Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 421:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure Container Registry.

  You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal.

  Solution: You create a secret in Azure Key Vault.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 422:

  HOTSPOT

  You have an Azure subscription.

  You plan to deploy the virtual machines shown in the following table.

  

  You need to identify the virtual machines and operating systems that can be deployed as confidential virtual machines?

  Which Windows virtual machines and which Linux virtual machines should you identify?

  

  

• Question 423:

  Your network contains an Active Directory forest named contoso.com. The forest contains a single domain.

  You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

  You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant.

  You need to recommend an integration solution that meets the following requirements:

  1. Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant

  2. Minimizes the number of servers required for the solution.

  Which authentication method should you include in the recommendation?

  A. federated identity with Active Directory Federation Services (AD FS)
  B. password hash synchronization with seamless single sign-on (SSO)
  C. pass-through authentication with seamless single sign-on (SSO)
  C. pass-through authentication with seamless single sign-on (SSO)

  ---

  Explanation

  Password hash synchronization requires the least effort regarding deployment, maintenance, and infrastructure. This level of effort typically applies to organizations that only need their users to sign in to Office 365, SaaS apps, and other Azure AD-based resources. When turned on, password hash synchronization is part of the Azure AD Connect sync process and runs every two minutes.

  Incorrect Answers:

  A: A federated authentication system relies on an external trusted system to authenticate users. Some companies want to reuse their existing federated system investment with their Azure AD hybrid identity solution. The maintenance and management of the federated system falls outside the control of Azure AD. It's up to the organization by using the federated system to make sure it's deployed securely and can handle the authentication load.

  C: For pass-through authentication, you need one or more (we recommend three) lightweight agents installed on existing servers. These agents must have access to your on-premises Active Directory Domain Services, including your on- premises AD domain controllers. They need outbound access to the Internet and access to your domain controllers. For this reason, it's not supported to deploy the agents in a perimeter network.

  Pass-through Authentication requires unconstrained network access to domain controllers. All network traffic is encrypted and limited to authentication requests.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

• Question 424:

  SIMULATION

  You need to ensure that the rg1lod1234578n1 Azure Storage account is encrypted by using a key stored in the KeyVault12345678 Azure key vault.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below.

  ---

  Explanation

  Step 1: To enable customer-managed keys in the Azure portal, follow these steps:

  1. Navigate to your storage account rg1lod1234578n1 2. On the Settings blade for the storage account, click Encryption. Select the Use your own key option, as shown in the following figure.

  

  Step 2: Specify a key from a key vault

  To specify a key from a key vault, first make sure that you have a key vault that contains a key. To specify a key from a key vault, follow these steps:

  4. Choose the Select from Key Vault option.

  5. Choose the key vault KeyVault1234578 containing the key you want to use.

  6. Choose the key from the key vault.

  

  https://docs.microsoft.com/en-us/azure/storage/common/storage-encryption-keys-portal

• Question 425:

  You have an Azure subscription linked to an Azure Active Directory Premium Plan 1 tenant.

  You plan to implement Azure Active Directory (Azure AD) Identity Protection.

  You need to ensure that you can configure a user risk policy and a sign-in risk policy.

  What should you do first?

  A. Purchase Azure Active Directory Premium Plan 2 licenses for all users.
  B. Register all users for Azure Multi-Factor Authentication (MFA).
  C. Enable security defaults for Azure AD.
  D. Upgrade Azure Security Center to the standard tier.
  A. Purchase Azure Active Directory Premium Plan 2 licenses for all users.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa

• Question 426:

  HOTSPOT

  Which virtual networks in Sub1 can User2 modify and delete in their current state? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: VNET4 and VNET1 only RG1 has only Delete lock, while there are no locks on RG4.

  RG2 and RG3 both have Read-only locks.

  Box 2: VNET4 only

  There are no locks on RG4, while the other resource groups have either Delete or Read-only locks.

  Note: As an administrator, you may need to lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. You can set the lock level to CanNotDelete or ReadOnly. In the portal, the locks are called Delete and Read-only respectively.

  CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.

  ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all authorized users to the permissions granted by the Reader role.

  Scenario:

  User2 is a Security administrator.

  Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6.

  User2 creates the virtual networks shown in the following table.

  

  Sub1 contains the locks shown in the following table.

  

  References:

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

• Question 427:

  You have an Azure subscription that contains a user named User1.

  You need to ensure that User1 can create managed identities. The solution must use the principle of least privilege.

  What should you do?

  A. Create a management group and assign User1 the Hybrid Identity Administrator Azure Active Directory (Azure AD) role.
  B. Create a management group and assign User1 the Managed Identity Operator role.
  C. Create a resource group and assign User1 to the Managed Identity Contributor role.
  D. Create an organizational unit (OU) and assign User1 the User administrator Azure Active Directory (Azure AD) role.
  C. Create a resource group and assign User1 to the Managed Identity Contributor role.

  ---

  Explanation

  https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities

• Question 428:

  HOTSPOT

  You have an Azure subscription.

  You plan to deploy a virtual machine named VM1.

  You need to use confidential disk encryption on VM1.

  Which virtual machine series should you use for VM1, and which type of disks can be encrypted by using confidential disk encryption? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 429:

  You have an Azure subscription that contains a resource group named RG1 and a security group named ServerAdmins. RG1 contains 10 virtual machines, a virtual network named VNET1, and a network security group (NSG) named NSG1. ServerAdmins can access the virtual machines by using RDP.

  You need to ensure that NSG1 only allows RDP connections to the virtual machines for a maximum of 60 minutes when a member of ServerAdmins requests access.

  What should you configure?

  A. an Azure policy assigned to RG1
  B. a just in time (JIT) VM access policy in Azure Security Center
  C. an Azure Active Directory (Azure AD) Privileged Identity Management (PIM) role assignment
  D. an Azure Bastion host on VNET1
  B. a just in time (JIT) VM access policy in Azure Security Center

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/security-center/just-in-time-explained

• Question 430:

  DRAG DROP

  You have an Azure subscription that contains an Azure SQL database named SQLDB1. SQLDB1 contains the columns shown in the following table.

  

  For the Email and Birthday columns, you implement dynamic data masking by using the default masking function.

  Which value will the users see in each column? To answer, drag the appropriate values to the correct columns. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Email: XXXX ==> Default masking function is used (and not email function)

  Birthday: 1900-01-01 ==> as explained in the documentation for date type using default

  https://learn.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview?view=azuresql