Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 171:

  You are securing access to the resources in an Azure subscription.

  A new company policy states that all the Azure virtual machines in the subscription must use managed disks.

  You need to prevent users from creating virtual machines that use unmanaged disks.

  What should you use?

  A. Azure Monitor
  B. Azure Policy
  C. Azure Security Center
  D. Azure Service Health
  B. Azure Policy

• Question 172:

  DRAG DROP

  You have an on-premises datacenter.

  You have an Azure subscription that contains a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. VNet1 is connected to the on-premises datacenter by using a Site-to-Site (S2S) VPN.

  You plan to create an Azure storage account named storage1 and deploy an Azure web app named App1.

  You need to ensure that network communication to each resource meets the following requirements:

  1. Connections to App1 must be allowed only from corporate network NAT addresses.

  2. Connections from VNet1 to storage1 must use the Microsoft backbone network.

  3. The solution must minimize costs.

  What should you configure for each resource? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 173:

  You have an Azure subscription that contains the resources shown in the following table.

  

  App1 uses Function 1, SQL1, and storage 1.

  You need to secure the traffic between App1, Function1, SQL1. and storage1, by using private endpoints.

  With which resources can App1 communicate by using a private endpoint?

  A. SQL1 only
  B. storage1 only
  C. Function1 only
  D. SQL1 and storage1 only
  E. storage1 and Function1 only
  F. storage1, SQL1, and Function1
  F. storage1, SQL1, and Function1

• Question 174:

  You have an Azure subscription that contains an Azure SQL database named SQL1. SQL1 contains the columns shown in the following table.

  

  You configure SQL! to use Always Encrypted.

  You need to configure deterministic encryption.

  Which column supports deterministic encryption?

  A. Column1
  B. Column2
  C. Column3
  D. Column4
  B. Column2

• Question 175:

  HOTSPOT

  You have an Azure Subscription that is linked to an Azure Active Directory (Azure AD). The tenant contains the users shown in the following table.

  

  You have an Azure key vault named Vault1 that has Purge protection set to Disabled. Vault1 contains the access policies shown in the following table.

  

  You create role assignments for Vault1 as shown in the following table.

  

  For each of the following statements, Yes if the statement is true, Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 176:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable Azure Storage Analytics logs and archive it to a storage account.

  What should you use to retrieve the diagnostics logs?

  A. Azure Cosmos DB explorer
  B. Azure Monitor
  C. AzCopy
  D. Microsoft Defender for Cloud
  C. AzCopy

  ---

  Explanation

  Azure Storage analytics logging

  How logs are stored

  All logs are stored in block blobs in a container named $logs, which is automatically created when Storage Analytics is enabled for a storage account. The $logs container is located in the blob namespace of the storage account, for example:

  http://<accountname>.blob.core.windows.net/$logs.

  This container cannot be deleted once Storage Analytics has been enabled, though its contents can be deleted. If you use your storage-browsing tool to navigate to the container directly, you will see all the blobs that contain your logging data.

  Most storage browsing tools enable you to view the metadata of blobs; you can also read this information using PowerShell or programmatically.

  AzCopy is a command-line tool that moves data into and out of Azure Storage. See the Get started with AzCopy article to download AzCopy and learn about the ways that you can provide authorization credentials to the storage service.

  Incorrect:

  Not B: Would have to choose to use Azure Monitor instead of Storage Analytics logs We recommend that you use Azure Storage logs in Azure Monitor instead of Storage Analytics logs.

  https://learn.microsoft.com/en-us/azure/storage/common/storage-analytics-logging

  https://learn.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy

• Question 177:

  SIMULATION

  You need to create a new Azure Active Directory (Azure AD) directory named 10317806.onmicrosoft.com. The new directory must contain a user named user10317806 who is configured to sign in by using Azure Multi-Factor Authentication (MFA).

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  To create a new Azure AD tenant:

  1. Browse to the Azure portal and sign in with an account that has an Azure subscription.

  2. Select the plus icon (+) and search for Azure Active Directory.

  

  3. Select Azure Active Directory in the search results.

  

  4. Select Create.

  5. Provide an Organization name (10317806) and an Initial domain name (10317806). Then select Create. This will create the directory named 10317806.onmicrosoft.com.

  

  6. After directory creation is complete, select the information box to manage your new directory.

  To create the user:

  1. In the Azure portal, make sure you are on the Azure Active Directory fly out.

  

  If not, select the Azure Active Directory icon from the left services navigation.

  

  2. Under Manage, select Users.

  

  3. Select All users and then select + New user.

  4. Provide a Name and User name (user10317806) for the user. When you're done, select Create.

  To enable MFA:

  1. In the Azure portal, make sure you are on the Azure Active Directory fly out.

  

  If not, select the Azure Active Directory icon from the left services navigation.

  

  2. Under Manage, select Users.

  

  3. Click on the Multi-Factor Authentication link.

  4. Tick the checkbox next to the user's name and click the Enable link.

  https://docs.microsoft.com/en-us/power-bi/developer/create-an-azure-active-directory-tenant

• Question 178:

  You have an Azure subscription that contains a managed identity named Identity1 and the Azure key vaults shown in the following table.

  

  KeyVault1 contains an access policy that grants Identity1 the following key permissions:

  Get

  List

  Wrap

  Unwrap

  You need to provide Identity1 with the same permissions for KeyVault2. The solution must use the principle of least privilege.

  Which role should you assign to Identity1?

  A. Key Vault Crypto Service Encryption User
  B. Key Vault Crypto User
  C. Key Vault Reader
  D. Key Vault Crypto Officer
  D. Key Vault Crypto Officer

  ---

  Explanation

  Key Vault Crypto Officer - Perform any action on the keys of a key vault, except manage permissions. Only works for key vaults that use the 'Azure role-based access control' permission model.

  Incorrect:

  Key Vault Crypto Service Encryption User

  Read metadata of keys and perform wrap/unwrap operations. Only works for key vaults that use the 'Azure role-based access control' permission model.

  Key Vault Crypto User

  Perform cryptographic operations using keys. Only works for key vaults that use the 'Azure role-based access control' permission model.

  Key Vault Reader

  Read metadata of key vaults and its certificates, keys, and secrets. Cannot read sensitive values such as secret contents or key material. Only works for key vaults that use the 'Azure role-based access control' permission model.

  https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide

• Question 179:

  HOTSPOT

  You have an Azure subscription that contains the storage accounts shown in the following table.

  

  You need to create private endpoints for the target sub-resources of the storage accounts. The solution must ensure that all the target sub-resources can be accessed by using a private endpoint.

  What is the minimum number of private endpoints you should create for each storage account? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 180:

  You have an Azure subscription that is linked to an Azure AD tenant and contains the resources shown in the following table.

  

  Which resources can be assigned the Contributor role for VM1?

  A. Managed1 and App1 only
  B. Group1 and Managed1 only
  C. Group1, Managed1, and VM2 only
  D. Group1, Managed1, VM1, and App1 only
  A. Managed1 and App1 only

  ---

  Explanation

  Security principal

  A security principal is an object that represents a user, group, service principal, or managed identity that is requesting access to Azure resources. You can assign a role to any of these security principals.

  * Managed1 - OK

  The scope for managed identities is at the Subscription level.

  * App1 - OK

  What can I do with Azure RBAC?

  Here are some examples of what you can do with Azure RBAC: Allow an application to access all resources in a resource group Etc.

  * Group1 - Not OK

  Not a dynamic device group.

  Dynamic group membership adds and removes group members automatically using membership rules based on member attributes.

  VM1, VM2 - Not OK

  Not a virtual machine.

  https://learn.microsoft.com/en-us/azure/role-based-access-control/overview