Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 431:

  From Azure Security Center, you enable Azure Container Registry vulnerability scanning of the images in Registry1.

  You perform the following actions:

  1. Push a Windows image named Image1 to Registry1.

  2. Push a Linux image named Image2 to Registry1.

  3. Push a Windows image named Image3 to Registry1.

  4. Modify Image1 and push the new image as Image4 to Registry1.

  5. Modify Image2 and push the new image as Image5 to Registry1.

  Which two images will be scanned for vulnerabilities? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Image4
  B. Image2
  C. Image1
  D. Image3
  E. Image5
  B. Image2
  E. Image5

  ---

  Explanation

  Only Linux images are scanned. Windows images are not scanned.

  https://docs.microsoft.com/en-us/azure/security-center/azure-container-registry-integration

• Question 432:

  You have an Azure AD tenant.

  You need to ensure that users cannot create passwords containing a variation of the word contoso.

  What should you configure?

  A. Microsoft Entra Verified ID
  B. Microsoft Entra Identity Governance
  C. Azure AD Privileged Identity Management (PIM)
  D. Azure AD Password Protection
  E. Azure AD Identity Protection
  D. Azure AD Password Protection

• Question 433:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  VNET1, VNET2, and VNET3 are peered with each other.

  You perform the following actions:

  1. Create two application security groups named ASG1 and ASG2 in the West US region.

  2. Add the network interface of VM1 to ASG1.

  The network interfaces of which virtual machines can you add to ASG1 and ASG2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  ASG1: VM2 only

  ASG2: VM1, VM2, VM4

  A Virtual Machine can be attached to more than one Application Security Group. This helps in cases of multi-application servers.

  There are only two requirements:

  1. All network interfaces used in an ASG must be within the same VNet 2. If ASGs are used in the source and destination, they must be within the same VNet

• Question 434:

  You have an Azure subscription that contains a resource group named RG1 and a security group serverless RG1 contains 10 virtual machine, a virtual network VNET1, and a network security group (NSG) named NSG1. ServerAdmins can access the virtual machines by using RDP.

  You need to ensure that NSG1 only RDP connections to the virtual for a maximum of 60 minutes when a member of ServerAdmins requests access.

  What should you configure?

  A. an Azure Active Directory (Azure AD) Privileged identity Management (PIM) role assignment.
  B. a just in time (JIT) VM access policy in Microsoft Defender for Cloud
  C. an azure policy assigned to RG1.
  D. an Azure Bastion host on VNET1.
  B. a just in time (JIT) VM access policy in Microsoft Defender for Cloud

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/security-center/just-in-time-explained

• Question 435:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the virtual machines shown in the following table.

  

  All the virtual machines have only private IP addresses.

  You deploy Azure Bastion to VNet1 as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 436:

  You plan to configure Azure Disk Encryption for VM4.

  Which key vault can you use to store the encryption key?

  A. KeyVault1
  B. KeyVault2
  C. KeyVault3
  D. KeyVault4
  A. KeyVault1

  ---

  Explanation

  The key vault needs to be in the same subscription and same region as the VM.

  VM4 is in West US. KeyVault1 is the only key vault in the same region as the VM.

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault

• Question 437:

  SIMULATION

  You need to configure a weekly backup of an Azure SQL database named Homepage. The backup must be retained for eight weeks.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to configure the backup policy for the Azure SQL database.

  1. In the Azure portal, type Azure SQL Database in the search box, select Azure SQL Database from the search results then select Homepage. Alternatively, browse to Azure SQL Database in the left navigation pane.

  2. Select the server hosting the Homepage database and click on Manage backups.

  3. Click on Configure policies.

  4. Ensure that the Weekly Backups option is ticked.

  5. Configure the How long would you like weekly backups to be retained option to 8 weeks.

  6. Click Apply to save the changes.

• Question 438:

  You have an Azure subscription that contains an Azure web app named 1 and a virtual machine named VM1. VM1 runs Microsoft SQL Server and is connected to a virtual network named VNet1. App1, VM1, and Vent are in the US Central Azure region.

  You need to ensure that App1 can connect to VM1. The solution must minimize costs.

  A. NAT gateway integration
  B. Azure Front Door
  C. regional virtual network integration
  D. gateway-required virtual network integration
  E. Azure Application Gateway integration
  C. regional virtual network integration

  ---

  Explanation

  Virtual network integration is used only to make outbound calls from your app into your virtual network. Virtual network integration gives your app access to resources in your virtual network, but it doesn't grant inbound private access to your app from the virtual network.

  The VNet integration feature behaves differently when it's used with virtual networks in the same region and with virtual networks in other regions. The VNet integration feature has two variations:

  1. Regional virtual network integration: When you connect to virtual networks in the same region, you must have a dedicated subnet in the virtual network you're integrating with.

  2. Gateway-required virtual network integration: When you connect directly to virtual networks in other regions or to a classic virtual network in the same region, you need an Azure Virtual Network gateway created in the target virtual network.

  https://learnwithankit.medium.com/azure-app-service-networking-vnet-integration-and-access-restriction-de5fdbdddd14

• Question 439:

  HOTSPOT

  You have an Azure key vault.

  You need to delegate administrative access to the key vault to meet the following requirements:

  1. Provide a user named User1 with the ability to set advanced access policies for the key vault.

  2. Provide a user named User2 with the ability to add and delete certificates in the key vault.

  3. Use the principle of least privilege.

  What should you use to assign access to each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1: RBAC

  RBAC is used as the Key Vault access control mechanism for the management plane. It would allow a user with the proper identity to:

  1. set Key Vault access policies 2. create, read, update, and delete key vaults

  3. set Key Vault tags

  Note: Role-based access control (RBAC) is a system that provides fine-grained access management of Azure resources. Using RBAC, you can segregate duties within your team and grant only the amount of access to users that they need to perform their jobs.

  User2: A key vault access policy

  A key vault access policy is the access control mechanism to get access to the key vault data plane. Key Vault access policies grant permissions separately to keys, secrets, and certificates.

  References:

  https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault

• Question 440:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Security Center for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create an initiative and an assignment that is scoped to a management group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/governance/policy/overview