Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 391:

  HOTSPOT

  You network contains an on-premises Active Directory domain that syncs to an Azure Active Directory (Azure AD) tenant. The tenant contains the users shown in the following table.

  

  The tenant contains the groups shown in the following table.

  

  You configure a multi-factor authentication (MFA) registration policy that and the following settings:

  Assignments:

  - Include: Group1

  - Exclude Group2

  Controls: Require Azure MFA registration Enforce Policy: On

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  

  

• Question 392:

  You are configuring and securing a network environment.

  You deploy an Azure virtual machine named VM1 that is configured to analyze network traffic.

  You need to ensure that all network traffic is routed through VM1.

  What should you configure?

  A. a system route
  B. a network security group (NSG)
  C. a user-defined route
  C. a user-defined route

  ---

  Explanation

  Although the use of system routes facilitates traffic automatically for your deployment, there are cases in which you want to control the routing of packets through a virtual appliance. You can do so by creating user defined routes that specify the next hop for packets flowing to a specific subnet to go to your virtual appliance instead, and enabling IP forwarding for the VM running as the virtual appliance.

  Note: User Defined Routes

  For most environments you will only need the system routes already defined by Azure. However, you may need to create a route table and add one or more routes in specific cases, such as:

  1. Force tunneling to the Internet via your on-premises network.

  2. Use of virtual appliances in your Azure environment.

  3. In the scenarios above, you will have to create a route table and add user defined routes to it.

  https://github.com/uglide/azure-content/blob/master/articles/virtual-network/virtual-networks-udr-overview.md

• Question 393:

  SIMULATION

  You need to ensure that the events in the NetworkSecurityGroupRuleCounter log of the VNETOI-Subnet0-NSG network security group (NSG) are stored in the Iogs31330471 Azure Storage account for 30 days.

  A. Please check the answer in the explantion
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. Please check the answer in the explantion

  ---

  Explanation

  Enable diagnostic resource logging for the NSG. You can use the Azure portal, Azure PowerShell, or the Azure CLI to do this. You need to select the Rule counter category under Logs and choose the Iogs31330471 storage account as the destination.

  Configure the retention policy for the storage account to keep the logs for 30 days. You can use the Azure portal, Azure PowerShell, or the Azure CLI to do this. You need to specify the days parameter as 30 for the Set-AzStorageServiceProperty cmdlet or the az storage logging update command.

  View and analyze the logs in the storage account. You can use any tool that can read JSON files, such as Azure Storage Explorer or Visual Studio Code. You can also export the logs to any visualization tool, SIEM solution, or IDS of your choice

• Question 394:

  You have an on-premises network.

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to deploy a Site-to-Site (S2S) VPN between the on-premises network and VNet1.

  You need to recommend an Azure VPN Gateway SKU that meets the following requirements:

  1. Supports 1-Gbps throughput

  2. Minimizes costs

  What should you recommend?

  A. VpnGw1
  B. VpnGw2
  C. VpnGw1AZ
  D. VpnGw2AZ
  B. VpnGw2

• Question 395:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains a resource group named RG1 and a user named User1. User1 is assigned the Owner role for RG1.

  You create an Azure Blueprints definition named Blueprint1 that includes a resource group named RG2 as shown in the following exhibit.

  

  You assign Blueprint1 to Subscription1 by using the following settings:

  1. Lock assignment: Read Only

  2. Managed Identity: System assigned

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

• Question 396:

  You need to implement the planned change for WAF1.

  The solution must minimize administrative effort.

  What should you do?

  A. Create an Azure policy.
  B. Modify the Azure-managed DRS.
  C. Add a custom rule.
  D. Modify the Bot Manager 1.1 rule set.
  C. Add a custom rule.

  ---

  
  

• Question 397:

  SIMULATION

  You need to ensure that the AzureBackupReport log for the Vault1 Recovery Services vault is stored in the WS11641655 Azure Log Analytics workspace.

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  1. In the Azure portal, type Recovery Services Vaults in the search box, select Recovery Services Vaults from the search results then select Vault1. Alternatively, browse to Recovery Services Vaults in the left navigation pane.

  2. In the properties of Vault1, scroll down to the Monitoring section and select Diagnostic Settings.

  3. Click the Add a diagnostic setting link.

  4. Enter a name in the Diagnostic settings name box.

  5. In the Log section, select AzureBackupReport.

  

  6. In the Destination details section, select Send to log analytics

  

  7. Select the WS11641655 Azure Log Analytics workspace.

  8. Click the Save button to save the changes.

  https://docs.microsoft.com/en-us/azure/backup/backup-azure-diagnostic-events

• Question 398:

  Your company has an Azure Container Registry.

  You have been tasked with assigning a user a role that allows for the uploading of images to the Azure Container Registry. The role assigned should not require more privileges than necessary.

  Which of the following is the role you should assign?

  A. Owner
  B. Contributor
  C. AcrPush
  D. AcrPull
  C. AcrPush

  ---

  Explanation

  https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-roles

• Question 399:

  HOTSPOT

  You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

  You plan to implement an application that will consist of the resources shown in the following table.

  

  Users will authenticate by using their Azure AD user account and access the Cosmos DB account by using resource tokens.

  You need to identify which tasks will be implemented in CosmosDB1 and WebApp1.

  Which task should you identify for each resource? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  CosmosDB1: Create database users and generate resource tokens.

  Azure Cosmos DB resource tokens provide a safe mechanism for allowing clients to read, write, and delete specific resources in an Azure Cosmos DB account according to the granted permissions.

  WebApp1: Authenticate Azure AD users and relay resource tokens

  A typical approach to requesting, generating, and delivering resource tokens to a mobile application is to use a resource token broker. The following diagram shows a high-level overview of how the sample application uses a resource token broker to manage access to the document database data:

  

  References:

  https://docs.microsoft.com/en-us/xamarin/xamarin-forms/data-cloud/cosmosdb/authentication

• Question 400:

  You have an Azure subscription that contains as Azure key vault and an Azure Storage account. The key vault contains customer-managed keys. The storage account is configured to use the customer-managed keys stored in the key vault.

  You plan to store data in Azure by using the following services:

  1. Azure Files

  2. Azure Blob storage

  3. Azure Log Analytics

  4. Azure Table storage

  5. Azure Queue storage

  Which two services support data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Table storage
  B. Azure Files
  C. Blob storage
  D. Queue storage
  B. Azure Files
  C. Blob storage

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption