Microsoft Azure Certified Security Engineer AZ-500 → AZ-500: Microsoft Azure Security Technologies Part 2

AZ-500: Microsoft Azure Security Technologies Part 2

Q21: You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 21

Azure AD Privileged Identity Management (PIM) is enabled for the tenant.
In PIM, the Password Administrator role has the following settings:
Maximum activation duration (hours): 2
Send email notifying admins of activation: Disable
Require incident/request ticket number during activation: Disable
Require Azure Multi-Factor Authentication for activation: Enable
Require approval to activate this role: Enable
Selected approver: Group1
You assign users the Password Administrator role as shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 21-1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 21-2

Answer: Yes, Yes, No

Q22: You have a hybrid configuration of Azure Active Directory (Azure AD) that has Single Sign-On (SSO) enabled. You have an Azure SQL Database instance that is configured to support Azure AD authentication. Database developers must connect to the database instance from the domain joined device and authenticate by using their on-premises Active Directory account. You need to ensure that developers can connect to the instance by using Microsoft SQL Server Management Studio. The solution must minimize authentication prompts. Which authentication method should you recommend?

A. Active Directory – Password
B. Active Directory – Universal with MFA support
C. SQL Server Authentication
D. Active Directory – Integrated

Answer: D

Q23: You plan to use Azure Resource Manager templates to perform multiple deployments of identically configured Azure virtual machines. The password for the administrator account of each deployment is stored as a secret in different Azure key vaults.
You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment.
The name of the key vault and the name of the secret will be provided as inline parameters.
What should you use to construct the resource ID?

A. a key vault access policy
B. a linked template
C. a parameters file
D. an automation account

Answer: B

Q24: You create a new Azure subscription that is associated to a new Azure Active Directory (Azure AD) tenant.
You create one active conditional access policy named Portal Policy. Portal Policy is used to provide access to the Microsoft Azure Management cloud app.
The Conditions settings for Portal Policy are configured as shown in the Conditions exhibit. (Click the Conditions tab.)

AZ-500 Microsoft Azure Security Technologies Question 24

The Grant settings for Portal Policy are configured as shown in the Grant exhibit. (Click the Grant tab.)

AZ-500 Microsoft Azure Security Technologies Question 24-1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 24-2

Answer: Yes, No, No

Q25: You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 25

The tenant contains the named locations shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 25-1

You create the conditional access policies for a cloud app named App1 as shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 25-2

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 25-3

Answer: Yes , Yes, No

Q26: You have an Azure subscription named Sub 1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 26

Each user is assigned an Azure AD Premium P2 license.
You plan to onboard and configure Azure AD Identity Protection.
Which users can onboard Azure AD Identity Protection, remediate users, and configure policies? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 26-1

Answer:

AZ-500 Microsoft Azure Security Technologies Question 26-2

Q27: You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 27

From Azure AD Privileged Identity Management (PIM), you configure the settings for the Security Administrator role as shown in the following exhibit.

AZ-500 Microsoft Azure Security Technologies Question 27-2

From PIM, you assign the Security Administrator role to the following groups:

Group1: Active assignment type, permanently assigned
Group2: Eligible assignment type, permanently eligible
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 27-3

Answer: No, Yes, No

Q28: Your company has an Azure subscription named Subscription1 that contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 28

The company is sold to a new owner.
The company needs to transfer ownership of Subscription1.
Which user can transfer the ownership and which tool should the user use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 28-1

Answer: Box 1; User2 –
Box 2: Azure Account Center –

Q29: You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 29

You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:

Assignments: Include Group1, exclude Group2
Conditions: Sign-in risk level: Medium and above
Access Allow access, Require multi-factor authentication
You need to identify what occurs when the users sign in to Azure AD.
What should you identify for each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 29-1

Answer: 1- Prompt for MFA
2.- Prompt for MFA
3.- Single Authentication

Q30: You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 30

In Azure AD Privileged Identity Management (PIM), the Role settings for the Contributor role are configured as shown in the exhibit. (Click the Exhibit tab.)

AZ-500 Microsoft Azure Security Technologies Question 30-1

You assign users the Contributor role on May 1, 2019 as shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 30-2

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 30-3

Answer: Yes, Yes, No

Q31: You work at a company named Contoso, Ltd. that has the offices shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 31

Contoso has an Azure Active Directory (Azure AD) tenant named contoso.com. All contoso.com users have Azure Multi-Factor Authentication (MFA) enabled. The tenant contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 31-1

The multi-factor authentication settings for contoso.com are configured as shown in the following exhibit.

AZ-500 Microsoft Azure Security Technologies Question 31-2

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 31-3

Answer: no, No, Yes

Q32: You have an Azure subscription. You configure the subscription to use a different Azure Active Directory (Azure AD) tenant. What are two possible effects of the change? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A. Role assignments at the subscription level are lost.
B. Virtual machine managed identities are lost.
C. Virtual machine disk snapshots are lost.
D. Existing Azure resources are deleted.

Answer: A,B

Q33: Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Sub1.
You have an Azure Storage account named sa1 in a resource group named RG1.
Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies.
You discover that unauthorized users accessed both the file service and the blob service.
You need to revoke all access to sa1.
Solution: You generate new SASs.
Does this meet the goal?

A. Yes
B. No

Answer: B

Q34: You have an Azure subscription that contains virtual machines. You enable just in time (JIT) VM access to all the virtual machines. You need to connect to a virtual machine by using Remote Desktop. What should you do first?

A. From Azure Directory (Azure AD) Privileged Identity Management (PIM), activate the Security administrator user role.
B. From Azure Active Directory (Azure AD) Privileged Identity Management (PIM), activate the Owner role for the virtual machine.
C. From the Azure portal, select the virtual machine, select Connect, and then select Request access.
D. From the Azure portal, select the virtual machine and add the Network Watcher Agent virtual machine extension.

Answer: C

Q35: Your network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 35

The tenant contains the groups shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 35-1

You configure a multi-factor authentication (MFA) registration policy that has the following settings:
– Assignments:
– Include: Group1
– Exclude: Group2
– Controls: Require Azure MFA registration
– Enforce Policy: On
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 35-2

Answer: Yes, No, Yes

Q36: You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.
The User administrator role is assigned to a user named Admin1. An external partner has a Microsoft account that uses the user1@outlook.com sign in. Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message:
Unable to invite user user1@outlook.com
Generic authorization exception.
You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant. What should you do?

A. From the Roles and administrators blade, assign the Security administrator role to Admin1.
B. From the Organizational relationships blade, add an identity provider.
C. From the Custom domain names blade, add a custom domain.
D. From the Users blade, modify the External collaboration settings.

Answer: D

Q37: You have an Azure Active Directory (Azure AD) tenant.
You have the deleted objects shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 37

On May 4, 2020, you attempt to restore the deleted objects by using the Azure Active Directory admin center. Which two objects can you restore? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A. Group1
B. Group2
C. User2
D. User1
Answer: B,C

Q38: You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

AZ-500 Microsoft Azure Security Technologies Question 38

You create an Azure role by using the following JSON file.

AZ-500 Microsoft Azure Security Technologies Question 38-1

You assign Role1 to User1 for RG1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

AZ-500 Microsoft Azure Security Technologies Question 38-2

Answer: Yes, No, No

Q38: You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1. You plan to publish several apps in the tenant. You need to ensure that User1 can grant admin consent for the published apps. Which two possible user roles can you assign to User1 to achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. Security administrator
B. Cloud application administrator
C. Application administrator
D. User administrator
E. Application developer

Answer: B,C

Q39: You have an Azure subscription that is associated with an Azure Active Directory (Azure AD) tenant. When a developer attempts to register an app named App1 in the tenant, the developer receives the error message shown in the following exhibit.

AZ-500 Microsoft Azure Security Technologies Question 39

You need to ensure that the developer can register App1 in the tenant. What should you do for the tenant?

A. Modify the Directory properties.
B. Set Enable Security defaults to Yes.
C. Configure the Consent and permissions settings for enterprise applications.
D. Modify the User settings.

Answer: D

Q40: You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant and a user named User1.
The App registrations settings for the tenant are configured as shown in the following exhibit.

AZ-500 Microsoft Azure Security Technologies Question 40

You plan to deploy an app named App1.
You need to ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which role should you assign to User1?

A. App Configuration Data Owner for the subscription
B. Managed Application Contributor for the subscription
C. Cloud application administrator in Azure AD
D. Application developer in Azure AD

Answer: D

Cart

Practice Exam

Protect Your System: Understanding CVE-2024-3400 Zero-Day Vulnerability

AWS Certified Cloud Practitioner CLF-C02 Exam Part 6

Cart