Microsoft Azure AZ-500 Security Technologies (Practice Exam #4) - Udemy Flashcards
You have an existing AD Connect implementation. You have to prevent users from a certain department to be synchronised to AAD. What tool do you use?
A. AAD Connect wizard on the AD Connect server
B . Synchronization Rules Editor on the AD Connect server
C. AAD Connect in the Azure portal
D. AD Users and Computers on the local DC
B . Synchronization Rules Editor on the AD Connect server
Explanation:
Synchronization rules editor on the AD Connect server is used to change the users to be synced.
What format is an OpenID Connect token?
A. XML
B. SAML
C. JWT
D. Java
C. JWT
Which two of the following are objects you can configure to apply AAD PIM to?
A. Access Reviews
B. AAD Roles
C. ADD Groups
D. Azure Resources
E. AAD Dynamic Groups
B. AAD Roles
D. Azure Resources
Explanation:
AAD Roles and Azure resources https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure#who-can-do-what-in-pim
In Azure SQL Database AlwaysEncrypted, two types of column encryption is supported. Match the requirement with the appropriate column encryption type. Plaintext data values always produce the same cyphertext:
A. Deterministic
B. Randomized
A. Deterministic
In Azure SQL Database AlwaysEncrypted, two types of column encryption is supported. Match the requirement with the appropriate column encryption type. SQL Server can use the encrypted columns in joins and lookups:
A. Deterministic
B. Randomized
A. Deterministic
Explanation:
In Azure SQL Database AlwaysEncrypted, two types of column encryption is supported. Match the requirement with the appropriate column encryption type. Highest level of security:
A. Deterministic
B. Randomized
B. Randomized
In Azure SQL Database AlwaysEncrypted, two types of column encryption is supported. Match the requirement with the appropriate column encryption type. Not suitable for columns containing boolean data:
A. Deterministic
B. Randomized
A. Deterministic
Explanation:
You create a new Azure Key Vault and want to ensure that malicious permanent deletions of key vault items can be recovered for 90 days. What at a minimum would you have to enable on the Key Vault?
A. Soft-delete only
B. Purge protection only
C. Soft-delete and purge protection
D. Delete lock only
E. Read-only lock only
C. Soft-delete and purge protection
Explanation:
Soft-delete will allow recovery of accidentally deleted key vault items (or the key vault itself) for 90 days. However a malicious user might purge soft-deleted items which will prevent their recovery despite soft-delete being enabled. To prevent purging of soft-deleted items you should enable purge protection which in turn requires soft-delete to be enabled. The best answer is Soft-delete and purge protection.
Which of the following are default rules created with a network security group?
A. DenyAllInBound
B. DenyAllOutBound
C. DenyVnetInBound
D. DenyVnetOutBound
A. DenyAllInBound
Explanation:
AllowVnetInBound,
AllowAzureLoadBalancerInBound,
DenyAllInBound,
AllowVnetOutBound,
AllowInternetOutBound,
DenyAllOutBound,
Are the default rules in all NSGs
You must minimise costs. What is the minimum license required to configure Azure AD MFA?
A. Azure AD Premium P1
B. Azure AD Premium P2
C. No license is required
D. Any Office 365 license
E. No license is required, but the user must be an Azure AD Global Administrator
E. No license is required, but the user must be an Azure AD Global Administrator
Explanation:
No license is required, but the user must be an Azure AD Global Administrator
MFA is free if you are a AAD global administrator - reduced functionality
You get MFA for all users with any O365 subscription - reduced functionality
You get full-featured MFA with AAD P1
You get full-featured MFA with AAD P2 (all AAD P1 features is included in AAD P2)
You can configure MFA for any user with no licenses and your subscription will be charged on a per-user consumption-based model
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing
When configuring AAD conditional access policies, which of the following are mandatory requirements?
A. User / group
B. Cloud Apps
C. Sign-in risk
D. Device platforms
E. Device state
F. Location
G. Client apps
H. Access controls
A. User / group
B. Cloud Apps
H. Access controls
Explanation:
User / group,
Cloud Apps,
Access controls,
All the others are optional.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-mfa
You are configuring AIP policies. You specify two labels:
Label1: matches “Word1”
Label2: matches “Word2”
You create a document in MS Word that contains both words, which label is applied?
A. Label1
B. Label2
C. Label1 and Label2
D. No label
B. Label2
Explanation:
Label 2 is applied. AIP labels are applied in the order they are listed in the policy with the last matching label (or sublable) winning. Only one label is applied to the document. Only Office documents are supported.
https://docs.microsoft.com/en-us/azure/information-protection/faqs-infoprotect#can-a-file-have-more-than-one-classification
What tools are available to you for changing the key scenario in AIP (from Microsoft managed to BYOK for example)?
A. Azure portal
B. O365 management portal
C. Security and Compliance Centre
D. Windows PowerShell
E. Azure CLI
D. Windows PowerShell
Explanation:
https://www.udemy.com/course/azure-az-500-security-technologies-practice-test/learn/quiz/4704056/result/1388030393#overview:~:text=Windows%20PowerShell%20is%20currently%20the%20only%20option%20for%20key%20management%20in%20AIP.
You must minimise costs. What is the minimum license required to configure Azure AD Conditional Access?
A. Azure AD Premium P1
B. Azure AD Premium P2
C. No license is required
D. Any Office 365 license
E. No license is required, but the user must be an Azure AD Global Administrator
A. Azure AD Premium P1
Explanation:
Azure AD Premium P1 is required to configure and use Conditional Access
Azure AD Premium P2 includes all the features of Azure Premium P1 (not minimum)
You cannot configure or use conditional access if you don’t have at least AAD P1
Conditional access in not included in Azure AD for O365 - having an O365 license won’t help
Being an Azure AD Global Administrator doesn’t permit configuring AAD Conditional access, you must have an AAD P1 license at least.
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview#license-requirements
When configuring an privileged access review what are the three available settings when an assigned reviewer does not complete the review before the configured review ends?
A. Do nothing
B. Take recommendations
C. Remove Access
D. Approve Access
E. Prompt owner
B. Take recommendations
C. Remove Access
D. Approve Access
Explanation:
Do nothing - not an option
Take recommendations - use the PIM access review recommended action
Remove Access - revoke all access to the role
Approve Access - approve all existing access to the role
https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review#upon-completion-settings
