CertBlaze

Microsoft

AZ-500 Free Practice Questions — Page 15

Question 150

HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains two administrative units named AU1 and AU2. Users are assigned to the administrative units as shown in the following table. Users are assigned the roles shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point

Illustration for AZ-500 question 150 Illustration for AZ-500 question 150 Illustration for AZ-500 question 150
Show Answer
Correct Answer: Yes No No
Explanation:
Administrative unit-scoped roles apply only within their assigned administrative unit. Helpdesk Administrator can reset passwords for non-admin users in scope. Groups Administrator cannot reset passwords. Password Administrator can reset passwords for non-admins and Password Administrators, but not for a User Administrator.

Question 151

HOTSPOT - You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table. In storage1, you create a shared access signature (SAS) named SAS1 as shown in the following exhibit. To which resources can User1 write on July 1, 2022 by using SAS1 and key1? To answer select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 151 Illustration for AZ-500 question 151 Illustration for AZ-500 question 151
Show Answer
Correct Answer: SAS1: folder1 only Key1: container1, folder1 and table1
Explanation:
The account SAS allows only the File service, so it can write only to the file share (folder1). The storage account access key (key1) grants full access to all storage services in the account, including blob, file, and table resources.

Question 152

You have an Azure AD tenant that contains the identities shown in the following table. You plan to implement Azure AD Identity Protection. What is the maximum number of user risk policies you can configure?

A. 1
B. 90
C. 200
D. 265
E. 1000
Show Answer
Correct Answer: A
Explanation:
Azure AD (Microsoft Entra ID) Identity Protection supports a single built-in User risk policy per tenant. While Conditional Access allows many policies, the legacy Identity Protection User risk policy itself is tenant-wide and limited to one.

Question 153

You have an Azure subscription that contains a user named User1. You need to ensure that User1 can create managed identities. The solution must use the principle of least privilege. What should you do?

A. Create a management group and assign User1 the Hybrid Identity Administrator Azure Active Directory (Azure AD) role.
B. Create a management group and assign User1 the Managed Identity Operator role.
C. Create a resource group and assign User1 to the Managed Identity Contributor role.
D. Create an organizational unit (OU) and assign User1 the User administrator Azure Active Directory (Azure AD) role.
Show Answer
Correct Answer: C
Explanation:
To create user-assigned managed identities, the required Azure RBAC role is Managed Identity Contributor. Assigning it at the resource group scope grants only the necessary permissions within that scope, satisfying the principle of least privilege. Managed Identity Operator can only read and assign identities, not create them. Azure AD roles such as Hybrid Identity Administrator or User Administrator do not grant Azure RBAC permissions to create managed identities.

Question 154

You have an Azure Active Directory (Azure AD) tenant that contains 500 users and an administrative unit named AU1. From the Azure Active Directory admin center, you plan to add the users to AU1 by using Bulk add members. You need to create and upload a file for the bulk add. What should you include in the file?

A. only the display name of each user
B. only the user principal name (UPN) of each user
C. only the user principal name (UPN) and display name of each user
D. only the user principal name (UPN) and object identifier of each user
E. only the object identifier of each user
Show Answer
Correct Answer: B
Explanation:
For bulk adding existing users to an Azure AD (Microsoft Entra ID) administrative unit, the CSV template requires one user principal name (UPN) per row. Display names and object IDs are not required for this operation. This is different from bulk user creation or some other bulk import scenarios.

Question 155

DRAG DROP - You have an Azure subscription. You plan to create two custom roles named Role1 and Role2. The custom roles will be used to perform the following tasks: • Members of Role1 will manage application security groups. • Members of Role2 will manage Azure Bastion. You need to add permissions to the custom roles. Which resource provider should you use for each role? To answer, drag the appropriate resource providers to the correct roles. Each resource provider may be used, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 155
Show Answer
Correct Answer: Role1: Microsoft.Network Role2: Microsoft.Network
Explanation:
Application Security Groups are Microsoft.Network resources, and Azure Bastion is managed through the Microsoft.Network resource provider (Microsoft.Network/bastionHosts).

Question 156

You have an Azure subscription that contains the resources shown in the following table. You need to configure storage1 to regenerate keys automatically every 90 days. Which cmdlet should you run?

A. Add-AzKeyVaultflanagedStorageAccount
B. Set-AzStorageAccountManagementPolicy
C. Set-AzStorageAccount
D. Add-AzStorageAccountManagementPolicyAction
Show Answer
Correct Answer: A
Explanation:
The cmdlet used to configure Azure Key Vault to manage a storage account and automatically regenerate its access keys on a defined schedule is Add-AzKeyVaultManagedStorageAccount (option A, despite the typo in the option text). It accepts a regeneration period (for example, 90 days). The other cmdlets manage storage lifecycle policies or storage account properties and do not configure automatic key regeneration.

Question 157

You have an Azure Active Directory (Azure AD) tenant that contains a group named Group1. You need to ensure that the members of Group1 sign in by using passwordless authentication. What should you do?

A. Configure the sign-in risk policy.
B. Create a Conditional Access policy.
C. Configure the Microsoft Authenticator authentication method policy.
D. Configure the certificate-based authentication (CBA) policy.
Show Answer
Correct Answer: B
Explanation:
To ensure members of a group sign in using passwordless authentication, you must enforce an authentication strength or passwordless requirement through a Conditional Access policy scoped to that group. The Microsoft Authenticator authentication method policy only enables the method; it does not require users to use passwordless sign-in. Sign-in risk policy and CBA policy do not generally enforce passwordless for the group.

Question 158

HOTSPOT - You have a Microsoft Sentinel deployment. You need to connect a third-party security solution to the deployment. The third-party solution will send Common Event Format (CEF)-formatted messages. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 158
Show Answer
Correct Answer: Deploy: A Linux server and a Syslog forwarder daemon Forward events to Microsoft Sentinel by using: An Azure Monitor agent
Explanation:
CEF messages are typically received by a Linux-based Syslog forwarder, which forwards them to Microsoft Sentinel. The current recommended ingestion method is the Azure Monitor agent (AMA).

Question 159

You have an Azure subscription that contains a managed identity named Identity1 and the Azure key vaults shown in the following table. KeyVault1 contains an access policy that grants Identity1 the following key permissions: • Get • List • Wrap • Unwrap You need to provide Identity1 with the same permissions for KeyVault2. The solution must use the principle of least privilege. Which role should you assign to Identity1?

A. Key Vault Crypto Service Encryption User
B. Key Vault Crypto User
C. Key Vault Reader
D. Key Vault Crypto Officer
Show Answer
Correct Answer: A
Explanation:
The required permissions are Get, List, Wrap, and Unwrap for keys. Under Azure Key Vault RBAC, the built-in 'Key Vault Crypto Service Encryption User' role is designed to read key metadata (covering get/list of key metadata) and perform wrap/unwrap operations. 'Key Vault Crypto User' grants additional cryptographic permissions such as encrypt/decrypt, sign/verify, backup, and update, exceeding the stated requirement. 'Key Vault Reader' cannot perform wrap/unwrap, and 'Key Vault Crypto Officer' is significantly more privileged because it can manage keys.

$19

Get all 437 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-500 study guide →