Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 401:

  You have an Azure subscription that contains a virtual machine named VM1.

  You are creating a data collection rule (DCR) named DCR1 that will collect events from VM1.

  You need to ensure that only events that have an ID of 4798 are collected.

  What should you use in DCR1?

  A. a PowerShell script
  B. aT-SQLquery
  C. an XPath query
  D. a KQL query
  C. an XPath query

• Question 402:

  DRAG DROP

  You have an Azure subscription named Sub1 that contains an Azure Storage account named Contosostorage1 and an Azure key vault named Contosokeyvault1.

  You plan to create an Azure Automation runbook that will rotate the keys of Contosostorage1 and store them in Contosokeyvault1.

  You need to implement prerequisites to ensure that you can implement the runbook.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create an Azure Automation account

  Runbooks live within the Azure Automation account and can execute PowerShell scripts.

  Step 2: Import PowerShell modules to the Azure Automation account

  Under `Assets' from the Azure Automation account Resources section select `to add in Modules to the runbook. To execute key vault cmdlets in the runbook, we need to add AzureRM.profile and AzureRM.key vault.

  Step 3: Create a connection resource in the Azure Automation account

  You can use the sample code below, taken from the AzureAutomationTutorialScript example runbook, to authenticate using the Run As account to manage Resource Manager resources with your runbooks. The AzureRunAsConnection is a connection asset automatically created when we created `run as accounts' above. This can be found under Assets -> Connections. After the authentication code, run the same code above to get all the keys from the vault.

  $connectionName = "AzureRunAsConnection"

  try

  {

  # Get the connection "AzureRunAsConnection "

  $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName

  "Logging in to Azure..."

  Add-AzureRmAccount `

  -ServicePrincipal `

  -TenantId $servicePrincipalConnection.TenantId `

  -ApplicationId $servicePrincipalConnection.ApplicationId `

  -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint

  } References:

  https://www.rahulpnath.com/blog/accessing-azure-key-vault-from-azure-runbook/

• Question 403:

  You have a sneaking suspicion that there are users trying to sign in to resources which are inaccessible to them.

  You decide to create an Azure Log Analytics query to confirm your suspicions. The query will detect unsuccessful user sign-in attempts from the last few days. You want to make sure that the results only show users who had failed to sign-in more than five times.

  Which of the following should be included in your query?

  A. The EventID and CountIf() parameters.
  B. The ActivityID and CountIf() parameters.
  C. The EventID and Count() parameters.
  D. The ActivityID and Count() parameters.
  C. The EventID and Count() parameters.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/examples

• Question 404:

  HOTSPOT

  You work at a company named Contoso, Ltd. that has the offices shown in the following table.

  

  Contoso has an Azure Active Directory (Azure AD) tenant named contoso.com. All contoso.com users have Azure Multi-Factor Authentication (MFA) enabled. The tenant contains the users shown in the following table.

  

  The multi-factor settings for contoso.com are configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 405:

  You have an Azure subscription that contains an Azure App Service app named App1, an Azure container instance named AC1. and a storage account named storage1. AC1 hosts an app named App2.

  Users send requests to App1 by using a URL of https:/app1.contoso.com/echo/resource- cache? param1 =sample. App1 calls App2. which retrieves data from storage1.

  You need to ensure that a security alert will be generated when connections are detected from anomalous IP addresses.

  Which Microsoft Defender for Cloud service should you use?

  A. Microsoft Defender for App Service
  B. Microsoft Defender for APIs
  C. Microsoft Defender for Storage
  D. Microsoft Defender for Containers
  B. Microsoft Defender for APIs

• Question 406:

  HOTSPOT

  Your company uses cloud-based resources from the following platforms:

  1. Azure

  2. Amazon Web Services (AWS)

  3. Google Cloud Platform (GCP)

  You plan to implement Microsoft Defender for Cloud.

  On which platforms can you use Defender for Cloud to protect containers and storage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 407:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a hybrid configuration of Azure Active Directory (Azure AD).

  You have an Azure HDInsight cluster on a virtual network.

  You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.

  You need to configure the environment to support the planned authentication.

  Solution: You deploy an Azure AD Application Proxy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead, you connect HDInsight to your on-premises network by using Azure Virtual Networks and a VPN gateway.

  Note: To allow HDInsight and resources in the joined network to communicate by name, you must perform the following actions:

  1. Create Azure Virtual Network.

  2. Create a custom DNS server in the Azure Virtual Network.

  3. Configure the virtual network to use the custom DNS server instead of the default Azure Recursive Resolver.

  4. Configure forwarding between the custom DNS server and your on-premises DNS server.

  https://docs.microsoft.com/en-us/azure/hdinsight/connect-on-premises-network

• Question 408:

  HOTSPOT

  You have an Azure AD tenant that contains the groups shown in the following table.

  

  You assign licenses to the groups as shown in the following table.

  

  On May1, you delete Group1, Group2, and Group3.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 409:

  Note: This question is part of a series of questions that present the same scenario.

  Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure environment. You need to create a new Azure virtual machine from a tablet that runs the Android operating system.

  Solution: You use PowerShell in Azure Cloud Shell.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  Azure Cloud Shell is a browser-based shell experience to manage and develop Azure resources. Cloud Shell offers a browser-accessible, pre-congured shell experience for managing Azure resources without the overhead of installing, versioning, and maintaining a machine yourself.

  Being browser-based, Azure Cloud Shell can be run on a browser from a tablet that runs the Android operating system.

  References:

  https://docs.microsoft.com/en-us/azure/cloud-shell/features

• Question 410:

  SIMULATION

  You need to prevent HTTP connections to the rg1lod10598168n1 Azure Storage account.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Require secure transfer to ensure secure connections

  You can configure your storage account to accept requests from secure connections only by setting the Secure transfer required property for the storage account. When you require secure transfer, any requests originating from an insecure connection are rejected. Microsoft recommends that you always require secure transfer for all of your storage accounts.

  When secure transfer is required, a call to an Azure Storage REST API operation must be made over HTTPS. Any request made over HTTP is rejected.

  Require secure transfer in the Azure portal

  You can turn on the Secure transfer required property when you create a storage account in the Azure portal. You can also enable it for existing storage accounts.

  Require secure transfer for an existing storage account

  Step 1: Select an existing storage account (here: rg1lod28681041n1) in the Azure portal.

  Step 2: In the storage account menu pane, under Settings, select Configuration.

  Step 3: Under Secure transfer required, select Enabled.

  

  https://learn.microsoft.com/en-us/azure/storage/common/storage-require-secure-transfer