Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 271:

  From Azure Security Center, you need to deploy SecPol1.

  What should you do first?

  A. Enable Azure Defender.
  B. Create an Azure Management group.
  C. Create an initiative.
  D. Configure continuous export.
  C. Create an initiative.

  ---

  Explanation

  https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/security-center/custom-security-policies.md

  https://zimmergren.net/create-custom-security-center-recommendation-with-azure-policy/

• Question 272:

  DRAG DROP

  You need to deploy AKS1 to meet the platform protection requirements.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

  Select and Place:

  

  

• Question 273:

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  You have an Amazon Web Service (AWS) account named AWS1 that is connected to defender for Cloud.

  You need to ensure that AWS foundational Security Best Practices. The solution must minimize administrate effort.

  What should do you in Defender for Cloud?

  A. Create a new customer assessment.
  B. Assign a built-in assessment.
  C. Assign a built-in compliance standard.
  D. Create a new custom standard.
  C. Assign a built-in compliance standard.

• Question 274:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:

  1. Assignments: Include Group1, exclude Group2

  2. Conditions: Sign-in risk level: Medium and above

  3. Access Allow access, Require multi-factor authentication

  You need to identify what occurs when the users sign in to Azure AD.

  What should you identify for each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditionalaccess-policies/

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identityprotection-policies

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identityprotection-risks

• Question 275:

  You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

  You are assigned the Global administrator role for the tenant. You are responsible for managing Azure Security Center settings.

  You need to create a custom sensitivity label.

  What should you do?

  A. Create a custom sensitive information type.
  B. Elevate access for global administrators in Azure AD.
  C. Change Azure Security Center to use Standard-tier-pricing.
  D. Enable integration with Microsoft Cloud App Security.
  A. Create a custom sensitive information type.

  ---

  Explanation

  First, you need to create a new sensitive information type because you can't directly modify the default rules.

  References:

  https://docs.microsoft.com/en-us/office365/securitycompliance/customize-a-built-in-sensitive-information-type

• Question 276:

  HOTSPOT

  You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table.

  

  You schedule two update deployments named Update1 and Update2. Update1 updates VM3. Update2 updates VM6.

  Which additional virtual machines can be updated by using Update1 and Update2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Update1: VM1 and VM2 only VM3: Windows Server 2016 West US RG2

  Update2: VM4 and VM5 only VM6: CentOS 7.5 East US RG1

  For Linux, the machine must have access to an update repository. The update repository can be private or public.

  References:

  https://docs.microsoft.com/en-us/azure/automation/automation-update-management

• Question 277:

  You have Azure Resource Manager templates that you use to deploy Azure virtual machines.

  You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.

  What should you use?

  A. Azure Advisor
  B. an Azure Desired State Configuration (DSC) virtual machine extension
  C. security policies in Azure Security Center
  D. Azure Logic Apps
  B. an Azure Desired State Configuration (DSC) virtual machine extension

  ---

  Explanation

  The primary use case for the Azure Desired State Configuration (DSC) extension is to bootstrap a VM to the Azure Automation State Configuration (DSC) service. The service provides benefits that include ongoing management of the VM configuration and integration with other operational tools, such as Azure Monitoring. Using the extension to register VM's to the service provides a flexible solution that even works across Azure subscriptions.

  https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview

• Question 278:

  HOTSPOT

  You have the Azure key vaults shown in the following table.

  

  KV1 stores a secret named Secret1 and a key for a managed storage account named Key1.

  You back up Secret1 and Key1.

  To which key vaults can you restore each backup? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  The backups can only be restored to key vaults in the same subscription and same geography. You can restore to a different region in the same geography.

• Question 279:

  You have an Azure subscription that contains a user named User1 and a storage account that hosts a blob container named blob1.

  You need to grant user1 access to blob1. The solution must ensure that the access expires after six days.

  What should you use?

  A. a shared access policy
  B. a shared access signature (SAS)
  C. role-based access control (RBAC)
  D. a managed identity
  B. a shared access signature (SAS)

  ---

  Explanation

  A shared access signature (SAS) is a URI that grants access to Azure Storage resources without requiring a storage account key. SAS tokens can be used to grant access to specific resources, such as a blob container, for a specific period of time.

  To grant User1 access to blob1 with an expiration of six days, you can create a SAS token with the following parameters: -

  Permissions: r, w, or d, depending on the level of access that you want to grant.

  - Start time: The current time.

  - Expiry time: Six days from now.

  Once you have created the SAS token, you can provide it to User1. User1 can then use the SAS token to access blob1 until the expiry time.

• Question 280:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected]

  Azure Password: GpOAe4@lDg

  If the Azure portal does not load successfully in the browser, press CTRL+K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 28681041

  You need to collect all the audit failure data from the security log of a virtual machine named VM1 to an Azure Storage account. To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Step 1: Create a workspace

  Azure Monitor can collect data directly from your Azure virtual machines into a Log Analytics workspace for detailed analysis and correlation.

  1. In the Azure portal, select All services. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics workspaces.

  

  2. Select Create, and then select choices for the following items:

  

  3. After providing the required information on the Log Analytics workspace pane, select OK.

  While the information is verified and the workspace is created, you can track its progress under Notifications from the menu.

  Step 2: Enable the Log Analytics VM Extension

  Installing the Log Analytics VM extension for Windows and Linux allows Azure Monitor to collect data from your Azure VMs.

  1. In the Azure portal, select All services found in the upper left-hand corner. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics workspaces.

  2. In your list of Log Analytics workspaces, select DefaultWorkspace (the name you created in step 1).

  3. On the left-hand menu, under Workspace Data Sources, select Virtual machines.

  4. In the list of Virtual machines, select a virtual machine you want to install the agent on. Notice that the Log Analytics connection status for the VM indicates that it is Not connected.

  5. In the details for your virtual machine, select Connect. The agent is automatically installed and configured for your Log Analytics workspace. This process takes a few minutes, during which time the Status shows Connecting.

  After you install and connect the agent, the Log Analytics connection status will be updated with This workspace.

  https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm