Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 21:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable the diagnostic logs for the storage account.

  What should you use to retrieve the diagnostics logs?

  A. Azure Storage Explorer
  B. SQL query editor in Azure
  C. File Explorer in Windows
  D. Azure Security Center
  A. Azure Storage Explorer

  ---

  Explanation

  If you want to download the metrics for long-term storage or to analyze them locally, you must use a tool or write some code to read the tables. You must download the minute metrics for analysis. The tables do not appear if you list all the tables in your storage account, but you can access them directly by name. Many storage-browsing tools are aware of these tables and enable you to view them directly (see Azure Storage Client Tools for a list of available tools).

  Microsoft provides several graphical user interface (GUI) tools for working with the data in your Azure Storage account. All of the tools outlined in the following table are free.

  

  Note:

  There are several versions of this question in the exam. The questions in the exam have two different correct answers:

  1. Azure Storage Explorer

  2. AZCopy

  Other incorrect answer options you may see on the exam include the following:

  1. Azure Monitor 2. The Security & Compliance admin center

  3. Azure Cosmos DB explorer

  4. Azure Monitor References:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-analyticsmetrics?toc=%2fazure%2fstorage%2fblobs%2ftoc.json

  https://docs.microsoft.com/en-us/azure/storage/common/storage-explorers

• Question 22:

  You have an Azure subscription.

  You create an Azure web app named Contoso1812 that uses an S1 App service plan.

  You create a DNS record for www.contoso.com that points to the IP address of Contoso1812.

  You need to ensure that users can access Contoso1812 by using the https://www.contoso.comURL.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Turn on the system-assigned managed identity for Contoso1812.
  B. Add a hostname to Contoso1812.
  C. Scale out the App Service plan of Contoso1812.
  D. Add a deployment slot to Contoso1812.
  E. Scale up the App Service plan of Contoso1812.
  F. Upload a PFX file to Contoso1812.
  B. Add a hostname to Contoso1812.
  F. Upload a PFX file to Contoso1812.

  ---

  Explanation

  B: You can configure Azure DNS to host a custom domain for your web apps. For example, you can create an Azure web app and have your users access it using either www.contoso.com or contoso.com as a fully qualified domain name (FQDN).

  To do this, you have to create three records:

  A root "A" record pointing to contoso.com

  A root "TXT" record for verification

  A "CNAME" record for the www name that points to the A record

  E: To map a custom DNS name to a web app, the web app's App Service plan must be a paid tier (Shared, Basic, Standard, Premium or Consumption for Azure Functions).

  I Scale up the App Service plan: Select any of the non-free tiers (D1, B1, B2, B3, or any tier in the Production category).

  References:

  https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain

• Question 23:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  Subnet1 and Subnet2 have a network security group {NSG). The NSG has an outbound rule that has the following configurations:

  1. Port; Any

  2. Source: Any

  3. Priority: 100

  4. Action: Deny

  5. Protocol: Any

  6. Destination: Storage

  The subscription contains a storage account named storage1.

  You create a private endpoint named Private1 that has the following settings:

  1. Resource type: Microsoft.Storage/storageAccounts

  2. Resource: storage1

  3. Target sub-resource: blob

  4. Virtual network: VNet1

  5. Subnet: Subnet1

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Service Tag "storage" represents Azure Storage Accounts and can only be applied on the Outbound direction.

  Here the NSG is denying the access to any Storage account ( direction is Outbound, read well) and it is applied on the Subnet level not on the NIC level.

  No - VM2 being on the subnet 2 not on subnet 1 will be deny

  Yes - VM1 and Private 1 are in the same subnet so VM1 will have access

  No - VM2 has been denied the access by the NSG

• Question 24:

  You need to implement the function apps to meet the technical requirements.

  Which apps should you include in the implementation?

  A. Fa1 and Fa2 only
  B. Fa2 and Fa3 only
  C. Fa1 and Fa3 only
  D. Fa1, Fa2, and Fa3
  D. Fa1, Fa2, and Fa3

• Question 25:

  HOTSPOT

  Which virtual networks in Sub1 can User9 modify and delete in their current state? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: VNET4 and VNET1 only RG1 has only Delete lock, while there are no locks on RG4.

  RG2 and RG3 both have Read-only locks.

  Box 2: VNET4 only

  There are no locks on RG4, while the other resource groups have either Delete or Read-only locks.

  Note: As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly. In the portal, the locks are called Delete and Read-only respectively.

  1. CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.

  2. ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.

  Scenario:

  Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6.

  User9 creates the virtual networks shown in the following table.

  

  Sub1 contains the locks shown in the following table.

  

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

• Question 26:

  You have the Azure virtual machines shown in the following table.

  

  Each virtual machine has a single network interface.

  You add the network interface of VM1 to an application security group named ASG1.

  You need to identify the network interfaces of which virtual machines you can add to ASG1.

  What should you identify?

  A. VM2 only
  B. VM2, VM3, VM4, and VM5
  C. VM2, VM3, and VM5 only
  D. VM2 and VM3 only
  D. VM2 and VM3 only

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/virtual-network/application-security-groups

• Question 27:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password. place your cursor in the Enter password box and click on the password below.

  Azure Username: Userl [email protected]

  Azure Password: GpOAe4@lDg

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 28681041

  You need to add the network interface of a virtual machine named VM1 to an application security group named ASG1.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  To add the network interface of a virtual machine named VM1 to an application security group named ASG1, you can follow these steps:

  1. In the Azure portal, search for and select the virtual machine named VM1.

  2. In the left pane, select Networking.

  3. In the Networking pane, select the network interface that you want to add to the application security group named ASG1.

  4. In the network interface pane, select Application security groups. In the Application security groups pane, select Add. In the Add application security group pane, select the application security group named ASG1.

  5. Select Save.

  You can find more information on this topic in the following Microsoft documentation: Add a network interface to an application security group using the Azure portal.

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

• Question 28:

  You company has an Azure Active Directory (Azure AD) tenant named contoso.com.

  You plan to create several security alerts by using Azure Monitor.

  You need to prepare the Azure subscription for the alerts.

  What should you create first?

  A. An Azure Storage account
  B. an Azure Log Analytics workspace
  C. an Azure event hub
  D. an Azure Automation account
  B. an Azure Log Analytics workspace

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-create-workspace

• Question 29:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  An IP address of 10.1.0.4 is assigned to VM5. VM5 does not have a public IP address.

  VM5 has just in time (JIT) VM access configured as shown in the following exhibit.

  

  You enable JIT VM access for VM5.

  NSG1 has the inbound rules shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 30:

  You implement the planned changes for the key vaults.

  To which key vaults can you restore AKV1 backups?

  A. AKV4only
  B. AKV3 and AKV4 only
  C. AKV4 and AKV5 only
  D. AKV2, AKV3, and AKV4 only
  E. AKV2, AKV3, AKV4, and AKV5
  C. AKV4 and AKV5 only