Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 461:

  HOTSPOT

  Your company has two offices in Seattle and New York. Each office connects to the Internet by using a NAT device. The offices use the IP addresses shown in the following table.

  

  The company has an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

  

  The MFA service settings are configured as shown in the exhibit. (Click the Exhibit tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 2: No

  Use of Microsoft Authenticator is not required.

  Note: Microsoft Authenticator is a multifactor app for mobile devices that generates time-based codes used during the Two-Step Verification process.

  Box 3: No

  The New York IP address subnet is included in the "skip multi-factor authentication for request.

  References:

  https://www.cayosoft.com/difference-enabling-enforcing-mfa/

• Question 462:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  You have an Azure subscription that contains the resources shown in the following table.

  

  You have.

  The users shown in the following table.

  

  You create an Azure SQL managed instance named SQL1 and enable Microsoft Entra-only authentication. You need to ensure that both User1 and User2 are set as the Microsoft Entra admin for SQL1.

  Solution: You set Group1 as the Microsoft Entra admin for SQL1.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 463:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected]

  Azure Password: Gp0Ae4@!Dg

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 28681041

  You need to configure Azure to allow RDP connections from the Internet to a virtual machine named VM1. The solution must minimize the attack surface of VM1.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Cannot connect remotely to a VM because RDP port is not enabled in NSG

  Symptom

  You cannot make an RDP connection to a VM in Azure because the RDP port is not opened in the network security group.

  Solution

  When you create a new VM, all traffic from the Internet is blocked by default.

  To enable the RDP port in an NSG, follow these steps:

  Step 1: Sign in to the Azure portal.

  Step 2: In Virtual Machines, select the VM that has the problem.

  Step 3: In Settings, select Networking.

  Step 4: In Inbound port rules, check whether the port for RDP is set correctly. The following is an example of the configuration:

  Priority: 300

  Name: Port_3389

  Port(Destination): 3389

  Protocol: TCP

  Source: Any

  Destinations: Any

  Action: Allow

  If you specify the source IP address, this setting allows traffic only from a specific IP address or range of IP addresses to connect to the VM. Make sure that the computer you are using to start the RDP session is within the range.

  Incorrect:

  * Create an RDP connection to a Windows VM using Azure Bastion.

  Need to allow an RDP connection, not try to create a RDP connection.

  https://learn.microsoft.com/en-us/azure/bastion/bastion-connect-vm-rdp-windows

• Question 464:

  You have multiple development teams that will create apps in Azure.

  You plan to create a standard development environment that will be deployed for each team.

  You need to recommend a solution that will enforce resource locks across the development environments and ensure that the locks are applied in a consistent manner.

  What should you include in the recommendation?

  A. an Azure policy
  B. an Azure Resource Manager template
  C. a management group
  D. an Azure blueprint
  D. an Azure blueprint

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

• Question 465:

  You have an Azure subscription that contains a storage account named storage1 and two web apps named app1 and app2.

  Both apps will write data to storage1.

  You need to ensure that each app can read only the data that it has written.

  What should you do?

  A. Provide each app with a system-assigned identity and configure storage1 to use Azure AD User account authentication.
  B. Provide each app with a separate Storage account key and configure the app to send the key with each request.
  C. Provide each app with a user-managed identity and configure storage1 to use Azure AD User account authentication.
  D. Provide each app with a unique Base64-encoded AES-256 encryption key and configure the app to send the key with each request.
  C. Provide each app with a user-managed identity and configure storage1 to use Azure AD User account authentication.

  ---

  Explanation

  A user-assigned identity is a standalone Azure resource that can be assigned to your app. An app can have multiple user-assigned identities.

  Incorrect:

  Not A: A system-assigned identity is tied to your application and is deleted if your app is deleted. An app can only have one system-assigned identity.

  https://docs.microsoft.com/en-us/azure/app-service/overview-managed-identity

• Question 466:

  HOTSPOT

  You have an Azure SQL database named DB1 that contains a table named Tablet.

  You need to configure DB1 to meet the following requirements:

  Sensitive data in Table1 must be identified automatically.

  Only the first character and last character of the sensitive data must be displayed in query results.

  Which two features should you configure? To answer, select the features in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 467:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Sub1.

  You have an Azure Storage account named Sa1 in a resource group named RG1.

  Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.

  You discover that unauthorized users accessed both the file service and the blob service.

  You need to revoke all access to Sa1.

  Solution: You create a lock on Sa1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately affects all of the shared access signatures associated with it.

  References:

  https://docs.microsoft.com/en-us/rest/api/storageservices/Establishing-a-Stored-Access-Policy

• Question 468:

  HOTSPOT

  Your on-premises network contains the servers shown in the following table.

  

  You have an Azure subscription that contains multiple virtual machines that run either Windows Server 2019 or SLES.

  You plan to implement adaptive application controls in Microsoft Defender for Cloud.

  Which operating systems and platforms can you monitor? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 469:

  You have an Azure AD tenant that contains three users named User1, User2, and User3.

  You configure Azure AD Password Protection as shown in the following exhibit.

  

  The users perform the following tasks:

  1. User1 attempts to reset her password to C0nt0s0.

  2. User2 attempts to reset her password to F@brikamHQ.

  3. User3 attempts to reset her password to Pr0duct123.

  Which password reset attempts fail?

  A. User1 only
  B. User2 only
  C. User3 only
  D. User1 and User 3 only
  E. User1, User2, and User3
  E. User1, User2, and User3

• Question 470:

  HOTSPOT

  You plan to use Azure Monitor Logs to collect logs from 200 servers that run Windows Server 2016.

  You need to automate the deployment of the Log Analytics Agent to all the servers by using an Azure Resource Manager template.

  How should you complete the template? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://blogs.technet.microsoft.com/manageabilityguys/2015/11/19/enabling-the-microsoft-monitoring-agent-in-windows-json-templates/