Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 141:

  You have an Azure Active Directory (Azure AD) tenant that contains a user named Admin1. Admin1 is assigned the Application developer role.

  You purchase a cloud app named App1 and register App1 in Azure AD.

  Admin1 reports that the option to enable token encryption for App1 is unavailable.

  You need to ensure that Admin1 can enable token encryption for App1 in the Azure portal.

  What should you do?

  A. Upload a certificate for App1.
  B. Modify the API permissions of App1.
  C. Add App1 as an enterprise application.
  D. Assign Admin1 the Cloud application administrator role.
  A. Upload a certificate for App1.

  ---

  Explanation

  This is a tricky one because uploading a certificate is also required. However, the question states that the Token Encryption option is unavailable. This is because the app is not added as an enterprise application. When the app is added as an enterprise application, the Token Encryption option will be available. Then you can upload the certificate.

  https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/howto-saml-token-encryption

• Question 142:

  HOTSPOT

  On Monday, you configure an email notification in Microsoft Defender for Cloud to notify user1 @contoso.com about alerts that have a severity level of Low, Medium, or High. On Tuesday, Microsoft Defender for Cloud generates the security alerts shown in the following table.

  

  How many email notifications will user1 @contoso.com receive on Tuesday? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  

  

• Question 143:

  You have an Azure subscription.

  You plan to deploy a new Conditional Access policy named CAPolicy1.

  You need to use the What if tool to evaluate how CAPolicy1 wall affect users. The solution must minimize the impact of CAPolicy1 on the users.

  To what should you set the Enable policy setting for CAPolicy1?

  A. Off
  B. On
  C. Report only
  C. Report only

  ---

  Explanation

  Report-only mode is a new Conditional Access policy state that allows administrators to evaluate the impact of Conditional Access policies before enabling them in their environment. With the release of report-only mode:

  Conditional Access policies can be enabled in report-only mode, this is not applicable with the "User Actions" scope.

  During sign-in, policies in report-only mode are evaluated but not enforced.

  Results are logged in the Conditional Access and Report-only tabs of the Sign-in log details.

  Customers with an Azure Monitor subscription can monitor the impact of their Conditional Access policies using the Conditional Access insights workbook.

  https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-report-only

• Question 144:

  DRAG DROP

  You have an Azure Sentinel workspace that has an Azure Active Directory (Azure AD) data connector.

  You are threat hunting suspicious traffic from a specific IP address.

  You need to annotate an intermediate event stored in the workspace and be able to reference the IP address when navigating through the investigation graph.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  https://docs.microsoft.com/en-us/azure/sentinel/bookmarks

• Question 145:

  You have an Azure key vault named Vault1 that stores the resources shown in following table.

  

  Which resources support the creation of a rotation policy?

  A. Key1 Only
  B. Cert1 only
  C. Key1 and Secret1 only
  D. Key1 and Cert1 only
  E. Secret1 and Cert1 only
  F. Key1, Secret1, and Cert1
  C. Key1 and Secret1 only

• Question 146:

  HOTSPOT

  You have an Azure subscription that contains a user named User1. User1 is assigned the Reader role for the subscription.

  You plan to create a custom role named Role1 and assign Role1 to User1.

  You need to ensure that User1 can create and manage application security groups by using Azure portal.

  Which two permissions should you add to Role1? To answer, select the appropriate permissions in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. Microsoft Portal

  2. Microsoft Network

  https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-services-resource-providers

• Question 147:

  You have an Azure subscription named Sub1 that contains the virtual machines shown in the following table.

  

  You need to ensure that the virtual machines in RG1 have the Remote Desktop port closed until an authorized user requests access.

  What should you configure?

  A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
  B. an application security group
  C. Azure Active Directory (Azure AD) conditional access
  D. just in time (JIT) VM access
  D. just in time (JIT) VM access

  ---

  Explanation

  Just-in-time (JIT) virtual machine (VM) access can be used to lock down inbound traffic to your Azure VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.

  Note: When just-in-time is enabled, Security Center locks down inbound traffic to your Azure VMs by creating an NSG rule. You select the ports on the VM to which inbound traffic will be locked down. These ports are controlled by the just-in- time solution.

  When a user requests access to a VM, Security Center checks that the user has Role-Based Access Control (RBAC) permissions that permit them to successfully request access to a VM. If the request is approved, Security Center automatically configures the Network Security Groups (NSGs) and Azure Firewall to allow inbound traffic to the selected ports and requested source IP addresses or ranges, for the amount of time that was specified. After the time has expired, Security Center restores the NSGs to their previous states. Those connections that are already established are not being interrupted, however.

  https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time

• Question 148:

  HOTSPOT

  You have an Azure subscription that contains the following resources:

  1. An Azure key vault

  2. An Azure SQL database named Database1

  3. Two Azure App Service web apps named AppSrv1 and AppSrv2 that are configured to use system-assigned managed identities and access Database1

  You need to implement an encryption solution for Database1 that meets the following requirements:

  1. The data in a column named Discount in Database1 must be encrypted so that only AppSrv1 can decrypt the data.

  2. AppSrv1 and AppSrv2 must be authorized by using managed identities to obtain cryptographic keys.

  How should you configure the encryption settings for Database1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell

• Question 149:

  You have an Azure subscription that contains an Azure key vault.

  You need to configure the maximum number of days for which new keys are valid. The solution must minimize administrative effort.

  What should you use?

  A. Azure Purview
  B. Key Vault properties
  C. Azure Blueprints
  D. Azure Policy
  D. Azure Policy

  ---

  Explanation

  Azure Policy example Usage Scenarios include:

  You want to improve the security posture of your company by implementing requirements around minimum key sizes and maximum validity periods of certificates in your company's key vaults but you don't know which teams will be compliant and which are not.

  Note: Azure Policy is a governance tool that gives users the ability to audit and manage their Azure environment at scale. Azure Policy provides the ability to place guardrails on Azure resources to ensure they are compliant with assigned policy rules. It allows users to perform audit, real-time enforcement, and remediation of their Azure environment. The results of audits performed by policy will be available to users in a compliance dashboard where they will be able to see a drill down of which resources and components are compliant and which are not.

  https://docs.microsoft.com/en-us/azure/key-vault/general/azure-policy

• Question 150:

  SIMULATION

  You need to prevent administrative users from accidentally deleting a virtual network named VNET1. The administrative users must be allowed to modify the settings of VNET1.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Locking prevents other users in your organization from accidentally deleting or modifying critical resources, such as Azure subscription, resource group, or resource.

  Note: In Azure, the term resource refers to an entity managed by Azure. For example, virtual machines, virtual networks, and storage accounts are all referred to as Azure resources.

  1. In the Settings blade for virtual network VNET, select Locks.

  

  2.To add a lock, select Add.

  

  3. For Lock type select Delete lock, and click OK

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources