Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 201:

  DRAG DROP

  You need to perform the planned changes for OU2 and User1.

  Which tools should you use? To answer, drag the appropriate tools to the correct resources. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 202:

  You have an Azure AD tenant. The tenant contains users that are assigned Azure AD Premium P2 licenses.

  You have a partner company that has a domain named fabrikam.com. The fabrikam.com domain contains a user named User1. User1 has an email address of [email protected]

  You need to provide User1 with access to the resources in the tenant. The solution must meet the following requirements:

  1. User1 must be able to sign in by using the [email protected] credentials.

  2. You must be able to grant User1 access to the resources in the tenant.

  3. Administrative effort must be minimized.

  What should you do?

  A. Create a user account for User1.
  B. To the tenant, add fabrikam.com as a custom domain.
  C. Create an invite for User1.
  D. Set Enable guest self-service sign up via user flows to Yes for the tenant.
  C. Create an invite for User1.

  ---

  Explanation

  With Azure AD B2B collaboration, you can invite anyone to collaborate with your organization using their own work, school, or social account.

  https://learn.microsoft.com/en-us/azure/active-directory/external-identities/b2b-quickstart-add-guest-users-portal

• Question 203:

  HOTSPOT

  You have the hierarchy of Azure resources shown in the following exhibit.

  

  RG1, RG2, and RG3 are resource groups.

  RG2 contains a virtual machine named VM1.

  You assign role-based access control (RBAC) roles to the users shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 204:

  You have an Azure subscription that uses Microsoft Sentinel.

  You need to create a Microsoft Sentinel notebook that will use the Guided Investigation - Anomaly Lookup template.

  What should you create first?

  A. an analytics rule
  B. a Log Analytics workspace
  C. an Azure Machine Learning workspace
  D. a hunting query
  A. an analytics rule

• Question 205:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  The subscription is linked to an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  You create the groups shown in the following table.

  

  The membership rules for Group1 and Group2 are configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

• Question 206:

  You have a Microsoft Entra tenant named contoso.com.

  You plan to collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com.

  Fabrikam.com uses the following identity providers:

  1. Google Cloud Platform (GCP)

  2. Microsoft accounts

  3. Microsoft Entra ID

  You need to configure the Cross-tenant access settings for B2B collaboration.

  Which identity providers support cross-tenant access?

  A. Microsoft Entra ID only
  B. GCP and Microsoft Entra ID only
  C. Microsoft accounts and Microsoft Entra ID only
  D. GCP, Microsoft accounts, and Microsoft Entra ID
  D. GCP, Microsoft accounts, and Microsoft Entra ID

• Question 207:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable Azure Storage Analytics logs and archive it to a storage account.

  What should you use to retrieve the diagnostics logs?

  A. Azure Cosmos DB explorer
  B. Azure Monitor
  C. AzCopy
  D. Microsoft Defender for Cloud
  C. AzCopy

• Question 208:

  HOTSPOT

  You have an Azure subscription that contains the custom roles shown in the following table.

  

  In the Azure portal, you plan to create new custom roles by cloning existing roles. The new roles will be configured as shown in the following table.

  

  Which roles can you clone to create each new role? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/active-directory/roles/custom-create

  https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal

• Question 209:

  You have an Azure subscription that contains an Azure key vault and an Azure Storage account. The key vault contains customer-managed keys. The storage account is configured to use the customer- managed keys stored In the key vault.

  You plan to store data in Azure by using the following services:

  1. Azure Files

  2. Azure Blob storage

  3. Azure Log Analytics

  4. Azure Table storage

  5. Azure Queue storage

  Which two services data encryption by using the keys stored in the key vault? Each correct answer present a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Queue storage
  B. Table storage
  C. Azure Files
  D. Blob storage
  A. Queue storage
  B. Table storage

  ---

  Explanation

  When using customer managed keys on a storage account, the CMK are automatically enabled for BLOB and FILE. You can then optionaly configure Queues and Tables.

  "Data stored in Queue and Table storage isn't automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services to be included in this protection at the time that you create the storage account."

  https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#customer-managed-keys-for-queues-and-tables

• Question 210:

  SIMULATION

  You need to ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group. The solution must use the principle of least privilege.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below.

  ---

  Explanation

  RBAC Role: Virtual Machine Contributor

  Create and manage virtual machines, manage disks, install and run software, reset the password of the root user of the virtual machine using VM extensions, and manage local user accounts using VM extensions. This role does not grant you management access to the virtual network or storage account the virtual machines are connected to. This role does not allow you to assign roles in Azure RBAC.

  Grant a user access to Azure resources using the Azure portal

  Azure role-based access control (Azure RBAC) is the way that you manage access to Azure resources. Here you will grant a user access to create and manage virtual machines in a resource group.

  Grant Access

  In Azure RBAC, to grant access, you assign an Azure role.

  Step 1: In the list of Resource groups, open the RGllod28681041 resource group.

  Step 2: In the navigation menu, click Access control (IAM).

  Step 3: Click the Role assignments tab to see the current list of role assignments.

  

  Step 4: Click Add > Add role assignment.

  Step 5: On the Role tab, select the Virtual Machine Contributor role.

  

  Step 6: On the Members tab, select yourself or another user.

  Step 7: On the Review + assign tab, review the role assignment settings.

  Step 8: Click Review + assign to assign the role.

  After a few moments, the user is assigned the Virtual Machine Contributor role at the RG1lod28681041 resource group scope.