Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 331:

  HOTSPOT

  You have an Azure key vault.

  You need to delegate administrative access to the key vault to meet the following requirements:

  1. Provide a user named User1 with the ability to set access policies for the key vault.

  2. Provide a user named User2 with the ability to add and delete certificates in the key vault.

  3. Use the principle of least privilege.

  What should you use to assign access to each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 332:

  You have an Azure subscription that contains an Azure SQL server named SQL1. SQL1 contains an Azure SQL database named DB1.

  You need to use Microsoft Defender for Cloud to complete a vulnerability assessment for DB1.

  What should you do first?

  A. From Advanced Threat Protection types, select SQL injection vulnerability.
  B. Configure the Send scan report to setting.
  C. Set Periodic recurring scans to ON.
  D. Enable the Microsoft Defender for SQL plan.
  D. Enable the Microsoft Defender for SQL plan.

  ---

  Explanation

  Enable vulnerability assessment on your Azure SQL databases

  Prerequisites

  Make sure thatMicrosoft Defender for Azure SQL is enabled so that you can run scans on your Azure SQL databases.

  Make sure you read and understand the differences between the express and classic configuration.

  When you enable the Defender for Azure SQL plan in Defender for Cloud, Defender for Cloud automatically enables Advanced Threat Protection and vulnerability assessment with the express configuration for all Azure SQL databases in the selected subscription.

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/sql-azure-vulnerability-assessment-enable

• Question 333:

  SIMULATION

  You need to ensure that the rg1lod10598168n1 Azure Storage account is encrypted by using a key stored in the KeyVault10598168 Azure key vault.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Configure customer-managed keys in the same tenant for an existing storage account

  Azure Storage encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can manage your own keys. Customer-managed keys must be stored in Azure Key Vault or Key Vault Managed Hardware Security Model (HSM).

  Configure encryption for manual updating of key versions

  Step 1: In the Azure portal, navigate to the Storage accounts page, and select rg1lod28681041n1

  Step 2: On the Encryption tab, indicate for which services you want to enable support for customer-managed keys in the Enable support for customer-managed keys field.

  Step 3: In the Encryption type field, select Customer-managed keys (CMK).

  Step 4: To locate the key URI in the Azure portal, navigate to your key vault, and select the Keys setting. Select the desired key, then select the key to view its versions. Select a key version to view the settings for that version.

  Step 5: Copy the value of the Key Identifier field, which provides the URI.

  

  Step 6: In the Encryption key settings for your storage account, choose the Enter key URI option.

  Step 7: Paste the URI that you copied into the Key URI field. Include the key version on the URI to configure manual updating of the key version.

  Step 8: Specify a user-assigned managed identity by choosing the Select an identity link.

  

  Step 9: Select the Review button to validate

  https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-existing-account

• Question 334:

  A support engineer plans to perform several Azure management tasks by using the Azure CLI.

  You install the CLI on a computer.

  You need to tell the support engineer which tools to use to run the CLI.

  Which two tools should you instruct the support engineer to use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Command Prompt
  B. Azure Resource Explorer
  C. Windows PowerShell
  D. Windows Defender Firewall
  E. Network and Sharing Center
  A. Command Prompt
  C. Windows PowerShell

  ---

  Explanation

  For Windows the Azure CLI is installed via an MSI, which gives you access to the CLI through the Windows Command Prompt (CMD) or PowerShell.

  References:

  https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-windows?view=azure-cli-latest

• Question 335:

  You have an Azure subscription that contains a resource group named RG1 and the identities shown in the following table.

  

  You assign Group4 the Contributor role for RG1.

  Which identities can you add to Group4 as members?

  A. User1 only
  B. User1 and Group3 only
  C. User1, Group1, and Group3 only
  D. User1, Group2, and Group3 only
  E. User1, Group1, Group2, and Group3
  B. User1 and Group3 only

  ---

  Explanation

  Limitation of using managed identities for authorization

  Using Azure AD groups for granting access to services is a great way to simplify the authorization process. The idea is simple - grant permissions to a group and add identities to the group so that they inherit the same permissions. This is a well-established pattern from various on-premises systems and works well when the identities represent users.

  https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/managed-identity-best-practice-recommendations

• Question 336:

  HOTSPOT

  You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

  

  You create a resource group named RG1.

  Which users can modify the permissions for RG1 and which users can create virtual networks in RG1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Only an owner can change permissions on resources.

  Box 2: A Contributor can create/modify/delete anything in the subscription but cannot change permissions.

• Question 337:

  You have an Azure subscription linked to an Azure AD tenant named contoso.com. Contoso.com contains a user named User1 and an Azure web app named App1.

  You plan to enable User1 to perform the following tasks:

  1. Configure contoso.com to use Microsoft Entra Verified ID.

  2. Register App1 in contoso.com.

  You need to identify which roles to assign to User1. The solution must use the principle of least privilege.

  Which two roles should you identify? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Authentication Policy Administrator
  B. Authentication Administrator
  C. Cloud App Security Administrator
  D. Application Administrator
  E. User Administrator
  A. Authentication Policy Administrator
  D. Application Administrator

  ---

  Explanation

  To enable User1 to perform the tasks, you should assign the following roles:

  -

  Authentication Policy Administrator: This role is required to configure the tenant for Microsoft Entra Verified ID. The user needs to have the global administrator or the authentication policy administrator permission for the directory they want to configure.

  - Application Administrator: This role is required to register an application in Microsoft Entra ID. If User1 is not the global administrator, they need the application administrator permission to complete the app registration including granting admin consent.

  Reference

  Configure your tenant for Microsoft Entra Verified ID

  https://learn.microsoft.com/en-us/azure/active-directory/verifiable-credentials/verifiable-credentials-configure-tenant

• Question 338:

  HOTSPOT

  You have an on-premises server named Server1.

  You have an Azure subscription that contains a Microsoft Sentinel workspace named Sentinel 1.

  You install the Windows Firewall solution in Sentinel1.

  You need to use Microsoft Sentinel to monitor Windows Defender Firewall on Server1.

  What should you install on Server1, and what should you create in the Azure subscription? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 339:

  You need to implement the planned change for storage2. The solution must meet the technical requirements for storage encryption.

  A. Create an encryption scope in storage2.
  B. Configure storage2 to use an account encryption key.
  C. Assign an Azure role-based access control (Azure RBAC) role to storage2.
  D. Enable purge protection for storage2.
  A. Create an encryption scope in storage2.

• Question 340:

  SIMULATION

  You need to ensure that web11597200 is protected from malware by using Microsoft Antimalware for Virtual Machines and is scanned every Friday at 01:00.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to install and configure the Microsoft Antimalware extension on the virtual machine named web11597200.

  1. In the Azure portal, type Virtual Machines in the search box, select Virtual Machines from the search results then select web11597200. Alternatively, browse to Virtual Machines in the left navigation pane.

  2. In the properties of web11597200, click on Extensions.

  3. Click the Add button to add an Extension.

  4. Scroll down the list of extensions and select Microsoft Antimalware.

  5. Click the Create button. This will open the settings pane for the Microsoft Antimalware Extension.

  6. In the Scan day field, select Friday.

  7. In the Scan time field, enter 60. The scan time is measured in minutes after midnight so 60 would be 01:00, 120 would be 02:00 etc.

  8. Click the OK button to save the configuration and install the extension.