AZ500 Flashcards
(39 cards)
You have a workload in Azure that uses a virtual machine named VM1. VM1 is in a resource group named RG1.
You need to create and assign an identity to VM1 that will be used to access Azure resources. Other virtual machines must be able to use the same identity.
Which PowerShell script should you run?
New-AzUserAssignedIdentity -ResourceGroupName RG1 -Name VMID $vm = Get-AzVM -ResourceGroupName RG1 -Name VM1 Update-AzVM -ResourceGroupName RG1 -VM $vm -IdentityType UserAssigned -IdentityID “/subscriptions/<SUBSCRIPTION>/resourcegroups/RG1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/VMID"</SUBSCRIPTION>
You have an Azure subscription that is used for training purposes.
You need to allow external users to create resources in the subscription.
Which two identity providers can be used to access the subscription? Each correct answer presents a complete solution.
You manage external guest users in a Microsoft Entra tenant. The tenant uses the default settings.
Which capability is available to the guest users?
Invite other guests.
You need to delegate the ability to configure sign-in risk policies. The solution must follow the principle of least privilege.
Which role should you assign?
Security Administrator
You manage Microsoft Entra tenant for a retail company.
You need to ensure that employees using shared Android tablets can use passwordless authentication when accessing the Azure portal.
Which authentication method should you use?
the Microsoft Authenticator app
You need to configure passwordless authentication. The solution must follow the principle of least privilege.
Which role should assign to complete the task?
Global Administrator
You have a Microsoft Entra tenant.
You need to recommend a passwordless authentication method. The solution must support near-field communication (NFC) devices.
Which two authentication methods should you recommend? Each correct answer presents a complete solution.
FIDO2 security keys
Windows Hello for Business
You have an Azure subscription.
You plan to deploy Microsoft Entra Verified ID.
You need to identify which administrative roles are required for the solution. The solution must follow the principle of least privilege.
Which three roles should you identify? Each correct answer presents part of the solution.
Application Administrator
Authentication Policy Administrator
Contributor
You have a Microsoft Entra tenant.
You need to recommend a passwordless authentication solution.
Which three authentication methods should you include in the recommendation? Each correct answer presents a complete solution.
FIDO2 security keys
the Microsoft Authenticator app
Windows Hello for Business
You need to provide an administrator with the ability to configure access reviews in Microsoft Entra Privileged Identity Management (PIM). The solution must follow the principle of least privilege.
Which role should you assign to the administrator?
Privileged Role Administrator
You create a web API and register the API as a Microsoft Entra application.
You need to expose a function in the API to ensure that administrators must provide consent to apps that use the API.
What should you add to your app registration?
a scope
You are managing permission consent for Microsoft Entra app registration.
Which component displays the publisher domain?
publisher name and verification
You are creating a Microsoft Entra app registration. You are configuring credentials for the app registration and have the following requirements:
Ensure that the credentials are not transmitted during authentication.
Ensure that the credentials are stored securely.
Ensure that credential usage follows the principle of least privilege.
What should you do?
Use certificate credentials.
You have a Microsoft Entra tenant that uses the default setting.
You need to prevent users from a domain named contoso.com from being invited to the tenant.
What should you do?
Edit the Collaboration restrictions settings.
You need to provide an administrator with the ability to manage custom RBAC roles. The solution must follow the principle of least privilege.
Which role should you assign to the administrator?
User Access Administrator
You have the following security policy deployed to an Azure subscription.
{
“policyRule”: {
“if”: {
“allOf”: [
{
“field”: “type”,
“equals”: “Microsoft.Storage/storageAccounts”
},
{
“field”: “Microsoft.Storage/storageAccounts/allowSharedKeyAccess”,
“equals”: “true”
}
]
},
“then”: {
“effect”: “Deny”
}
}
}
You successfully deploy a new storage account.
Which statements is true?
Usage of Microsoft Entra authentication is enforced.
You are configuring an Azure Policy in your environment.
You need to ensure that any resources that are missing a tag named CostCenter inherit a value from a resource group.
You create a custom policy that uses the following snippet.
{
“policyRule”: {
“if”: {
“field”: “tags[‘CostCenter’]”,
“exists”: “false”
},
“then”: {
“effect”: “modify”,
“details”: {
“roleDefinitionIds”: [
“/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c”
],
“operations”: [
{
“operation”: “addOrReplace”,
“field”: “tags[‘CostCenter’]”,
“value”: “[resourceGroup().tags[‘CostCenter’]]”
}
]
}
}
}
}
Which policy mode should you use?
Indexed
You have an Azure subscription that contains a user named Admin1.
You need to ensure that Admin1 can access the Regulatory compliance dashboard in Microsoft Defender for Cloud. The solution must follow the principle of least privilege.
Which two roles should you assign to Admin1? Each correct answer presents part of the solution.
Resource Policy Contributor
Security Admin
You have an Azure subscription that contains a user named Admin1.
You need to ensure that Admin1 can create and assign custom security initiatives in Microsoft Defender for Cloud. The solution must follow the principle of least privilege.
Which role should you assign to Admin1?
Owner (Subscription)
You have an Azure subscription.
You need to recommend a solution that uses crawling technology of Microsoft to discover and actively scan assets within an online infrastructure. The solution must also discover new connections over time.
What should you include in the recommendation?
Microsoft Defender External Attack Surface Management (EASM)
You set Periodic recurring scans to ON while implementing a Microsoft Defender for SQL vulnerability assessment.
How often will the scan be triggered?
once a week
You are implementing a Microsoft Defender for SQL vulnerability assessments.
Where are the scan results stored?
an Azure Storage account
You have an Azure subscription and the following SQL deployments:
An Azure SQL database named DB1
An Azure SQL Server named sqlserver1
An instance of SQL Server on Azure Virtual Machines named VM1 that has Microsoft SQL Server 2022 installed
An on-premises server named Server1 that has SQL Server 2019 installed
Which deployments can be protected by using Microsoft Defender for Cloud?
DB1, sqlserver1, VM1, and Server1
You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1.
You need to protect AKS1 by using Microsoft Defender for Cloud.
Which Defender plan should you use?
Microsoft Defender for Containers
