Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 261:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create the Azure Storage accounts shown in the following table.

  

  You need to configure auditing for SQL1.

  Which storage accounts and Log Analytics workspaces can you use as the audit log destination? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 262:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable the diagnostic logs for the storage account.

  What should you use to retrieve the diagnostics logs?

  A. Azure Security Center
  B. Azure Monitor
  C. the Security admin center
  D. Azure Storage Explorer
  D. Azure Storage Explorer

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/storage/blobs/monitor-blob-storage?tabs=azure-portal

• Question 263:

  HOTSPOT

  You have an Azure subscription that contains three storage accounts, an Azure SQL managed instance named SQL1, and three Azure SQL databases.

  The storage accounts are configured as shown in the following table.

  

  SQL1 has the following settings:

  1. Auditing: On

  2. Audit log destination: storage1

  The Azure SQL databases are configured as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/azure-sql/managed-instance/auditing-configure

  https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview

• Question 264:

  You have an Azure subscription that contains a SQL Server on Azure Virtual Machines instance named SQt1 and a Microsoft Sentinel workspace named Sentinel1.

  You need to monitor security incidents on SQL1 by using Sentinel1.

  What should you do first?

  A. On SQL1, enable SQL1 Server audit.
  B. On SQL1. install the Connected Machine agent for Azure Arc-enabled servers.
  C. From the Azure portal, create a Log Analytics workspace.
  D. From Sentinel1, enable VM insights.
  A. On SQL1, enable SQL1 Server audit.

• Question 265:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

  

  Contoso.com contains a group naming policy. The policy has a custom blocked word list rule that includes the word Contoso.

  Which users can create a group named Contoso Sales in contoso.com? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-naming-policy

• Question 266:

  You have a Microsoft Entra tenant named contoso.com.

  You have a partner company that has a Microsoft Entra tenant named fabrikam.com.

  You need to ensure that when a user in fabrikam.com attempts to access the resources in contoso.com, the user only receives a single Microsoft Entra Multi-Factor Authentication (MFA) prompt. The solution must minimize administrative effort.

  What should you do?

  A. From the Azure portal of contoso.com, configure the inbound access default settings.
  B. From the Azure portal of contoso.com, configure the External collaboration settings.
  C. From the Azure portal of contoso.com, configure the outbound access default settings.
  D. From the Azure portal of fabrikam.com, configure the outbound access default settings.
  A. From the Azure portal of contoso.com, configure the inbound access default settings.

• Question 267:

  SIMULATION

  You need to ensure that a user named Danny11597200 can sign in to any SQL database on a Microsoft SQL server named web11597200 by using SQL Server Management Studio (SSMS) and Azure Active Directory (Azure AD) credentials.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to provision an Azure AD Admin for the SQL Server.

  1. In the Azure portal, type SQL Server in the search box, select SQL Server from the search results then select the server named web11597200. Alternatively, browse to SQL Server in the left navigation pane.

  2. In the SQL Server properties page, click on Active Directory Admin.

  3. Click the Set Admin button.

  4. In the Add Admin window, search for and select Danny11597200.

  5. Click the Select button to add Danny11597200.

  6. Click the Save button to save the changes.

  https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell

• Question 268:

  You need to ensure that users can access VM0. The solution must meet the platform protection requirements.

  What should you do?

  A. Move VM0 to Subnet1.
  B. On Firewall, configure a network traffic filtering rule.
  C. Assign RT1 to AzureFirewallSubnet.
  D. On Firewall, configure a DNAT rule.
  A. Move VM0 to Subnet1.

  ---

  Explanation

  Azure Firewall has the following known issue: Conflict with Azure Security Center (ASC) Just-in-Time (JIT) feature.

  If a virtual machine is accessed using JIT, and is in a subnet with a user-defined route that points to Azure Firewall as a default gateway, ASC JIT doesn't work. This is a result of asymmetric routing - a packet comes in via the virtual machine public IP (JIT opened the access), but the return path is via the firewall, which drops the packet because there is no established session on the firewall.

  Solution: To work around this issue, place the JIT virtual machines on a separate subnet that doesn't have a user-defined route to the firewall.

  Scenario:

  

  Following the implementation of the planned changes, the IT team must be able to connect to VM0 by using JIT VM access.

  

  References:

  https://docs.microsoft.com/en-us/azure/firewall/overview

• Question 269:

  HOTSPOT

  You need to manage Azure by using Azure Cloud Shell.

  Which Azure portal icon should you select? To answer, select the appropriate icon in the answer area.

  

  

  ---

  You can access Azure Cloud Shell in the Azure portal by clicking the icon.

  Azure Cloud Shell is an interactive, authenticated, browser-accessible shell for managing Azure resources. It provides the exibility of choosing the shell experience that best suits the way you work, either Bash or PowerShell. Cloud Shell enables access to a browser-based command-line experience built with Azure management tasks in mind.

  References:

  https://docs.microsoft.com/en-us/azure/cloud-shell/overview?view=azure-cli-latest

• Question 270:

  You have an Azure subscription that contains a key vault and an Azure SQL server.

  You need to deploy an Azure SQL database that uses Transparent Data Encryption (TDE) and a customer-managed key.

  What should you create before you deploy the database?

  A. An app registration
  B. A standard general-purpose v2 storage account
  C. A user-assigned managed identity
  D. A user account that is assigned the SQL Security Manager role
  C. A user-assigned managed identity