Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 131:

  DRAG DROP

  You need to configure SQLDB1 to meet the data and application requirements.

  Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 132:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Security Center for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create a resource graph and an assignment that is scoped to a management group.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Management groups in Microsoft Azure solve the problem of needing to impose governance policy on more than one Azure subscription simultaneously. However, you need to use an initiative, not a resource graph to bundle the policy definitions into a group that can be applied to the management group.

  References:

  https://4sysops.com/archives/apply-governance-policy-to-multiple-azure-subscriptions-with-management-groups/

• Question 133:

  HOTSPOT

  You have the Azure Information Protection conditions shown in the following table.

  

  You have the Azure Information Protection labels shown in the following table.

  

  You need to identify how Azure Information Protection will label files.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Label 2 only

  How multiple conditions are evaluated when they apply to more than one label 1. The labels are ordered for evaluation, according to their position that you specify in the policy: The label positioned first has the lowest position (least sensitive) and the label positioned last has the highest position (most sensitive).

  2. The most sensitive label is applied.

  3. The last sublabel is applied.

  Box 2: No Label

  Automatic classification applies to Word, Excel, and PowerPoint when documents are saved, and apply to Outlook when emails are sent. Automatic classification does not apply to Microsoft Notepad.

  References:

  https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-classification

• Question 134:

  Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD). Azure AD Connect is installed on a domain member server named Server1.

  You need to ensure that a domain administrator for the adatum.com domain can modify the synchronization options. The solution must use the principle of least privilege.

  Which Azure AD role should you assign to the domain administrator?

  A. Security administrator
  B. Global administrator
  C. User administrator
  B. Global administrator

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-accounts-permissions

• Question 135:

  HOTSPOT

  You have an Azure subscription named Subcription1 that contains the resources shown in the following table.

  

  You have an Azure subscription named Subcription2 that contains the following resources:

  1. An Azure Sentinel workspace

  2. An Azure Event Grid instance

  You need to ingest the CEF messages from the NVAs to Azure Sentinel.

  NOTE: Each correct selection is worth one point.

  

  

• Question 136:

  You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

  An administrator named Admin1 has access to the following identities:

  1. An OpenID-enabled user account

  2. A Hotmail account

  3. An account in contoso.com

  4. An account in an Azure AD tenant named fabrikam.com

  You plan to use Azure Account Center to transfer the ownership of Sub1 to Admin1.

  To which accounts can you transfer the ownership of Sub1?

  A. contoso.com only
  B. contoso.com, fabrikam.com, and Hotmail only
  C. contoso.com and fabrikam.com only
  D. contoso.com, fabrikam.com, Hotmail, and OpenID-enabled user account
  C. contoso.com and fabrikam.com only

  ---

  Explanation

  When you transfer billing ownership of your subscription to an account in another Azure AD tenant, you can move the subscription to the new account's tenant. If you do so, all users, groups, or service principals who had role based access (RBAC) to manage subscriptions and its resources lose their access. Only the user in the new account who accepts your transfer request will have access to manage the resources.

  https://docs.microsoft.com/en-us/azure/billing/billing-subscription-transfer

  https://docs.microsoft.com/en-us/azure/billing/billing-subscription-transfer#transferring-subscription-to-an-account-in-another-azure-ad-tenant

• Question 137:

  SIMULATION

  You plan to use Azure Disk Encryption for several virtual machine disks.

  You need to ensure that Azure Disk Encryption can retrieve secrets from the KeyVault11641655 Azure key vault.

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  1. In the Azure portal, type Key Vaults in the search box, select Key Vaults from the search results then select KeyVault11641655. Alternatively, browse to Key Vaults in the left navigation pane.

  2. In the Key Vault properties, scroll down to the Settings section and select Access Policies.

  3. Select the Azure Disk Encryption for volume encryption

  

  4. Click Save to save the changes.

• Question 138:

  You have an Azure Active Directory (Azure AD) tenant that contains a group named Group1.

  You need to ensure that the members of Group1 sign in by using passwordless authentication.

  What should you do?

  A. Configure the sign-in risk policy.
  B. Create a Conditional Access policy.
  C. Configure the Microsoft Authenticator authentication method policy.
  D. Configure the certificate-based authentication (CBA) policy.
  C. Configure the Microsoft Authenticator authentication method policy.

• Question 139:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to use service endpoints and service endpoint policies.

  Which resources can be accessed by using a service endpoint, and which resources support service endpoint policies? To answer, select the appropriate options in the answer area.

  NOTE; Each correct selection is worth one point.

  

  

• Question 140:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a hybrid configuration of Azure Active Directory (Azure AD).

  You have an Azure HDInsight cluster on a virtual network.

  You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.

  You need to configure the environment to support the planned authentication.

  Solution: You deploy Azure Active Directory Domain Services (Azure AD DS) to the Azure subscription.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  You don't need a VPN with OnPrem to connect to HDInsights. It would be relevant if you need connection between HDInsights and onPrem servers and/or want to remove/restric public traffic.

  HDIsights can be accessed from internet no matters of the authentication method.

  https://learn.microsoft.com/en-us/azure/hdinsight/hdinsight-virtual-network-architecture

  Now you want to connects HDI with on-prem AD DS identities.

  The only supported way is to use Azure AD DS (An Azure Service, different from your onprem AD DS).

  Azure AD DS needs AD connect with PHS from On-Prem AD DS to Azure AD. You are in Hybrid config so already setup AD Connects.

  Azure AD DS is deplpoyed in a VNEt and needs to be Perred with HDInsights VNet. That's it.

  https://learn.microsoft.com/en-us/azure/hdinsight/domain-joined/apache-domain-joined-create-configure-enterprise-security-cluster