Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 351:

  HOTSPOT

  You have 20 Azure subscriptions and a security group named Group1. The subscriptions are children of the root management group.

  Each subscription contains a resource group named RG1.

  You need to ensure that for each subscription RG1 meets the following requirements:

  1. The members of Group1 are assigned the Owner role.

  2. The modification of permissions to RG1 is prevented.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 352:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable Azure Storage Analytics logs and archive it to a storage account.

  What should you use to retrieve the diagnostics logs?

  A. Azure Monitor
  B. SQL query editor in Azure
  C. File Explorer in Windows
  D. Azure Storage Explorer
  D. Azure Storage Explorer

• Question 353:

  SIMULATION

  The developers at your company plan to publish an app named App11641655 to Azure.

  You need to ensure that the app is registered to Azure Active Directory (Azure AD). The registration must use the sign-on URLs of https://app.contoso.com.

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Step 1: Register the Application 1. Sign in to your Azure Account through the Azure portal.

  2. Select Azure Active Directory.

  3. Select App registrations.

  4. Select New registration.

  5. Name the application App11641655. Select a supported account type, which determines who can use the application. Under Redirect URI, select Web for the type of application you want to create. Enter the URI:

  https://app.contoso.com,

  where the access token is sent to.

  

  6. Click Register Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

• Question 354:

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  You need to use Defender for Cloud to review regulatory compliance with the Azure CIS 1.4,0 standard. The solution must minimize administrative effort.

  What should you do first?

  A. Assign an Azure policy.
  B. Manually add the Azure CIS 1.4.0 standard.
  C. Disable one of the Out of the box standards.
  D. Add a custom initiative.
  A. Assign an Azure policy.

  ---

  Explanation

  Customize the set of standards in your regulatory compliance dashboard

  How are regulatory compliance standards represented in Defender for Cloud?

  Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.

  To see compliance data mapped as assessments in your dashboard, add a compliance standard to your management group or subscription from within the Security policy page.

  When you've assigned a standard or benchmark to your selected scope, the standard appears in your regulatory compliance dashboard with all associated compliance data mapped as assessments. You can also download summary reports for any of the standards that have been assigned.

  Add a standard to your Azure resources 1. From Defender for Cloud's menu, select Regulatory compliance to open the regulatory compliance dashboard. Here you can see the compliance standards currently assigned to the currently selected subscriptions.

  2. From the top of the page, select Manage compliance policies.

  3. Select the subscription or management group for which you want to manage the regulatory compliance posture.

  Tip

  We recommend selecting the highest scope for which the standard is applicable so that compliance data is aggregated and tracked for all nested resources.

  4. Select Security policy.

  5. Expand the Industry & regulatory standards section and select Add more standards.

  6. From the Add regulatory compliance standards page, you can search for any of the available standards 7. Select Add and enter all the necessary details for the specific initiative such as scope, parameters, and remediation.

  8. From Defender for Cloud's menu, select Regulatory compliance again to go back to the regulatory compliance dashboard.

  Your new standard appears in your list of Industry & regulatory standards.

  Note

  It may take a few hours for a newly added standard to appear in the compliance dashboard.

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages

• Question 355:

  HOTSPOT

  You suspect that users are attempting to sign in to resources to which they have no access.

  You need to create an Azure Log Analytics query to identify failed user sign-in attempts from the last three days. The results must only show users who had more than five failed sign-in attempts.

  How should you configure the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  The following example identifies user accounts that failed to log in more than five times in the last day, and when they last attempted to log in.

  let timeframe = 1d;

  SecurityEvent

  | where TimeGenerated > ago(1d)

  | where AccountType == 'User' and EventID == 4625 // 4625 - failed log in | summarize failed_login_attempts=count(), latest_failed_login=arg_max(TimeGenerated, Account) by Account

  | where failed_login_attempts > 5

  | project-away Account1 References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/examples

• Question 356:

  You have an Azure subscription named Sub1 that contains the resources shown in the following table.

  

  You need to ensure that you can provide VM1 with secure access to a database on SQL1 by using a contained database user.

  What should you do?

  A. Enable a managed service identity on VM1.
  B. Create a secret in KV1.
  C. Configure a service endpoint on SQL1.
  D. Create a key in KV1.
  A. Enable a managed service identity on VM1.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-sql

• Question 357:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to deploy the virtual machines shown in the following table.

  

  You need to assign managed identities to the virtual machines. The solution must meet the following requirements:

  1. Assign each virtual machine the required roles.

  2. Use the principle of least privilege.

  What is the minimum number of managed identities required?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

  ---

  Explanation

  We have two different sets of required permissions. VM1 and VM2 have the same permission requirements. VM3 and VM4 have the same permission requirements.

  A user-assigned managed identity can be assigned to one or many resources. By using user-assigned managed identities, we can create just two managed identities: one with the permission requirements for VM1 and VM2 and the other with the permission requirements for VM3 and VM4.

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

• Question 358:

  DRAG DROP

  You are implementing conditional access policies.

  You must evaluate the existing Azure Active Directory (Azure AD) risk events and risk levels to configure and implement the policies.

  You need to identify the risk level of the following risk events:

  1. Users with leaked credentials

  2. Impossible travel to atypical locations

  3. Sign-ins from IP addresses with suspicious activity

  Which level should you identify for each risk event? To answer, drag the appropriate levels to the correct risk events. Each level may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Azure AD Identity protection can detect six types of suspicious sign-in activities:

  1. Users with leaked credentials

  2. Sign-ins from anonymous IP addresses 3. Impossible travel to atypical locations

  4. Sign-ins from infected devices 5. Sign-ins from IP addresses with suspicious activity

  6. Sign-ins from unfamiliar locations

  These six types of events are categorized in to 3 levels of risks - High, Medium &

  Low:

  

  References:

  http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

• Question 359:

  You need to consider the underlined segment to establish whether it is accurate.

  You have been tasked with creating a different subscription for each of your company's divisions. However, the subscriptions will be linked to a single Azure Active Directory (Azure AD) tenant.

  You want to make sure that each subscription has identical role assignments.

  You make use of Azure AD Privileged Identity Management (PIM).

  Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  A. No adjustment required
  B. Azure Blueprints
  C. Conditional access policies
  D. Azure DevOps
  A. No adjustment required

  ---

  Explanation

  The Azure AD Privileged Identity Management (PIM) service also allows Privileged Role Administrators to make permanent admin role assignments.

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-add-role-to-user

• Question 360:

  HOTSPOT

  You have an Azure subscription that contains the storage accounts shown in the following table.

  

  You enable Azure Defender for Storage.

  Which storage services of storage5 are monitored by Azure Defender for Storage, and which storage accounts are protected by Azure Defender for Storage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/storage/common/azure-defender-storage-configure?tabs=azure-security-center