Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 341:

  You have 15 Azure virtual machines in a resource group named RG1.

  All virtual machines run identical applications.

  You need to prevent unauthorized applications and malware from running on the virtual machines.

  What should you do?

  A. Apply an Azure policy to RG1.
  B. From Azure Security Center, configure adaptive application controls.
  C. Configure Azure Active Directory (Azure AD) Identity Protection.
  D. Apply a resource lock to RG1.
  B. From Azure Security Center, configure adaptive application controls.

  ---

  Explanation

  Microsoft Defender for Cloud helps you prevent, detect, and respond to threats. Defender for Cloud gives you increased visibility into, and control over, the security of your Azure resources. It provides integrated security monitoring and policy management across your Azure subscriptions. It helps detect threats that might otherwise go unnoticed, and works with a broad ecosystem of security solutions.

  Defender for Cloud helps you optimize and monitor the security of your virtual machines by: Providing security recommendations for the virtual machines. Example recommendations include: apply system updates, configure ACLs endpoints, enable antimalware, enable network security groups, and apply disk encryption.

  Monitoring the state of your virtual machines.

  https://docs.microsoft.com/en-us/azure/security-center/security-center-adaptive-application

• Question 342:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  SQL1 has the following configurations:

  1. Auditing: Enabled

  2. Audit log destination: storage1, Workspace1

  DB1 has the following configurations:

  1. Auditing: Enabled

  2. Audit log destination: storage2

  DB2 has auditing disabled.

  Where are the audit logs for DB1 and DB2 stored?

  To answer, select the appropriate options in the answer area

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: storage1, storage2, and Workspace1

  DB1

  Auditing at the Azure SQL Database server level and at the DB1 level.

  Box 2: storage1 and Workspace1

  DB2

  Auditing at the Azure SQL Database server level.

  Note: Auditing an instance of the SQL Server Database Engine or an individual database involves tracking and logging events that occur on the Database Engine. SQL Server audit lets you create server audits, which can contain server audit specifications for server level events, and database audit specifications for database level events. Audited events can be written to the event logs or to audit files.

  Server Audit Specification

  The Server Audit Specification object belongs to an audit. You can create one server audit specification per audit, because both are created at the SQL Server instance scope.

  Database Audit Specification

  The Database Audit Specification object also belongs to a SQL Server audit. You can create one database audit specification per SQL Server database per audit.

  https://learn.microsoft.com/en-us/sql/relational-databases/security/auditing/sql-server-audit-database-engine

• Question 343:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.

  You plan to publish several apps in the tenant.

  You need to ensure that User1 can grant admin consent for the published apps.

  Which two possible user roles can you assign to User1 to achieve this goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Application developer
  B. Security administrator
  C. Application administrator
  D. User administrator
  E. Cloud application administrator
  C. Application administrator
  E. Cloud application administrator

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent

• Question 344:

  DRAG DROP

  You need to deploy AKS1 to meet the platform protection requirements.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

  Select and Place:

  

  

  ---

  Scenario: Azure AD users must be to authenticate to AKS1 by using their Azure AD credentials.

  Litewire plans to deploy AKS1, which is a managed AKS (Azure Kubernetes Services) cluster.

  Step 1: Create a server application

  To provide Azure AD authentication for an AKS cluster, two Azure AD applications are created. The first application is a server component that provides user authentication.

  Step 2: Create a client application

  The second application is a client component that's used when you're prompted by the CLI for authentication. This client application uses the server application for the actual authentication of the credentials provided by the client.

  Step 3: Deploy an AKS cluster.

  Use the az group create command to create a resource group for the AKS cluster.

  Use the az aks create command to deploy the AKS cluster.

  Step 4: Create an RBAC binding.

  Before you use an Azure Active Directory account with an AKS cluster, you must create role-binding or cluster role-binding. Roles define the permissions to grant, and bindings apply them to desired users. These assignments can be applied to a given namespace, or across the entire cluster.

  https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration

• Question 345:

  You have the Azure resource shown in the following table.

  

  You need to meet the following requirements:

  1. Internet-facing virtual machines must be protected by using network security groups (NSGs).

  2. All the virtual machines must have disk encryption enabled.

  What is the minimum number of security that you should create in Azure Security Center?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

  ---

  Explanation

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept#what-is-a-security-policy

  An Azure Policy definition, created in Azure Policy, is a rule about specific security conditions that you want controlled. Built in definitions include things like controlling what type of resources can be deployed or enforcing the use of tags on all resources. You can also create your own custom policy definitions.

• Question 346:

  You need to configure WebApp1 to meet the data and application requirements.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Upload a public certificate.
  B. Turn on the HTTPS Only protocol setting.
  C. Set the Minimum TLS Version protocol setting to 1.2.
  D. Change the pricing tier of the App Service plan.
  E. Turn on the Incoming client certificates protocol setting.
  B. Turn on the HTTPS Only protocol setting.
  E. Turn on the Incoming client certificates protocol setting.

  ---

  Explanation

  B. Turn on the HTTPS Only protocol setting. (x) > To force 'mutual auth' you must turn off HTTP

  E. Turn on the Incoming client certificates protocol setting. (X) > must set it to 'Require' Refer

  https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tlsmutual-auth

• Question 347:

  HOTSPOT

  You have an Azure subscription named Sub1 that contains the resources shown in the following table.

  

  You need to enable Microsoft Defender for Cloud for storage accounts and virtual machines.

  At which levels can you enable Defender for Cloud for the storage accounts and the virtual machines? To answer, select the appropriate options in the answer area

  NOTE: Each correct selection is worth one point.

  

  

• Question 348:

  You plan to use Azure Resource Manager templates to perform multiple deployments of identically configured Azure virtual machines. The password for the administrator account of each deployment is stored as a secret in different Azure key vaults.

  You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment. The name of the key vault and the name of the secret will be provided as inline parameters.

  What should you use to construct the resource ID?

  A. a key vault access policy
  B. a linked template
  C. a parameters file
  D. an automation account
  B. a linked template

  ---

  Explanation

  You reference the key vault in the parameter file, not the template. The following image shows how the parameter file references the secret and passes that value to the template.

  

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-keyvault-parameter

• Question 349:

  HOTSPOT

  You have a Microsoft Sentinel deployment.

  You need to connect a third-party security solution to the deployment. The third-party solution will send Common Event Format (CER-formatted messages.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. Linux server and a Syslog forwarder daemon

  2. Azure Monitor agent

  https://learn.microsoft.com/en-us/azure/sentinel/connect-common-event-format

  There are two main steps to making this connection, that will be explained below in detail: - Designating a Linux machine or VM as a dedicated log forwarder, installing the Log Analytics agent on it, and configuring the agent to forward the logs to your Microsoft Sentinel workspace. The installation and configuration of the agent are handled by a deployment script. - Configuring your device to send its logs in CEF format to a Syslog server.

• Question 350:

  You have an Azure subscription that contains 100 virtual machines and has Azure Security Center Standard tier enabled.

  You plan to perform a vulnerability scan of each virtual machine.

  You need to deploy the vulnerability scanner extension to the virtual machines by using an Azure Resource Manager template.

  Which two values should you specify in the code to automate the deployment of the extension to the virtual machines? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. the user assigned managed identity
  B. the Key Vault managed storage account Key
  C. the Azure Active Directory (Azure AD) ID
  D. the system-assigned managed identity
  E. the primary shared key
  F. the workspace ID
  A. the user assigned managed identity
  C. the Azure Active Directory (Azure AD) ID

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/azure-arc/servers/onboard-service-principal