Microsoft AZ-500 Practice Questions with Explanations

Free Microsoft AZ-500 practice questions. 50 of them, each with the correct answer, a full explanation, and the reason every other option is wrong. These are real questions from the AZ-500 exam, not paraphrases, and every explanation is written out rather than just marking the right letter.

They are drawn from the same bank as the full AZ-500 pack, which has 506 questions in total.

Get the full AZ-500 question bank (506 questions) →

AZ-500 practice questions

Question 1

Your company recently created an Azure subscription. You have been tasked with making sure that a specified user is able to implement Azure AD Privileged Identity Management (PIM). Which of the following is the role you should assign to the user?

  • A. The Global administrator role.
  • B. The Security administrator role.
  • C. The Password administrator role.
  • D. The Compliance administrator role.
Show answer and explanation ▾

Correct answer: A

The Global Administrator role is required to implement Azure AD Privileged Identity Management (PIM). While other administrative roles can manage PIM after it's set up, only Global Administrators have the permissions necessary to initially implement and configure PIM for an organization.

Why the other options are wrong:

  • B. Security administrators can work with PIM but cannot initially implement it.
  • C. Password administrators have no PIM implementation capabilities.
  • D. Compliance administrators lack the necessary PIM implementation permissions.

Question 2

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of pass-through authentication and seamless SSO with password hash synchronization. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

The solution does not meet the requirements because it combines pass-through authentication with password hash synchronization, which is contradictory and unnecessary. Additionally, pass-through authentication does not enforce on-premises password policies on Azure AD, and using both methods does not reduce the number of servers as required. The goal requires a single cohesive approach that maintains policy enforcement.

Why the other options are wrong:

  • A. This solution fails because it mixes conflicting authentication methods and doesn't properly enforce on-premises policies.

Question 3

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of federation with Active Directory Federation Services (AD FS). Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Federation with AD FS does not meet the requirements because it requires significant infrastructure investment (additional AD FS and WAP servers), which increases rather than reduces the number of necessary servers. While federation does preserve on- premises password policies, it contradicts the goal of reducing server requirements.

Why the other options are wrong:

  • A. AD FS federation requires multiple additional servers, increasing infrastructure costs rather than reducing them.

Question 4

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of password hash synchronization and seamless SSO. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: A

Password hash synchronization combined with seamless SSO meets all requirements. It enforces on-premises password policies because users authenticate against on-premises AD, maintains user logon limitations, reduces server requirements by avoiding AD FS infrastructure, and provides seamless single sign-on experience. This is the optimal lightweight solution for the stated requirements.

Why the other options are wrong:

  • B. This combination of password hash sync and seamless SSO directly addresses all stated requirements and is the recommended approach.

Question 5

Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. After syncing all on-premises identities to Azure AD, you are informed that users with a givenName attribute starting with LAB should not be allowed to sync to Azure AD. Which of the following actions should you take?

  • A. You should make use of the Synchronization Rules Editor to create an attribute- based filtering rule.
  • B. You should configure a DNAT rule on the Firewall.
  • C. You should configure a network traffic filtering rule on the Firewall.
  • D. You should make use of Active Directory Users and Computers to create an attribute-based filtering rule.
Show answer and explanation ▾

Correct answer: A

You should make use of the Synchronization Rules Editor to create an attribute-based filtering rule. The Synchronization Rules Editor is the correct tool to create attribute-based filtering rules in Azure AD Connect. This allows you to filter objects during synchronization based on attribute values, such as excluding users whose givenName starts with 'LAB'. This is a standard Azure AD Connect configuration task.

Why the other options are wrong:

  • B. DNAT rules on firewalls handle network address translation, not user attribute filtering.
  • C. Firewall traffic filtering rules control network traffic, not synchronization of specific user attributes.
  • D. Active Directory Users and Computers is an on-premises tool for managing AD objects, not for configuring Azure AD Connect sync rules.

Question 6

You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD). The process involves assessing the risk events and risk levels. Which of the following is the risk level that should be configured for users that have leaked credentials?

  • A. None
  • B. Low
  • C. Medium
  • D. High
Show answer and explanation ▾

Correct answer: D

Leaked credentials represent a high-risk security event because they indicate that user account credentials have been compromised and are actively available to potential attackers. This requires the highest risk classification to trigger strong conditional access policies such as mandatory password change or multi-factor authentication.

Why the other options are wrong:

  • A. Leaked credentials cannot be classified as 'None' risk.
  • B. Leaked credentials represent more than a low risk level.
  • C. Compromised credentials warrant a higher risk classification than medium.

Question 7

You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD). The process involves assessing the risk events and risk levels. Which of the following is the risk level that should be configured for sign ins that originate from IP addresses with dubious activity?

  • A. None
  • B. Low
  • C. Medium
  • D. High
Show answer and explanation ▾

Correct answer: C

Sign-ins from IP addresses with dubious activity are classified as medium risk. While these are suspicious and warrant attention, they are not as severe as confirmed compromised credentials. Medium risk appropriately triggers moderate conditional access controls like additional verification without blocking access entirely.

Why the other options are wrong:

  • A. Dubious IP activity cannot be classified as 'None' risk.
  • B. Suspicious IP addresses warrant more than low risk classification.
  • D. This threat level is serious but not as critical as confirmed account compromise.

Question 8

You have been tasked with configuring an access review, which you plan to assigned to a new collection of reviews. You also have to make sure that the reviews can be reviewed by resource owners. You start by creating an access review program and an access review control. You now need to configure the Reviewers. Which of the following should you set Reviewers to?

  • A. Selected users.
  • B. Members (Self).
  • C. Group Owners.
  • D. Anyone.
Show answer and explanation ▾

Correct answer: C

When configuring reviewers for an access review, setting Reviewers to 'Group Owners' ensures that resource owners (the group owners) conduct the reviews. This aligns with the requirement that reviews be performed by resource owners who have the authority and responsibility to make access decisions for their resources.

Why the other options are wrong:

  • A. Selected users might not be the appropriate resource owners.
  • B. Members (Self) would have users review their own access, not resource owners reviewing others.
  • D. Anyone is too broad and doesn't ensure resource owners perform the reviews.

Question 9

Your company recently created an Azure subscription. You have, subsequently, been tasked with making sure that you are able to secure Azure AD roles by making use of Azure Active Directory (Azure AD) Privileged Identity Management (PIM). Which of the following actions should you take FIRST?

  • A. You should sign up Azure Active Directory (Azure AD) Privileged Identity Management (PIM) for Azure AD roles.
  • B. You should consent to Azure Active Directory (Azure AD) Privileged Identity Management (PIM).
  • C. You should discover privileged roles.
  • D. You should discover resources.
Show answer and explanation ▾

Correct answer: A

Before you can use Azure AD Privileged Identity Management (PIM) to secure Azure AD roles, you must first sign up or enable PIM for Azure AD roles in your tenant. This is the prerequisite step that must be completed before any other PIM operations can be performed, including consent, role discovery, or resource discovery.

Why the other options are wrong:

  • B. Consent is required after signup, not before; signup is the first action.
  • C. Discovering privileged roles comes after PIM is signed up and enabled.
  • D. Discovering resources is a later step in the PIM configuration process.

Question 10

You need to consider the underlined segment to establish whether it is accurate. You have been tasked with creating a different subscription for each of your company's divisions. However, the subscriptions will be linked to a single Azure Active Directory (Azure AD) tenant. You want to make sure that each subscription has identical role assignments. You make use of Azure AD Privileged Identity Management (PIM). Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  • A. No adjustment required
  • B. Azure Blueprints
  • C. Conditional access policies
  • D. Azure DevOps
Show answer and explanation ▾

Correct answer: B

Azure Blueprints is the correct service for ensuring identical configurations across multiple subscriptions. While PIM manages role assignments, Azure Blueprints is specifically designed to define and deploy standardized resource sets, including role assignments, to multiple subscriptions consistently. This allows each division's subscription to have identical role assignments.

Why the other options are wrong:

  • A. PIM alone does not ensure identical role assignments across multiple subscriptions automatically.
  • C. Conditional access policies control authentication and access conditions, not resource configuration consistency.
  • D. Azure DevOps is a development and CI/CD platform, not a resource consistency tool for subscriptions.

Question 11

Your company has an Azure Container Registry. You have been tasked with assigning a user a role that allows for the uploading of images to the Azure Container Registry. The role assigned should not require more privileges than necessary. Which of the following is the role you should assign?

  • A. Owner
  • B. Contributor
  • C. AcrPush
  • D. AcrPull
Show answer and explanation ▾

Correct answer: C

AcrPush is the least-privileged role that allows users to push (upload) images to an Azure Container Registry. It grants only the permissions necessary for uploading images without providing unnecessary elevated privileges like Owner or Contributor roles would.

Why the other options are wrong:

  • A. Owner role grants excessive privileges beyond what is needed for uploading images.
  • B. Contributor role grants more permissions than necessary for the image upload task.
  • D. AcrPull is for downloading images, not uploading them.

Question 12

Your company has an Azure Container Registry. You have been tasked with assigning a user a role that allows for the downloading of images from the Azure Container Registry. The role assigned should not require more privileges than necessary. Which of the following is the role you should assign?

  • A. Reader
  • B. Contributor
  • C. AcrDelete
  • D. AcrPull
Show answer and explanation ▾

Correct answer: D

AcrPull is the least-privileged role that allows users to pull (download) images from an Azure Container Registry. It grants only the permissions necessary for pulling images without providing unnecessary elevated privileges. This is the proper principle of least privilege for the downloading requirement.

Why the other options are wrong:

  • A. Reader role is a broader organizational role, not specifically designed for ACR pull operations.
  • B. Contributor role grants more permissions than necessary for downloading images.
  • C. AcrDelete is for deleting images, not pulling/downloading them.

Question 13

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your Company's Azure subscription includes a virtual network that has a single subnet configured. You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed. You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and Azure SQL databases via the service endpoint. You need to perform a task on the virtual machine prior to deploying containers. Solution: You create an application security group. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Creating an application security group does not enable containers to access Azure Storage and SQL databases via the service endpoint. An application security group is a network filtering mechanism for managing inbound/outbound rules between resources. To enable service endpoint access, you need to configure the service endpoint on the subnet and potentially install networking components, but not an application security group.

Why the other options are wrong:

  • A. An application security group does not provide the network configuration needed for service endpoint access to Azure Storage and SQL databases.

Question 14

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your Company's Azure subscription includes a virtual network that has a single subnet configured. You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed. You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and Azure SQL databases via the service endpoint. You need to perform a task on the virtual machine prior to deploying containers. Solution: You create an AKS Ingress controller. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Creating an AKS Ingress controller does not satisfy the requirement. An AKS Ingress controller is used for managing external access to services in Azure Kubernetes Service clusters. The scenario describes a single virtual machine with Docker containers, not an AKS cluster, making an AKS Ingress controller irrelevant to enabling service endpoint access.

