• For a full set of 700+ questions. Go to https://skillcertpro.com/product/microsoft-azure-security-technologies-az-500-practice-exam-set/ • SkillCertPro offers detailed explanations to each question which helps to understand the concepts better. • It is recommended to score above 85% in SkillCertPro exams before attempting a real exam. • SkillCertPro updates exam questions every 2 weeks. • You will get life time access and life time free updates • SkillCertPro assures 100% pass guarantee in first attempt.

1. Microsoft Azure Security Technologies (AZ-500) Exam Dumps 2023
Microsoft Azure Security Technologies (AZ-500) Practice Tests 2023. Contains 700+ exam
questions to pass the exam in first attempt.
SkillCertPro offers real exam questions for practice for all major IT certifications.
 For a full set of 700+ questions. Go to
https://skillcertpro.com/product/microsoft-azure-security-technologies-az-
500-practice-exam-set/
 SkillCertPro offers detailed explanations to each question which helps to
understand the concepts better.
 It is recommended to score above 85% in SkillCertPro exams before attempting
a real exam.
 SkillCertPro updates exam questions every 2 weeks.
 You will get life time access and life time free updates
 SkillCertPro assures 100% pass guarantee in first attempt.
Below are the free 10 sample questions.
Question 1:
How can you assign multiple built-in roles to a user in Azure?
A. By assigning each role individually to the user
B. By creating a custom role that combines the desired built-in roles
C. By assigning a role group that includes the desired built-in roles to the user
D. By assigning a built-in role to a security group and adding the user to that
group
Answer: B
Explanation:
By creating a custom role that combines the desired built-in roles. Explanation:
While option A is technically correct, it can be time-consuming and inefficient to
assign each role individually to a user. Option B allows for the creation of a

2. custom role that combines the desired built-in roles, making it easier to assign
multiple roles to a user with just one assignment. Option C is incorrect because
role groups are used to assign multiple users to a role, not multiple roles to a
user. Option D is also incorrect because it involves assigning a role to a security
group, which may not be necessary or appropriate for the situation.
Question 2:
Which option allows you to delegate group management tasks to specific users or
groups in Azure AD?
A. Azure AD dynamic groups
B. Azure AD self-service group management
C. Azure AD Privileged Identity Management (PIM)
D. Azure AD B2B collaboration
Answer: C
Explanation:
Azure AD Privileged Identity Management (PIM) Explanation: Azure AD Privileged
Identity Management (PIM) allows you to delegate group management tasks to
specific users or groups. PIM provides just-in-time privileged access to Azure AD
and Azure resources, including the ability to manage groups. With PIM, you can
assign roles to users or groups, and those roles can include the ability to manage
groups. This allows you to delegate group management tasks to specific users or
groups, while still maintaining control over who has access to those tasks. PIM
also provides auditing and reporting capabilities, so you can track who has
performed group management tasks and when they were performed. A. Azure AD
dynamic groups Explanation: Azure AD dynamic groups allow you to automatically
add or remove users from a group based on certain criteria, such as job title or
department. While dynamic groups can be useful for managing access to
resources, they do not allow you to delegate group management tasks to specific
users or groups. B. Azure AD self-service group management Explanation: Azure

3. AD self-service group management allows users to create and manage their own
groups, without requiring administrator intervention. While this can be useful for
reducing administrative overhead, it does not allow you to delegate group
management tasks to specific users or groups. D. Azure AD B2B collaboration
Explanation: Azure AD B2B collaboration allows you to invite external users to
collaborate with your organization, but it does not provide any group
management capabilities.
Question 3:
What is the purpose of access reviews in Azure Identity Governance?
A. To validate user access to Azure resources and ensure compliance with
security policies
B. To automate the provisioning and deprovisioning of user roles in Azure
C. To enforce password policies and multi-factor authentication for user accounts
D. To manage user permissions within a specific Azure AD tenant
Answer: A
Explanation:
To validate user access to Azure resources and ensure compliance with security
policies. This proposition is correct because access reviews in Azure Identity
Governance are used to validate user access to Azure resources and ensure
compliance with security policies. Access reviews allow administrators to review
and approve or revoke access to resources based on the user‘s role and
responsibilities. This helps to ensure that users only have access to the resources
they need to perform their job functions and that access is granted in accordance
with security policies. B. To automate the provisioning and deprovisioning of user
roles in Azure. This proposition is incorrect because the purpose of access reviews
in Azure Identity Governance is not to automate the provisioning and
deprovisioning of user roles in Azure. While access reviews can help to ensure
that users have the appropriate access to resources, they do not automate the

4. process of provisioning or deprovisioning user roles. C. To enforce password
policies and multi-factor authentication for user accounts. This proposition is
incorrect because the purpose of access reviews in Azure Identity Governance is
not to enforce password policies and multi-factor authentication for user
accounts. While these are important security measures, they are not directly
related to access reviews. D. To manage user permissions within a specific Azure
AD tenant. This proposition is incorrect because the purpose of access reviews in
Azure Identity Governance is not to manage user permissions within a specific
Azure AD tenant. While access reviews can help to ensure that users have the
appropriate access to resources, they do not directly manage user permissions
within an Azure AD tenant.
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-
vpngateways
Question 4:
Your company plans to create separate subscriptions for each department. Each
subscription will be associated to the same Azure Active Directory (Azure AD)
tenant. You need to configure each subscription to have the same role
assignments. What should you use?
A. Azure Security Center
B. Azure Policy
C. Azure AD Privileged Identity Management (PIM)
D. Azure Blueprints
Answer: D
Explanation:
Just as a blueprint allows an engineer or an architect to sketch a project‘s design
parameters, Azure Blueprints enables cloud architects and central information
technology groups to define a repeatable set of Azure resources that implements
and adheres to an organization‘s standards, patterns, and requirements.

5. Blueprints are a declarative way to orchestrate the deployment of various
resource templates and other artifacts such as: ✑ Role Assignments ✑ Policy
Assignments ✑ Azure Resource Manager templates ✑ Resource Groups
Reference: https://docs.microsoft.com/en-
us/azure/governance/blueprints/overview
Question 5:
What are the two components required to implement Azure AD Password
Protection?
A. Password Protection Proxy and Password Protection DC Agent
B. Password Protection Connector and Password Protection Agent
C. Password Protection Server and Password Protection Connector
D. Password Protection Agent and Password Protection Cloud Service
Answer: B
Explanation:
Password Protection Connector and Password Protection Agent Explanation:
Azure AD Password Protection is a feature that helps to prevent weak passwords
from being used in an organization. To implement this feature, two components
are required: Password Protection Connector and Password Protection Agent. The
Password Protection Connector is responsible for connecting the on-premises
Active Directory environment to the Azure AD Password Protection service. The
Password Protection Agent is responsible for enforcing the password policies that
are defined in the Azure AD Password Protection service. Together, these two
components work to ensure that strong passwords are used in an organization. A.
Password Protection Proxy and Password Protection DC Agent Explanation: This
proposition is incorrect because it mentions Password Protection Proxy, which is
not a component required for implementing Azure AD Password Protection. The
correct component is Password Protection Connector. The Password Protection

6. DC Agent is a valid component, but it is only one of the two required components.
C. Password Protection Server and Password Protection Connector Explanation:
This proposition is incorrect because it mentions Password Protection Server,
which is not a component required for implementing Azure AD Password
Protection. The correct component is Password Protection Agent. D. Password
Protection Agent and Password Protection Cloud Service Explanation: This
proposition is incorrect because it mentions Password Protection Cloud Service,
which is not a component required for implementing Azure AD Password
Protection. The correct component is Password Protection Connector. The
Password Protection Agent is a valid component, but it is only one of the two
required components.
 For a full set of 700+ questions. Go to
https://skillcertpro.com/product/microsoft-azure-security-technologies-az-
500-practice-exam-set/
 SkillCertPro offers detailed explanations to each question which helps to
understand the concepts better.
 It is recommended to score above 85% in SkillCertPro exams before attempting
a real exam.
 SkillCertPro updates exam questions every 2 weeks.
 You will get life time access and life time free updates
 SkillCertPro assures 100% pass guarantee in first attempt.
Question 6:
Your company has an Azure subscription that includes two virtual machines,
named VirMac1 and VirMac2, which both have a status of Stopped
(Deallocated).The virtual machines belong to different resource groups, named
ResGroup1 and ResGroup2.You have also created two Azure policies that are both
configured with the virtualMachines resource type. The policy configured for
ResGroup1 has a policy definition of not allowed resource types, while the policy
configured for ResGroup2 has a policy definition of Allowed resource types. You
then create a Read-only resource lock on VirMac1, as well as a Read-only resource
lock on ResGroup2.Which of the following is TRUE with regards to the scenario?
(Choose all that apply.)

7. A. You will be able to start VirMac1.
B. You will NOT be able to start VirMac1.
C. You will be able to create a virtual machine in ResGroup2.
D. You will NOT be able to create a virtual machine in ResGroup2.
Answer: B, D
Explanation:
Answer is B and D Allowed Resource Type (Deny): Defines the resource types that
you can deploy. Its effect is to deny all resources that aren‘t part of this defined
list. https://docs.microsoft.com/en-us/azure/governance/policy/overview
“ReadOnly means authorized users can read a resource, but they can‘t delete or
update the resource. Applying this lock is similar to restricting all authorized users
to the permissions granted by the Reader role“ “A read-only lock on a resource
group that contains a virtual machine prevents all users from starting or restarting
the virtual machine. These operations require a POST request.
“https://docs.microsoft.com/en-us/azure/governance/policy/overview
Question 7:
Which feature in Azure AD Identity Protection allows you to monitor and
investigate risky sign-in activities?
A. User risk policy
B. Identity protection reports
C. Risky sign-ins
D. Risk events
Answer: C
Explanation:

8. Risky sign-ins Explanation: Azure AD Identity Protection provides the feature of
monitoring and investigating risky sign-in activities. This feature allows
administrators to view a list of sign-in activities that are considered risky based on
various factors such as location, device, and user behavior. By monitoring these
risky sign-ins, administrators can take appropriate actions to prevent
unauthorized access to their organization‘s resources. The other options, such as
user risk policy, identity protection reports, and risk events, are also important
features of Azure AD Identity Protection, but they do not specifically address the
monitoring and investigation of risky sign-in activities.
Question 8:
What is the difference between delegated permissions and application
permissions in app registration permission scopes?
A. Delegated permissions allow an application to act on behalf of a user, while
application permissions allow an application to act independently
B. Delegated permissions can only be granted by an administrator, while
application permissions can be granted by users themselves
C. Delegated permissions are specific to web applications, while application
permissions are specific to native applications
D. Delegated permissions provide read-only access to resources, while
application permissions provide read and write access
Answer: A
Explanation:
Delegated permissions allow an application to act on behalf of a user, while
application permissions allow an application to act independently. This
proposition is correct. Delegated permissions are permissions that are granted to
an application to perform actions on behalf of a user. This means that the
application can access resources and perform actions that the user has authorized
it to do. On the other hand, application permissions are permissions that are

9. granted to an application to perform actions independently, without the need for
user authorization. This means that the application can access resources and
perform actions without any user intervention. The main difference between the
two is that delegated permissions require user authorization, while application
permissions do not. B. Delegated permissions can only be granted by an
administrator, while application permissions can be granted by users themselves.
This proposition is incorrect. Both delegated permissions and application
permissions can be granted by administrators or users themselves, depending on
the configuration of the application. The main difference between the two is the
type of permissions that are granted, not who grants them. C. Delegated
permissions are specific to web applications, while application permissions are
specific to native applications. This proposition is incorrect. Both delegated
permissions and application permissions can be used in both web and native
applications. The type of application does not determine the type of permissions
that are used. D. Delegated permissions provide read-only access to resources,
while application permissions provide read and write access. This proposition is
incorrect. Both delegated permissions and application permissions can provide
read-only or read and write access to resources https://docs.microsoft.com/en-
us/azure/traffic-manager/traffic-manager-routing-methods
Question 9:
What are the different types of consent available for app registrations in Azure
AD?
A. Admin consent and user consent
B. Read-only consent and read-write consent
C. Implicit consent and explicit consent
D. App-level consent and user-level consent
Answer: A
Explanation:

10. Admin consent and user consent are the correct types of consent available for
app registrations in Azure AD. Explanation: Admin consent is given by an
administrator of the Azure AD tenant and allows the app to access resources on
behalf of all users in the tenant. User consent is given by individual users and
allows the app to access resources on their behalf. Both types of consent are
important for ensuring that apps have the necessary permissions to function
properly while also protecting user data and privacy. B. Read-only consent and
read-write consent are not relevant to app registrations in Azure AD. These types
of consent are typically used in the context of data access and refer to the level of
access that an app has to a particular resource. C. Implicit consent and explicit
consent are not the correct types of consent available for app registrations in
Azure AD. These terms refer to the way in which consent is obtained, with implicit
consent being given through a user‘s actions (such as clicking a button) and
explicit consent being given through a separate consent dialogue or agreement.
D. App-level consent and user-level consent are not the correct types of consent
available for app registrations in Azure AD. While these terms may be used in
other contexts, they do not apply to the specific consent mechanisms used in
Azure AD.
Question 10:
Which authentication protocol is recommended for integrating Azure AD with
cloud-based SaaS applications?
A. OAuth 2.0
B. WS-Federation
C. SAML 2.0
D. Kerberos
Answer: A
Explanation:
OAuth 2.0 is the recommended authentication protocol for integrating Azure AD
with cloud-based SaaS applications. OAuth 2.0 is an open standard for

11. authorization that allows users to grant access to their resources without sharing
their credentials. It is widely used by cloud-based SaaS applications and provides a
secure and efficient way to authenticate users. Azure AD supports OAuth 2.0 and
provides a seamless integration with SaaS applications that use this protocol. B.
WS-Federation is not the recommended authentication protocol for integrating
Azure AD with cloud-based SaaS applications. WS-Federation is a web services
protocol that provides a way to establish trust between different security
domains. It is not widely used by cloud-based SaaS applications and is not as
efficient as OAuth 2.0 for authentication purposes. C. SAML 2.0 is not the
recommended authentication protocol for integrating Azure AD with cloud-based
SaaS applications. SAML 2.0 is an XML-based protocol for exchanging
authentication and authorization data between parties. It is widely used by
enterprise applications but is not as efficient as OAuth 2.0 for cloud-based SaaS
applications. D. Kerberos is not the recommended authentication protocol for
integrating Azure AD with cloud-based SaaS applications. Kerberos is a network
authentication protocol that provides a way to authenticate users and services in
a network environment. It is not widely used by cloud-based SaaS applications
and is not as efficient as OAuth 2.0 for authentication purposes.
 For a full set of 700+ questions. Go to
https://skillcertpro.com/product/microsoft-azure-security-technologies-az-
500-practice-exam-set/
 SkillCertPro offers detailed explanations to each question which helps to
understand the concepts better.
 It is recommended to score above 85% in SkillCertPro exams before attempting
a real exam.
 SkillCertPro updates exam questions every 2 weeks.
 You will get life time access and life time free updates
 SkillCertPro assures 100% pass guarantee in first attempt.