Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 11:

  You have been tasked with delegate administrative access to your company's Azure key vault.

  You have to make sure that a specific user can set advanced access policies for the key vault. You also have to make sure that access is assigned based on the principle of least privilege.

  Which of the following options should you use to achieve your goal?

  A. A key vault access policy
  B. Azure policy
  C. Azure AD Privileged Identity Management (PIM)
  D. Azure DevOps
  A. A key vault access policy

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault

• Question 12:

  HOTSPOT

  You have an Azure subscription that contains an Azure key vault named ContosoKey1.

  You create users and assign them roles as shown in the following table.

  

  You need to identify which users can perform the following actions:

  1. Delegate permissions for ContsosKey1.

  2. Configure network access to ContosoKey1.

  Which users should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-gb/azure/key-vault/general/rbac-guide

• Question 13:

  You have an Azure subscription named Subscription1.

  You need to view which security settings are assigned to Subscription1 by default.

  Which Azure policy or initiative definition should you review?

  A. the Audit diagnostic setting policy definition
  B. the Enable Monitoring in Azure Security Center initiative definition
  C. the Enable Azure Monitor for VMs initiative definition
  D. the Azure Monitor solution `Security and Audit' must be deployed policy definition
  B. the Enable Monitoring in Azure Security Center initiative definition

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/security-center/tutorial-security-policy

  https://docs.microsoft.com/en-us/azure/security-center/policy-reference

• Question 14:

  HOTSPOT

  What is the membership of Group1 and Group2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: User1, User2, User3, User4

  Contains "ON" is true for Montreal (User1), MONTREAL (User2), London (User 3), and Ontario (User4) as string and regex operations are not case sensitive.

  Box 2: Only User3

  Match "*on" is only true for London (User3).

  Scenario:

  Contoso.com contains the users shown in the following table.

  

  Contoso.com contains the security groups shown in the following table.

  

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership

• Question 15:

  You have an Azure environment.

  You need to identify any Azure configurations and workloads that are non-compliant with ISO 27001:2013 standards.

  What should you use?

  A. Azure Active Directory (Azure AD) Identity Protection
  B. Microsoft Defender for Cloud
  C. Microsoft Defender for Identity
  D. Microsoft Sentinel
  B. Microsoft Defender for Cloud

• Question 16:

  DRAG DROP

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The Azure virtual machines on SpokeVNetSubnet0 can communicate with the computers on the on-premises network.

  You plan to deploy an Azure firewall to HubVNet.

  You create the following two routing tables:

  1. RT1: Includes a user-defined route that points to the private IP address of the Azure firewall as a next hop address

  2. RT2: Disables BGP route propagation and defines the private IP address of the Azure firewall as the default gateway

  You need to ensure that traffic between SpokeVNetSubnet0 and the on-premises network flows through the Azure firewall.

  To which subnet should you associate each route table? To answer, drag the appropriate subnets to the correct route tables. Each subnet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 17:

  You have an Azure subscription that contains an Azure App Services web app named WebApp1 and an Azure key vault named Vault1. Vault1 has the certificates shown in the following table.

  

  You plan to implement TLS for WebApp1.

  You need to add a certificate to WebApp1.

  Which certificates from Vault1 can you add to WebApp1?

  A. Cert1 and Cert2 only
  B. Cert1 and Cert3 only
  C. Cert3 and Cert4 only
  D. Cert1, Cert2, Cert3, and Cert4
  A. Cert1 and Cert2 only

• Question 18:

  HOTSPOT

  You have an Azure Subscription that is connected to an on-premises datacenter and contains the resources shown in the following table.

  

  You need to configure virtual network service endpoints for VNet1 and VNet2. The solution must meet the following requirements:

  1. The virtual machines that connect to the subnet of VNet1 must access storage1, storage2, and Azure AD by using the Microsoft backbone network.

  2. The virtual machines that connect to the subnet of VNet2 must access storage1 and KeyVault1 by using the Microsoft backbone network.

  3. The virtual machines must use the Microsoft backbone network to communicate between VNet1 and VNet2.

  How many service endpoints should you configure for each virtual network? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: 1

  VNet1

  The virtual machines that connect to the subnet of VNet1 must access storage1, storage2, and Azure AD by using the Microsoft backbone network.

  The virtual machines must use the Microsoft backbone network to communicate between VNet1 and VNet2.

  First service endpoint: One service endpoint for Microsoft.Storage added to VNET1.

  The question asks how many to add to VNET1. When adding service endpoints on the VNET1 side you only get to choose the service (Microsoft.Storage) not the actual storage accounts. Once you add this service endpoint it can be then linked to on the storage side for both accounts.

  Second Service Endpoint: No second service endpoint needed.

  Incorrect:

  * Service Endpoint between Virtual Machines in the two Virtual Network VM is not a service endpoint type.

  * Service Endpoint for Microsoft.AzureActiveDirectory

  Microsoft.AzureActiveDirectory tag listed under services supporting service endpoints is used only for supporting service endpoints to ADLS Gen 1. Azure AD doesn't support service endpoints natively.

  Box 2: 2

  VNet2

  The virtual machines that connect to the subnet of VNet2 must access storage1 and KeyVault1 by using the Microsoft backbone network.

  First service endpoint: One service endpoint for Microsoft.Storage added to VNET2.

  Second Service Endpoint: Azure Key Vault.

  Note:

  Service endpoints are available for the following Azure services and regions. The Microsoft.* resource is in parenthesis. Enable this resource from the subnet side while configuring service endpoints for your service:

  Generally available

  Azure Storage (Microsoft.Storage): Generally available in all Azure regions.

  Azure Storage cross-region service endpoints (Microsoft.Storage.Global): Generally available in all Azure regions.

  Azure SQL Database (Microsoft.Sql): Generally available in all Azure regions.

  Azure Synapse Analytics (Microsoft.Sql): Generally available in all Azure regions for dedicated SQL pools (formerly SQL DW).

  Azure Database for PostgreSQL server (Microsoft.Sql): Generally available in Azure regions where database service is available.

  Azure Database for MySQL server (Microsoft.Sql): Generally available in Azure regions where database service is available.

  Azure Database for MariaDB (Microsoft.Sql): Generally available in Azure regions where database service is available.

  Azure Cosmos DB (Microsoft.AzureCosmosDB): Generally available in all Azure regions.

  Azure Key Vault (Microsoft.KeyVault): Generally available in all Azure regions.

  Azure Service Bus (Microsoft.ServiceBus): Generally available in all Azure regions.

  Azure Event Hubs (Microsoft.EventHub): Generally available in all Azure regions.

  Azure Data Lake Store Gen 1 (Microsoft.AzureActiveDirectory): Generally available in all Azure regions where ADLS Gen1 is available.

  Azure App Service (Microsoft.Web): Generally available in all Azure regions where App service is available.

  Azure Cognitive Services (Microsoft.CognitiveServices): Generally available in all Azure regions where Cognitive services are available.

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

• Question 19:

  Note: This question is part of a series of questions that present the same scenario.

  Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. An Azure administrator plans to run a PowerShell script that creates Azure resources.

  You need to recommend which computer conguration to use to run the script.

  Solution: Run the script from a computer that runs Linux and has the Azure CLI tools installed.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  A PowerShell script is a le that contains PowerShell cmdlets and code. A PowerShell script needs to be run in PowerShell.

  PowerShell can now be installed on Linux. However, the question states that the computer has Azure CLI tools, not PowerShell installed.

  Therefore, this solution does not meet the goal.

  References:

  https://docs.microsoft.com/en-us/powershell/scripting/components/ise/how-to-write-and-run-scripts-in-the-windows-powershell-ise?view=powershell-6

• Question 20:

  SIMULATION

  You need to perform a full malware scan every Sunday at 02:00 on a virtual machine named VM1 by using Microsoft Antimalware for Virtual Machines.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Deploy the Microsoft Antimalware Extension using the Azure Portal for single VM deployment 1. In Azure Portal, go to the Azure VM1's blade, navigate to the Extensions section and press Add.

  

  2. Select the Microsoft Antimalware extension and press Create.

  3. Fill the "Install extension" form as desired and press OK.

  Scheduled: Enable

  Scan type: Full

  Scan day: Sunday

  

  https://www.e-apostolidis.gr/microsoft/azure/azure-vm-antimalware-extension-management/