CertBlaze

Microsoft

AZ-500 Free Practice Questions — Page 4

Question 33

HOTSPOT - Your network contains an on-premises Active Directory domain that syncs to a Microsoft Entra tenant. The tenant contains the users shown in the following table. The tenant contains the groups shown in the following table. You configure a multi-factor authentication (MFA) registration policy that has the following settings: • Assignments: o Include: Group1 o Exclude: Group2 • Controls: Require Azure MFA registration • Enforce Policy: On For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 33 Illustration for AZ-500 question 33 Illustration for AZ-500 question 33
Show Answer
Correct Answer: Yes No Yes
Explanation:
The MFA registration policy applies to members of Group1, except those excluded via Group2. User1 and User3 are included and not excluded, so they must register. User2 is excluded because exclusion takes precedence over inclusion. Whether a user is synchronized from on-premises does not change policy scope in this scenario.

Question 34

HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the virtual machines shown in the following table. You have a storage account named contoso2024 that contains the following resources: • A container named Container1 that contains a file named File1 • A file share named Share1 that contains a file named File2 You create a private endpoint for contoso2024 as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 34 Illustration for AZ-500 question 34 Illustration for AZ-500 question 34 Illustration for AZ-500 question 34
Show Answer
Correct Answer: Yes Yes No
Explanation:
The private endpoint targets the Blob sub-resource, so blob access (File1 in the blob container) is available over the private endpoint from the hosting VNet and its peered VNet (with proper DNS). The Azure Files share (File2) requires a separate private endpoint for the file sub-resource.

Question 35

HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table. From Microsoft Entra Privileged Identity Management (PIM), you configure the settings for the Security Administrator role as shown in the following exhibit. From PIM, you assign the Security Administrator role to the following groups: • Group1: Active assignment type, permanently assigned • Group2: Eligible assignment type, permanently eligible For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 35 Illustration for AZ-500 question 35 Illustration for AZ-500 question 35
Show Answer
Correct Answer: No Yes No
Explanation:
Group1 has a permanent active role assignment, so its members already have the role and do not activate it. Group2 has a permanent eligible assignment, so its members can activate immediately because approval is not required. A user who already has the role actively assigned does not need (and effectively does not use) activation.

Question 36

HOTSPOT - Your network contains an on-premises Active Directory domain named adatum.com that syncs to a Microsoft Entra tenant. The Microsoft Entra tenant contains the users shown in the following table. You configure the Microsoft Entra Password Protection settings for adatum.com as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 36 Illustration for AZ-500 question 36 Illustration for AZ-500 question 36
Show Answer
Correct Answer: No No Yes
Explanation:
Password protection is evaluated when passwords are changed, not for existing passwords. Cloud-only users always have Microsoft Entra password protection enforced, so a password containing the banned term 'Adatum' (including normalized substitutions) is rejected. The on-premises synced user is subject to Windows Server AD password protection in Audit mode, so the weak password is audited rather than blocked.

Question 37

HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table. You configure the Temporary Access Pass settings as shown in the following exhibit. You add the Temporary Access Pass authentication method to Admin2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 37 Illustration for AZ-500 question 37 Illustration for AZ-500 question 37
Show Answer
Correct Answer: No No Yes
Explanation:
A generated Temporary Access Pass code cannot be viewed again after creation. The TAP policy targets only Group1, so User1 is not eligible for TAP creation/use under this policy. A Privileged Authentication Administrator can create a TAP for another administrator (not themselves), so Admin2 can add a TAP for Admin1.

Question 38

You have an Azure subscription that contains an Azure Data Lake Storage account named sa1. You plan to deploy an app named App1 that will access sa1 and perform operations, including Read, List, Create Directory, and Delete Directory. You need to ensure that App1 can connect securely to sa1 by using a private endpoint. What is the minimum number of private endpoints required for sa1?

A. 1
B. 2
C. 3
D. 4
E. 5
Show Answer
Correct Answer: B
Explanation:
Azure Data Lake Storage Gen2 exposes both the DFS and Blob subresources. Directory operations such as Create Directory and Delete Directory use the DFS endpoint, while some storage operations are redirected to the Blob endpoint. Microsoft recommends creating private endpoints for both the DFS and Blob subresources to ensure all ADLS Gen2 operations succeed. Therefore, the minimum required is two private endpoints.

Question 39

You have an Azure subscription that contains the resources shown in the following table. You create an Azure DDoS Protection plan named DDoS1 in the West US Azure region. Which resources can you add to DDoS1?

A. VNetl1only
B. WebApp1 only
C. VNet1 and VNet2 only
D. VNet1 and WebApp1 only
E. VNet1, VNet2, and WebApp1
Show Answer
Correct Answer: C
Explanation:
An Azure DDoS Protection plan can be associated with virtual networks, not directly with Azure App Service (Web Apps). A single DDoS Protection plan can protect VNets across different Azure regions and subscriptions within the same Microsoft Entra tenant. Therefore, both VNet1 and VNet2 can be added to DDoS1, but WebApp1 cannot be added directly.

Question 40

SIMULATION - You need to ensure that the events in the NetworkSecurityGroupRuleCounter log of the VNET01-Subnet0-NSG network security group (NSG) are stored in the logs1234578 Azure Storage account. To complete this task, sign in to the Azure portal.

Show Answer
Correct Answer: Azure portal → Network Security Groups → VNET01-Subnet0-NSG → Diagnostic settings → Add diagnostic setting → select NetworkSecurityGroupRuleCounter log → Send to storage account → choose logs1234578 → Save.
Explanation:
Configure a diagnostic setting on the NSG to export the NetworkSecurityGroupRuleCounter log category to the specified Azure Storage account.

Question 41

You have a Microsoft Entra tenant named Contoso.com and an Azure Kubernetes Service (AKS) cluster AKS1. You discover that AKS1 cannot be accessed by using accounts from Contoso.com. You need to ensure AKS1 can be accessed by using accounts from Contoso.com. The solution must minimize administrative effort. What should you do first?

A. From Azure, recreate AKS1.
B. From AKS1, upgrade the version of Kubernetes.
C. From Microsoft Entra, add a Microsoft Entra ID P2 license.
D. From Microsoft Entra, configure the User settings.
Show Answer
Correct Answer: A
Explanation:
If the AKS cluster was created without Microsoft Entra (Azure AD) integration, older AKS behavior required enabling it at cluster creation. Simply changing Entra user settings, adding a P2 license, or upgrading Kubernetes would not by themselves make the existing cluster accessible with Entra accounts. Recreating the cluster with Microsoft Entra integration is the first required action and minimizes ongoing administration by using native Entra authentication.

Question 42

DRAG DROP - You have an Azure subscription that contains an Azure web app named App1. You plan to configure a Conditional Access policy for App1. The solution must meet the following requirements: • Only allow access to App1 from Windows devices. • Only allow devices that are marked as compliant to access App1. Which Conditional Access policy settings should you configure? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 42
Show Answer
Correct Answer: Only allow access to App1 from Windows devices: Conditions Only allow devices that are marked as compliant to access App1: Grant
Explanation:
Use the Device platforms condition to restrict access to Windows devices. In the Grant controls, require the device to be marked as compliant to allow access.

$19

Get all 437 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-500 study guide →