Microsoft AZ-500

No is incorrect because the requirement is to allow authentication using on-premises Active Directory credentials, which implies domain-based authentication mechanisms (for example, Kerberos/LDAP) rather than Azure AD-only sign-in. Azure AD DS is specifically designed to provide those AD DS protocols as a managed service in Azure and is a supported approach for enabling HDInsight ESP domain integration. While there are alternative implementations (such as deploying AD DS domain controllers on Azure VMs), the proposed solution can meet the goal, so answering No would wrongly assume Azure AD DS cannot satisfy the requirement.

A Key Vault access policy controls whether a user, service principal, or managed identity can read secrets from the vault. It is necessary for authorization, but it does not provide a mechanism to build or pass a resource ID into an ARM deployment. Even with the correct access policy, the deployment still needs a way to specify which vault and secret to use. Therefore, access policy is related to permissions, not dynamic construction or designation of the Key Vault resource ID.

A linked template is used to split deployments into reusable modules or separate template files. Although a linked template can accept parameters and use functions internally, it is not the standard mechanism for supplying a Key Vault secret reference for a secure parameter value. The question asks what should be used to designate the appropriate Key Vault during each deployment when names are provided as parameters, and that is typically handled through deployment parameters rather than by introducing another template. Using a linked template would add unnecessary complexity and does not directly answer the requirement.

An Automation Account can run scripts or orchestrate deployment workflows, but it is not an ARM template construct for passing Key Vault secret references. The requirement is specifically about how to designate the correct Key Vault during ARM deployments, which is handled natively through template parameters and parameter files. Automation may invoke the deployment, but it does not replace the ARM mechanism for secret resolution. As a result, it is outside the scope of the direct solution.

Incorrect. Creating a role in Azure AD does not grant an application permission to read secrets from Azure Key Vault. Key Vault secret access is controlled at the vault level through a Key Vault access policy or, in environments using the RBAC permission model, through an Azure RBAC role assignment scoped to the vault. An Azure AD role affects directory-level administration and is not how the application is authorized to use Secret1.

Incorrect. Keys and secrets are different object types in Azure Key Vault and serve different purposes. Creating a key would enable cryptographic operations, but it would not allow the application to access the existing secret named Secret1. The requirement is about granting access to a secret, not creating a new cryptographic asset.

Incorrect. Azure AD Application Proxy is used to publish internal web applications for remote access through Azure AD. It has no role in granting an application permission to read data from Azure Key Vault. Even if Application Proxy were enabled, the application would still need explicit authorization on Vault1 to access Secret1.

Yes is incorrect because new SAS tokens do not invalidate previously distributed SAS tokens. Unauthorized users who already possess valid SAS URIs can continue accessing the blob and file services until those tokens expire or their signing basis is revoked. To stop all existing SAS-based access, you must regenerate the storage account keys and/or remove or modify stored access policies used by the SAS. Therefore, the proposed action does not meet the stated goal.

Application permissions are intended for app-only access where no signed-in user is involved, such as background services or automation jobs. That does not match the requirement to access secrets on behalf of application users, because the resulting token would represent only the application identity. In addition, application permissions generally require admin consent, so the “without admin consent” part is also incorrect. This option fails on both the permission type and the consent requirement.

Although delegated permissions are the right general category for acting on behalf of users, Azure Key Vault delegated permissions are not user-consentable in the normal sense. They are admin-restricted permissions and require administrator approval in the tenant before the app can use them. Therefore, saying delegated permission without admin consent is incomplete and technically incorrect for Key Vault. This makes the current answer wrong even though it correctly identified the delegated model.

Application permissions that require admin consent are used when an app accesses resources as itself, without any signed-in user context. That is appropriate for daemon apps, scheduled tasks, or service principals, but not for a user-driven scenario. Because the question explicitly says “on behalf of the application users,” the app must not use app-only permissions. Even though admin consent is commonly required for application permissions, the permission type itself is wrong here.

Azure Security Center (now Microsoft Defender for Cloud) focuses on security posture management, recommendations, and threat protection. It can surface misconfigurations and suggest least-privilege improvements, but it does not provide a mechanism to template and automatically apply identical RBAC role assignments across multiple subscriptions. It’s primarily for monitoring and improving security, not for stamping baseline access control configurations during subscription provisioning.

Azure Policy is used to enforce and evaluate compliance by auditing, denying, or remediating resource configurations. While it is excellent for ensuring resources meet standards (tags, SKUs, encryption, allowed locations), it is not intended to create and maintain consistent RBAC role assignments across subscriptions as a baseline. Policy can’t directly define subscription RBAC assignments in the way Blueprints can.

Azure AD Privileged Identity Management (PIM) provides just-in-time activation, approval workflows, access reviews, and time-bound privileged role assignments for Azure AD roles and Azure resource roles. It improves how privileged access is managed, but it does not solve the requirement to configure multiple subscriptions to have the same initial set of role assignments. PIM governs elevation and lifecycle, not subscription-to-subscription RBAC replication.

No. This is incorrect because adding the Microsoft Antimalware VM extension is a supported and intended method to deploy antimalware to Azure IaaS virtual machines. VM extensions are specifically designed to install and configure software inside VMs post-deployment, including security tooling like antimalware. While doing it manually per VM may be operationally tedious without automation, it still achieves the stated requirement of deploying Microsoft Antimalware.

Access policies control who can access Key Vault objects, but they are not the specific Key Vault setting that ADE fundamentally uses to store the VM encryption material. The question asks which vault setting should be configured to enable ADE with backup support, and the encryption dependency is on secrets rather than on the permission model itself. While permissions are necessary operationally, they are not the best answer from the listed choices. In exam questions like this, Microsoft often distinguishes between the object type used by ADE and the authorization mechanism used to reach it.

Keys are optional in Azure Disk Encryption and are only used when you choose to implement a Key Encryption Key to wrap the BitLocker Encryption Key. ADE can be enabled successfully without configuring a KEK at all. Since the question does not state that customer-managed key wrapping is required, Keys is not the mandatory setting. Therefore, this option is too specific and not universally required for ADE with Azure Backup.

Locks are Azure resource management controls that prevent accidental deletion or modification of resources. They do not participate in the encryption workflow and have no role in storing or retrieving disk encryption material. Applying a lock to the vault would not enable Azure Disk Encryption on the VM. Locks also do not affect Azure Backup compatibility for ADE-protected virtual machines.

Azure Application Insights provides application performance monitoring (APM), logging, and telemetry for web apps. While it’s a best practice for observability and can be integrated into App Service, it is not required to configure continuous deployment from Azure Repos. You can enable CI/CD without any monitoring resources, so this is not the first thing to create.

An Azure Storage account can be used for build artifacts, diagnostics logs, deployment packages, or application data, but it is not a prerequisite for setting up continuous deployment from Azure Repos to an App Service web app. Azure DevOps can store artifacts in its own artifact storage, and App Service deployments do not require a customer-managed storage account by default.

Azure DevTest Labs is designed to create and manage dev/test environments (often VM-based), control costs, and apply policies like auto-shutdown. It is not used to host Azure Repos or to configure App Service continuous deployment. For CI/CD to an Azure Web App using Azure Repos, DevTest Labs is unrelated and not required.