Why the other options are wrong:

  • A. An AKS Ingress controller is not applicable to standalone Docker containers on a virtual machine and does not enable service endpoint access.

Question 15

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your Company's Azure subscription includes a virtual network that has a single subnet configured. You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed. You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and Azure SQL databases via the service endpoint. You need to perform a task on the virtual machine prior to deploying containers. Solution: You install the container network interface (CNI) plug-in. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: A

Installing the container network interface (CNI) plug-in is the correct solution. The CNI plug-in enables containers to communicate through the virtual network and access Azure service endpoints properly. This is the necessary networking configuration that allows Docker containers to access Azure Storage and SQL databases via the service endpoint.

Why the other options are wrong:

  • B. Installing a CNI plug-in is the required action to enable container access to service endpoints.

Question 16

You make use of Azure Resource Manager templates to deploy Azure virtual machines. You have been tasked with making sure that Windows features that are not in use, are automatically inactivated when instances of the virtual machines are provisioned. Which of the following actions should you take?

  • A. You should make use of Azure DevOps.
  • B. You should make use of Azure Automation State Configuration.
  • C. You should make use of network security groups (NSG).
  • D. You should make use of Azure Blueprints.
Show answer and explanation ▾

Correct answer: B

Azure Automation State Configuration (formerly DSC) is the appropriate solution for automatically configuring Windows features during virtual machine provisioning. It allows you to define desired state configurations that are applied when VMs are deployed via Azure Resource Manager templates, ensuring unused Windows features are disabled automatically.

Why the other options are wrong:

  • A. Azure DevOps is for CI/CD pipelines and version control, not automatic VM feature configuration during provisioning.
  • C. Network security groups control traffic flow between resources, not Windows feature configuration.
  • D. Azure Blueprints defines environment templates but relies on State Configuration for detailed feature management during deployment.

Question 17

Your company's Azure subscription includes Windows Server 2016 Azure virtual machines. You are informed that every virtual machine must have a custom antimalware virtual machine extension installed. You are writing the necessary code for a policy that will help you achieve this. Which of the following is an effect that must be included in your code?

  • A. Disabled
  • B. Modify
  • C. AuditIfNotExists
  • D. DeployIfNotExists
Show answer and explanation ▾

Correct answer: D

DeployIfNotExists is the correct effect for automatically deploying a resource (antimalware extension) when it doesn't exist. This effect both audits non-compliance and automatically deploys the extension to achieve compliance, which is exactly what's needed to ensure all VMs have the custom antimalware extension installed.

Why the other options are wrong:

  • A. Disabled turns off the policy entirely and would not deploy the extension.
  • B. Modify changes existing resources but doesn't deploy new extensions to resources that lack them.
  • C. AuditIfNotExists only reports on non-compliance without automatically deploying the extension.

Question 18

Your company makes use of Azure Active Directory (Azure AD) in a hybrid configuration. All users are making use of hybrid Azure AD joined Windows 10 computers. You manage an Azure SQL database that allows for Azure AD authentication. You need to make sure that database developers are able to connect to the SQL database via Microsoft SQL Server Management Studio (SSMS). You also need to make sure the developers use their on-premises Active Directory account for authentication. Your strategy should allow for authentication prompts to be kept to a minimum. Which of the following is the authentication method the developers should use?

  • A. Azure AD token.
  • B. Azure Multi-Factor authentication.
  • C. Active Directory integrated authentication.
Show answer and explanation ▾

Correct answer: C

Active Directory integrated authentication allows developers to use their on-premises Active Directory credentials seamlessly without additional authentication prompts. Since the computers are hybrid Azure AD joined, they can authenticate using Kerberos/NTLM from on-premises AD, and Azure SQL can validate these credentials through the hybrid setup, minimizing authentication prompts.

Why the other options are wrong:

  • A. Azure AD token requires explicit token acquisition and additional authentication steps.
  • B. Azure Multi-Factor Authentication adds an extra authentication factor, increasing prompts rather than minimizing them.

Question 19

You have been tasked with enabling Advanced Threat Protection for an Azure SQL Database server. Advanced Threat Protection must be configured to identify all types of threat detection. Which of the following will happen if when a faulty SQL statement is generate in the database by an application?

  • A. A Potential SQL injection alert is triggered.
  • B. A Vulnerability to SQL injection alert is triggered.
  • C. An Access from a potentially harmful application alert is triggered.
  • D. A Brute force SQL credentials alert is triggered.
Show answer and explanation ▾

Correct answer: B

When a faulty SQL statement is generated by an application, Advanced Threat Protection detects potential vulnerability to SQL injection. This alert identifies patterns in the SQL code that could indicate a vulnerability to injection attacks, even if the statement itself is malformed or faulty.

Why the other options are wrong:

  • A. Potential SQL injection alerts are triggered for actual injection attempts, not faulty statements.
  • C. Access from potentially harmful application alerts relate to suspicious connection behavior, not faulty SQL statements.
  • D. Brute force SQL credentials alerts are triggered for repeated failed login attempts, not malformed queries.

Question 20

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure Container Registry. You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal. Solution: You create an Azure Active Directory (Azure AD) role assignment. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Creating an Azure AD role assignment alone does not configure AKS to authenticate to ACR using the autogenerated service principal. While an Azure AD role assignment may be part of the solution, the autogenerated service principal credentials must be explicitly configured in the AKS cluster's image pull secrets or the cluster's managed identity must be granted the AcrPull role on the ACR resource. A role assignment by itself is insufficient.

Why the other options are wrong:

  • A. This is incorrect because an Azure AD role assignment is a partial step; additional configuration of the service principal credentials or managed identity is required for AKS to actually authenticate to ACR.

Question 21

You have been tasked with delegate administrative access to your company's Azure key vault. You have to make sure that a specific user can set advanced access policies for the key vault. You also have to make sure that access is assigned based on the principle of least privilege. Which of the following options should you use to achieve your goal?

  • A. Azure Information Protection
  • B. RBAC
  • C. Azure AD Privileged Identity Management (PIM)
  • D. Azure DevOps
Show answer and explanation ▾

Correct answer: B

RBAC (Role-Based Access Control) is the correct mechanism for delegating administrative access to Azure Key Vault with granular permissions. RBAC allows you to assign specific roles (such as Key Vault Administrator or Key Vault Secrets Officer) to users, enabling you to set advanced access policies while following the principle of least privilege by granting only the minimum permissions needed for the task.

Why the other options are wrong:

  • A. Azure Information Protection is used for data classification and protection, not for managing access controls to Azure Key Vault.
  • C. Azure AD PIM is designed for just-in-time and time-bound access elevation of privileged roles, not for standard administrative delegation to Key Vault.
  • D. Azure DevOps is a development and CI/CD platform, not an access control mechanism for managing Azure resource permissions.

Question 22

You have been tasked with delegate administrative access to your company's Azure key vault. You have to make sure that a specific user is able to add and delete certificates in the key vault. You also have to make sure that access is assigned based on the principle of least privilege. Which of the following options should you use to achieve your goal?

  • A. A key vault access policy
  • B. Azure policy
  • C. Azure AD Privileged Identity Management (PIM)
  • D. Azure DevOps
Show answer and explanation ▾

Correct answer: A

A key vault access policy is the appropriate mechanism to delegate granular permissions for certificate operations. It allows you to specify exactly which users can perform which operations (add, delete certificates) on the key vault, implementing the principle of least privilege without granting excessive permissions.

Why the other options are wrong:

  • B. Azure Policy is for enforcing organizational standards across Azure resources, not for delegating granular access to key vault operations.
  • C. Azure AD Privileged Identity Management is for managing elevated access and time- based permissions, not for routine certificate management operations.
  • D. Azure DevOps is a CI/CD and development platform, not an access control mechanism for Azure key vaults.

Question 23

You have an Azure virtual machine that runs Windows Server R2. You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine. Which of the following is TRUE with regards to Azure Disk Encryption for a Windows VM?

  • A. It is supported for basic tier VMs.
  • B. It is supported for standard tier VMs.
  • C. It is supported for VMs configured with software-based RAID systems.
  • D. It is supported for VMs configured with Storage Spaces Direct (S2D).
Show answer and explanation ▾

Correct answer: B

Azure Disk Encryption for Windows VMs is supported on standard tier VMs. Basic tier VMs do not meet the minimum requirements for ADE, and software-based RAID and Storage Spaces Direct configurations have compatibility limitations that prevent ADE from functioning correctly.

Why the other options are wrong:

  • A. Azure Disk Encryption is not supported for basic tier VMs due to insufficient capabilities.
  • C. Software-based RAID systems are not supported with Azure Disk Encryption.
  • D. Storage Spaces Direct (S2D) is not a supported configuration for Azure Disk Encryption.

Question 24

You have an Azure virtual machine that runs Ubuntu 16.04-DAILY-LTS. You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine. Which of the following is TRUE with regards to Azure Disk Encryption for a Linux VM?

  • A. It is NOT supported for basic tier VMs.
  • B. It is NOT supported for standard tier VMs.
  • C. OS drive encryption for Linux virtual machine scale sets is supported.
  • D. Custom image encryption is supported.
Show answer and explanation ▾

Correct answer: A

Azure Disk Encryption for Linux VMs is not supported for basic tier VMs, which lack the necessary performance and capability requirements. Basic tier VMs do not meet the minimum specifications needed for ADE functionality on Linux systems.

Why the other options are wrong:

  • B. Azure Disk Encryption is supported for standard tier Linux VMs.
  • C. OS drive encryption for Linux virtual machine scale sets is not currently supported.
  • D. Custom image encryption requires specific preparation steps and is not universally supported without proper configuration.

Question 25

You need to consider the underlined segment to establish whether it is accurate. You have configured an Azure Kubernetes Service (AKS) cluster in your testing environment. You are currently preparing to deploy the cluster to the production environment. After disabling HTTP application routing, you want to replace it with an application routing solution that allows for reverse proxy and TLS termination for AKS services via a solitary IP address. You must create an AKS Ingress controller. Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  • A. No adjustment required.
  • B. a network security group
  • C. an application security group
  • D. an Azure Basic Load Balancer
Show answer and explanation ▾

Correct answer: A

An AKS Ingress controller is the correct solution for providing reverse proxy and TLS termination for AKS services via a single IP address. The statement is accurate as written -an Ingress controller handles exactly these requirements. Network security groups, application security groups, and load balancers are networking components that may support an Ingress deployment but are not the primary solution for the described functionality.

Why the other options are wrong:

  • B. A network security group controls traffic rules but does not provide reverse proxy or TLS termination capabilities.
  • C. An application security group manages network access policies but is not a routing or TLS termination solution.
  • D. A Basic Load Balancer provides load balancing but lacks the application-layer routing and TLS termination features of an Ingress controller.

Question 26

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant. As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings. You are currently preparing to create a custom sensitivity label. Solution: You start by altering the pricing tier of the Security Center. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Creating custom sensitivity labels in Azure is managed through the Microsoft 365 compliance center or Azure Information Protection, not through Azure Security Center pricing tier adjustments. Altering the Security Center pricing tier affects security monitoring and threat protection capabilities but has no relation to sensitivity label creation. This solution does not meet the stated goal.

Why the other options are wrong:

  • A. Changing the Security Center pricing tier does not enable or facilitate the creation of custom sensitivity labels.

Question 27

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant. As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings. You are currently preparing to create a custom sensitivity label. Solution: You start by integrating Security Center and Microsoft Cloud App Security. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Custom sensitivity labels are created through the Microsoft 365 compliance center or Azure Information Protection, not by integrating Security Center with Microsoft Cloud App Security. While this integration enhances security monitoring across cloud applications, it does not provide the functionality needed to create custom sensitivity labels. This solution does not meet the goal.

Why the other options are wrong:

  • A. Integrating Security Center with Cloud App Security does not enable custom sensitivity label creation.

Question 28

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant. As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings. You are currently preparing to create a custom sensitivity label. Solution: You start by creating a custom sensitive information type. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: A

Creating a custom sensitive information type is the correct approach to establish custom sensitivity labels in Azure. Custom sensitive information types are defined in the compliance center and form the foundation for sensitivity labels that can then be applied to data classification and protection policies. This solution directly addresses the stated requirement.

Why the other options are wrong:

  • B. Creating a custom sensitive information type is the appropriate and necessary step to enable custom sensitivity labels.

Question 29

You have a sneaking suspicion that there are users trying to sign in to resources which are inaccessible to them. You decide to create an Azure Log Analytics query to confirm your suspicions. The query will detect unsuccessful user sign-in attempts from the last few days. You want to make sure that the results only show users who had failed to sign-in more than five times. Which of the following should be included in your query?

  • A. The EventID and CountIf() parameters.
  • B. The ActivityID and CountIf() parameters.
  • C. The EventID and Count() parameters.
  • D. The ActivityID and Count() parameters.
Show answer and explanation ▾

Correct answer: C

To detect unsuccessful sign-in attempts and filter results to show only users with more than five failed attempts, the query must use EventID to identify failed sign-in events and the Count() function to aggregate the number of occurrences per user. The Count() function (without parameters) aggregates rows into groups, allowing the subsequent filtering with a 'where' clause to identify users exceeding the five-attempt threshold. ActivityID and CountIf() are not the appropriate operators for this use case.

Why the other options are wrong:

  • A. CountIf() is not the correct aggregation function; Count() is needed to aggregate failed attempts by user.
  • B. ActivityID is not the relevant field for sign-in failure detection; EventID is the correct identifier, and CountIf() is not appropriate.
  • D. ActivityID is not the relevant field for identifying failed sign-in events; EventID is the correct field to use.

Question 30

After creating a new Azure subscription, you are tasked with making sure that custom alert rules can be created in Azure Security Center. You have created an Azure Storage account. Which of the following is the action you should take?

  • A. You should make sure that Azure Active Directory (Azure AD) Identity Protection is removed.
  • B. You should create a DLP policy.
  • C. You should create an Azure Log Analytics workspace.
  • D. You should make sure that Security Center has the necessary tier configured.
Show answer and explanation ▾

Correct answer: C

To create custom alert rules in Azure Security Center, an Azure Log Analytics workspace is required. Custom alerts in Security Center depend on Log Analytics to store and analyze data from your resources. The workspace serves as the backend for querying events and defining custom alert conditions. Azure Active Directory Identity Protection, DLP policies, and Security Center tier configuration are not prerequisites for custom alert rule creation.

Why the other options are wrong:

  • A. Removing Azure AD Identity Protection is not related to creating custom alert rules in Security Center.
  • B. Creating a DLP policy is unrelated to Security Center custom alert rule functionality.
  • D. While Security Center tier affects certain features, the core requirement for custom alerts is a Log Analytics workspace, not tier configuration.

Question 31

Your company's Azure subscription includes an Azure Log Analytics workspace. Your company has a hundred on-premises servers that run either Windows Server 2012 R2 or Windows Server 2016, and is linked to the Azure Log Analytics workspace. The Azure Log Analytics workspace is set up to gather performance counters associated with security from these linked servers. You have been tasked with configuring alerts according to the information gathered by the Azure Log Analytics workspace. You have to make sure that alert rules allow for dimensions, and that alert creation time should be kept to a minimum. Furthermore, a single alert notification must be created when the alert is created and when the alert is sorted out. You need to make use of the necessary signal type when creating the alert rules. Which of the following is the option you should use?

  • A. You should make use of the Activity log signal type.
  • B. You should make use of the Application Log signal type.
  • C. You should make use of the Metric signal type.
  • D. You should make use of the Audit Log signal type.
Show answer and explanation ▾

Correct answer: C

The Metric signal type is the correct choice for this scenario. Metrics support dimensions, which allow for more granular alerting rules. Metric alerts have minimal creation time and automatically generate notifications both when an alert is triggered and when it resolves. Activity logs and Audit logs are event-based and don't support dimensions in the same way. Application Log is not a standard signal type in Azure Monitor.

Why the other options are wrong:

  • A. Activity log signal type does not support dimensions and is designed for subscription- level events rather than performance metrics.
  • B. Application Log is not a standard signal type option in Azure Monitor alert creation.
  • D. Audit Log signal type is not a standard Azure Monitor signal type for creating metric- based alerts.

