Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 521:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

  

  Azure AD Privileged Identity Management (PIM) is enabled for the tenant.

  In PIM, the Password Administrator role has the following settings:

  1. Maximum activation duration (hours): 2

  2. Send email notifying admins of activation: Disable

  3. Require incident/request ticket number during activation: Disable

  4. Require Azure Multi-Factor Authentication for activation: Enable

  5. Require approval to activate this role: Enable

  6. Selected approver: Group1

  You assign users the Password Administrator role as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Active assignments don't require the member to perform any action to use the role. Members assigned as active have the privileges assigned to the role at all times.

  Box 2: Yes

  While Multi-Factor Authentication is disabled for User2 and the setting Require Azure Multi-Factor Authentication for activation is enabled, User2 can request the role but will need to enable MFA to use the role.

  Note: Eligible assignments require the member of the role to perform an action to use the role. Actions might include performing a multi-factor authentication (MFA) check, providing a business justification, or requesting approval from designated approvers.

  Box 3: No

  User3 is Group1, which is a Selected Approver Group, however, self-approval is not allowed and someone else from group is required to approve the request.

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-resource-roles-assign-roles

• Question 522:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable the diagnostic logs for the storage account.

  What should you use to retrieve the diagnostics logs?

  A. Azure Storage Explorer
  B. SQL query editor in Azure
  C. File Explorer in Windows
  D. Azure Security Center
  A. Azure Storage Explorer

  ---

  Explanation

  If you want to download the metrics for long-term storage or to analyze them locally, you must use a tool or write some code to read the tables. You must download the minute metrics for analysis. The tables do not appear if you list all the tables in your storage account, but you can access them directly by name. Many storage-browsing tools are aware of these tables and enable you to view them directly (see Azure Storage Client Tools for a list of available tools).

  Microsoft provides several graphical user interface (GUI) tools for working with the data in your Azure Storage account. All of the tools outlined in the following table are free.

  

  Note:

  There are several versions of this question in the exam. The questions in the exam have two different correct answers:

  Azure Storage Explorer

  AZCopy

  Other incorrect answer options you may see on the exam include the following: SQL query editor in Azure

  File Explorer in Windows

  Azure Monitor Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-metrics?toc=%2fazure%2fstorage%2fblobs%2ftoc.json

  https://docs.microsoft.com/en-us/azure/storage/common/storage-explorers

• Question 523:

  SIMULATION

  You need to ensure that the audit logs from the SQLdb1 Azure SQL database are stored in the WS11641655 Azure Log Analytics workspace.

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  1. In the Azure portal, type SQL in the search box, select SQL databases from the search results then select SQLdb1. Alternatively, browse to SQL databases in the left navigation pane.

  2. In the properties of SQLdb1, scroll down to the Security section and select Auditing.

  3. Turn auditing on if it isn't already, tick the Log Analytics checkbox then click on Configure.

  

  4. Select the WS11641655 Azure Log Analytics workspace.

  5. Click Save to save the changes.

• Question 524:

  You have an Azure subscription that contains an Azure key vault.

  You create a storage account named storage1.

  You plan to store data in the following storage1 services:

  1. Azure Files

  2. Azure Blob storage

  3. Azure Table storage

  4. Azure Queue storage

  For which two services can you configure data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution,

  NOTE: Each correct selection is worth one point.

  A. Blob storage
  B. Table storage
  C. Queue storage
  D. Azure Files
  A. Blob storage
  D. Azure Files

• Question 525:

  HOTSPOT

  You have an Azure AD tenant named contoso.com that contains the users shown in the following table.

  

  You add enterprise applications to contoso.com as shown in the following table.

  

  You need to identify which users can grant admin consent for App1 and App2.

  Which users should you identify for each application? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 526:

  You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.

  You need to ensure that User1 can create and manage administrative units. The solution must use the principle of least privilege.

  Which role should you assign to User1?

  A. Privileged role administrator
  B. Helpdesk administrator
  C. Global administrator
  D. Security administrator
  C. Global administrator

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-registration-mfa-sspr-combined

  as somenick stated

• Question 527:

  HOTSPOT

  You have an Azure subscription that contains an Azure key vault named KeyVault1 and the virtual machines shown in the following table.

  

  You set the Key Vault access policy to Enable access to Azure Disk Encryption for volume encryption.

  KeyVault1 is configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 528:

  You have an Azure subscription named Subcription1 that contains an Azure Active Directory (Azure AD) tenant named contoso.com and a resource group named RG1.

  You create a custom role named Role1 for contoso.com.

  You need to identify where you can use Role1 for permission delegation.

  What should you identify?

  A. contoso.com only
  B. contoso.com and RGT only
  C. contoso.com and Subscription1 only
  D. contoso.com, RG1, and Subcription1
  A. contoso.com only

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles

• Question 529:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant.

  After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf.

  Solution: You configure a delegated permission with admin consent.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 530:

  DRAG DROP

  You have an Azure AD tenant that contains the users shown in the following table.

  

  You enable passwordless authentication for the tenant.

  Which authentication method can each user use for passwordless authentication? To answer, drag the appropriate authentication methods to the correct users. Each authentication method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Microsoft Authenticator app only Android mobile device with facial recognition

  Microsoft Authenticator

  The Authenticator App turns any iOS or Android phone into a strong, passwordless credential.

  Box 2: Microsoft Authenticator app, Windows Hello for Business, and FIDO2 security keys

  Windows Hello for Business is ideal for information workers that have their own designated Windows PC. The biometric and PIN credentials are directly tied to the user's PC, which prevents access from anyone other than the owner.

  Authenticator app: Works in scenarios where Azure AD authentication is used, including across all browsers, during Windows 10 setup, and with integrated mobile apps on any operating system.

  Security keys: Work on lock screen for Windows 10 and the web in supported browsers like Microsoft Edge (both legacy and new Edge).

  FIDO2 security keys Pre-requisite:

  Windows 10, version 1903 or later Azure Active Directory

  Incorrect:

  * FIDO2

  FIDO2 security keys

  The FIDO (Fast IDentity Online) Alliance helps to promote open authentication standards and reduce the use of passwords as a form of authentication.

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless