment settings.
   • CUpdate the end date of the user assignment.
   • DEdit the role activation settings.

   Show answer

   Answer: D

   Explanation

   To ensure that the Billing administrator role can only be used for a maximum of two hours, you need to edit the role activation settings. To do this, follow these steps: 1. Sign in to the Azure portal. 2. Go to Azure Active Directory > Privileged Identity Management. 3. Click Roles > Role settings. 4. Select the Billing administrator role. 5. Under Activation maximum duration, set the maximum duration to 2 hours. 6. Click Save. Once you have edited the role activation settings, User1 will be able to activate the Billing administrator role for a maximum of two hours at a time. After two hours, the role assignment will automatically expire. Reference Configure Microsoft Entra role settings in Privileged Identity Management https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-change-default-settings

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 70 · 496 in bank

    HOTSPOT - You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.

    

    User1 is assigned the following roles for storage1: • Storage Blob Data Reader • Storage Table Data Contributor • Storage File Data SMB Share Reader In storage1, you create a shared access signature (SAS) named SAS1 as shown in the following exhibit.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    RBAC roles only apply when connecting with AD credentials : 1. Y beacause SAS gives him File Delete permission 2. N because he has only SMB File Reader, he can't delete 3. N because SAS only gives File permission, not Table

    Source: Adapted from community discussion — sigvast

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 61. 496 questions available.