Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 251:

  You create a new Azure subscription.

  You need to ensure that you can create custom alert rules in Azure Security Center.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Onboard Azure Active Directory (Azure AD) Identity Protection.
  B. Create an Azure Storage account.
  C. Implement Azure Advisor recommendations.
  D. Create an Azure Log Analytics workspace.
  E. Upgrade the pricing tier of Security Center to Standard.
  D. Create an Azure Log Analytics workspace.
  E. Upgrade the pricing tier of Security Center to Standard.

  ---

  Explanation

  D: You need write permission in the workspace that you select to store your custom alert.

  References:

  https://docs.microsoft.com/en-us/azure/security-center/security-center-custom-alert

• Question 252:

  HOTSPOT

  You have an Azure subscription that is linked to an Azure AD tenant and contains the virtual machines shown in the following table.

  

  The subnets of the virtual networks have the service endpoints shown in the following table.

  

  You create the resources shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  The private IP address for VM1 is used.

  Note: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.

  Box 2: No

  The private IP address of VM2 (10.1.2.5) is used, not the public IP address.

  Box 3: No

  The private IP address is used.

  Today, Azure service traffic from a virtual network uses public IP addresses as source IP addresses. With service endpoints, service traffic switches to use virtual network private addresses as the source IP addresses when accessing the Azure service from a virtual network. This switch allows you to access the services without the need for reserved, public IP addresses used in IP firewalls.

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

• Question 253:

  You have an Azure subscription that contains the Azure App Service web apps shown in the following table.

  

  You upload a private key certificate named Cert1.pfx to App1.

  Which apps can use Cert1?

  A. App1 only
  B. App1 and App2 only
  C. App1 and App4 only
  D. App1, App2, and App3 only
  E. App1, App2, App3, and App4
  A. App1 only

• Question 254:

  SIMULATION

  You need to enable Advanced Data Security for the SQLdb1 Azure SQL database. The solution must ensure that Azure Advanced Threat Protection (ATP) alerts are sent to [email protected].

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  1. In the Azure portal, type SQL in the search box, select SQL databases from the search results then select SQLdb1. Alternatively, browse to SQL databases in the left navigation pane.

  2. In the properties of SQLdb1, scroll down to the Security section and select Advanced data security.

  3. Click on the Settings icon.

  4. Tick the Enable Advanced Data Security at the database level checkbox.

  5. Click Yes at the confirmation prompt.

  6. In the Storage account select a storage account if one isn't selected by default.

  7. Under Advanced Threat Protection Settings, enter [email protected] in the Send alerts to box.

  8. Click the Save button to save the changes.

  https://docs.microsoft.com/en-us/azure/azure-sql/database/advanced-data-security

• Question 255:

  You plan to deploy an app that will modify the properties of Azure Active Directory (Azure AD) users by using Microsoft Graph.

  You need to ensure that the app can access Azure AD.

  What should you configure first?

  A. an app registration
  B. an external identity
  C. a custom role-based access control (RBAC) role
  D. an Azure AD Application Proxy
  A. an app registration

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added

• Question 256:

  HOTSPOT

  Your company has an Azure subscription named Subscription1 that contains the users shown in the following table.

  

  The company is sold to a new owner.

  The company needs to transfer ownership of Subscription1.

  Which user can transfer the ownership and which tool should the user use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1; User2

  Billing Administrator

  Select Transfer billing ownership for the subscription that you want to transfer.

  Enter the email address of a user who's a billing administrator of the account that will be the new owner for the subscription.

  Box 2: Azure Account Center

  Azure Account Center can be used.

  https://docs.microsoft.com/en-us/azure/billing/billing-subscription-transfer#transfer-billing-ownership-of-an-azure-subscription

• Question 257:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create an Azure DDoS Protection plan named DDoS1 in the West US Azure region.

  Which resources can you add to DDoS1?

  A. VNetl1only
  B. WebApp1 only
  C. VNet1 and VNet2 only
  D. VNet1 and WebApp1 only
  E. VNet1, VNet2, and WebApp1
  C. VNet1 and VNet2 only

• Question 258:

  DRAG DROP

  You have an Azure subscription named Sub1 that contains an Azure Log Analytics workspace named LAW1.

  You have 500 Azure virtual machines that run Windows Server 2016 and are enrolled in LAW1.

  You plan to add the System Update Assessment solution to LAW1.

  You need to ensure that System Update Assessment-related logs are uploaded to LAW1 from 100 of the virtual machines only.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/insights/solution-targeting

• Question 259:

  Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled.

  You have been tasked with analyzing the security events of a Windows Server 2016 virtual machine. You have already accessed Azure Monitor.

  Which of the following options should you use?

  A. Application Log
  B. Metrics
  C. Activity Log
  D. Logs
  D. Logs

  ---

  Explanation

  Log Integration collects Azure diagnostics from your Windows virtual machines, Azure activity logs, Azure Security Center alerts, and Azure resource provider logs. This integration provides a unified dashboard for all your assets, whether they're on-premises or in the cloud, so that you can aggregate, correlate, analyze, and alert for security events.

  https://docs.microsoft.com/en-us/azure/security/azure-log-audit

• Question 260:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Microsoft Defender for Cloud for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create a policy initiative and an assignment that is scoped to the Tenant Root Group management group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/governance/policy/overview

  https://4sysops.com/archives/apply-governance-policy-to-multiple-azure-subscriptions-with-management-groups/