Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 111:

  SIMULATION

  You need to create a new Azure Active Directory (Azure AD) directory named 11641655.onmicrosoft.com and a user named User1 in the new directory. The solution must ensure that User1 is enabled for Azure Multi-Factor Authentication (MFA).

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Step 1: Create an Azure Active Directory tenant 1. Browse to the Azure portal and sign in with an account that has an Azure subscription.

  2. Select the plus icon (+) and search for Azure Active Directory.

  

  3. Select Azure Active Directory in the search results.

  

  4. Select Create.

  5. Provide an Organization name and an Initial domain name (10598168). Then select Create. Your directory is created.

  

  6. After directory creation is complete, select the information box to manage your new directory.

  Next, you're going to add tenant users.

  Step 2: Create an Azure Active Directory tenant user 7. In the Azure portal, make sure you are on the Azure Active Directory fly out.

  

  8. Under Manage, select Users.

  

  9. Select All users and then select + New user.

  10. Provide a Name and User name (user1) for the regular user tenant You can also show the temporary password. When you're done, select Create.

  Name: user1

  User name: [email protected]

  

  https://docs.microsoft.com/en-us/power-bi/developer/create-an-azure-active-directory-tenant

• Question 112:

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a single subnet. The subscription contains a virtual machine named VM1 that is connected to VNet1.

  You plan to deploy an Azure SQL managed instance named SQL1.

  You need to ensure that VM1 can access SQL1.

  Which three components should you create? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a subnet
  B. a network security perimeter
  C. a virtual network gateway
  D. a network security group (NSG)
  E. a route table
  A. a subnet
  D. a network security group (NSG)
  E. a route table

• Question 113:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  From Azure AD Privileged Identity Management (PIM), you configure the settings for the Security Administrator role as shown in the following exhibit.

  

  From PIM, you assign the Security Administrator role to the following groups:

  1. Group1: Active assignment type, permanently assigned

  2. Group2: Eligible assignment type, permanently eligible

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Eligible Type: A role assignment that requires a user to perform one or more actions to use the role. If a user has been made eligible for a role, that means they can activate the role when they need to perform privileged tasks. There's no difference in the access given to someone with a permanent versus an eligible role assignment. The only difference is that some people don't need that access all the time.

  You can choose from two assignment duration options for each assignment type (eligible and active) when you configure settings for a role. These options become the default maximum duration when a user is assigned to the role in Privileged Identity Management.

  Use the Activation maximum duration slider to set the maximum time, in hours, that a role stays active before it expires. This value can be from one to 24 hours.

  Box 2: Yes

  Active Type: A role assignment that doesn't require a user to perform any action to use the role. Users assigned as active have the privileges assigned to the role

  Box 3: Yes

  User3 is member of Group2.

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

  https://docs.microsoft.com/bs-cyrl-ba/azure/active-directory/privileged-identity-management/pim-resource-roles-configure-role-settings

• Question 114:

  You have an Azure subscription that contains the subnets shown in the following table.

  

  The subscription contains Azure web app named WebApp1 that has the following configurations:

  1. Region West Us

  2. Virtual network VNet1

  3. VNet integration on: Enabled

  4. Outbound subnet: Subnet11

  5. Windows plan (West US): ASP1

  You plan to deploy an Azure web app named WebApp2 that will have the following settings:

  1. Region: West US

  2. VNet integration on-Enabled

  3. Windows plan (West UAS): WebApp2?

  To which subnets can you integrate WebApp2?

  A. Subnet11 only
  B. Subnet2 only
  C. Subnet11 or subnet12 only
  D. Subnet2 or Subnet21 only
  E. Subnet11, subnet2, or Subnet21
  D. Subnet2 or Subnet21 only

• Question 115:

  HOTSPOT

  You assign User8 the Owner role for RG4, RG5, and RG6.

  In which resource groups can User8 create virtual networks and NSGs? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: RG6 only

  The policy does not allow the creation of virtual networks/subnets in RG5. Only NSGs can be created in RG4.

  Box 2: The policy does not allow the creation of NSGs in RG5.

  

  https://docs.microsoft.com/en-us/azure/governance/policy/overview

• Question 116:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable the diagnostic logs for the storage account.

  What should you use to retrieve the diagnostics logs?

  A. Azure Security Center
  B. Azure Monitor
  C. the Security admin center
  D. Azure Storage Explorer
  D. Azure Storage Explorer

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?toc=%2fazure%2fstorage%2fblobs%2ftoc.json

• Question 117:

  DRAG DROP

  Your company has an Azure SQL database that has Always Encrypted enabled.

  You are required to make the relevant information available to application developers to allow them to access data in the database.

  Which two of the following options should be made available? Answer by dragging the correct options from the list to the answer area.

  Select and Place:

  

  

  ---

  Always Encrypted uses two types of keys: column encryption keys and column master keys. A column encryption key is used to encrypt data in an encrypted column. A column master key is a key-protecting key that encrypts one or more column encryption keys.

  https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine

• Question 118:

  You need to implement the planned change for VM1 to access storage1.

  The solution must meet the technical requirements.

  What should you do first?

  A. Configure a system-assigned managed identity on VM1.
  B. Configure federated identity credentials for ID1.
  C. Assign the Storage Blob Data Reader role to storage 1.
  D. Assign ID1 to VM1.
  E. Add a role assignment condition to storage1.
  A. Configure a system-assigned managed identity on VM1.

• Question 119:

  You have an Azure subscription name Sub1 that contains an Azure Policy definition named Policy1. Policy1 has the following settings:

  1. Definition location: Tenant Root Group

  2. Category: Monitoring

  You need to ensure that resources that are noncompliant with Policy1 are listed in the Azure Security Center dashboard.

  What should you do first?

  A. Change the Category of Policy1 to Security Center.
  B. Add Policy1 to a custom initiative.
  C. Change the Definition location of Policy1 to Sub1.
  D. Assign Policy1 to Sub1.
  B. Add Policy1 to a custom initiative.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/governance/policy/overview

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/custom-security-policies

• Question 120:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The virtual networks contain the subnets shown in the following table.