Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 281:

  You have an on-premises datacenter that contains multiple servers.

  You have an Azure subscription.

  You plan to onboard the on-premises servers to Microsoft Defender for Cloud by using a script.

  You need to create an identity to enable the script to run without prompting for Microsoft Entra credentials.

  Which type of identity should you create?

  A. user account
  B. user-assigned managed identity
  C. system-assigned managed identity
  D. group account
  E. service principal
  E. service principal

• Question 282:

  You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 has the Key Vault VM extension installed.

  For Vault1, you rotate the keys, secrets, and certificates.

  What will be updated automatically on VM1?

  A. the keys only
  B. the secrets only
  C. the certificates only
  D. the keys and secrets only
  E. the secrets and certificates only
  F. the keys, secrets, and certificates
  C. the certificates only

  ---

  Explanation

  The Key Vault VM extension provides automatic refresh of certificates stored in an Azure key vault. Specifically, the extension monitors a list of observed certificates stored in key vaults, and, upon detecting a change, retrieves, and installs the corresponding certificates.

  https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-windows

• Question 283:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  NSG1 and NSG2 both have default rules only.

  The subscription contains the virtual machines shown in the following table.

  

  The subscription contains the web apps shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 284:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Azure subscription that includes an Azure key vault. You have previously created a secret in the key vault.

  After an application developer registers an application in Azure Active Directory (Azure AD), you are instructed to make sure that the application is able to use the secret you created.

  Solution: You should create a role in Azure AD.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  Azure Key Vault provides a way to securely store credentials and other keys and secrets, but your code needs to authenticate to Key Vault to retrieve them.

  Managed identities for Azure resources overview make solving this problem simpler, by giving Azure services an automatically managed identity in Azure Active Directory (Azure AD). You can use this identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without having any credentials in your code.

  Example: How a system-assigned managed identity works with an Azure VM

  After the VM has an identity, use the service principal information to grant the VM access to Azure resources. To call Azure Resource Manager, use role-based access control (RBAC) in Azure AD to assign the appropriate role to the VM service principal. To call Key Vault, grant your code access to the specific secret or key in Key Vault.

  https://docs.microsoft.com/en-us/azure/key-vault/quick-create-net

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

• Question 285:

  HOTSPOT

  You have an Azure subscription that contains an Azure firewall named AzFW1. AzFW1 has a firewall policy named FWPolicy1.

  You need to add rule collections to FWPolicy1 to meet the following requirements:

  1. Allow traffic based on the FQDN of the destination.

  2. Allow TCP traffic.

  Which types of rule collections should you add for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 286:

  You have an Azure subscription named Sub1 that contains an Azure Log Analytics workspace named LAW1.

  You have 100 on-premises servers that run Windows Server 2012 R2 and Windows Server 2016. The servers connect to LAW1. LAW1 is configured to collect security-related performance counters from the connected servers.

  You need to configure alerts based on the data collected by LAW1. The solution must meet the following requirements:

  1. Alert rules must support dimensions.

  2. The time it takes to generate an alert must be minimized.

  3. Alert notifications must be generated only once when the alert is generated and once when the alert is resolved.

  Which signal type should you use when you create the alert rules?

  A. Log
  B. Log (Saved Query)
  C. Metric
  D. Activity Log
  C. Metric

  ---

  Explanation

  Metric alerts in Azure Monitor provide a way to get notified when one of your metrics cross a threshold. Metric alerts work on a range of multi-dimensional platform metrics, custom metrics, Application Insights standard and custom metrics.

  Note: Signals are emitted by the target resource and can be of several types. Metric, Activity log, Application Insights, and Log.

  References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-metric

• Question 287:

  DRAG DROP

  You have an Azure subscription that contains the following resources:

  1. A virtual network named VNET1 that contains two subnets named Subnet1 and Subnet2.

  2. A virtual machine named VM1 that has only a private IP address and connects to Subnet1.

  You need to ensure that Remote Desktop connections can be established to VM1 from the internet.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange then in the correct order.

  Select and Place:

  

  

• Question 288:

  You have an Azure subscription that contains virtual machines.

  You enable just in time (JIT) VM access to all the virtual machines.

  You need to connect to a virtual machine by using Remote Desktop.

  What should you do first?

  A. From Azure Directory (Azure AD) Privileged Identity Management (PIM), activate the Security administrator user role.
  B. From Azure Active Directory (Azure AD) Privileged Identity Management (PIM), activate the Owner role for the virtual machine.
  C. From the Azure portal, select the virtual machine, select Connect, and then select Request access.
  D. From the Azure portal, select the virtual machine and add the Network Watcher Agent virtual machine extension.
  C. From the Azure portal, select the virtual machine, select Connect, and then select Request access.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/connect-logon

• Question 289:

  HOTSPOT

  You have an Azure subscription.

  You configure Microsoft Sentinel to use multiple data sources.

  You need to create analytic rules that meet the following requirements:

  1. Rule 1: Automatically match Common Event Format (CEF) logs and syslog data with domain, IP address, and URL indicators.

  2. Rule 2: Use Microsoft proprietary algorithms.

  Which type of detection should you use for each rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 290:

  You have an Azure virtual machines shown in the following table.

  

  You create an Azure Log Analytics workspace named Analytics1 in RG1 in the East US region.

  Which virtual machines can be enrolled in Analytics1?

  A. VM1 only
  B. VM1, VM2, and VM3 only
  C. VM1, VM2, VM3, and VM4
  D. VM1 and VM4 only
  C. VM1, VM2, VM3, and VM4

  ---

  Explanation

  Note: Create a workspace 1. In the Azure portal, click All services. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics.

  2. Click Create, and then select choices for the following items:

  Provide a name for the new Log Analytics workspace, such as DefaultLAWorkspace. OMS workspaces are now referred to as Log Analytics workspaces.

  Select a Subscription to link to by selecting from the drop-down list if the default selected is not appropriate.

  For Resource Group, select an existing resource group that contains one or more Azure virtual machines.

  Select the Location your VMs are deployed to. For additional information, see which regions Log Analytics is available in.

  Incorrect Answers:

  B, C: A Log Analytics workspace provides a geographic location for data storage. VM2 and VM3 are at a different location.

  D: VM4 is a different resource group.

  References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access