Microsoft Azure Security Technologies practice questions

1. Question 1 of 25

   Your company recently created an Azure subscription. You have been tasked with making sure that a specified user is able to implement Azure AD Privileged Identity Management (PIM). Which of the following is the role you should assign to the user?

   • AThe Global administrator role.
   • BThe Security administrator role.
   • CThe Password administrator role.
   • DThe Compliance administrator role.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan#assign-and-activate-azure-ad-roles For Azure AD roles in PIM, only a user who is in the Privileged Role Administrator or Global Administrator role can manage assignments for other administrators. Global Administrators, Security Administrators, Global Readers, and Security Readers can also view assignments to Azure AD roles in PIM.

   Adapted from community discussion by zellck · 2024-09-23 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. N

      Nityaanantha_Raman

      2025-03-22

      Selected A11 upvotes

      Given answer is correct. https://docs.google.com/document/d/1oNH9i2ssNi9gISG3JGuxUoUhmAA4xCaGahEKv2dRN6Y/edit?usp=sharing

   2. S

      Shahrezza

      2021-10-02

      10 upvotes

      Given answer is correct. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

   3. K

      kakakayayaya

      2021-08-22

      6 upvotes

      Today, this not 100% correct. PIM ready to use without consent. Any user that have active role enables PIM.

   4. Z

      zellck

      2024-09-23

      Selected A3 upvotes

      A is the answer. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan#assign-and-activate-azure-ad-roles For Azure AD roles in PIM, only a user who is in the Privileged Role Administrator or Global Administrator role can manage assignments for other administrators. Global Administrators, Security Administrators, Global Readers, and Security Readers can also view assignments to Azure AD roles in PIM.

2. Question 2 of 25

   Your company has an Azure Container Registry. You have been tasked with assigning a user a role that allows for the downloading of images from the Azure Container Registry. The role assigned should not require more privileges than necessary. Which of the following is the role you should assign?

   • AReader
   • BContributor
   • CAcrDelete
   • DAcrPull

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Question gives the condition, "The role assigned should not require more privileges than necessary." Therefore, D (Acrpull) is CORRECT because it provides the least number of permissions required for downloading images from a Container Registry. Answer A (Reader): provides at least two (2) permissions, which would be one (1) more than Acrpull allows for. [Ref. https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-roles?tabs=azure-cli]

   Adapted from community discussion by Lyonel · 2024-09-23 · 79 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. L

      Lyonel

      2024-09-23

      79 upvotes

      Question gives the condition, "The role assigned should not require more privileges than necessary." Therefore, D (Acrpull) is CORRECT because it provides the least number of permissions required for downloading images from a Container Registry. Answer A (Reader): provides at least two (2) permissions, which would be one (1) more than Acrpull allows for. [Ref. https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-roles?tabs=azure-cli]

   2. F

      Fal991l

      2024-09-23

      Selected D2 upvotes

      The role that should be assigned to allow for the downloading of images from the Azure Container Registry without granting unnecessary privileges is "AcrPull". The AcrPull role provides read-only permissions to pull images from the registry. This role is the minimum required permission to pull an image. It does not allow pushing or modifying images or managing the registry itself. The other options are not the best fit for this scenario: The Reader role provides read-only access to all resources within a resource group, which includes the container registry. However, this role is too broad and provides more access than needed for just pulling images. The Contributor role provides the ability to manage all aspects of a resource, including creating, modifying, and deleting. This role is more permissions than are necessary for just pulling images. The AcrDelete role provides the ability to delete repositories and images from the registry. This role is more permissions than are necessary for just pulling images.

   3. M

      Mazhar1993

      2024-04-19

      1 upvote

      The role you should assign is AcrPull because it specifically grants the ability to pull (download) images from the Azure Container Registry, which is the required permission for the user. Assigning the Reader role would provide broader access than necessary, as it includes permissions beyond image pulling. Similarly, assigning the Contributor role would grant excessive privileges, as it includes permissions for creating, deleting, and modifying resources, which are not required for simply downloading images. The AcrDelete role is also not suitable, as it specifically grants permission to delete image data from the registry, which is not needed for the task described. Therefore, AcrPull is the most appropriate role that meets the requirement of allowing image downloading without granting unnecessary privileges. https://learn.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-roles?tabs=azure-cli

   4. E

      ech

      2021-10-23

      4 upvotes

      agree read can Access Resource Manager and Pull, but AcrPull role is just for pulling the image.

3. Question 3 of 25

   You have been tasked with enabling Advanced Threat Protection for an Azure SQL Database server. Advanced Threat Protection must be configured to identify all types of threat detection. Which of the following will happen if when a faulty SQL statement is generate in the database by an application?

   • AA Potential SQL injection alert is triggered.
   • BA Vulnerability to SQL injection alert is triggered.
   • CAn Access from a potentially harmful application alert is triggered.
   • DA Brute force SQL credentials alert is triggered.

   Show answer

   Correct answer: B

   How others answered

   • B59%
   • A41%

   Only 59% agreed on this answer — treat it as contested rather than settled.

   Explanation

   A possible vulnerability to SQL Injection (SQL.VM_VulnerabilityToSqlInjection SQL.DB_VulnerabilityToSqlInjection SQL.MI_VulnerabilityToSqlInjection SQL.DW_VulnerabilityToSqlInjection) An application has generated a faulty SQL statement in the database. This can indicate a possible vulnerability to SQL injection attacks. There are two possible reasons for a faulty statement. A defect in application code might have constructed the faulty SQL statement. Or, application code or stored procedures didn't sanitize user input when constructing the faulty SQL statement, which can be exploited for SQL injection. ) https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-sql-db-and-warehouse

   Adapted from community discussion by Rume · 2021-06-30 · 52 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. R

      Rume

      2021-06-30

      52 upvotes

      A possible vulnerability to SQL Injection (SQL.VM_VulnerabilityToSqlInjection SQL.DB_VulnerabilityToSqlInjection SQL.MI_VulnerabilityToSqlInjection SQL.DW_VulnerabilityToSqlInjection) An application has generated a faulty SQL statement in the database. This can indicate a possible vulnerability to SQL injection attacks. There are two possible reasons for a faulty statement. A defect in application code might have constructed the faulty SQL statement. Or, application code or stored procedures didn't sanitize user input when constructing the faulty SQL statement, which can be exploited for SQL injection. ) https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-sql-db-and-warehouse

   2. S

      Seelearndo

      2024-09-23

      Selected B3 upvotes

      Alert: A possible vulnerability to SQL Injection Description: An application has generated a faulty SQL statement in the database. This can indicate a possible vulnerability to SQL injection attacks. There are two possible reasons for a faulty statement. A defect in application code might have constructed the faulty SQL statement. Or, application code or stored procedures didn't sanitize user input when constructing the faulty SQL statement, which can be exploited for SQL injection. ↑ B is the correct answer since a faulty SQL statement will result in a possible vulnerability alert. Alert: Potential SQL injection Description: An active exploit has occurred against an identified application vulnerable to SQL injection. This means an attacker is trying to inject malicious SQL statements by using the vulnerable application code or stored procedures. ↑ A is incorrect since a potential SQL injection alert is triggered when an active exploit is identified. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-sql-db-and-warehouse

   3. A

      AbdallaAM

      2023-09-03

      Selected B4 upvotes

      AZ 500 Book: When you enable ADS, threat protection is available for SQL. Threat protection for Azure SQL Database detects anomalous activities that indicate unusual and potentially harmful attempts to access or exploit databases. For example, an alert that may be generated by this feature is the possible vulnerability to SQL Injection. This alert might indicate a possible vulnerability to SQL injection attacks. Usually there are two possible reasons for a faulty statement: a defect in application code might have constructed the faulty SQL statement, or the application code/stored procedures didn’t sanitize user input.

   4. M

      Mazhar1993

      2024-09-23

      3 upvotes

      The correct option is A Vulnerability to SQL injection alert is triggered: This aligns with the scenario where a faulty SQL statement suggests a possible vulnerability to SQL injection attacks due to improper user input sanitization. A Potential SQL injection alert is not triggered because the context describes a faulty SQL statement generated by an application, indicating a vulnerability rather than an actual SQL injection attempt. An Access from a potentially harmful application alert is not triggered as the context focuses on detecting vulnerabilities related to SQL injection rather than the origin or access pattern of the application. A Brute force SQL credentials alert is not triggered since the context does not indicate any brute force attack or credential-based intrusion attempt. https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-sql-db-and-warehouse

4. Question 4 of 25

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of pass-through authentication and seamless SSO with password hash synchronization. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Correct answer: A

   How others answered

   • A76%
   • B24%

   Explanation

   We have 3 options for solution: 1) Password hash synchronization + Seamless SSO 2) Pass-through Authentication + Seamless SSO 3) Federation with AD FS 1 - doesn't support "password policies and user logon limitations". 2 and 3 - support, but 3 requres more servers.

   Adapted from community discussion by kakakayayaya · 2021-08-19 · 54 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. K

      kakakayayaya

      2021-08-19

      54 upvotes

      We have 3 options for solution: 1) Password hash synchronization + Seamless SSO 2) Pass-through Authentication + Seamless SSO 3) Federation with AD FS 1 - doesn't support "password policies and user logon limitations". 2 and 3 - support, but 3 requres more servers.

   2. M

      moutaz1983

      2021-08-10

      22 upvotes

      I will go Yes here because this password policy enfocement can be done only using Pass through auth See decision tree: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn

   3. L

      LeandroFerraz

      2023-03-21

      3 upvotes

      Yes, the solution meets the goal. Pass-through authentication and seamless SSO with password hash synchronization is a valid strategy for integrating Active Directory and Azure AD, while ensuring that password policies and user logon limitations apply to synced user accounts. Pass-through authentication allows users to use the same password they use on-premises, while their credentials are authenticated directly against on-premises Active Directory, providing a secure and simple authentication experience. Seamless SSO provides a seamless user experience, allowing users to access cloud resources without having to enter their credentials repeatedly. Password hash synchronization ensures that password changes made on-premises are synced to Azure AD, enabling users to sign in to cloud resources using their synchronized password. Using this strategy, there is no need to deploy additional servers, as the authentication and synchronization process is handled by Azure AD Connect, which can be installed on an existing server.

   4. F

      fahrulnizam

      2024-09-23

      Selected A3 upvotes

      "must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant" keyword here in this question is 'synced'. So, answer is YES Password hash synchronization. A sign-in method that synchronizes a hash of a users on-premises AD password with Azure AD. Pass-through authentication. A sign-in method that allows users to use the same password on-premises and in the cloud, but doesn't require the additional infrastructure of a federated environment.

5. Question 5 of 25

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure Container Registry. You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal. Solution: You create an Azure Active Directory (Azure AD) role assignment. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Correct answer: B

   How others answered

   • B79%
   • A21%

   Explanation

   Answer is B The question says to "make us of auto-generated service principal", not managed identity. You'll use CLI or Powershell to automate generation of service principal to link AKS to ACR. see additional links: https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-powershell "use the New-AzAksCluster command to generate the service principal automatically, the service principal credentials are written to the file ~/.azure/acsServicePrincipal.json on the machine used to run the command"

   Adapted from community discussion by Irishtk · 2022-04-28 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. M

      Mazhar1993

      2024-09-23

      5 upvotes

      The answer is No. When an AKS cluster is created, Azure automatically generates a service principal to facilitate interactions with other Azure resources, including ACR. This auto-generated service principal can be directly used for authenticating the AKS cluster to the ACR registry. Therefore, creating an additional Azure AD role assignment is unnecessary as the auto-generated service principal already fulfills the authentication requirements. The proposed solution of creating an Azure AD role assignment adds complexity without providing any additional benefit, making it unnecessary and not meeting the goal efficiently. https://learn.microsoft.com/bs-latn-ba/azure/aks/cluster-container-registry-integration?tabs=azure-cli

   2. Z

      zellck

      2023-05-07

      Selected B5 upvotes

      B is the answer. https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli The Azure Container Registry service supports a set of built-in Azure roles that provide different levels of permissions to an Azure container registry. Use Azure role-based access control (Azure RBAC) to assign specific permissions to users, service principals, or other identities that need to interact with a registry, for example to pull or push container images.

   3. X

      xRiot007

      2024-07-15

      5 upvotes

      The answer is B, but not because of that. The Microsoft Entra group will attach the AcrPull permission automatically, completing RBAC. The reason why the answer is No is because the authentication is done automatically, you don't have to create any roles. You just need to attach the service (AKS) to the container (ACR)

   4. L

      Lrrr_FromOmicronPersei8

      2021-12-04

      Selected B5 upvotes

      This is clearly wrong, or a typo. The line should read "an RBAC role assignment".

6. Question 6 of 25

   Select 2

   Your company has an Azure subscription that includes two virtual machines, named VirMac1 and VirMac2, which both have a status of Stopped (Deallocated). The virtual machines belong to different resource groups, named ResGroup1 and ResGroup2. You have also created two Azure policies that are both configured with the virtualMachines resource type. The policy configured for ResGroup1 has a policy definition of Not allowed resource types, while the policy configured for ResGroup2 has a policy definition of Allowed resource types. You then create a Read-only resource lock on VirMac1, as well as a Read-only resource lock on ResGroup2. Which of the following is TRUE with regards to the scenario? (Choose all that apply.)

   • AYou will be able to start VirMac1.
   • BYou will NOT be able to start VirMac1.
   • CYou will be able to create a virtual machine in ResGroup2.
   • DYou will NOT be able to create a virtual machine in ResGroup2.

   Show answer

   Correct answer: B, D

   How others answered

   • BD94%

   Explanation

   Correct answer is B and D, When you will create a virtual machine in ResGroup2 it will give you error "The selected resource group is read only"

   Adapted from community discussion by SajjadKarim · 2021-07-08 · 75 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. S

      SajjadKarim

      2021-07-08

      75 upvotes

      Correct answer is B and D, When you will create a virtual machine in ResGroup2 it will give you error "The selected resource group is read only"

   2. Y

      Yiannisthe7th

      2021-07-18

      12 upvotes

      B and D for sure. When you create a new VM and select a read-only resource group you get a "The selected resource group is read only"

   3. Z

      zellck

      2023-05-07

      11 upvotes

      https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#considerations-before-applying-your-locks A read-only lock on a resource group that contains a virtual machine prevents all users from starting or restarting a virtual machine. These operations require a POST method request.

   4. T

      trevax

      2021-08-18

      11 upvotes

      Please don't confuse people, at least try in lab before. You can't start / deploy vm (neither any ressources) on RG with read-only lock

7. Question 7 of 25

   You have been tasked with delegate administrative access to your company's Azure key vault. You have to make sure that a specific user is able to add and delete certificates in the key vault. You also have to make sure that access is assigned based on the principle of least privilege. Which of the following options should you use to achieve your goal?

   • AA key vault access policy
   • BAzure policy
   • CAzure AD Privileged Identity Management (PIM)
   • DAzure DevOps

   Show answer

   Correct answer: A

   How others answered

   • A96%

   Explanation

   The answer is A: These operations are done on the key vault's data plane. The suitable built-in role would be a Key Vault Certificates Officer - able to perform any action on the certificates of a key vault, except manage permissions. https://docs.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli#azure-built-in-roles-for-key-vault-data-plane-operations

   Adapted from community discussion by in_da_cloud · 2022-09-30 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. I

      in_da_cloud

      2022-09-30

      Selected A5 upvotes

      The answer is A: These operations are done on the key vault's data plane. The suitable built-in role would be a Key Vault Certificates Officer - able to perform any action on the certificates of a key vault, except manage permissions. https://docs.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli#azure-built-in-roles-for-key-vault-data-plane-operations

   2. R

      Ruffyit

      2024-09-26

      4 upvotes

      These operations are done on the key vault's data plane. The suitable built-in role would be a Key Vault Certificates Officer - able to perform any action on the certificates of a key vault, except manage permissions.

   3. J

      jacqs101

      2024-07-24

      4 upvotes

      Answer A is correct - RBAC gives you access to the vault (management plane), Key vault policies grants access to the data within the vault (data plane)

   4. Z

      zellck

      2023-11-07

      Selected A2 upvotes

      A is the answer. https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy A Key Vault access policy determines whether a given security principal, namely a user, application or user group, can perform different operations on Key Vault secrets, keys, and certificates. You can assign access policies using the Azure portal, the Azure CLI, or Azure PowerShell.

8. Question 8 of 25

   You have an Azure virtual machine that runs Ubuntu 16.04-DAILY-LTS. You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine. Which of the following is TRUE with regards to Azure Disk Encryption for a Linux VM?

   • AIt is NOT supported for basic tier VMs.
   • BIt is NOT supported for standard tier VMs.
   • COS drive encryption for Linux virtual machine scale sets is supported.
   • DCustom image encryption is supported.

   Show answer

   Correct answer: A

   How others answered

   • A79%
   • D21%

   Explanation

   option A is correct . you can find Unsupported scenarios Azure Disk Encryption does not work for the following Linux scenarios, features, and technology: Encrypting basic tier VM or VMs created through the classic VM creation method. Disabling encryption on an OS drive or data drive of a Linux VM when the OS drive is encrypted. Encrypting the OS drive for Linux virtual machine scale sets. Encrypting custom images on Linux VMs. Integration with an on-premises key management system. Azure Files (shared file system). Network File System (NFS). Dynamic volumes. Ephemeral OS disks.

   Adapted from community discussion by azcourse · 2021-10-22 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. A

      azcourse

      2021-10-22

      17 upvotes

      option A is correct . you can find Unsupported scenarios Azure Disk Encryption does not work for the following Linux scenarios, features, and technology: Encrypting basic tier VM or VMs created through the classic VM creation method. Disabling encryption on an OS drive or data drive of a Linux VM when the OS drive is encrypted. Encrypting the OS drive for Linux virtual machine scale sets. Encrypting custom images on Linux VMs. Integration with an on-premises key management system. Azure Files (shared file system). Network File System (NFS). Dynamic volumes. Ephemeral OS disks.

   2. L

      Lobe

      2021-07-22

      7 upvotes

      Correct Answer is A "Azure Disk Encryption does not work for the following Linux scenarios, features, and technology: Encrypting basic tier VM or VMs created through the classic VM creation method." https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-linux

   3. O

      onewheelwheelie

      2023-11-20

      5 upvotes

      This is not correct, "Encrypting custom images on Linux VMs." is listed directly under the list of scnearios where a Linux VM can NOT be encrypted.

   4. S

      stonwall12

      2025-02-12

      Selected A2 upvotes

      Answer: A, NOT supported for basic tier VMs. Reason: Azure Disk Encryption is not supported for basic tier VMs in Linux, just as with Windows VMs. It is supported for standard tier VMs. OS drive encryption for Linux virtual machine scale sets is not supported, and custom image encryption is also not supported for Linux VMs. These limitations apply specifically to Linux VMs to ensure compatibility and performance. Reference: https://learn.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-overview#unsupported-scenarios

9. Question 9 of 25

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant. As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings. You are currently preparing to create a custom sensitivity label. Solution: You start by altering the pricing tier of the Security Center. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   Here is the documentation for this question. 1- Create Sensitive Info type 2- Create Pattern 3- Choose Confidence level 4- Choose and define primary elements 5- Value for char prox 6- Choose recommend confidence level 7 - Submit

   Adapted from community discussion by salmantarik · 2021-10-18 · 39 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

   1. S

      salmantarik

      2021-10-18

      39 upvotes

      Here is the documentation for this question. 1- Create Sensitive Info type 2- Create Pattern 3- Choose Confidence level 4- Choose and define primary elements 5- Value for char prox 6- Choose recommend confidence level 7 - Submit

   2. I

      Irishtk

      2022-04-29

      16 upvotes

      Technology in this question has been obsolete by newer products. Some pricing changes to Microsoft Defender for Cloud(formerly Azure Security Center). "Purchase of a Microsoft Purview account is required to apply data sensitivity classifications and run the scans." https://docs.microsoft.com/en-us/azure/defender-for-cloud/information-protection

   3. T

      trevax

      2021-08-18

      14 upvotes

      No - First you have to create a custom sensitive information type.

   4. S

      schpeter_091

      2024-11-09

      1 upvote

      This is what you should do before creating a sensitivity label: "To make sure you have permissions to create and manage sensitivity labels, see Permissions required to create and manage sensitivity labels" Depending on the portal you're using, navigate to one of the following locations: +Sign in to the Microsoft Purview portal > Information Protection card > Sensitivity labels. If the Information Protection solution card isn't displayed, select View all solutions and then select Information Protection from the Data Security section. +Sign in to the Microsoft Purview compliance portal > Solutions > Information protection > Labels On the Labels page, select + Create a label to start the new sensitivity label configuration.

10. Question 10 of 25

    Select 2

    Your company uses Azure DevOps with branch policies configured. Which of the following is TRUE with regards to branch policies? (Choose all that apply.)

    • AIt enforces your team's change management standards.
    • BIt controls who can read and update the code in a branch.
    • CIt enforces your team's code quality.
    • DIt places a branch into a read-only state.

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

    Explanation

    AC is the answer. https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies Branch policies help teams protect their important branches of development. Policies enforce your team's code quality and change management standards.

    Adapted from community discussion by zellck · 2024-05-07 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. E

       Eltooth

       2023-03-17

       Selected A, C4 upvotes

       A and C are correct. https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&tabs=browser

    2. M

       majstor86

       2024-03-02

       Selected A, C3 upvotes

       A. It enforces your team's change management standards. C. It enforces your team's code quality.

    3. A

       Andre369

       2024-05-18

       Selected A, C2 upvotes

       A. It enforces your team's change management standards. C. It enforces your team's code quality. Branch policies in Azure DevOps are used to enforce certain rules and standards on code branches within a repository. They help maintain code quality, ensure proper change management, and enforce best practices.

    4. B

       bur88

       2023-03-08

       3 upvotes

       A,C - Branch policies help teams protect their important branches of development. Policies enforce your team's code quality and change management standards. https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&tabs=browser

11. Question 11 of 25

    Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of password hash synchronization and seamless SSO. Does the solution meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B89%

    Explanation

    Answer should be "No" password hash synchronization cannot support the password policies and user logon limitations For this you need to implement Pass-through authentication

    Adapted from community discussion by Dushank · 2021-07-21 · 45 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. D

       Dushank

       2021-07-21

       45 upvotes

       Answer should be "No" password hash synchronization cannot support the password policies and user logon limitations For this you need to implement Pass-through authentication

    2. K

       kakakayayaya

       2021-08-19

       20 upvotes

       There are 3 options for solution: 1) Password hash synchronization + Seamless SSO 2) Pass-through Authentication + Seamless SSO 3) Federation with AD FS 1 - doesn't support "password policies and user logon limitations".

    3. R

       rawrkadia

       2021-08-17

       8 upvotes

       Correction, it does somewhat support password policies like complexity, (but does not support expiration) and does not support logon restrictions at all. There's about 20 versions of this question in the dump and I'm glad by this point people are arriving at the correct answer and realizing PHS doesn't work for the use case. :)

    4. A

       awfnewf1q243

       2024-09-23

       Selected B2 upvotes

       B. No Correct path through the decision tree is Yes -> Yes -> No -> No, which results in "Pass-though Auth + Seamless SSO" The only reason we would want PHS is if we answered "No" to "Do you want to enforce user-level Active Directory security policies during sign in?" The stated objective is "make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant" If you read footnote #3 of the decision tree it says "If you need to apply, user-level Active Directory security policies such as account expired, disabled account, password expired, account locked out, and sign-in hours on each user sign-in, Azure AD requires some on-premises components." Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn#decision-tree

12. Question 12 of 25

    You need to consider the underlined segment to establish whether it is accurate. Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it. Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type. The mobile application must be registered in Azure AD. You require a redirect URI from the developer for registration purposes. Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

    • ANo adjustment required
    • Ba secret
    • Ca login hint
    • Da client ID

    Show answer

    Correct answer: A

    How others answered

    • A55%
    • D42%

    Only 55% agreed on this answer — treat it as contested rather than settled.

    Explanation

    In your link the Client ID is the registration ID assigned in Azure AD : (Client ID = The Application (client) ID that the Azure portal - App registrations page assigned to your app.) But that's what we a trying to do (The mobile application must be registered in Azure AD.) You cannot get what is not yet created

    Adapted from community discussion by zorglub · 2022-01-06 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. Z

       zorglub

       2022-01-06

       14 upvotes

       In your link the Client ID is the registration ID assigned in Azure AD : (Client ID = The Application (client) ID that the Azure portal - App registrations page assigned to your app.) But that's what we a trying to do (The mobile application must be registered in Azure AD.) You cannot get what is not yet created

    2. Z

       zellck

       2023-05-07

       9 upvotes

       Client ID is generated when app is registered, not given by developer. https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app#register-an-application When registration finishes, the Azure portal displays the app registration's Overview pane. You see the Application (client) ID. Also called the client ID, this value uniquely identifies your application in the Microsoft identity platform.

    3. D

       DarkCyberGhost

       2022-01-19

       Selected A5 upvotes

       The Answer given (A) is correct. if you look at the table in https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow 1/4 way down the page you will see; client_id is required, and it is The Application (client) ID that the Azure portal - App registrations page assigned to your app. but you will also see; redirect_uri is recommended and is The redirect_uri of your app, where authentication responses can be sent and received by your app. It must exactly match one of the redirect_uris you registered in the portal, except it must be URL-encoded. So if it must be registered as stated in the question, then it doesn not yet have a client ID as this is assigned once registered, but it also need to be able to obtain Azure AD access tokens using the OAuth 2 implicit grant type. SO, the redirect URI is required to allow for this as it is recommended for the use of sending auth responses the application recives. once you have this you can register the app and thus getting the ClientID.

    4. S

       Subeee

       2022-12-15

       9 upvotes

       Guys, this is ridiculous. I see conflicts in given and voted answers for most of the questions. Which one to trust. This is totally unacceptable for a paid version of an exam dump.

13. Question 13 of 25

    Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. After syncing all on-premises identities to Azure AD, you are informed that users with a givenName attribute starting with LAB should not be allowed to sync to Azure AD. Which of the following actions should you take?

    • AYou should make use of the Synchronization Rules Editor to create an attribute-based filtering rule.
    • BYou should configure a DNAT rule on the Firewall.
    • CYou should configure a network traffic filtering rule on the Firewall.
    • DYou should make use of Active Directory Users and Computers to create an attribute-based filtering rule.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    40 Questions 1 Case Study = 6 Questions 1 Lab = 10 Tasks - You need to be comfortable navigating in Azure Total 56 Questions Some new questions, most are from this site. Big thank you to Exam Topics and everyone for their comments. Rule of thumb, go with the most votes.

    Adapted from community discussion by CK9797 · 2022-11-11 · 10 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. C

       CK9797

       2022-11-11

       10 upvotes

       40 Questions 1 Case Study = 6 Questions 1 Lab = 10 Tasks - You need to be comfortable navigating in Azure Total 56 Questions Some new questions, most are from this site. Big thank you to Exam Topics and everyone for their comments. Rule of thumb, go with the most votes.

    2. C

       cometoit

       2021-10-24

       4 upvotes

       There's not such thing as an attribute-based filtering rule in AD. Filtering rules are an AAD Connect capability.

    3. C

       ccKane

       2021-11-08

       3 upvotes

       Should be A according to https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-configure-filtering#negative-filtering-do-not-sync-these /// you have to use the Synchronization Rules Editor

    4. S

       sky_top_onestart

       2021-10-12

       3 upvotes

       D. You should make use of Active Directory Users and Computers to create an attribute-based filtering rule.

14. Question 14 of 25

    You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD). The process involves assessing the risk events and risk levels. Which of the following is the risk level that should be configured for users that have leaked credentials?

    • ANone
    • BLow
    • CMedium
    • DHigh

    Show answer

    Correct answer: D

    How others answered

    • D93%

    Explanation

    D. High Note: It is very unlikely the Microsoft will require the memorization of specific risk levels given that they have changed the documentation. Previously the risk levels were very well defined, however they now provide this very vague paragraph: "Microsoft doesn't provide specific details about how risk is calculated. Each level of risk brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user." Modern Documentation: https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection#investigate-risk Legacy Documentation: https://web.archive.org/web/20190419234045/https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risk-events

    Adapted from community discussion by awfnewf1q243 · 2024-09-23 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. A

       awfnewf1q243

       2024-09-23

       Selected D8 upvotes

       D. High Note: It is very unlikely the Microsoft will require the memorization of specific risk levels given that they have changed the documentation. Previously the risk levels were very well defined, however they now provide this very vague paragraph: "Microsoft doesn't provide specific details about how risk is calculated. Each level of risk brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user." Modern Documentation: https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection#investigate-risk Legacy Documentation: https://web.archive.org/web/20190419234045/https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risk-events

    2. C

       ccKane

       2021-11-08

       4 upvotes

       Microsoft: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection#risk-levels Identity Protection categorizes risk into three tiers: low, medium, and high. While Microsoft does not provide specific details about how risk is calculated, we will say that each level brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user. Solution: High. Because users that have leaked credentials are very threatening, the risk should be high.

    3. F

       Fal991l

       2024-09-23

       Selected D2 upvotes

       The risk level that should be configured for users that have leaked credentials in a conditional access policy is High. When a user's credentials are leaked, it means that their username and password have been compromised and are potentially in the hands of an attacker. This puts the user's account and the resources that they have access to at a high level of risk, making it important to apply strict access controls and security measures. By setting the risk level to High, conditional access policies can be configured to enforce stricter security measures, such as requiring multifactor authentication or blocking access to certain resources entirely. Therefore, the correct answer is D. High.

    4. I

       ITFranz

       2024-12-26

       Selected D1 upvote

       To support the answer: When a user has leaked credentials detected in Azure, the risk level is typically set to "High" in Conditional Access policies. This is because leaked credentials pose a significant security threat, as they indicate that the user's valid credentials have been compromised and are potentially available to unauthorized parties. To configure a Conditional Access policy for leaked credentials: In the Azure portal, navigate to Microsoft Entra ID > Security > Conditional Access. Create a new policy or edit an existing one. Under "Conditions", select "User risk". Set "Configure" to "Yes". Choose "High" as the risk level. By setting the risk level to "High" for leaked credentials, you ensure that the policy takes immediate action when such a threat is detected, such as requiring a password reset or multi-factor authentication Answer = D

15. Question 15 of 25

    You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD). The process involves assessing the risk events and risk levels. Which of the following is the risk level that should be configured for sign ins that originate from IP addresses with dubious activity?

    • ANone
    • BLow
    • CMedium
    • DHigh

    Show answer

    Correct answer: C

    How others answered

    • C70%
    • B30%

    Only 70% agreed on this answer — treat it as contested rather than settled.

    Explanation

    C. Medium Note: It is very unlikely the Microsoft will require the memorization of specific risk levels given that they have changed the documentation. Previously the risk levels were very well defined, however they now provide this very vague paragraph: "Microsoft doesn't provide specific details about how risk is calculated. Each level of risk brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user." Modern Documentation: https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection#investigate-risk Legacy Documentation: https://web.archive.org/web/20190419234045/https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risk-events

    Adapted from community discussion by awfnewf1q243 · 2024-09-23 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. U

       Ucy

       2021-07-02

       50 upvotes

       Correct Answer is B IP addresses with suspicious/dubious activity risk level is LOW

    2. B

       bur88

       2022-03-06

       26 upvotes

       Update: in 2022 it is C : Medium already https://github.com/toddkitta/azure-content/blob/master/articles/active-directory/active-directory-identityprotection-risk-events-types.md#sign-ins-from-ip-addresses-with-suspicious-activity

    3. T

       thienvupt

       2021-07-03

       15 upvotes

       The same with Sign-ins from IP addresses with suspicious activity so B is correct

    4. A

       awfnewf1q243

       2024-09-23

       Selected C8 upvotes

       C. Medium Note: It is very unlikely the Microsoft will require the memorization of specific risk levels given that they have changed the documentation. Previously the risk levels were very well defined, however they now provide this very vague paragraph: "Microsoft doesn't provide specific details about how risk is calculated. Each level of risk brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user." Modern Documentation: https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection#investigate-risk Legacy Documentation: https://web.archive.org/web/20190419234045/https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risk-events

16. Question 16 of 25

    Your company recently created an Azure subscription. You have, subsequently, been tasked with making sure that you are able to secure Azure AD roles by making use of Azure Active Directory (Azure AD) Privileged Identity Management (PIM). Which of the following actions should you take FIRST?

    • AYou should sign up Azure Active Directory (Azure AD) Privileged Identity Management (PIM) for Azure AD roles.
    • BYou should consent to Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
    • CYou should discover privileged roles.
    • DYou should discover resources.

    Show answer

    Correct answer: C

    How others answered

    • C44%
    • D35%

    Only 44% agreed on this answer — treat it as contested rather than settled.

    Explanation

    "Consent to PIM" is deprecated. No more required. So now only priv users needs to access/ visits PIM (Premium P2 is enabled") - Access will be provided automatically. "When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management): We automatically enable PIM for the organization Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment"

    Adapted from community discussion by Rume · 2021-06-30 · 45 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. R

       Rume

       2021-06-30

       45 upvotes

       "Consent to PIM" is deprecated. No more required. So now only priv users needs to access/ visits PIM (Premium P2 is enabled") - Access will be provided automatically. "When a user who is active in a privileged role in an Azure AD organization with a Premium P2 license goes to Roles and administrators in Azure AD and selects a role (or even just visits Privileged Identity Management): We automatically enable PIM for the organization Their experience is now that they can either assign a "regular" role assignment or an eligible role assignment"

    2. B

       Brandonzzm

       2023-02-14

       4 upvotes

       The first action you should take is C. You should discover privileged roles. Before you can start using Azure Active Directory (Azure AD) Privileged Identity Management (PIM) to secure Azure AD roles, you need to know what privileged roles exist in your environment. This involves discovering the roles that have elevated permissions and could be potential targets for privilege misuse or abuse. Once you have identified the privileged roles, you can then configure PIM to provide just-in-time access to these roles and ensure that users only have access to them when needed. This helps reduce the risk of privilege misuse and improve the security of your Azure environment. After discovering privileged roles, you can then proceed with signing up for PIM, consenting to PIM, and discovering resources as needed to fully configure and use PIM to manage privileged access in your Azure environment.

    3. J

       Jimmy500

       2024-06-17

       5 upvotes

       Hi please read question carefully , it does not say Enable role for Azure subscription, Your solution is correct but it is for Azure Subscription not Azure Roles. So since we are not talking about resources we must choose C. If in the condiition it says for Azure resource we must chose D in this case - Discover Azure resources.

    4. P

       purek77

       2024-09-23

       Selected C4 upvotes

       Yes, question is outdated (consent is no longer required), however looking at below link - it seems that you have to "Discover and mitigate privileged roles" - therefore C is potentially correct answer nowadays. https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-deployment-plan

17. Question 17 of 25

    You need to encrypt storage1 to meet the technical requirements. Which key vaults can you use?

    • AKeyVault2 and KeyVault3 only
    • BKeyVault1 only
    • CKeyVault1 and KeyVault3 only
    • DKeyVault1, KeyVault2, and KeyVault3

    Show answer

    Correct answer: D

    How others answered

    • D82%

    Explanation

    D is the answer. https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-existing-account?tabs=azure-portal You can use a new or existing key vault to store customer-managed keys. The storage account and key vault may be in different regions or subscriptions in the same tenant.

    Adapted from community discussion by zellck · 2023-05-08 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. S

       somenick

       2022-10-21

       Selected D23 upvotes

       Things have changed. Now KeyVault can be in a different region or sub, but in the same tenant: https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-existing-account?WT.mc_id=Portal-Microsoft_Azure_Storage&tabs=azure-portal

    2. D

       Dom1nation

       2023-04-12

       9 upvotes

       Still though keep in mind it's different for Azure Disk Encryption: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault?tabs=azure-portal#create-a-key-vault

    3. Z

       zellck

       2023-05-08

       Selected D4 upvotes

       D is the answer. https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-existing-account?tabs=azure-portal You can use a new or existing key vault to store customer-managed keys. The storage account and key vault may be in different regions or subscriptions in the same tenant.

    4. P

       Pamban

       2024-05-14

       3 upvotes

       Correct! supported below You can either create your own keys and store them in the key vault or managed HSM, or you can use the Azure Key Vault APIs to generate keys. The storage account and the key vault or managed HSM can be in different Microsoft Entra tenants, regions, and subscriptions. Link: https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview

18. Question 18 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You create a new stored access policy. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    I believe the correct answer to this is "No". You can up to 5 access policies on an object. Creating a new one doesn't revoke the old one. To revoke a stored access policy, you can delete it, rename it by changing the signed identifier, or change the expiry time to a value in the past. Nowhere in the documentation does it say creating a new one revokes the old one.

    Adapted from community discussion by JohnCrawford · 2019-10-22 · 72 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. J

       JohnCrawford

       2019-10-22

       72 upvotes

       I believe the correct answer to this is "No". You can up to 5 access policies on an object. Creating a new one doesn't revoke the old one. To revoke a stored access policy, you can delete it, rename it by changing the signed identifier, or change the expiry time to a value in the past. Nowhere in the documentation does it say creating a new one revokes the old one.

    2. S

       S_Khan

       2020-03-15

       21 upvotes

       Answer "Yes" is correct. You can find explanation in the article: https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy "A stored access policy provides an additional level of control over service-level shared access signatures (SAS) on the server side. Establishing a stored access policy serves to group shared access signatures and to provide additional restrictions for signatures that are bound by the policy. You can use a stored access policy to change the start time, expiry time, or permissions for a signature, or to revoke it after it has been issued."

    3. S

       Sedge

       2019-12-15

       12 upvotes

       The reasoning behind, "create a new stored access policy" being correct is that this policy can be created with an expiry date in the past, thus revoking access to the shared access signature. This answer is indeed, 'Yes'. Can you also revoke, delete, or modify an existing stored access policy? Sure, but that is not what this question is asking. Can access to a SAS be revoked by creating a new stored access policy? Yes.

    4. K

       kristiann21

       2020-06-01

       9 upvotes

       Correct Answer No. Shared access signatures provides access to a particular resource such as blog. Stored access policies are a group of Shared Access Signatures (SAS). In order to revoke access to a SAS you can either: 1. Rotate the Key1 or Key 2, that is the access keys used to sign the SAS. Rotating the access keys used to sign the SAS, invalidates any previously signed SAS hence revoking the SAS issused before 2. Remove the stored access policy which an SAS is linked to. If a Stored Access Policy is removed, it also invalidates the SASs liked to the Stored Access Policy. Creating a new Stored Acccess Policy? Well it just creates a new Stored Access Policy and does nothing to existing SAS, and Stored Access Policy. So, the correct answer is 'No'.

19. Question 19 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure HDInsight cluster on a virtual network. You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials. You need to configure the environment to support the planned authentication. Solution: You deploy Azure Active Directory Domain Services (Azure AD DS) to the Azure subscription. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: A

    How others answered

    • A64%
    • B36%

    Only 64% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Azure AD domain Services is the only supported way for HD Insight cluster integration integration with active directory. so AAD connect to synchronise identities from an on-premises active directory to Azure AD and then Azure AD domain services for the HD Insights integration

    Adapted from community discussion by PlasticMind · 2020-06-29 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. A

       Adamasbue

       2020-05-20

       36 upvotes

       Wrong: https://docs.microsoft.com/en-us/azure/hdinsight/domain-joined/apache-domain-joined-architecture

    2. H

       Hemn1990

       2021-01-01

       29 upvotes

       You have hybrid enviroment so AD DS is alredy in place, you would need site to site vpn so the answer is no.

    3. P

       PlasticMind

       2020-06-29

       20 upvotes

       Azure AD domain Services is the only supported way for HD Insight cluster integration integration with active directory. so AAD connect to synchronise identities from an on-premises active directory to Azure AD and then Azure AD domain services for the HD Insights integration

    4. B

       BTAB

       2022-06-30

       15 upvotes

       @Adamasbue is correct. From that URL it states: If HDInsight and Azure AD DS are deployed in the same virtual network, the connectivity is automatically provided, and no further action is needed. The question details that AADDS will be deployed to the Azure subscription. There is still ambiguity in the question, because it doesn't say that AADDS is deployed within the same virtual network of HDInsight. These questions kill me.

20. Question 20 of 25

    You plan to use Azure Resource Manager templates to perform multiple deployments of identically configured Azure virtual machines. The password for the administrator account of each deployment is stored as a secret in different Azure key vaults. You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment. The name of the key vault and the name of the secret will be provided as inline parameters. What should you use to construct the resource ID?

    • Aa key vault access policy
    • Ba linked template
    • Ca parameters file
    • Dan automation account

    Show answer

    Correct answer: B

    How others answered

    • B93%

    Explanation

    The correct answer is B "a linked template" and I'm backing this up by the below link: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli in the question it says: You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment. The name of the key vault and the name of the secret will be provided as inline parameters. ------------- if you check the pictures in the link, you'll find that answer B, supports the dynamic solution and the picture used to describe it contains "inline parameter" unlike the answer in the solution. case closed

    Adapted from community discussion by shaheer1991 · 2020-05-22 · 24 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. R

       rharbeg

       2019-11-25

       106 upvotes

       The correct answer should be B https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-keyvault-parameter#reference-secrets-with-dynamic-id

    2. S

       shaheer1991

       2020-05-22

       24 upvotes

       The correct answer is B "a linked template" and I'm backing this up by the below link: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli in the question it says: You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment. The name of the key vault and the name of the secret will be provided as inline parameters. ------------- if you check the pictures in the link, you'll find that answer B, supports the dynamic solution and the picture used to describe it contains "inline parameter" unlike the answer in the solution. case closed

    3. F

       fonte

       2023-01-13

       7 upvotes

       Hi all, Passed my exam (13JAN2023) with 918. 50 questions (45 + 5 of a case study). Around 95% of the questions are here. I've compiled the questions and my answers in a ppt, feel free to check it out and hope it helps. https://www.dropbox.com/s/ay00xp2fnloq1ex/AZ%20500%20-%20Exam%20Topics.pptx?dl=0 Use pass az500prep to open the file. Thanks to all the people that comment on questions, I wouldn't have passed without them :)

    4. A

       asktomsk

       2020-03-10

       8 upvotes

       C is the correct answer. The question assumes passwords are already in Key Vault and should be passed as inline parameters. So you can create a parametes file to support it.

21. Question 21 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure HDInsight cluster on a virtual network. You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials. You need to configure the environment to support the planned authentication. Solution: You create a site-to-site VPN between the virtual network and the on-premises network. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B73%
    • A27%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Here is hint in the question itself--- "You need to configure the environment to support the planned authentication" They are asking to "configure the environment" to support the planned auth, hence VPN is one of solution

    Adapted from community discussion by cloudguy365 · 2020-05-03 · 73 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. C

       cloudguy365

       2020-05-03

       73 upvotes

       Here is hint in the question itself--- "You need to configure the environment to support the planned authentication" They are asking to "configure the environment" to support the planned auth, hence VPN is one of solution

    2. P

       PDR

       2020-01-23

       32 upvotes

       agree it is confusing. My reasons : It says "You have a hybrid configuration of Azure Active Directory (Azure AD)" which suggests that AD Connect is in place , but it isnt clear plus doesnt mention what configuration it has (Hash Synch, Pass through, Federated etc). Creating a site to site VPN will simply just enabled connectivty between the on premise network and the HDInsight cluster but not fulfil the authentifacation via on premises AD. So without exact knowledge of the configuration of the Hybrid AD , any AD connect etc it is impossible to say for sure that would work. You could take it further and say it is impossible to know as you dont know the config of the HD cluster, any NSGs etc. I always find this ambiguous questions a bit annoying if I have the knowledge to answer them but the details are too blurry.

    3. P

       PaulRSE

       2021-01-17

       12 upvotes

       I think the correct answer is "Yes". Here is why: Question states: "You have a hybrid configuration of Azure Active Directory (Azure AD)." So, AAD Connect is already installed and configured. Question states: "You have an Azure HDInsight cluster on a virtual network." You already have HDInsight configured. Question States: "You 'plan' to allow users to authenticate to the cluster by using their on-premises Active Directory credentials." Key word, "plan" Question states: "You need to configure the environment to support the planned authentication." The next logical step is to create the site-to-site VPN so that users can authenticate, using whatever method configured for authentication, using HDInsight. The VPN is needed so it meets the goal.

    4. S

       SB

       2019-08-19

       10 upvotes

       Answer seems confusing: VPN is needed to restrict access to HDInsight cluster to corporate network. To authenticate using on-prem credentials one need to set up password hash sync to Azure AD DS and assure networking connectivity from the HDInsight virtual network to the Azure AD DS virtual network (see https://docs.microsoft.com/en-us/azure/hdinsight/domain-joined/apache-domain-joined-architecture)

22. Question 22 of 25

    Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant. You need to recommend an integration solution that meets the following requirements: ✑ Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant ✑ Minimizes the number of servers required for the solution. Which authentication method should you include in the recommendation?

    • Afederated identity with Active Directory Federation Services (AD FS)
    • Bpassword hash synchronization with seamless single sign-on (SSO)
    • Cpass-through authentication with seamless single sign-on (SSO)

    Show answer

    Correct answer: C

    How others answered

    • C97%

    Explanation

    This is the breaking point, actually password policies is not like GPO(GPOs are only in AADDS and ADDS, no such thing like GPOs in AAD) ---- ✑ Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant Also, we need to have less servers to manage ✑ Minimizes the number of servers required for the solution. Which authentication method should you include in the recommendation? A. federated identity with Active Directory Federation Services (AD FS) - completely not matching our requirements. B. password hash synchronization with seamless single sign-on (SSO) - this is match C. pass-through authentication with seamless single sign-on (SSO) - this is match as well. Why B is more correct? Because both authentication methods enforce password policies, but with B we do not have to manage large on prem infrastructure in order to protect sign in process. Which meets the second requirements in the question - minimize the servers required. At first I got confused as well, but in question they are talking about password policies not GPOs. Which make sense why B is the correct one.

    Adapted from community discussion by Ilko · 2020-12-17 · 36 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. A

       Ace786

       2020-09-02

       109 upvotes

       PTA for sure as you need to enforce on prem password policies hence pass through to on prem

    2. I

       Ilko

       2020-12-17

       36 upvotes

       This is the breaking point, actually password policies is not like GPO(GPOs are only in AADDS and ADDS, no such thing like GPOs in AAD) ---- ✑ Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant Also, we need to have less servers to manage ✑ Minimizes the number of servers required for the solution. Which authentication method should you include in the recommendation? A. federated identity with Active Directory Federation Services (AD FS) - completely not matching our requirements. B. password hash synchronization with seamless single sign-on (SSO) - this is match C. pass-through authentication with seamless single sign-on (SSO) - this is match as well. Why B is more correct? Because both authentication methods enforce password policies, but with B we do not have to manage large on prem infrastructure in order to protect sign in process. Which meets the second requirements in the question - minimize the servers required. At first I got confused as well, but in question they are talking about password policies not GPOs. Which make sense why B is the correct one.

    3. T

       t2khan

       2021-04-26

       16 upvotes

       The answer is Pass-through for sure. If you carefully read the question its showing *You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant (till here Password-hash could be the solution with only have to deploy AD Connect without any additional infra structure) Then FOCUS on the next requirement => *Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant (this will clarify that the authentication is happening on the on-premises site not at the cloud and policy need to be enforced so Pass-through will be the correct answer) https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-user-signin Please upvote to make it easier for future learners. thanks

    4. R

       rgullini

       2021-04-17

       16 upvotes

       Agree with you. PTA due to the policies. Microsoft uses to create this questions which might lead to confusion with statements like "least administrative effort required" or "minimize the number of servers". These statements should be taken as "when possible" or "as much as possible"

23. Question 23 of 25

    Select 2

    You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1. You plan to publish several apps in the tenant. You need to ensure that User1 can grant admin consent for the published apps. Which two possible user roles can you assign to User1 to achieve this goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • ASecurity administrator
    • BCloud application administrator
    • CApplication administrator
    • DUser administrator
    • EApplication developer

    Show answer

    Correct answer: B, C

    How others answered

    • BC100%

    Explanation

    Granting tenant-wide admin consent requires you to sign in as Global Administrator, an Application Administrator, or a Cloud Application Administrator.

    Adapted from community discussion by arunjana · 2021-06-06 · 64 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. A

       arunjana

       2021-06-06

       64 upvotes

       Granting tenant-wide admin consent requires you to sign in as Global Administrator, an Application Administrator, or a Cloud Application Administrator.

    2. C

       cunlu

       2021-06-26

       5 upvotes

       o grant tenant-wide admin consent from App registrations: Sign in to the Azure portal as a Global Administrator, an Application Administrator, or a Cloud Application Administrator. Select Azure Active Directory then App registrations. Select the application to which you want to grant tenant-wide admin consent. Select API permissions and then click Grant admin consent. Carefully review the permissions the application requires. If you agree with the permissions the application requires, grant consent.

    3. G

       greatadhesiveness

       2022-01-28

       4 upvotes

       Granting tenant-wide admin consent requires you to sign in as a user that is authorized to consent on behalf of the organization. This includes Global Administrator and Privileged Role Administrator. For applications which do not require application permissions for Microsoft Graph or Azure AD Graph this also includes Application Administrator and Cloud Application Administrator. A user can also be authorized to grant tenant-wide consent if they are assigned a custom directory role that includes the permission to grant permissions to applications. https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent

    4. Y

       yonie

       2024-06-24

       Selected B, C2 upvotes

       To grant tenant-wide admin consent, you need: A Microsoft Entra user account with *one of the following roles*: Global Administrator or Privileged Role Administrator, for granting consent for apps requesting any permission, for any API. Cloud Application Administrator or Application Administrator, for granting consent for apps requesting any permission for any API, except Microsoft Graph app roles (application permissions). A custom directory role that includes the permission to grant permissions to applications, for the permissions required by the application. https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal#prerequisites

24. Question 24 of 25

    You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant and a user named User1. The App registrations settings for the tenant are configured as shown in the following exhibit.

    

    You plan to deploy an app named App1. You need to ensure that User1 can register App1 in Azure AD. The solution must use the principle of least privilege. Which role should you assign to User1?

    • AApp Configuration Data Owner for the subscription
    • BManaged Application Contributor for the subscription
    • CCloud application administrator in Azure AD
    • DApplication developer in Azure AD

    Show answer

    Correct answer: D

    How others answered

    • D86%

    Explanation

    Correct Answer Application Developer Users in this role can create application registrations when the "Users can register applications" setting is set to No. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-developer

    Adapted from community discussion by SIDNASIR · 2021-06-20 · 32 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. S

       SIDNASIR

       2021-06-20

       32 upvotes

       Correct Answer Application Developer Users in this role can create application registrations when the "Users can register applications" setting is set to No. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-developer

    2. A

       Amin_7

       2021-06-25

       11 upvotes

       Application Developer - Create application registration when ability is disabled for all users

    3. E

       Eltooth

       2022-03-21

       Selected D6 upvotes

       D is correct answer. Assign the Application Developer role to grant the ability to create application registrations when the Users can register applications setting is set to No. This role also grants permission to consent on one's own behalf when the Users can consent to apps accessing company data on their behalf setting is set to No. https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles#grant-individual-permissions-to-create-and-consent-to-applications-when-the-default-ability-is-disabled

    4. B

       bmanu

       2021-05-24

       6 upvotes

       Application Administrator is not part or the 4 options. Application Developer meets the principle of least privileges req

25. Question 25 of 25

    You have an Azure subscription named Subcription1 that contains an Azure Active Directory (Azure AD) tenant named contoso.com and a resource group named RG1. You create a custom role named Role1 for contoso.com. Where you can use Role1 for permission delegation?

    • Acontoso.com only
    • Bcontoso.com and RG1 only
    • Ccontoso.com and Subscription1 only
    • Dcontoso.com, RG1, and Subscription1

    Show answer

    Correct answer: A

    How others answered

    • A81%
    • D19%

    Explanation

    I don't think so. There are 2 types of roles: 1. Azure roles 2. Azure AD roles. Both of them can be created as custom roles. Since the question says: "You create a custom role named Role1 for contoso.com." - we may assume we are dealing with Azure AD roles here. According MS for AD roles: "Scope can be specified at the tenant level (organization-wide), administrative unit, or on an individual object (for example, a specific application)" See https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#differences-between-azure-roles-and-azure-ad-roles

    Adapted from community discussion by licna · 2022-01-10 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-500 or CertExamHQ.

    1. J

       jpons

       2021-06-30

       40 upvotes

       A - contoso.com only Azure AD role permissions can't be used in Azure custom roles and vice versa. https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-overview

    2. R

       Rahulbard

       2021-07-08

       26 upvotes

       Answer is D .. once a custom role is assinged to a user, the access can be at any level

    3. A

       adrien_m59

       2021-12-30

       Selected A7 upvotes

       Tested right now. Answer is A. Custom Role cannot be used for Subscriptions nor RGs

    4. L

       licna

       2022-01-10

       5 upvotes

       I don't think so. There are 2 types of roles: 1. Azure roles 2. Azure AD roles. Both of them can be created as custom roles. Since the question says: "You create a custom role named Role1 for contoso.com." - we may assume we are dealing with Azure AD roles here. According MS for AD roles: "Scope can be specified at the tenant level (organization-wide), administrative unit, or on an individual object (for example, a specific application)" See https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#differences-between-azure-roles-and-azure-ad-roles

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 1 of 25