Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 191:

  You have been tasked with delegate administrative access to your company's Azure key vault.

  You have to make sure that a specific user can set advanced access policies for the key vault. You also have to make sure that access is assigned based on the principle of least privilege.

  Which of the following options should you use to achieve your goal?

  A. Azure Information Protection
  B. RBAC
  C. Azure AD Privileged Identity Management (PIM)
  D. Azure DevOps
  B. RBAC

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault

• Question 192:

  HOTSPOT

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  Defender for Cloud has the security alerts shown in the following exhibit.

  

  

  

• Question 193:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure Container Registry.

  You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal.

  Solution: You create a conditional access policy.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 194:

  SIMULATION

  You plan to connect several Windows servers to the WS11641655 Azure Log Analytics workspace.

  You need to ensure that the events in the System event logs are collected automatically to the workspace after you connect the Windows servers.

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Azure Monitor can collect events from the Windows event logs or Linux Syslog and performance counters that you specify for longer term analysis and reporting, and take action when a particular condition is detected. Follow these steps to configure collection of events from the Windows system log and Linux Syslog, and several common performance counters to start with.

  Data collection from Windows VM 1. In the Azure portal, locate the WS11641655 Azure Log Analytics workspace then select Advanced settings.

  

  2. Select Data, and then select Windows Event Logs.

  3. You add an event log by typing in the name of the log. Type System and then select the plus sign +.

  4. In the table, check the severities Error and Warning. (for this question, select all severities to ensure that ALL logs are collected).

  5. Select Save at the top of the page to save the configuration.

  https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm

• Question 195:

  You have an Azure subscription that uses Azure AD Privileged Identity Management (PIM).

  A user named User1 is eligible for the Billing administrator role.

  You need to ensure that the role can only be used for a maximum of two hours.

  What should you do?

  A. Create a new access review.
  B. Edit the role assignment settings.
  C. Update the end date of the user assignment
  D. Edit the role activation settings.
  D. Edit the role activation settings.

  ---

  Explanation

  https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-change-default-settings

• Question 196:

  You have an Azure subscription.

  You plan to deploy an Azure SQL managed instance named AzSQL1.

  You need to recommend an encryption solution for AzSQL1.

  The solution must meet the following requirements:

  1. The database engine must be prevented from performing key provisioning, data encryption, and decryption operations.

  2. Database administrators must be prevented from viewing the encrypted data in plain text.

  What should you include in the recommendation?

  A. Azure Disk Encryption
  B. TLS
  C. Transparent Data Encryption (TDE) with customer-managed keys
  D. Always Encrypted
  E. Transparent Data Encryption (TDE) with Microsoft-managed keys
  D. Always Encrypted

• Question 197:

  HOTSPOT

  You have an Azure subscription that contains a storage account named storage1 and several virtual machines. The storage account and virtual machines are in the same Azure region. The network configurations of the virtual machines are shown in the following table.

  

  The virtual network subnets have service endpoints defined as shown in the following table.

  

  You configure the following Firewall and virtual networks settings for storage1:

  1. Allow access from: Selected networks

  2. Virtual networks: VNET3\Subnet3

  3. Firewall - Address range: 52.233.129.0/24

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  VNet1 has a service endpoint configure for Azure Storage. However, the Azure storage does not allow access from VNet1 or the public IP address of VM1.

  Box 2: Yes

  VNet2 does not have a service endpoint configured. However, the Azure storage allows access from the public IP address of VM2.

  Box 3: No

  Azure storage allows access from VNet3. However, VNet3 does not have a service endpoint for Azure storage. The Azure storage also does not allow access from the public IP of VM3.

• Question 198:

  Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled.

  You have been tasked with retrieving the identity of the user that removed a virtual machine fifteen days ago. You have already accessed Azure Monitor.

  Which of the following options should you use?

  A. Application Log
  B. Metrics
  C. Activity Log
  D. Logs
  C. Activity Log

  ---

  Explanation

  Azure activity logs provide insight into the operations that were performed on resources in your subscription. Activity logs were previously known as "audit logs" or "operational logs," because they report control-plane events for your subscriptions.

  https://docs.microsoft.com/en-us/azure/security/azure-log-audit

• Question 199:

  HOTSPOT

  You are evaluating the effect of the application security groups on the network communication between the virtual machines in Sub2.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No.

  VM4 is in Subnet13 which has NSG3 attached to it.

  VM1 is in ASG1. NSG3 would only allow ICMP pings from ASG2 but not ASG1. Only TCP traffic is allowed from ASG1.

  NSG3 has the inbound security rules shown in the following table.

  

  Box 2: Yes.

  VM2 is in ASG2. Any protocol is allowed from ASG2 so ICMP ping would be allowed.

  Box3. VM1 is in ASG1.

  TCP traffic is allowed from ASG1 so VM1 could connect to the web server as connections to the web server would be on ports TCP 80 or TCP 443.

• Question 200:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure Container Registry.

  You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal.

  Solution: You create an Azure Active Directory (Azure AD) role assignment.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  When you create an AKS cluster, Azure also creates a service principal to support cluster operability with other Azure resources. You can use this auto-generated service principal for authentication with an ACR registry. To do so, you need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry.

  https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-auth-aks