Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 311:

  HOTSPOT

  You have an Azure subscription named Subcription1 that contains the resources shown in the following table.

  

  You create an Azure role by using the following JSON file.

  

  You assign Role1 to User1 for RG1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Minimum requirements:

  "Microsoft.Compute/*/read", "Microsoft.Compute/virtualMachines/write", "Microsoft.Network/*/read", "Microsoft.Storage/*/read", "Microsoft.Authorization/*/read", "Microsoft.Resources/*/read", "Microsoft.Compute/virtualMachines/extensions/write"

• Question 312:

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  All the virtual networks are peered.

  You deploy Azure Bastion to VNET2.

  Which virtual machines can be protected by the bastion host?

  A. VM1, VM2, VM3, and VM4
  B. VM1, VM2, and VM3 only
  C. VM2 and VM4 only
  D. VM2 only
  A. VM1, VM2, VM3, and VM4

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/bastion/vnet-peering

• Question 313:

  You plan to create an Azure Kubernetes Service (AKS) cluster in an Azure subscription.

  The manifest of the registered server application is shown in the following exhibit.

  

  You need to ensure that the AKS cluster and Azure Active Directory (Azure AD) are integrated.

  Which property should you modify in the manifest?

  A. accessTokenAcceptedVersion
  B. keyCredentials
  C. groupMembershipClaims
  D. acceptMappedClaims
  C. groupMembershipClaims

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration-cli

  https://www.codeproject.com/Articles/3211864/Operation-and-Maintenance-of-AKS-Applications

• Question 314:

  HOTSPOT

  You have an Azure subscription that contains two users named User1 and User2 and the blob containers shown in the following table.

  

  Policy1 is configured as shown in the following exhibit.

  

  You assign the roles for storage1 as shown in the following table.

  

  The storage1 account has the following shared access signature (SAS) named SAS1:

  Allowed services: Blob

  Allowed resource types: Container

  Allowed permissions: Read, Write, List, Add, Create Blob versioning permissions: enables deletion of versions Allowed blob index permissions: Read/Write Starr and expiry date/time:

  - Start: 12/1/2021

  - End: 12/31/2021

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 315:

  You are configuring an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry.

  You need to use the auto-generated service principal to authenticate to the Azure Container Registry.

  What should you create?

  A. an Azure Active Directory (Azure AD) group
  B. an Azure Active Directory (Azure AD) role assignment
  C. an Azure Active Directory (Azure AD) user
  D. a secret in Azure Key Vault
  B. an Azure Active Directory (Azure AD) role assignment

  ---

  Explanation

  When you create an AKS cluster, Azure also creates a service principal to support cluster operability with other Azure resources. You can use this auto-generated service principal for authentication with an ACR registry. To do so, you need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry.

  References:

  https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-auth-aks

• Question 316:

  DRAG DROP

  You are configuring network connectivity for two Azure virtual networks named VNET1 and VNET2.

  You need to implement VPN gateways for the virtual networks to meet the following requirements:

  1. VNET1 must have six site-to-site connections that use BGP.

  2. VNET2 must have 12 site-to-site connections that use BGP.

  3. Costs must be minimized.

  Which VPN gateway SKU should you use for each virtual network? To answer, drag the appropriate SKUs to the correct networks. Each SKU may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwsku

• Question 317:

  You have 10 virtual machines on a single subnet that has a single network security group (NSG).

  You need to log the network traffic to an Azure Storage account.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Install the Network Performance Monitor solution.
  B. Enable Azure Network Watcher.
  C. Enable diagnostic logging for the NSG.
  D. Enable NSG flow logs.
  E. Create an Azure Log Analytics workspace.
  B. Enable Azure Network Watcher.
  D. Enable NSG flow logs.

  ---

  Explanation

  A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability. Steps include:

  1. Create a VM with a network security group 2. Enable Network Watcher and register the Microsoft.Insights provider

  3. Enable a traffic flow log for an NSG, using Network Watcher's NSG flow log capability

  4. Download logged data

  5. View logged data Reference:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal

• Question 318:

  HOTSPOT

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain and the devices shown in the following table.

  You have a hybrid Microsoft Entra tenant that contains a synced user named User1.

  You have an Azure subscription that contains the Azure Files shares shown in the following table.

  Used is assigned the Storage File Data SMB Share Contributor role tor storage1 and storage2.

  The Security settings for Share! are configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise. Select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 319:

  You have been tasked with enabling Advanced Threat Protection for an Azure SQL Database server.

  Advanced Threat Protection must be configured to identify all types of threat detection.

  Which of the following will happen if when a faulty SQL statement is generate in the database by an application?

  A. A Potential SQL injection alert is triggered.
  B. A Vulnerability to SQL injection alert is triggered.
  C. An Access from a potentially harmful application alert is triggered.
  D. A Brute force SQL credentials alert is triggered.
  B. A Vulnerability to SQL injection alert is triggered.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threat-detection-overview

• Question 320:

  SIMULATION

  You need to configure a Microsoft SQL server named Web11597200 only to accept connections from the Subnet0 subnet on the VNET01 virtual network.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to allow access to Azure services and configure a virtual network rule for the SQL Server.

  1. In the Azure portal, type SQL Server in the search box, select SQL Server from the search results then select the server named web11597200. Alternatively, browse to SQL Server in the left navigation pane.

  2. In the properties of the SQL Server, click Firewalls and virtual networks.

  3. In the Virtual networks section, click on Add existing. This will open the Create/Update virtual network rule window.

  4. Give the rule a name such as Allow_VNET01-Subnet0 (it doesn't matter what name you enter for the exam).

  5. In the Virtual network box, select VNET01.

  6. In the Subnet name box, select Subnet0.

  7. Click the OK button to save the rule.

  8. Back in the Firewall / Virtual Networks window, set the Allow access to Azure services option to On.