AZ-500 practice questions 71–80

1. Question 71 · 496 in bank

   You have an Azure subscription that contains a user named User1 and a storage account that hosts a blob container named blob1. You need to grant User1 access to blob1. The solution must ensure that the access expires after six days. What should you use?

   • Aa shared access signature (SAS)
   • Brole-based access control (RBAC)
   • Ca shared access policy
   • Da managed identity

   Show answer

   Answer: A

   Explanation

   A shared access signature (SAS) is a URI that grants access to Azure Storage resources without requiring a storage account key. SAS tokens can be used to grant access to specific resources, such as a blob container, for a specific period of time. To grant User1 access to blob1 with an expiration of six days, you can create a SAS token with the following parameters: - Permissions: r, w, or d, depending on the level of access that you want to grant. - Start time: The current time. - Expiry time: Six days from now. Once you have created the SAS token, you can provide it to User1. User1 can then use the SAS token to access blob1 until the expiry time.

   Source: Adapted from community discussion — OrangeSG

   Next question

2. Question 72 · 496 in bank

   Select 2

   You have an Azure subscription linked to an Azure AD tenant named contoso.com. Contoso.com contains a user named User1 and an Azure web app named App1. You plan to enable User1 to perform the following tasks: • Configure contoso.com to use Microsoft Entra Verified ID. • Register App1 in contoso.com. You need to identify which roles to assign to User1. The solution must use the principle of least privilege. Which two roles should you identify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAuthentication Policy Administrator
   • BAuthentication Administrator
   • CCloud App Security Administrator
   • DApplication Administrator
   • EUser Administrator

   Show answer

   Answer: AD

   Explanation

   AD. https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/verifiable-credentials-configure-tenant Ensure that you have the global administrator or the authentication policy administrator permission for the directory you want to configure. If you're not the global administrator, you need the application administrator permission to complete the app registration including granting admin consent.

   Source: Adapted from community discussion — xcapell

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 73 · 496 in bank

   You have an Azure AD tenant. You plan to implement an authentication solution to meet the following requirements: • Require number matching. • Display the geographical location when signing in. Which authentication method should you include in the solution?

   • AMicrosoft Authenticator
   • BFIDO2 security key
   • CSMS
   • DTemporary Access Pass

   Show answer

   Answer: A

   Explanation

   Microsoft Authenticator is the only authentication method that meets both requirements: - It supports number matching, which means that users must enter a number displayed in the Microsoft Authenticator app to approve sign-in attempts. - It can display the geographical location of the sign-in attempt (based on IP address during sign-in), which can be useful for detecting suspicious activity.

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn

   Next question

4. Question 74 · 496 in bank

   Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant. You plan to implement single sign-on (SSO) for Azure AD resources. You need to configure an Intranet Zone setting for all users by using a Group Policy Object (GPO). Which setting should you configure?

   • ALogon options
   • BAllow updates to status bar via script
   • CAllow active scripting
   • DAccess data sources across domains

   Show answer

   Answer: B

   Explanation

   https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-quick-start Refer to this link above. the answer is B as stated in the supported Microsoft site. Did a research to find the actual answer. thanks you. hope it help to the exam taker.

   Source: Adapted from community discussion — ElaineChia

   References

   • Microsoft Learn

   Next question

5. Question 75 · 496 in bank

   HOTSPOT - Your company has two offices in Seattle and New York. Each office connects to the Internet by using a NAT device. The offices use the IP addresses shown in the following table.

   

   The company has an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

   

   The MFA service settings are configured as shown in the exhibit. (Click the Exhibit tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - Box 2: No - Use of Microsoft Authenticator is not required. Either a text or phone call is required for MFA. Note: Microsoft Authenticator is a multifactor app for mobile devices that generates time-based codes used during the Two-Step Verification process. Box 3: No - The New York IP address subnet is included in the "skip multi-factor authentication for request. Reference: https://www.cayosoft.com/difference-enabling-enforcing-mfa/

   Source: Adapted from community discussion — gboyega

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 76 · 496 in bank

   HOTSPOT - You have an Azure AD tenant that contains the groups shown in the following table.

   

   You assign licenses to the groups as shown in the following table.

   

   On May1, you delete Group1, Group2, and Group3. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer seems correct Group 1 cannot be restored - Security groups cannot be restored Group 2 can be restored because its’s an O365 group Group 3 cannot be restored because 30 days have passed Please correct me if i'm wrong

   Source: Adapted from community discussion — Vokuhila

   References

   • Microsoft Learn

   

   Next question

7. Question 77 · 496 in bank

   You have an Azure AD tenant. You need to ensure that users cannot create passwords containing a variation of the word contoso. What should you configure?

   • AMicrosoft Entra Verified ID
   • BMicrosoft Entra Identity Governance
   • CAzure AD Privileged Identity Management (PIM)
   • DAzure AD Password Protection
   • EAzure AD Identity Protection

   Show answer

   Answer: D

   Explanation

   D is correct Azure AD Password Protection enables you to: Define custom password policies. Prevent the use of common words or patterns. Protect against various types of common attacks on passwords.

   Source: Adapted from community discussion — Vokuhila

   References

   • Microsoft Learn

   Next question

8. Question 78 · 496 in bank

   HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table.

   

   You configure the Temporary Access Pass settings as shown in the following exhibit.

   

   You add the Temporary Access Pass authentication method to Admin2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Think the answer is correct. User1 is not a member of Group1 Create a Temporary Access Pass After you enable a TAP policy, you can create TAPs for users in Microsoft Entra ID. These following roles can perform various actions related to a TAP. • Global Administrators can create, delete, and view a TAP for any user (except themselves). • Privileged Authentication Administrators can create, delete, and view a TAP for admins and members (except themselves). • Authentication Administrators can create, delete, and view a TAP for members (except themselves). • Global Readers can view TAP details for the user (without reading the code itself). Reference: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-temporary-access-pass

   Source: Adapted from community discussion — chiquito

   References

   • Microsoft Learn

   

   Next question

9. Question 79 · 496 in bank

   HOTSPOT - Your network contains an on-premises Active Directory domain named adatum.com that syncs to a Microsoft Entra tenant. The Microsoft Entra tenant contains the users shown in the following table.

   

   You configure the Microsoft Entra Password Protection settings for adatum.com as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Going with NYY This is not a new question. Please see Question #62Topic 2 for discussion Reference: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad#score-calculation https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-operations#enable-on-premises-password-protection https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-ban-bad-on-premises-deploy

   Source: Adapted from community discussion — chiquito

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 80 · 496 in bank

    HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table.

    

    From Microsoft Entra Privileged Identity Management (PIM), you configure the settings for the Security Administrator role as shown in the following exhibit.

    

    From PIM, you assign the Security Administrator role to the following groups: • Group1: Active assignment type, permanently assigned • Group2: Eligible assignment type, permanently eligible For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Think NYN is ok based on this: No - User1 is a member of Group1: that has Active assignment type, permanently assigned. Active assignments don't require the member to perform any activations to use the role. Members or owners assigned as active have the privileges assigned to the role at all times. Yes – No approval is required. There is no waiting. No – User3 is a member of Group1 and Group 2. Active assignments don't require the member to perform any activations to use the role. Reference: https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/groups-assign-member-owner

    Source: Adapted from community discussion — chiquito

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 71. 496 questions available.