Question 32

Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled. You have been tasked with retrieving the identity of the user that removed a virtual machine fifteen days ago. You have already accessed Azure Monitor. Which of the following options should you use?

  • A. Application Log
  • B. Metrics
  • C. Activity Log
  • D. Logs
Show answer and explanation ▾

Correct answer: C

The Activity Log is the correct option for tracking subscription-level activities, including resource deletions. It records all control plane operations performed on Azure resources, including who deleted a virtual machine and when. This is exactly what is needed to identify the user who removed the virtual machine 15 days ago. The Activity Log maintains historical data and can be filtered by resource type, time range, and operation type.

Why the other options are wrong:

  • A. Application Log is not relevant for tracking resource deletion activities at the subscription level.
  • B. Metrics contain performance data, not audit trail information about who performed operations.
  • D. Logs (referring to diagnostic logs or custom logs) would contain operational data from within resources, not subscription-level activities.

Question 33

Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled. You have been tasked with analyzing the security events of a Windows Server 2016 virtual machine. You have already accessed Azure Monitor. Which of the following options should you use?

  • A. Application Log
  • B. Metrics
  • C. Activity Log
  • D. Logs
Show answer and explanation ▾

Correct answer: D

The Logs option (which includes diagnostic logs and custom logs from Azure Diagnostics) is the correct choice for analyzing security events from a Windows Server virtual machine. Since the VM has Azure Diagnostics enabled, security event logs are collected and stored in Azure Monitor Logs. This allows querying Windows Security events, including authentication, authorization, and other security-related events using KQL (Kusto Query Language).

Why the other options are wrong:

  • A. Application Log is for tracking application-level events, not Windows operating system security events.
  • B. Metrics contain performance measurements and counters, not detailed security event information.
  • C. Activity Log tracks subscription-level operations, not guest OS security events from within virtual machines.

Question 34

You have been tasked with making sure that you are able to modify the operating system security configurations via Azure Security Center. To achieve your goal, you need to have the correct pricing tier for Azure Security Center in place. Which of the following is the pricing tier required?

  • A. Advanced
  • B. Premium
  • C. Standard
  • D. Free
Show answer and explanation ▾

Correct answer: C

The Standard pricing tier is required to modify operating system security configurations via Azure Security Center. The Standard tier provides features for hardening resources and implementing security recommendations, including OS security configuration adjustments. The Free tier only provides visibility and basic recommendations but lacks the capability to enforce or modify security configurations at the OS level.

Why the other options are wrong:

  • A. Advanced is not the correct pricing tier designation in Azure Security Center.
  • B. Premium is not the standard pricing tier name for Azure Security Center; Standard is the term used.
  • D. Free tier does not include the capability to modify operating system security configurations.

Question 35

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant. After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf. Solution: You configure a delegated permission with admin consent. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

The solution does not meet the goal. When an application needs to access Azure Key Vault secrets on behalf of users, delegated permissions alone are insufficient. The application requires application permissions (also called app roles or direct permissions) in addition to delegated permissions, because Key Vault needs to authenticate and authorize the application itself, not just the user. Admin consent without proper application permissions cannot grant the necessary access to Key Vault secrets.

Why the other options are wrong:

  • A. Delegated permissions with admin consent does not provide the application with the necessary permissions to access Key Vault secrets; application permissions are required.

Question 36

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant. After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf. Solution: You configure a delegated permission with no admin consent. Does the solution meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: A

The solution meets the goal. When configured correctly, delegated permissions without requiring admin consent allow an application to access Azure Key Vault secrets on behalf of users. The application requests permissions that users can consent to individually. This is a valid approach for user-delegated scenarios where the application acts on behalf of the authenticated user to access Key Vault secrets, provided the application is properly configured with the appropriate API permissions.

Why the other options are wrong:

  • B. This configuration can successfully allow user-delegated access to Key Vault secrets when properly set up.

Question 37

You need to consider the underlined segment to establish whether it is accurate. Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it. Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type. The mobile application must be registered in Azure AD. You require a redirect URI from the developer for registration purposes. Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  • A. No adjustment required
  • B. a secret
  • C. a login hint
  • D. a client ID
Show answer and explanation ▾

Correct answer: A

No adjustment is required. The statement is accurate. When registering a mobile application in Azure AD that uses the OAuth 2 implicit grant type, a redirect URI is indeed a necessary requirement. The redirect URI specifies where Azure AD should send the access token after successful authentication, and it is a mandatory component for the implicit flow to function properly. Mobile applications require this configuration to handle the callback from Azure AD.

Why the other options are wrong:

  • B. A secret is not needed for implicit grant flow applications; secrets are used in confidential client flows.
  • C. A login hint is optional guidance for authentication, not a required registration parameter.
  • D. A client ID is separate from the redirect URI and is automatically generated during registration.

Question 38

You are in the process of configuring an Azure policy via the Azure portal. Your policy will include an effect that will need a managed identity for it to be assigned. Which of the following is the effect in question?

  • A. AuditIfNotExist
  • B. Disabled
  • C. DeployIfNotExist
  • D. EnforceOPAConstraint
Show answer and explanation ▾

Correct answer: C

The DeployIfNotExist effect is the correct answer. This effect requires a managed identity to be assigned to the policy because it deploys resources or configurations when the specified condition is not met. The managed identity provides the necessary permissions for Azure Policy to perform the deployment operations. AuditIfNotExist only logs non- compliant resources without deploying anything, so it does not require a managed identity.

Why the other options are wrong:

  • A. AuditIfNotExist does not require a managed identity as it only audits and reports non- compliance without deploying resources.
  • B. Disabled does not perform any actions and does not require a managed identity.
  • D. EnforceOPAConstraint is not a standard Azure Policy effect that requires managed identities.

Question 39

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You create a new stored access policy. Does this meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Creating a new stored access policy does not revoke access granted by existing SASs and policies. To revoke all access, you must regenerate the storage account access keys, which invalidates all SASs derived from those keys. Creating a new policy is an additive action and cannot remove existing authorization grants. The compromised access must be actively revoked, not supplemented with new policies.

Why the other options are wrong:

  • A. This does not meet the goal because new policies do not invalidate existing SAS tokens and access policies.

Question 40

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure HDInsight cluster on a virtual network. You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials. You need to configure the environment to support the planned authentication. Solution: You deploy the On-premises data gateway to the on-premises network. Does this meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Deploying the On-premises Data Gateway does not enable HDInsight to authenticate users against on-premises Active Directory. The data gateway is designed for data connectivity to on-premises data sources, not for identity authentication. To authenticate HDInsight cluster users with on-premises AD credentials, you need to configure Enterprise Security Package (ESP) with Azure AD Domain Services or establish proper Kerberos authentication infrastructure, not a data gateway.

Why the other options are wrong:

  • A. The On-premises Data Gateway is for data connectivity, not for identity authentication to HDInsight.

Question 41

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure HDInsight cluster on a virtual network. You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials. You need to configure the environment to support the planned authentication. Solution: You create a site-to-site VPN between the virtual network and the on-premises network. Does this meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

While a site-to-site VPN establishes network connectivity between on-premises and Azure, it alone does not enable user authentication to HDInsight using on-premises AD credentials. A VPN is necessary but insufficient-you also need Enterprise Security Package (ESP) configured with proper Kerberos authentication and Azure AD Domain Services integration. The VPN provides infrastructure connectivity but not the authentication mechanism itself.

Why the other options are wrong:

  • A. A site-to-site VPN provides network connectivity but does not configure the authentication mechanism required for on-premises AD credentials to work with HDInsight.

Question 42

Your network contains an Active Directory forest named contoso.com. The forest contains a single domain. You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant. You need to recommend an integration solution that meets the following requirements: • Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant • Minimizes the number of servers required for the solution. Which authentication method should you include in the recommendation?

  • A. federated identity with Active Directory Federation Services (AD FS)
  • B. password hash synchronization with seamless single sign-on (SSO)
  • C. pass-through authentication with seamless single sign-on (SSO)
Show answer and explanation ▾

Correct answer: B

Password hash synchronization with seamless SSO meets both requirements while minimizing servers. Password hash sync syncs hashed passwords, ensuring on-premises password policies apply to synced accounts, and seamless SSO provides single sign-on functionality. This solution requires only the Azure AD Connect server. AD FS (option A) requires additional infrastructure (AD FS servers and WAP servers), increasing server count. Pass-through authentication (option C) also requires agent servers beyond Azure AD Connect, increasing infrastructure requirements.

Why the other options are wrong:

  • A. AD FS requires additional servers (AD FS and Web Application Proxy), which does not minimize server count.
  • C. Pass-through authentication requires additional agent servers deployed on-premises, which does not minimize the number of servers.

Question 43

Your network contains an on-premises Active Directory domain named corp.contoso.com. You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You sync all on-premises identities to Azure AD. You need to prevent users who have a givenName attribute that starts with TEST from being synced to Azure AD. The solution must minimize administrative effort. What should you use?

  • A. Synchronization Rules Editor
  • B. Web Service Configuration Tool
  • C. the Azure AD Connect wizard
  • D. Active Directory Users and Computers
Show answer and explanation ▾

Correct answer: A

The Synchronization Rules Editor is the tool used to create custom synchronization rules that filter which objects sync to Azure AD. To prevent users with a givenName starting with TEST from syncing, you create an inbound or outbound synchronization rule with an appropriate scoping filter. The Azure AD Connect wizard (option C) provides basic configuration but not the granular filtering required. Web Service Configuration Tool and Active Directory Users and Computers are not designed for Azure AD sync filtering.

Why the other options are wrong:

  • B. The Web Service Configuration Tool is not used for configuring Azure AD Connect synchronization rules.
  • C. The Azure AD Connect wizard provides general configuration but lacks the granular filtering capabilities of Synchronization Rules Editor.
  • D. Active Directory Users and Computers is an on-premises tool that cannot filter Azure AD synchronization.

Question 44

You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. An administrator named Admin1 has access to the following identities: • An OpenID-enabled user account • A Hotmail account • An account in contoso.com • An account in an Azure AD tenant named fabrikam.com You plan to use Azure Account Center to transfer the ownership of Sub1 to Admin1. To which accounts can you transfer the ownership of Sub1?

  • A. contoso.com only
  • B. contoso.com, fabrikam.com, and Hotmail only
  • C. contoso.com and fabrikam.com only
  • D. contoso.com, fabrikam.com, Hotmail, and OpenID-enabled user account
Show answer and explanation ▾

Correct answer: C

Azure Account Center allows subscription ownership transfer only to accounts that are members of an Azure AD directory or Microsoft account (live accounts). OpenID-enabled accounts are not supported for subscription ownership transfer. Therefore, you can transfer to the contoso.com account (the associated tenant) and the fabrikam.com account (another Azure AD tenant), but not to the Hotmail account or OpenID account in Azure Account Center context. Only Azure AD directory accounts and Microsoft accounts within the same governance model are eligible.

Why the other options are wrong:

  • A. The fabrikam.com account can also receive subscription ownership as it is an Azure AD tenant account.
  • B. Hotmail accounts cannot be used for subscription ownership transfer in Azure Account Center.
  • D. OpenID-enabled accounts are not supported for subscription ownership transfer.

Question 45

Your company plans to create separate subscriptions for each department. Each subscription will be associated to the same Azure Active Directory (Azure AD) tenant. You need to configure each subscription to have the same role assignments. What should you use?

  • A. Azure Security Center
  • B. Azure Policy
  • C. Azure AD Privileged Identity Management (PIM)
  • D. Azure Blueprints
Show answer and explanation ▾

Correct answer: D

Azure Blueprints is the correct tool for defining and deploying consistent role assignments across multiple subscriptions. Blueprints allow you to create reusable templates that include role assignments, which can be deployed to multiple subscriptions simultaneously, ensuring consistent RBAC configurations. Azure Policy manages compliance but not role assignments. Azure Security Center provides security monitoring. Azure AD PIM manages just-in-time privilege elevation, not consistent RBAC configuration across subscriptions.

Why the other options are wrong:

  • A. Azure Security Center provides security recommendations and monitoring, not role assignment configuration.
  • B. Azure Policy enforces compliance rules but does not directly configure role assignments.
  • C. Azure AD PIM manages privileged access and just-in-time elevation, not consistent role assignments across subscriptions.

Question 46

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You create a lock on sa1. Does this meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Creating a lock on the storage account only prevents accidental deletion or modification of the account itself. It does not revoke access to users with existing SASs and stored access policies. Those tokens and policies would remain valid and continue to grant access to the blob and file services. To revoke access, you must regenerate the storage account keys or revoke the specific access policies.

Why the other options are wrong:

  • A. A lock does not revoke authentication credentials or invalidate existing SAS tokens and access policies.

Question 47

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure HDInsight cluster on a virtual network. You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials. You need to configure the environment to support the planned authentication. Solution: You deploy Azure Active Directory Domain Services (Azure AD DS) to the Azure subscription. Does this meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Azure AD DS creates a managed domain in Azure that allows Azure VMs to authenticate against it, but does not directly bridge on-premises Active Directory to HDInsight for authentication. For HDInsight to authenticate users against on-premises Active Directory in a hybrid setup, you need to configure Enterprise Security Package (ESP) with proper network connectivity, domain joining, and potentially Azure AD Connect for synchronization, not Azure AD DS alone.

Why the other options are wrong:

  • A. Azure AD DS does not provide the necessary on-premises Active Directory integration for HDInsight user authentication in a hybrid scenario.

Question 48

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure HDInsight cluster on a virtual network. You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials. You need to configure the environment to support the planned authentication. Solution: You deploy an Azure AD Application Proxy. Does this meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: B

Azure AD Application Proxy is designed to enable remote access to on-premises web applications through Azure AD authentication. It does not provide direct on-premises Active Directory authentication to Azure HDInsight clusters. For HDInsight to authenticate users with on-premises Active Directory credentials, Enterprise Security Package (ESP) with proper domain integration is required, not Application Proxy.

Why the other options are wrong:

  • A. Application Proxy is for web application proxying, not for direct Active Directory credential authentication to HDInsight.

Question 49

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You regenerate the Azure storage account access keys. Does this meet the goal?

  • A. Yes
  • B. No
Show answer and explanation ▾

Correct answer: A

Regenerating the storage account access keys immediately invalidates all existing SAS tokens and stored access policies that were derived from those keys, preventing any further access using previously issued credentials. This is the definitive way to revoke all access to the storage account when unauthorized access has occurred, making it the correct solution to meet the stated goal.

Why the other options are wrong:

  • B. Regenerating storage account keys is the standard and effective method to revoke all access derived from those keys.

Question 50

You have a hybrid configuration of Azure Active Directory (Azure AD) that has Single Sign-On (SSO) enabled. You have an Azure SQL Database instance that is configured to support Azure AD authentication. Database developers must connect to the database instance from the domain joined device and authenticate by using their on-premises Active Directory account. You need to ensure that developers can connect to the instance by using Microsoft SQL Server Management Studio. The solution must minimize authentication prompts. Which authentication method should you recommend?

  • A. Active Directory - Password
  • B. Active Directory - Universal with MFA support
  • C. SQL Server Authentication
  • D. Active Directory - Integrated
Show answer and explanation ▾

Correct answer: D

Active Directory - Integrated (option D) is the optimal choice for domain-joined devices in a hybrid Azure AD SSO environment. It uses Kerberos to provide seamless, single sign-on authentication without requiring additional prompts. Since the devices are domain-joined and SSO is enabled, developers' on-premises Active Directory credentials will be passed transparently to SQL Server Management Studio, minimizing authentication prompts.

Why the other options are wrong:

  • A. Active Directory - Password requires explicit password entry, creating additional prompts.
  • B. Active Directory - Universal with MFA requires MFA challenges, creating additional authentication overhead.
  • C. SQL Server Authentication requires separate SQL credentials and does not leverage on-premises Active Directory.

Get the complete AZ-500 bank

These 50 questions are roughly 20% of the bank. The full pack has 506 real AZ-500 questions, each with the same depth of explanation, plus a questions-only PDF for timed practice and free updates forever.

View the full Microsoft AZ-500 question bank →

Related exams

Browse free practice questions for every exam →

Back to blog