Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 1:

  HOTSPOT

  You have an Azure subscription that contains the alerts shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview

• Question 2:

  You have been tasked with applying conditional access policies for your company's current Azure Active Directory (Azure AD).

  The process involves assessing the risk events and risk levels.

  Which of the following is the risk level that should be configured for sign ins that originate from IP addresses with dubious activity?

  A. None
  B. Low
  C. Medium
  D. High
  C. Medium

  ---

  Explanation

  http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

• Question 3:

  DRAG DROP

  You have an Azure subscription that contains a resource group named RG1 and an Azure policy named Policy1.

  You need to assign Policy1 to RG1.

  How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Get-AzPolicyDefinition

  The New-AzPolicyAssignment cmdlet creates a policy assignment. Specify a policy and scope.

  Example: Policy assignment at resource group level

  $ResourceGroup = Get-AzResourceGroup -Name 'ResourceGroup11'

  $Policy = Get-AzPolicyDefinition -Name 'VirtualMachinePolicy'

  New-AzPolicyAssignment -Name 'VirtualMachinePolicyAssignment' -PolicyDefinition $Policy -Scope $ResourceGroup.ResourceId

  The first command gets a resource group named ResourceGroup11 by using the Get-AzResourceGroup cmdlet and stores it in the $ResourceGroup variable. The second command gets the policy definition named VirtualMachinePolicy by using the Get-AzPolicyDefinition cmdlet and stores it in the $Policy variable. The final command assigns the policy in $Policy at the level of the resource group identified by the ResourceId property of $ResourceGroup.

  Box 2: New-AzPolicyAssignment

  https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azpolicyassignment

• Question 4:

  You have an Azure subscription named Sub1. Sub1 contains a virtual network named VNet1 that contains one subnet named Subnet1.

  Subnet1 contains an Azure virtual machine named VM1 that runs Ubuntu Server 20.04.

  You create a service endpoint for MicrosoftStorage in Subnet1.

  You need to ensure that when you deploy Docker containers to VM1, the containers can access Azure Storage resources by using the service endpoint.

  What should you do on VM1 before you deploy the container?

  A. Create an application security group and a network security group (NSG).
  B. Edit the docker-compose.yml file.
  C. Install the container network interface (CNI) plug-in.
  C. Install the container network interface (CNI) plug-in.

  ---

  Explanation

  The Azure Virtual Network container network interface (CNI) plug-in installs in an Azure Virtual Machine. The plug-in supports both Linux and Windows platform. The plug-in assigns IP addresses from a virtual network to containers brought up in the virtual machine, attaching them to the virtual network, and connecting them directly to other containers and virtual network resources. The plug-in doesn't rely on overlay networks, or routes, for connectivity, and provides the same performance as virtual machines.

  The following picture shows how the plug-in provides Azure Virtual Network capabilities to Pods:

  

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview

• Question 5:

  HOTSPOT

  You have an Azure subscription that contains the Azure Active Directory (Azure AD) resources shown in the following table.

  

  You create the groups shown in the following table.

  

  Which resources can you add to Group5 and Group6? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 6:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1 and an Azure container registry named AZCR1.

  You need to ensure that AKS1 can deploy container images stored in AZCR1.

  Solution: You assign the AcrPush role-based access control (RBAC) role to the system- assigned managed identity of AKS1.

  Does this meet the requirement?

  A. Yes
  B. No
  B. No

• Question 7:

  SIMULATION

  You need to create a new Azure Active Directory (Azure AD) directory named 12345678.onmicrosoft.com. The new directory must contain a new user named [email protected].

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Create Azure AD directory

  To create a new tenant

  Azure Active Directory - Overview page - Create a tenant

  Step 1: Sign in to your organization's Azure portal.

  Step 2: From the Azure portal menu, select Azure Active Directory.

  Step 3: On the overview page, select Manage tenants

  Step 4: Select Create.

  

  Step 5: On the Basics tab, select the type of tenant you want to create, either Azure Active Directory or Azure Active Directory (B2C).

  Step 6:

  Select Next: Configuration to move on to the Configuration tab.

  Step 7: On the Configuration tab, enter the following information: Type your desired Organization name (for example Contoso Organization) into the Organization name box.

  Type your desired Initial domain name (We use 28681041) into the Initial domain name box.

  Select your desired Country/Region or leave the United States option in the Country or region box.

  

  Step 8:

  Select Next: Review + Create. Review the information you entered and if the information is correct, select create.

  Step 9: Your new tenant is created with the domain 28681041.onmicrosoft.com.

  Add new users or delete existing users from your Azure Active Directory (Azure AD) tenant.

  Add a new user

  You can create a new user for your organization or invite an external user from the same starting point.

  1. Sign in to the Azure portal in the User Administrator role.

  2. Navigate to Azure Active Directory > Users.

  3. Select either Create new user or Invite external user from the menu. You can change this setting on the next screen.

  

  4. On the New User page, provide the new user's information:

  Identity: [email protected]

  *Details omitted* 5. Copy the autogenerated password provided in the Password box. You'll need to give this password to the user to sign in for the first time.

  6. Select Create.

  The user is created and added to your Azure AD organization.

  https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant

  https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/add-users-azure-active-directory

• Question 8:

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You need to enable file integrity monitoring in Microsoft Defender for Cloud.

  Which computers will support file integrity monitoring?

  A. Computer2 only
  B. Computer1 and Computer2 only
  C. Computer2 and Computer3 only
  D. Computer1, Computer2, and Computer3
  D. Computer1, Computer2, and Computer3

  ---

  Explanation

  File Integrity Monitoring (FIM) examines operating system files, Windows registries, application software, and Linux system files for changes that might indicate an attack.

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview

• Question 9:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You create the Azure policies shown in the following table.

  

  You create the resource locks shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1.) cannot perform write operation because following scope(s) are locked: 'subscriptions/xxxx/resourceGroups/xxx' Please remove the lock and try again.

  2.) When creating a VM in a resource group with a Read Only lock an error is shown: "The selected resource group is read only" 3.) Because of the read only lock virtual machines cannot be started nor stopped when the lock is added after the machine started. (not part of this use case, but still good to know.

  The article referenced in the answer states different because that is scoped to blueprints.

  In the Lock Resources pages is states the following regarding starting VMs: "A ReadOnly lock on a resource group that contains a virtual machine prevents all users from starting or restarting the virtual machine. These operations require a POST request."

  References:

  https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

• Question 10:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Subscription named Sub1.

  You have an Azure Storage account named Sa1 in a resource group named RG1.

  Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.

  You discover that unauthorized users accessed both the file service and the blob service.

  You need to revoke all access to Sa1.

  Solution: You generate new SASs.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead you should create a new stored access policy.

  To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately affects all of the shared access signatures associated with it.

  References:

  https://docs.microsoft.com/en-us/rest/api/storageservices/Establishing-a-Stored-Access-Policy