Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 301:

  You have an Azure Active Directory (Azure AD) tenant named Contoso.com and an Azure Kubernetes Service (AKS) cluster AKS1.

  You discover that AKS1 cannot be accessed by using accounts from Contoso.com.

  You need to ensure AKS1 can be accessed by using accounts from Contoso.com. The solution must minimize administrative effort.

  What should you do first?

  A. From Azure recreate AKS1.
  B. From AKS1, upgrade the version of Kubermetes.
  C. From Azure AD, implement Azure AD Premium P2.
  D. From Azure AD, configure the User settings
  A. From Azure recreate AKS1.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration-cli

• Question 302:

  HOTSPOT

  You have an Azure subscription that contains a Microsoft Sentinel workspace.

  Microsoft Sentinel is configured to ingest logs from several Azure workloads. A third-party service management platform is used to manage incidents.

  You need to identify which Microsoft Sentinel components to configure to meet the following requirements:

  1. When Microsoft Sentinel identifies a threat an incident must be created.

  2. A ticket must be logged in the service management platform when an incident is created in Microsoft Sentinel.

  Which component should you identify for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://learn.microsoft.com/en-us/azure/sentinel/overview#automate-and-orchestrate-common-tasks-by-using-playbooks

  Automate your common tasks and simplify security orchestration with playbooks that integrate with Azure services and your existing tools.

• Question 303:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to configure storage1 to regenerate keys automatically every 90 days.

  Which cmdlet should you run?

  A. Add-AzKeyVaultflanagedStorageAccount
  B. Set-AzStorageAccountManagementPolicy
  C. Set-AzStorageAccount
  D. Add-AzStorageAccountManagementPolicyAction
  A. Add-AzKeyVaultflanagedStorageAccount

• Question 304:

  You have an Azure subscription. The subscription contains a virtual network named VNet1 that contains the subnets shown in the following table.

  

  The subscription contains the function apps shown in the following table.

  

  The outbound traffic of which app is controlled by using NSG1?

  A. App4 only
  B. App3 and App4 only
  C. App2, App3, and App4 only
  D. App1, App2, App3, andApp4
  D. App1, App2, App3, andApp4

• Question 305:

  HOTSPOT

  You have the hierarchy of Azure resources shown in the following exhibit.

  

  You create the Azure Blueprint definition shown in the following table.

  

  To which objects can you assign BluePrint1 and BluePrint2? To answer, select the appropriate options in the answer area.

  

  

  ---

  Blueprints can only be assigned to subscriptions.

• Question 306:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that ServerAdmins can perform the following tasks:

  1. Create virtual machine to the existing virtual network in RG2 only.

  2. The solution must use the principle of least privilege.

  Which two role-based access control (RBAC) roles should you assign to ServerAdmins?

  Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. the Contributor role for the subscription
  B. the Network Contributor role for RG2
  C. A custom RBAC role for the subscription
  D. a custom RBAC role for RG2
  E. the Network Contributor role for RG1.
  F. the Virtual Machine Contributor role for RG1.
  D. a custom RBAC role for RG2
  F. the Virtual Machine Contributor role for RG1.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 307:

  SIMULATION

  You need to ensure that when administrators deploy resources by using an Azure Resource Manager template, the deployment can access secrets in an Azure key vault named KV11597200.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to configure an option in the Advanced Access Policy of the key vault.

  1. In the Azure portal, type Azure Key Vault in the search box, select Azure Key Vault from the search results then select the key vault named KV11597200. Alternatively, browse to Azure Key Vault in the left navigation pane.

  2. In the properties of the key vault, click on Advanced Access Policies.

  3. Tick the checkbox labelled Enable access to Azure Resource Manager for template deployment.

  4. Click Save to save the changes.

• Question 308:

  You have an Azure subscription that contains an Azure SQL database named SQL1 and an Azure key vault named KeyVault1. KeyVault1 stores the keys shown in the following table.

  

  You need to configure Transparent Data Encryption (TDE). TDE will use a customer-managed key for SQL1.

  Which keys can you use?

  A. Key2 only
  B. Key1 only
  C. Key2 and Key3 only
  D. Key1, Key2, Key3, and Key4
  E. Key1 and Key2 only
  E. Key1 and Key2 only

  ---

  Explanation

  The key must be an asymmetric, RSA or RSA HSM key. The supported key lengths are 2048-bit and 3072-bit.

  https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview

• Question 309:

  HOTSPOT

  You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.

  

  In storage1, you create a shared access signature (SAS) named SAS1 as shown in the following exhibit.

  

  To which resources can User1 write on July 1, 2022 by using SAS1 and key1? To answer select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 310:

  Your company recently created an Azure subscription.

  You have been tasked with making sure that a specified user is able to implement Azure AD Privileged Identity Management (PIM).

  Which of the following is the role you should assign to the user?

  A. The Global administrator role.
  B. The Security administrator role.
  C. The Password administrator role.
  D. The Compliance administrator role.
  A. The Global administrator role.

  ---

  Explanation

  To start using PIM in your directory, you must first enable PIM.

  1. Sign in to the Azure portal as a Global Administrator of your directory.

  You must be a Global Administrator with an organizational account (for example, @yourdomain.com), not a Microsoft account (for example, @outlook.com), to enable PIM for a directory.

  Scenario: Technical requirements include: Enable Azure AD Privileged Identity Management (PIM) for contoso.com

  https://docs.microsoft.com/bs-latn-ba/azure/active-directory/privileged-identity-management/pim-getting-started