CertBlaze

Microsoft

AZ-500 Free Practice Questions — Page 4

Question 32

You have a Microsoft Entra tenant named contoso.com. You have a partner company that has a Microsoft Entra tenant named fabrikam.com. You need to ensure that when a user in fabrikam.com attempts to access the resources in contoso.com, the user only receives a single Microsoft Entra Multi-Factor Authentication (MFA) prompt. The solution must minimize administrative effort. What should you do?

A. From the Azure portal of contoso.com, configure the inbound access default settings.
B. From the Azure portal of contoso.com, configure the External collaboration settings.
C. From the Azure portal of contoso.com, configure the outbound access default settings.
D. From the Azure portal of fabrikam.com, configure the outbound access default settings.
Show Answer
Correct Answer: A
Explanation:
To ensure users from fabrikam.com receive only a single MFA prompt when accessing contoso.com resources, contoso must trust the MFA performed in the external tenant. This is achieved by configuring Cross-tenant access settings → Inbound access default settings in contoso.com and enabling trust for MFA claims from external Microsoft Entra tenants. This prevents a second MFA challenge and, by using the default inbound settings, minimizes administrative effort.

Question 33

HOTSPOT - Your network contains an on-premises Active Directory domain that syncs to a Microsoft Entra tenant. The tenant contains the users shown in the following table. The tenant contains the groups shown in the following table. You configure a multi-factor authentication (MFA) registration policy that has the following settings: • Assignments: o Include: Group1 o Exclude: Group2 • Controls: Require Azure MFA registration • Enforce Policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 33 Illustration for AZ-500 question 33 Illustration for AZ-500 question 33
Show Answer
Correct Answer: User1: Yes User2: No User3: Yes
Explanation:
The MFA registration policy includes Group1 and excludes Group2. User1 and User3 are members of Group1 and not excluded, so they are prompted to register MFA at next authentication. User2 is explicitly excluded via Group2, so the policy does not apply. On-premises sync status does not affect MFA registration enforcement for users in the tenant.

Question 34

HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the virtual machines shown in the following table. You have a storage account named contoso2024 that contains the following resources: • A container named Container1 that contains a file named File1 • A file share named Share1 that contains a file named File2 You create a private endpoint for contoso2024 as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 34 Illustration for AZ-500 question 34 Illustration for AZ-500 question 34 Illustration for AZ-500 question 34
Show Answer
Correct Answer: VM1 → File1: Yes VM2 → File1: Yes VM2 → File2: No
Explanation:
The private endpoint is created for the storage account Blob sub-resource and placed in VNet2 (Subnet21). Private endpoints are reachable from peered VNets, so both VM1 (VNet1) and VM2 (VNet2) can access Blob data (File1) via the private IP, assuming DNS resolution is in place. File2 is in an Azure Files share, which requires a private endpoint for the File sub-resource; the existing Blob private endpoint does not provide private access to file shares.

Question 35

HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table. From Microsoft Entra Privileged Identity Management (PIM), you configure the settings for the Security Administrator role as shown in the following exhibit. From PIM, you assign the Security Administrator role to the following groups: • Group1: Active assignment type, permanently assigned • Group2: Eligible assignment type, permanently eligible For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 35 Illustration for AZ-500 question 35 Illustration for AZ-500 question 35
Show Answer
Correct Answer: No Yes No
Explanation:
User1 has an active, permanent assignment through Group1, so no activation window applies. User2 is eligible through Group2 and, with no approval required, activation assigns the role immediately. User3 already has the role as an active assignment via Group1, so activation is not applicable.

Question 36

HOTSPOT - Your network contains an on-premises Active Directory domain named adatum.com that syncs to a Microsoft Entra tenant. The Microsoft Entra tenant contains the users shown in the following table. You configure the Microsoft Entra Password Protection settings for adatum.com as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 36 Illustration for AZ-500 question 36 Illustration for AZ-500 question 36
Show Answer
Correct Answer: User1: No User2: No User3: Yes
Explanation:
Password protection is evaluated only during password changes, not at sign-in. Custom banned passwords are always enforced for cloud-only users, and normalization detects variants of banned terms like "Adatum". Audit mode applies only to on-premises Active Directory users, allowing but logging weak passwords there.

Question 37

HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table. You configure the Temporary Access Pass settings as shown in the following exhibit. You add the Temporary Access Pass authentication method to Admin2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 37 Illustration for AZ-500 question 37 Illustration for AZ-500 question 37
Show Answer
Correct Answer: Yes No Yes
Explanation:
• A Global Administrator can view TAP details for any user except themselves. • User1 isn’t targeted by the TAP policy (only Group1), so TAP can’t be added for User1. • A Privileged Authentication Administrator can add a TAP for another administrator (not themselves) who is in scope, such as Admin1.

Question 38

You have an Azure subscription that contains an Azure Data Lake Storage account named sa1. You plan to deploy an app named App1 that will access sa1 and perform operations, including Read, List, Create Directory, and Delete Directory. You need to ensure that App1 can connect securely to sa1 by using a private endpoint. What is the minimum number of private endpoints required for sa1?

A. 1
B. 2
C. 3
D. 4
E. 5
Show Answer
Correct Answer: B
Explanation:
Azure Data Lake Storage Gen2 exposes two relevant subresources for private endpoints: **dfs** (for hierarchical namespace operations like Create/Delete Directory and ACLs) and **blob** (which some Gen2 operations are redirected to). To ensure all listed operations (Read, List, Create Directory, Delete Directory) work reliably over private connectivity, you must create private endpoints for both the DFS and Blob subresources. Therefore, the minimum required is **2** private endpoints.

Question 39

You have an Azure subscription that contains the resources shown in the following table. You create an Azure DDoS Protection plan named DDoS1 in the West US Azure region. Which resources can you add to DDoS1?

A. VNetl1only
B. WebApp1 only
C. VNet1 and VNet2 only
D. VNet1 and WebApp1 only
E. VNet1, VNet2, and WebApp1
Show Answer
Correct Answer: C
Explanation:
Azure DDoS Protection Standard plans are associated with virtual networks, not with individual PaaS services like Azure Web Apps. A single DDoS protection plan can be linked to multiple VNets, even across different Azure regions and subscriptions within the same tenant. Therefore, both VNet1 and VNet2 can be added to DDoS1, but WebApp1 cannot be added directly.

Question 40

SIMULATION - You need to ensure that the events in the NetworkSecurityGroupRuleCounter log of the VNET01-Subnet0-NSG network security group (NSG) are stored in the logs1234578 Azure Storage account. To complete this task, sign in to the Azure portal.

Show Answer
Correct Answer: Azure portal → Network security groups → VNET01-Subnet0-NSG Monitoring → Diagnostic settings → Add diagnostic setting Select log: NetworkSecurityGroupRuleCounter Destination: Archive to a storage account Storage account: logs1234578 Save
Explanation:
NSG platform logs are exported using Diagnostic settings. Selecting the NetworkSecurityGroupRuleCounter log and archiving it to the specified Azure Storage account ensures the events are stored in logs1234578.

Question 41

You have a Microsoft Entra tenant named Contoso.com and an Azure Kubernetes Service (AKS) cluster AKS1. You discover that AKS1 cannot be accessed by using accounts from Contoso.com. You need to ensure AKS1 can be accessed by using accounts from Contoso.com. The solution must minimize administrative effort. What should you do first?

A. From Azure, recreate AKS1.
B. From AKS1, upgrade the version of Kubernetes.
C. From Microsoft Entra, add a Microsoft Entra ID P2 license.
D. From Microsoft Entra, configure the User settings.
Show Answer
Correct Answer: A
Explanation:
AKS access with Microsoft Entra ID depends on how authentication and authorization were configured at cluster creation. If AKS1 was created without Microsoft Entra ID integration (or with legacy limitations), you cannot later enable the required Entra-based access without recreating the cluster. Upgrading Kubernetes, adding licenses, or changing Entra user settings will not fix this. Recreating AKS1 with Microsoft Entra ID authentication enabled is therefore the first and necessary step, and it minimizes ongoing administrative effort by using native Entra integration.

$19

Get all 440 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-500 study guide →