Download Microsoft.AZ-500.PremDumps.2019-07-07.56q.vcex

Incorrect Answers:A, C: You can create a dynamic group for devices or for users, but you can't create a rule that contains both users and devices.D: For assigned group you can only add individual members.Scenario: Litware identifies the following identity and access requirements: All San Francisco users and their devices must be members of Group1.The tenant currently contain this group:    References:https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membershiphttps://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal

Incorrect Answers:A, C: You can create a dynamic group for devices or for users, but you can't create a rule that contains both users and devices.D: For assigned group you can only add individual members.Scenario: Litware identifies the following identity and access requirements: All San Francisco users and their devices must be members of Group1.The tenant currently contain this group:     References:https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membershiphttps://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal

Password hash synchronization requires the least effort regarding deployment, maintenance, and infrastructure. This level of effort typically applies to organizations that only need their users to sign in to Office 365, SaaS apps, and other Azure AD-based resources. When turned on, password hash synchronization is part of the Azure AD Connect sync process and runs every two minutes. Incorrect Answers:A: A federated authentication system relies on an external trusted system to authenticate users. Some companies want to reuse their existing federated system investment with their Azure AD hybrid identity solution. The maintenance and management of the federated system falls outside the control of Azure AD. It's up to the organization by using the federated system to make sure it's deployed securely and can handle the authentication load.C: For pass-through authentication, you need one or more (we recommend three) lightweight agents installed on existing servers. These agents must have access to your on-premises Active Directory Domain Services, including your on-premises AD domain controllers. They need outbound access to the Internet and access to your domain controllers. For this reason, it's not supported to deploy the agents in a perimeter network.Pass-through Authentication requires unconstrained network access to domain controllers. All network traffic is encrypted and limited to authentication requests. References:https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

Use the Synchronization Rules Editor and write attribute-based filtering rule. References:https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration

Azure AD Identity protection can detect six types of suspicious sign-in activities:Users with leaked credentials Sign-ins from anonymous IP addresses Impossible travel to atypical locations Sign-ins from infected devices Sign-ins from IP addresses with suspicious activity Sign-ins from unfamiliar locations These six types of events are categorized in to 3 levels of risks – High, Medium & Low:    References:http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

Box 1: YesUser1 is member of Group1. Sign in from unfamiliar location is risk level Medium. Box 2: YesUser2 is member of Group1. Sign in from anonymous IP address is risk level Medium. Box 3: NoSign-ins from IP addresses with suspicious activity is low. Note:     Azure AD Identity protection can detect six types of suspicious sign-in activities:Users with leaked credentials Sign-ins from anonymous IP addresses Impossible travel to atypical locations Sign-ins from infected devices Sign-ins from IP addresses with suspicious activity Sign-ins from unfamiliar locations These six types of events are categorized in to 3 levels of risks – High, Medium & Low:References:http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

Step 1: Create an access review programStep 2: Create an access review controlStep 3: Set Reviewers to Group ownersIn the Reviewers section, select either one or more people to review all the users in scope. Or you can select to have the members review their own access. If the resource is a group, you can ask the group owners to review.      References:https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-reviewhttps://docs.microsoft.com/en-us/azure/active-directory/governance/manage-programs-controls

Box 1: User3 onlyUse the Members (self) option to have the users review their own role assignments. Box 2: User3 will receive a confirmation requestUse the Should reviewer not respond list to specify what happens for users that are not reviewed by the reviewer within the review period. This setting does not impact users who have been reviewed by the reviewers manually. If the final reviewer's decision is Deny, then the user's access will be removed. No change - Leave user's access unchanged Remove access - Remove user's access Approve access - Approve user's access Take recommendations - Take the system's recommendation on denying or approving the user's continued access References:https://docs.microsoft.com/bs-latn-ba/azure/active-directory/privileged-identity-management/pim-how-to-start-security-review

Step 1: Consent to PIM    Step: 2 Verify your identity by using multi-factor authentication (MFA)Click Verify my identity to verify your identity with Azure MFA. You'll be asked to pick an account. Step 3: Sign up PIM for Azure AD rolesOnce you have enabled PIM for your directory, you'll need to sign up PIM to manage Azure AD roles. References:https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started

Box 2: NoUse of Microsoft Authenticator is not required. Note: Microsoft Authenticator is a multifactor app for mobile devices that generates time-based codes used during the Two-Step Verification process.Box 3: NoThe New York IP address subnet is included in the "skip multi-factor authentication for request. References:https://www.cayosoft.com/difference-enabling-enforcing-mfa/