Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 221:

  SIMULATION

  You need to ensure that the events in the NetworkSecurityGroupRuleCounter log of the VNET01-Subnet0-NSG network security group (NSG) are stored in the logs11597200 Azure Storage account for 30 days.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to configure the diagnostic logging for the NetworkSecurityGroupRuleCounter log.

  1. In the Azure portal, type Network Security Groups in the search box, select Network Security Groups from the search results then select VNET01-Subnet0-NSG. Alternatively, browse to Network Security Groups in the left navigation pane.

  2. In the properties of the Network Security Group, click on Diagnostic Settings.

  3. Click on the Add diagnostic setting link.

  4. Provide a name in the Diagnostic settings name field. It doesn't matter what name you provide for the exam.

  5. In the Log section, select NetworkSecurityGroupRuleCounter.

  6. In the Destination details section, select Archive to a storage account.

  7. In the Storage account field, select the logs11597200 storage account.

  8. In the Retention (days) field, enter 30.

  9. Click the Save button to save the changes.

• Question 222:

  You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1.

  You have an Azure container registry that stores container images that were deployed by using Azure DevOps Microsoft-hosted agents.

  You need to ensure that administrators can access AKS1 only from specific networks. The solution must minimize administrative effort.

  What should you configure for AKS1?

  A. authorized IP address ranges
  B. an Application Gateway Ingress Controller (AGIC)
  C. a private endpoint
  D. a private cluster
  A. authorized IP address ranges

• Question 223:

  HOTSPOT

  You have an Azure Sentinel workspace that contains an Azure Active Directory (Azure AD) connector, an Azure Log Analytics query named Query1 and a playbook named Playbook1.

  Query1 returns a subset of security events generated by Azure AD.

  You plan to create an Azure Sentinel analytic rule based on Query1 that will trigger Playbook1.

  You need to ensure that you can add Playbook1 to the new rule.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom

  https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

• Question 224:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your Company's Azure subscription includes a virtual network that has a single subnet configured.

  You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed.

  You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and Azure SQL databases via the service endpoint.

  You need to perform a task on the virtual machine prior to deploying containers.

  Solution: You create an AKS Ingress controller.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 225:

  HOTSPOT

  You have an Azure subscription that contains an Azure SQL database named SQL1.

  You plan to deploy a web app named App1.

  You need to provide App1 with read and write access to SQL1. The solution must meet the following requirements:

  1. Provide App1 with access to SQL1 without storing a password.

  2. Use the principle of least privilege.

  3. Minimize administrative effort.

  Which type of account should App1 use to access SQL1, and which database roles should you assign to App1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/app-service/tutorial-connect-msi-sql-database?tabs=windowsclient%2Cdotnet

• Question 226:

  You need to consider the underlined segment to establish whether it is accurate.

  You have configured an Azure Kubernetes Service (AKS) cluster in your testing environment.

  You are currently preparing to deploy the cluster to the production environment.

  After disabling HTTP application routing, you want to replace it with an application routing solution that allows for reverse proxy and TLS termination for AKS services via a solitary IP address.

  You must create an AKS Ingress controller.

  Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  A. No adjustment required.
  B. a network security group
  C. an application security group
  D. an Azure Basic Load Balancer
  A. No adjustment required.

  ---

  Explanation

  An ingress controller is a piece of software that provides reverse proxy, configurable traffic routing, and TLS termination for Kubernetes services.

  https://docs.microsoft.com/en-us/azure/aks/ingress-tls

• Question 227:

  You have a Microsoft Entra tenant that contains a user named User1.

  You have an app registration named App1.

  For App1, you create an app role named Role1.

  You need to assign User1 to Role1.

  What should you use in the Azure portal?

  A. Roles and administrators for App1 from Enterprise applications
  B. App roles for App1 from App registrations
  C. Users and groups for App1 from Enterprise applications
  D. API permissions for App1 from App registrations
  E. Roles and administrators from the Microsoft Entra admin center
  C. Users and groups for App1 from Enterprise applications

• Question 228:

  HOTSPOT

  You need to recommend an encryption solution for the planned ExpressRoute implementation. The solution must meet the technical requirements.

  Which ExpressRoute circuit should you recommend for each type of encryption? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 229:

  You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud.

  You have the management group hierarchy shown in the following exhibit.

  

  You create the definitions shown in the following table.

  

  You need to use Defender for Cloud to add a security policy.

  Which definitions can you use as a security policy?

  A. Policy1 only
  B. Policy1 and Initiative1 only
  C. Initiative1 and Initiative2 only
  D. Initiative1, Initiative2, and Initiative3 only
  E. Policy1, Initiative1, Initiative2, and Initiative3
  B. Policy1 and Initiative1 only

  ---

  Explanation

  Microsoft Defender for Cloud applies security initiatives to your subscriptions. These initiatives contain one or more security policies. Each of those policies results in a security recommendation for improving your security posture.

  * Initiative1- OK

  Initative1 is at the Tenant Root Group level, so it applies to Sub1 as well.

  * Initiative2- OK

  Initative2 applies at the subscription level.

  Incorrect:

  * Policy1 - Not OK

  Microsoft Defender for Cloud applies security initiatives to your subscriptions, not policies

  * Initiative3 applies in MG1 only, not in Sub1.

  Note: Understand scope for Azure RBAC

  Scope is the set of resources that access applies to.

  Scope levels

  In Azure, you can specify a scope at four levels: management group, subscription, resource group, and resource. Scopes are structured in a parent-child relationship. Each level of hierarchy makes the scope more specific. You can assign roles at any of these levels of scope. The level you select determines how widely the role is applied. Lower levels inherit role permissions from higher levels.

  Note 2: Initiative definition

  An initiative definition is a collection of policy definitions that are tailored toward achieving a singular overarching goal. Initiative definitions simplify managing and assigning policy definitions. They simplify by grouping a set of policies as one single item.

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept

  https://learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview

• Question 230:

  DRAG DROP

  You have three Azure subscriptions and a user named User1.

  You need to provide User1 with the ability to manage and view costs for the resources across all three subscriptions. The solution must use the principle of least privilege.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

  Select and Place: