Free Microsoft AZ-500 Practice Questions & Answers 2026 Part3 | Microsoft Azure Security Technologies

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced.Solution: You recommend the use of pass-through authentication and seamless SSO with password hash synchronization.Does the solution meet the goal?

You have an Azure subscription that contains a user named User1. You need to ensure that User1 can create managed identities. The solution must use the principle of least privilege.What should you do?

You need to ensure that users signing in to the Azure portal are prompted to sign in every 48 hours. What should you configure?

You need to consider the underlined segment to establish whether it is accurate.You have been tasked with creating a different subscription for each of your company's divisions. However, the subscriptions will be linked to a single Azure ActiveDirectory (Azure AD) tenant.You want to make sure that each subscription has identical role assignments.You make use of Azure AD Privileged Identity Management (PIM).Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish ifthe solution satisfies the requirements.Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenantwith the same name.You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant,and that the amount of necessary servers are reduced.Solution: You recommend the use of password hash synchronization and seamless SSO.Does the solution meet the goal?

Your company recently created an Azure subscription. You have, subsequently, been tasked with making sure that you are able to secure Azure AD roles by making use of Azure Active Directory (Azure AD) Privileged Identity Management (PIM).Which of the following actions should you take FIRST?

HOTSPOT You need to create Role1 to meet the platform protection requirements. How should you complete the role definition of Role1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

You need to ensure that you can meet the security operations requirements. What should you do first?

You have an Azure subscription that contains a Microsoft Sentinel workspace named Sentinel 1. Sentinel! is NOT onboarded to the unified security operations platform in Microsoft 365. You need to create a new playbook in Sentinel 1. The solution must support the use of automation rules. Which type of playbook should you create?

You have a sneaking suspicion that there are users trying to sign in to resources which are inaccessible to them.You decide to create an Azure Log Analytics query to confirm your suspicions. The query will detect unsuccessful user sign-in attempts from the last few days.You want to make sure that the results only show users who had failed to sign-in more than five times.Which of the following should be included in your query?

You onboard Azure Sentinel. You connect Azure Sentinel to Azure Security Center.You need to automate the mitigation of incidents in Azure Sentinel. The solution must minimize administrative effort.What should you create?

In order to get diagnostics from an Azure virtual machine you own, what is the first step to doing that?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced.Solution: You recommend the use of password hash synchronization and seamless SSO.Does the solution meet the goal?

You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD).

You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD).The process involves assessing the risk events and risk levels.Which of the following is the risk level that should be configured for users that have leaked credentials?

You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.An administrator named Admin1 has access to the following identities:-An OpenID-enabled user account-A Hotmail account-An account in contoso.com-An account in an Azure AD tenant named fabrikam.comYou plan to use Azure Account Center to transfer the ownership of Sub1 to Admin1.To which accounts can you transfer the ownership of Sub1?

You have an Azure subscription that contains virtual machines.You enable just in time (JIT) VM access to all the virtual machines.You need to connect to a virtual machine by using Remote Desktop.What should you do first?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish ifthe solution satisfies the requirements.Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenantwith the same name.You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant,and that the amount of necessary servers are reduced.Solution: You recommend the use of pass-through authentication and seamless SSO with password hash synchronization.Does the solution meet the goal?

A company is planning to develop a mobile application. The application will be using the OAuth2 implicit grant type to get Azure AD access tokens. The application needs to be registered in Azure AD. Which of the following is required to register the application in Azure AD?

You need to consider the underlined segment to establish whether it is accurate.You have been tasked with creating a different subscription for each of your company's divisions. However, the subscriptions will be linked to a single Azure ActiveDirectory (Azure AD) tenant.You want to make sure that each subscription has identical role assignments.You make use of Azure AD Privileged Identity Management (PIM).Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ContReg1.You enable content trust for ContReg1.You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege.Which two roles should you assign to User1? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

You have an Azure subscription name Sub1 that contains an Azure Policy definition named Policy1. Policy1 has the following settings: Definition location: Tenant Root Group Category: Monitoring You need to ensure that resources that are noncompliant with Policy1 are listed in the Azure Security Center dashboard. What should you do first? https://docs.microsoft.com/en-us/azure/governance/policy/overview

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription named Sub1.You have an Azure Storage account named sa1 in a resource group named RG1.Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies.You discover that unauthorized users accessed both the file service and the blob service.You need to revoke all access to sa1.Solution: You create a new stored access policy.Does this meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a hybrid configuration of Azure Active Directory (Azure AD).You have an Azure HDInsight cluster on a virtual network.You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.You need to configure the environment to support the planned authentication.Solution: You create a site-to-site VPN between the virtual network and the on-premises network.Does this meet the goal?

You have an Azure Active Directory (Azure AD) tenant.You have the deleted objects shown in the following table.On May 4, 2020, you attempt to restore the deleted objects by using the Azure Active Directory admin center.Which two objects can you restore? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced.Solution: You recommend the use of federation with Active Directory Federation Services (AD FS).Does the solution meet the goal?

You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use automatically generated service principal for the AKS cluster to authenticate to the Azure Container Registry. What should you create?

You make use of Azure Resource Manager templates to deploy Azure virtual machines.You have been tasked with making sure that Windows features that are not in use, are automatically inactivated when instances of the virtual machines are provisioned.Which of the following actions should you take?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your Company's Azure subscription includes a virtual network that has a single subnet configured.You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed.You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and AzureSQL databases via the service endpoint.You need to perform a task on the virtual machine prior to deploying containers.Solution: You install the container network interface (CNI) plug-in.Does the solution meet the goal?

You want to gather logs from a large number of Windows Server 2016 computers using Azure Log Analytics.You are configuring an Azure Resource Manager template to deploy the Microsoft Monitoring Agent to all the servers automatically.Which of the following should be included in the template? (Choose all that apply.)

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription named Sub1.You have an Azure Storage account named sa1 in a resource group named RG1.Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies.You discover that unauthorized users accessed both the file service and the blob service.You need to revoke all access to sa1.Solution: You create a lock on sa1.Does this meet the goal?

Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenantwith the same name.After syncing all on-premises identities to Azure AD, you are informed that users with a givenName attribute starting with LAB should not be allowed to sync toAzure AD.Which of the following actions should you take?

You have an Azure subscription.You create an Azure web app named Contoso1812 that uses an S1 App Service plan.You plan tocreate a CNAME DNS record for www.contoso.com that points to Contoso1812.You need to ensure that users can access Contoso1812 by using the https://www.contoso.com URL.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant.After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf.Solution: You configure a delegated permission with no admin consent.Does the solution meet the goal?

A team is planning on deploying Azure resources by using Resource Manager templates. The templates need to reference secrets that are stored in the Azure Key Vault. You need to ensure deployments can be made accordingly. Which of the following would you use to restrict access to the secrets in the key vault?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Sub1. You have an Azure Storage account named sa1 in a resource group named RG1. Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies. You discover that unauthorized users accessed both the file service and the blob service. You need to revoke all access to sa1. Solution: You regenerate the Azure storage account access keys. Does this meet the goal? Generating new storage account keys will invalidate all SAS's that were based on the previous keys.

You need to configure WebApp1 to meet the data and application requirements. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You create a new Azure subscription.You need to ensure that you can create custom alert rules in Azure Security Center.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your Company's Azure subscription includes a virtual network that has a single subnet configured.You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed.You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and AzureSQL databases via the service endpoint.You need to perform a task on the virtual machine prior to deploying containers.Solution: You create an application security group.Does the solution meet the goal?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant.As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings.You are currently preparing to create a custom sensitivity label.Solution: You start by integrating Security Center and Microsoft Cloud App Security.Does the solution meet the goal?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant.As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings.You are currently preparing to create a custom sensitivity label.Solution: You start by altering the pricing tier of the Security Center.Does the solution meet the goal?

Web Application Firewall offers centralized protection of web applications from common vulnerabilities and exploits. Which of the following is an optional stage in creating a WAF (Web Application Firewall) policy on Azure Front Door using Azure Portal?

Your network contains an on-premises Active Directory domain named corp.contoso.com.You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.You sync all on-premises identities to Azure AD.You need to prevent users who have a givenName attribute that starts with TEST from being synced to Azure AD. The solution must minimize administrative effort.What should you use?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant.After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf.Solution: You configure a delegated permission with admin consent.Does the solution meet the goal?

Your company recently created an Azure subscription.You have been tasked with making sure that a specified user is able to implement Azure AD Privileged Identity Management (PIM).Which of the following is the role you should assign to the user?

Your network contains an Active Directory forest named contoso.com. The forest contains a single domain.You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant.You need to recommend an integration solution that meets the following requirements:-Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant-Minimizes the number of servers required for the solution.Which authentication method should you include in the recommendation?

You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD).The process involves assessing the risk events and risk levels.Which of the following is the risk level that should be configured for users that have leaked credentials?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced.Solution: You recommend the use of federation with Active Directory Federation Services (AD FS).Does the solution meet the goal?