Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 101:

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the virtual machines shown in the following table.

  

  On NIC1, you configure an application security group named ASG1.

  On which other network interfaces can you configure ASG1?

  A. NIC2 only
  B. NIC2, NIC3, NIC4, and NIC5
  C. NIC2 and NIC3 only
  D. NIC2, NIC3, and NIC4 only
  C. NIC2 and NIC3 only

  ---

  Explanation

  Only network interfaces in NVET1, which consists of Subnet11 and Subnet12, can be configured in ASG1, as all network interfaces assigned to an application security group have to exist in the same virtual network that the first network interface assigned to the application security group is in.

  https://azure.microsoft.com/es-es/blog/applicationsecuritygroups/

• Question 102:

  DRAG DROP

  You need to configure an access review. The review will be assigned to a new collection of reviews and reviewed by resource owners.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create an access review program

  Step 2: Create an access review control

  Step 3: Set Reviewers to Group owners

  In the Reviewers section, select either one or more people to review all the users in scope. Or you can select to have the members review their own access. If the resource is a group, you can ask the group owners to review.

  

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

  https://docs.microsoft.com/en-us/azure/active-directory/governance/manage-programs-controls

• Question 103:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Security Center for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create an initiative and an assignment that is scoped to the Tenant Root Group management group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/governance/policy/overview

  https://4sysops.com/archives/apply-governance-policy-to-multiple-azure-subscriptions-with-management-groups/

• Question 104:

  HOTSPOT

  You are configuring just in time (JIT) VM access to a set of Azure virtual machines.

  You need to grant users PowerShell access to the virtual machine by using JIT VM access.

  What should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/security-center/just-in-time-explained#what-permissions-are-needed-to-configure-and-use-jit

• Question 105:

  You have an Azure subscription that contains an Azure Blob storage account bolb1.

  You need to configure attribute-based access control (ABAC) for blob1.

  Which attributes can you use in access conditions?

  A. blob index tags only
  B. blob index tags and container names only
  C. file extensions and container names only
  D. blob index tags, file extensions, and container names
  B. blob index tags and container names only

  ---

  Explanation

  https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-overview

• Question 106:

  HOTSPOT

  You have an Azure subscription that is linked to a Microsoft Entra tenant. The tenant uses Microsoft Entra ID Protection.

  You have 2,000 users that are each assigned a Microsoft Entra ID P2 license.

  You plan to use Azure Monitor to generate an alert when a workload identity that is using leaked credentials is detected.

  You need to configure the Diagnostic setting to support the planned alert. The solution must minimize administrative effort.

  Which log category should you collect, and to

  which destination should you send the logs? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 107:

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You are configuring Microsoft Defender for Servers.

  You plan to enable adaptive application controls to create an allowlist of known-safe apps on the virtual machines.

  Which virtual machines support the use of adaptive application controls?

  A. VM1 and VM2 only
  B. VM2 and VM4 only
  C. VM2 and VM3 only
  D. VM1, VM2, VM3, and VM4
  D. VM1, VM2, VM3, and VM4

• Question 108:

  Your network contains an Active Directory forest named contoso.com. You have an Azure Directory (Azure AD) tenant named contoso.com.

  You plan to configure synchronization by using the Express Settings installation option in Azure AD Connect.

  You need to identify which roles and groups are required to perform the planned configuration. The solution must use the principle of least privilege.

  Which two roles and groups should you identify? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. the Domain Admins group in Active Directory
  B. the Security administrator role in Azure AD
  C. the Global administrator role in Azure AD
  D. the User administrator role in Azure AD
  E. the Enterprise Admins group in Active Directory
  C. the Global administrator role in Azure AD
  E. the Enterprise Admins group in Active Directory

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions

• Question 109:

  HOTSPOT

  You plan to implement an Azure function named Function1 that will create new storage accounts for containerized application instances.

  You need to grant Function1 the minimum required privileges to create the storage accounts. The solution must minimize administrative effort.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/howto-assign-access-portal

• Question 110:

  You have an Azure subscription.

  You plan to create a custom role-based access control (RBAC) role that will provide permission to read the Azure Storage account.

  Which property of the RBAC role definition should you configure?

  A. NotActions []
  B. DataActions []
  C. AssignableScopes []
  D. Actions []
  D. Actions []

  ---

  Explanation

  To `Read a storage account', ie. list the blobs in the storage account, you need an `Action' permission. To read the data in a storage account, ie. open a blob, you need a `DataAction' permission.

  https://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions