Microsoft AZ-500 Flashcards

Recently, your business started an Azure subscription. You are responsible for ensuring that a particular user may utilize Azure AD Privileged Identity Management (PIM). Which of the following roles should you provide the user?

Answer: The Global administrator role.

To manage Azure AD Privileged Identity Management (PIM), a user requires the highest level of administrative permissions. The Global Administrator role is the most powerful role in Azure AD, granting comprehensive control over all administrative features, including the ability to configure and administer PIM. Other roles listed do not possess the necessary broad permissions for full PIM management.

Your business has an Active Directory forest with just the weylandindustries.com domain. Additionally, they have a tenant with the same name in Azure Active Directory (Azure AD). The integration of Active Directory with the Azure AD tenancy is your responsibility. You want to introduce Azure AD Connect. Your integration approach must ensure that user accounts that are synchronized to the Azure AD tenant are affected by password rules and user login limitations, and that the number of required servers is kept to a minimum. You suggest using seamless SSO with password hash synchronization and pass-through authentication. Is the aim being met by the solution?

Answer: No

The proposed solution combines Password Hash Synchronization (PHS) with Pass-through Authentication (PTA), which are mutually exclusive authentication methods in Azure AD Connect. You cannot use both simultaneously for the same users. This technical incompatibility means the solution is unfeasible and therefore fails to meet the stated integration aim.

Your business has an Active Directory forest with just the weylandindustries.com domain. Additionally, they have a tenant with the same name in Azure Active Directory (Azure AD). The integration of Active Directory with the Azure AD tenancy is your responsibility. You want to introduce Azure AD Connect. Your integration approach must ensure that user accounts that are synchronized to the Azure AD tenant are affected by password rules and user login limitations, and that the number of required servers is kept to a minimum. You suggest using Active Directory Federation Services (AD FS) for federation as a solution. Is the aim being met by the solution?

Answer: No

While Active Directory Federation Services (AD FS) can ensure on-premises password rules and login limitations apply, it requires a substantial infrastructure of multiple servers (AD FS servers and Web Application Proxy servers). This directly contradicts the requirement to keep the number of required servers to a minimum. Thus, AD FS does not meet all the specified aims.

Your business has an Active Directory forest with just the weylandindustries.com domain. Additionally, they have a tenant with the same name in Azure Active Directory (Azure AD). The integration of Active Directory with the Azure AD tenancy is your responsibility. You want to introduce Azure AD Connect. Your integration approach must ensure that user accounts that are synchronized to the Azure AD tenant are affected by password rules and user login limitations, and that the number of required servers is kept to a minimum. You suggest using seamless SSO and password hash synchronization as a fix. Is the aim being met by the solution?

Answer: Yes

Password Hash Synchronization (PHS) ensures that on-premises password rules and login limitations are enforced for synchronized user accounts, as their password hashes are synced from on-premises AD. Combined with seamless SSO, this solution provides a good user experience and minimizes server count, as it primarily relies on Azure AD Connect without additional infrastructure like AD FS. This combination effectively meets all the specified requirements.

Your business has an Active Directory forest with just the weylandindustries.com domain. Additionally, they have a tenant with the same name in Azure Active Directory (Azure AD). You are informed that users with a givenName attribute commencing with LAB should not be permitted to sync to Azure AD once all on-premises identities have been synced to it. Cloud AD. Which of the subsequent actions ought you to perform?

Answer: You should make use of the Synchronization Rules Editor to create an attribute-based filtering rule.

To prevent specific users from synchronizing to Azure AD based on an attribute like 'givenName', you must configure filtering within Azure AD Connect. The Synchronization Rules Editor is the dedicated tool used to create or modify inbound and outbound synchronization rules, allowing you to define attribute-based filtering criteria to control which objects are synchronized. Firewall rules or Active Directory Users and Computers are not designed for this purpose.

You are responsible for implementing conditional access restrictions for the current Azure Active Directory (Azure AD) of your firm. Assessing risk occurrences and risk levels is a step in the process. Which of the following should be specified as the risk level for users whose credentials have been compromised?

Answer: High

Compromised credentials represent a critical security vulnerability, as they can lead to unauthorized access and data breaches. In Azure AD Identity Protection, this scenario is classified as a 'High' risk level. Conditional Access policies can then be configured to respond to high-risk users by blocking access or requiring strong authentication like MFA, thereby protecting the environment.

You have been tasked with setting up an access review that will be added to a fresh group of reviews. Additionally, you must guarantee that resource owners may see the reviews. You begin by developing an access review program and control. The Reviewers need to be configured immediately. Which option should you choose for Reviewers?

Answer: Group Owners.

To ensure that resource owners can oversee and manage access reviews for their resources, selecting 'Group Owners' as the Reviewers is the appropriate choice. This option automatically designates the owners of the group, who are typically the resource owners, as the individuals responsible for reviewing access. This approach aligns with the principle of least privilege and delegates review responsibility to those most knowledgeable about who should have access.