Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 31:

  DRAG DROP

  Your company has an Azure SQL database that has Always Encrypted enabled.

  You are required to make the relevant information available to application developers to allow them to access data in the database.

  Which two of the following options should be made available? Answer by dragging the correct options from the list to the answer area.

  Select and Place:

  

  

  ---

  Always Encrypted uses two types of keys: column encryption keys and column master keys. A column encryption key is used to encrypt data in an encrypted column. A column master key is a key-protecting key that encrypts one or more column encryption keys.

  https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine

• Question 32:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant.

  As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings.

  You are currently preparing to create a custom sensitivity label.

  Solution: You start by integrating Security Center and Microsoft Cloud App Security.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 33:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Subscription named Sub1.

  You have an Azure Storage account named Sa1 in a resource group named RG1.

  Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.

  You discover that unauthorized users accessed both the file service and the blob service.

  You need to revoke all access to Sa1.

  Solution: You regenerate the access keys.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately effects all of the shared access signatures associated with it.

  References:

  https://docs.microsoft.com/en-us/rest/api/storageservices/Establishing-a-Stored-Access-

  Policy

• Question 34:

  HOTSPOT

  Your network contains an on-premises Active Directory domain named adatum.com that syncs to Azure Active Directory (Azure AD).

  The Azure AD tenant contains the users shown in the following table.

  

  You configure the Authentication methods - Password Protection settings for adatum.com as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 35:

  You have two Azure subscriptions named Sub1 and Sub2 that contain the virtual networks shown in the following table.

  

  You have an Azure Virtual Network Manager instance named AVNM1 that has the following configurations:

  1. Management scope: Sub1

  2. Network groups:

  3. NetGrp1: Static membership that includes VNet1

  4. NetGrp2: Dynamic membership that has the following criteria: Tags that contain Red

  5. Security admin rule collection: SARule1

  6. Deployed to all Azure regions

  You create two new virtual networks as shown in the following table.

  

  Which virtual networks will have SARule1 applied?

  A. VNet1 and VNet2 only
  B. VNet2 and VNet3 only
  C. VNet1, VNet2, and VNet3 only
  D. VNet2, VNet3, and VNet4 only
  E. VNet1, VNet2, VNet3, and VNet4
  C. VNet1, VNet2, and VNet3 only

• Question 36:

  HOTSPOT

  You have an Azure subscription named Sub1. Sub1 has an Azure Storage account named storage1 that contains the resources shown in the following table.

  

  You generate a shared access signature (SAS) to connect to the blob service and the file service.

  Which tool can you use to access the contents in Container1 and Share1 by using the SAS? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 37:

  You have an Azure Active Directory (Azure AD) tenant and a root management group.

  You create 10 Azure subscriptions and add the subscriptions to the root management group.

  You need to create an Azure Blueprints definition that will be stored in the root management group.

  What should you do first?

  A. Add an Azure Policy definition to the root management group.
  B. Modify the role-based access control (RBAC) role assignments for the root management group.
  C. Create a user-assigned identity.
  D. Create a service principal.
  B. Modify the role-based access control (RBAC) role assignments for the root management group.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin

• Question 38:

  HOTSPOT

  You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. EAMS1 contains the inventory assets shown in the following table.

  

  Which assets are scanned daily, and which assets will display in the default dashboard charts? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 39:

  You have an Azure subscription that contains a storage account named storage1 and a virtual machine named VM1.

  VM1 is connected to a virtual network named VNet1 that contains one subnet and uses Azure DNS.

  You need to ensure that VM1 connects to storage! by using a private IP address. The solution must minimize administrative effort.

  What should you do?

  A. For storage1, disable public network access.
  B. Create an Azure Private DNS zone.
  C. On VNet1. create a new subnet.
  D. For storage1, create a new private endpoint.
  D. For storage1, create a new private endpoint.

  ---

  Explanation

  Create storage account with a private endpoint

  For the storage account create and configure the private endpoint. The private endpoint uses a network interface assigned an IP address in the virtual network.

  You can then connect to the storage account from the VM using a private IP address through the private endpoint.

  https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal

• Question 40:

  SIMULATION

  You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod10598168 Azure Storage account.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Grant access from a virtual network.

  You can configure storage accounts to allow access only from specific subnets. The allowed subnets can belong to a virtual network in the same subscription or a different subscription, including those that belong to a different Azure AD tenant.

  You can enable a service endpoint for Azure Storage within the virtual network. The service endpoint routes traffic from the virtual network through an optimal path to the Azure Storage service. The identities of the subnet and the virtual network are also transmitted with each request. Administrators can then configure network rules for the storage account that allow requests to be received from specific subnets in a virtual network. Clients granted access via these network rules must continue to meet the authorization requirements of the storage account to access the data.

  Step 1: Go to the storage account that you want to secure.

  Step 2: Select Networking.

  Step 3: Check that you've chosen to allow access from Selected networks.

  Step 4: To grant access to a virtual network by using a new network rule, under Virtual networks, select Add existing virtual network. Select the Virtual networks and Subnets options, and then select Add.

  In our case specify the 131.107.0.0/16 subnet.

  If a service endpoint for Azure Storage wasn't previously configured for the selected virtual network and subnets, you can configure it as part of this operation.

  Create a service endpoint policy 1. Select + Create a resource on the upper, left corner of the Azure portal.

  2. In search pane, type "service endpoint policy" and select Service endpoint policy and then select Create.

  

  3. Enter, or select, the following information in Basics

  * Details omitted* 4. Select + Add under Resources and enter or select the following information in Add a resource pane

  Service: Only Microsoft.Storage is available with Service Endpoint Policies

  Scope: Select one out of Single Account, All accounts in subscription and All accounts in resource group

  Subscription: Select your subscription for storage account. Policy and storage accounts can be in different subscriptions.

  Resource group: Select your resource group. Required, if scope is set as, "All accounts in resource group" or "Single account".

  Resource: Select your Azure Storage resource under the selected Subscription or Resource Group

  Click on Add button at bottom to finish adding the resource

  

  5. Select Associated subnets to view the subnets the policy is associated. If no subnet is associated yet, follow the instructions in the next step.

  

  6. Select Associated subnets to view the subnets the policy is associated. If no subnet is associated yet, follow the instructions in the next step.

  7. Associate a policy to a subnet

  

  8. Select Review + Create. Validate the information and Click Create. To make further edits, click Previous.

  

  https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security