Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 291:

  SIMULATION

  You need to ensure that User2-1234578 has all the key permissions for KeyVault1234578.

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  You need to assign the user the Key Vault Secrets Officer role.

  1. In the Azure portal, type Key Vaults in the search box, select Key Vaults from the search results then select KeyVault1234578. Alternatively, browse to Key Vaults in the left navigation pane.

  2. In the key vault properties, select Access control (IAM).

  3. In the Add a role assignment section, click the Add button.

  4. In the Role box, select the Key Vault Secrets Officer role from the drop-down list.

  5. In the Select box, start typing User2-1234578 and select User2-1234578 from the search results.

  6. Click the Save button to save the changes.

• Question 292:

  You need to encrypt storage1 to meet the technical requirements.

  Which key vaults can you use?

  A. KeyVault2 and KeyVault3 only
  B. KeyVault1 only
  C. KeyVault1 and KeyVault3 only
  D. KeyVault1, KeyVault2, and KeyVault3
  D. KeyVault1, KeyVault2, and KeyVault3

  ---

  Explanation

  You can either create your own keys and store them in the key vault or managed HSM, or you can use the Azure Key Vault APIs to generate keys. The storage account and the key vault or managed HSM can be different Azure Active Directory (Azure AD) tenants, regions, and subscriptions.

  https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview

• Question 293:

  You have been tasked with altering a current security playbook via Azure Security Center.

  You want make sure that the playbook sends email messages to a distribution group, instead of a user.

  Which of the following options should you use to achieve your goal?

  A. Azure Blueprints
  B. Activity Log
  C. Azure Log Analytics
  D. Azure Logic Apps Designer
  D. Azure Logic Apps Designer

  ---

  Explanation

  You can change an existing playbook in Security Center to add an action, or conditions. To do that you just need to click on the name of the playbook that you want to change, in the Playbooks tab, and Logic App Designer opens up.

  https://docs.microsoft.com/en-us/azure/security-center/security-center-playbooks

• Question 294:

  HOTSPOT

  You need to configure the AKS1 and ID1 managed identities to meet the technical requirements. The solution must follow the principle of least privilege.

  Which role should you assign to each identity? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  

  

• Question 295:

  You have an Azure subscription that uses Azure Active Directory (Azure AD) Privileged Identity Management (PIM).

  A PIM user that is assigned the User Access Administrator role reports receiving an authorization error when performing a role assignment or viewing the list of assignments.

  You need to resolve the issue by ensuring that the PIM service principal has the correct permissions for the subscription. The solution must use the principle of least privilege.

  Which role should you assign to the PIM service principle?

  A. Contributor
  B. User Access Administrator
  C. Managed Application Operator
  D. Resource Policy Contributor
  B. User Access Administrator

• Question 296:

  HOTSPOT

  You are evaluating the security of VM1, VM2, and VM3 in Sub2.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  VM1: Yes. NSG2 applies to VM1 and this allows inbound tra c on port 80.

  VM2: No. NSG2 and NSG1 apply to VM2. NSG2 allows the inbound tra c on port 80 but NSG1 does not allow it.

  VM3: Yes. There are no NSGs applying to VM3 so all ports will be open.

• Question 297:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Subscription named Sub1.

  You have an Azure Storage account named Sa1 in a resource group named RG1.

  Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.

  You discover that unauthorized users accessed both the file service and the blob service.

  You need to revoke all access to Sa1.

  Solution: You create a new stored access policy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Shared access signatures provides access to a particular resource such as blog. Stored access policies are a group of Shared Access Signatures (SAS). In order to revoke access to a SAS you can either:

  1. Rotate the Key1 or Key 2, that is the access keys used to sign the SAS. Rotating the access keys used to sign the SAS, invalidates any previously signed SAS hence revoking the SAS issused before 2. Remove the stored access policy which an SAS is linked to. If a Stored Access Policy is removed, it also invalidates the SASs liked to the Stored Access Policy.

• Question 298:

  HOTSPOT

  You have a Microsoft Entra tenant that contains the users shown in the following table.

  

  AII the users have devices that contain certificates issued by a certification authority (CA) named ContosoCA. You create a Conditional Access policy that has the following settings:

  Name: CAPoltcy1

  Assignments

  Users and groups: Group1

  Target resources

  Include: All cloud apps

  Access controls

  Grant access: Require multi-factor authentication Enable policy: On

  You enable and target certificate-based authentication as shown in the Enable and Target exhibit. (Click the Enable and Target tab.)

  

  You configure certificate-based authentication as shown in the Configure exhibit. (Click the Configure tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  

  

• Question 299:

  You have an app that uses an Azure SQL database.

  You need to be notified if a SQL injection attack is launched against the database.

  What should you do?

  A. Modify the Diagnostics settings for the database.
  B. Deploy the SQL Health Check solution in Azure Monitor.
  C. Enable Azure Defender for SQL for the database.
  D. Enable server-level auditing for the database.
  C. Enable Azure Defender for SQL for the database.

• Question 300:

  DRAG DROP

  Your network contains an on-premises Active Directory domain named contoso.com. The domain contains a user named User1.

  You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains an Azure Storage account named storage1. Storage1 contains an Azure file share named share1.

  Currently, the domain and the tenant are not integrated.

  You need to ensure that User1 can access share1 by using his domain credentials.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable