Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 231:

  You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.

  You plan to enable passwordless authentication for the tenant.

  You need to ensure that User1 can enable the combined registration experience. The solution must use the principle of least privilege.

  Which role should you assign to User1?

  A. Security administrator
  B. Privileged role administrator
  C. Authentication administrator
  D. Global administrator
  C. Authentication administrator

  ---

  Explanation

  Authentication Administrator.

  Users with this role can set or reset any authentication method (including passwords) for non-administrators and some roles. Authentication Administrators can require users who are non-administrators or assigned to some roles to re-register against existing non-password credentials (for example, MFA or FIDO), and can also revoke remember MFA on the device, which prompts for MFA on the next sign-in.

  Note: Before combined registration, users registered authentication methods for Azure AD Multi-Factor Authentication and self-service password reset (SSPR) separately. People were confused that similar methods were used for Azure AD Multi-Factor Authentication and SSPR but they had to register for both features. Now, with combined registration, users can register once and get the benefits of both Azure AD Multi-Factor Authentication and SSPR.

  Azure Active Directory role enable the combined registration experience

  Incorrect:

  Privileged Role Administrator.

  Users with this role can manage role assignments in Azure Active Directory, as well as within Azure AD Privileged Identity Management. They can create and manage groups that can be assigned to Azure AD roles. In addition, this role allows management of all aspects of Privileged Identity Management and administrative units.

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined

  https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#privileged-role-administrator

• Question 232:

  HOTSPOT

  You have a management group named MG1 that contains an Azure subscription named Sub1.

  Sub1 contains the resources shown in the following table.

  

  You create an Azure Virtual Network Manager instance named AVNM1 that has the following configurations:

  Management scope: MG1

  Network groups:

  Name: Group1

  Group members: VNet1

  Security admin configuration:

  Name: SAT

  Rule collections:

  Name: SACollection1

  Target network groups: Group1

  Security admin rules:

  Name: SARule1

  Priority: 500

  Action: Deny

  Direction: Inbound

  Source type: Any

  Source port *

  SA1 is deployed to all Azure regions.

  You create a Virtual Network Manager instance named AVNM2 that has the following configurations:

  Management scope: Sub1

  Network groups:

  Name: Group2

  Group members: VNet1

  Security admin configuration:

  Name: SA2

  Rule collections:

  Name: SACollection2

  Target network groups: Group2

  Security admin rules:

  Name: SARule2

  Priority: 500

  Action: Always allow

  Direction: Inbound

  Source type: Any

  Source port: *

  SA2 is deployed to all Azure regions.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE Each correct selection is worth one point.

  

  

• Question 233:

  Your company uses Azure DevOps with branch policies configured.

  Which of the following is TRUE with regards to branch policies? (Choose all that apply.)

  A. It enforces your team's change management standards.
  B. It controls who can read and update the code in a branch.
  C. It enforces your team's code quality.
  D. It places a branch into a read-only state.
  A. It enforces your team's change management standards.
  C. It enforces your team's code quality.

  ---

  Explanation

  Branch policies help teams protect their important branches of development. Policies enforce your team's code quality and change management standards.

  https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&viewFallbackFrom=vsts

• Question 234:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected]

  Azure Password: Gp0Ae4@!Dg

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 28681041

  You need to email an alert to a user named [email protected] if the average CPU usage of a virtual machine named VM1 is greater than 70 percent for a period of 15 minutes.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Create an alert rule on a metric with the Azure portal 1. In the portal, locate the resource, here VM1, you are interested in monitoring and select it.

  2. Select Alerts (Classic) under the MONITORING section. The text and icon may vary slightly for different resources.

  3. Select the Add metric alert (classic) button and fill in the fields as per below, and click OK.

  Metric: CPU Percentage -

  Condition: Greater than -

  Period: Over last 15 minutes -

  Notify via: email - Additional administrator email(s): [email protected]

  

  https://docs.microsoft.com/en-us/azure/sql-database/sql-database-insights-alerts-portal

• Question 235:

  Your company recently created an Azure subscription. You have, subsequently, been tasked with making sure that you are able to secure Azure AD roles by making use of Azure Active Directory (Azure AD) Privileged Identity Management (PIM).

  Which of the following actions should you take FIRST?

  A. You should sign up Azure Active Directory (Azure AD) Privileged Identity Management (PIM) for Azure AD roles.
  B. You should consent to Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
  C. You should discover privileged roles.
  D. You should discover resources.
  B. You should consent to Azure Active Directory (Azure AD) Privileged Identity Management (PIM).

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started

• Question 236:

  HOTSPOT

  You have an Azure subscription that contains three storage account named storage1, storage2, and storage3, three Log Analytics workspaces named Analytics1, Analytics2, Analytics3, and three Azure event hub named EventHub1, EventHub2, and EventHub3.

  For Microsoft Entra ID, you create the diagnostic settings shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  

  

• Question 237:

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  You need to add a custom security recommendation to Defender for Cloud. The recommendation must be assigned the custom severity rating of the subscription.

  What should you create?

  A. an exemption
  B. an initiative definition
  C. a policy definition
  D. an assignment
  C. a policy definition

• Question 238:

  You onboard Azure Sentinel. You connect Azure Sentinel to Azure Security Center.

  You need to automate the mitigation of incidents in Azure Sentinel. The solution must minimize administrative effort.

  What should you create?

  A. an alert rule
  B. a playbook
  C. a function app
  D. a runbook
  B. a playbook

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

• Question 239:

  HOTSPOT

  You have an Azure subscription that contains the storage accounts shown in the following, table.

  

  You enable Microsoft Defender for Storage.

  Which storage services of storages are monitored by Microsoft Defender for Storage, and which storage accounts are protected by Microsoft Defender for Storage? To answer, select the appropriate options in the answer area.

  

  

• Question 240:

  You need to meet the technical requirements for the finance department users.

  Which CAPolicy1 settings should you modify?

  A. Cloud apps or actions
  B. Conditions
  C. Grant
  D. Session
  D. Session

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime