Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 471:

  You have 10 on-premises servers that run Windows Server 2019.

  You plan to implement Azure Security Center vulnerability scanning for the servers.

  What should you install on the servers first?

  A. the Azure Arc enabled servers Connected Machine agent
  B. the Microsoft Defender for Endpoint agent
  C. the Security Events data connector in Azure Sentinel
  D. the Microsoft Endpoint Configuration Manager client
  A. the Azure Arc enabled servers Connected Machine agent

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/azure-arc/servers/agent-overview

  https://docs.microsoft.com/en-us/azure/security-center/deploy-vulnerability-assessment-vm

• Question 472:

  DRAG DROP

  Your company has an Azure Active Directory (Azure AD) tenant named contoso.com.

  The company is developing an application named App1. App1 will run as a service on server that runs Windows Server 2016. App1 will authenticate to contoso.com and access Microsoft Graph to read directory data.

  You need to delegate the minimum required permissions to App1.

  Which three actions should you perform in sequence from the Azure portal? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create an app registration

  First the application must be created/registered.

  Step 2: Add an application permission

  Application permissions are used by apps that run without a signed-in user present.

  Step 3: Grant permissions

  Incorrect Answers:

  Delegated permission

  Delegated permissions are used by apps that have a signed-in user present.

  Application Proxy:

  Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent

• Question 473:

  You have an Azure subscription that contains a web app named App1.

  Users must be able to select between a Google identity or a Microsoft identity when authenticating to App1.

  You need to add Google as an identity provider in Azure AD.

  Which two pieces of information should you configure? Each correct answer presents part of the solution.

  Each correct selection is worth one point

  A. a tenant name
  B. a tenant ID
  C. the endpoint URL Of an application
  D. a client ID
  E. a client secret
  D. a client ID
  E. a client secret

  ---

  Explanation

  Configure Google federation in Azure AD.

  You'll now set the Google client ID and client secret. You can use the Azure portal or PowerShell to do so. Be sure to test your Google federation configuration by inviting yourself. Use a Gmail address and try to redeem the invitation with your invited Google account.

  To configure Google federation in the Azure portal:

  1. Sign in to the Azure portal as an External Identity Provider Administrator or a Global Administrator.

  2. In the left pane, select Azure Active Directory.

  3. Select External Identities.

  4. Select All identity providers, and then select the Google button.

  5. Enter the client ID and client secret you obtained earlier.

  https://learn.microsoft.com/en-us/azure/app-service/configure-authentication-provider-google

• Question 474:

  SIMULATION

  The developers at your company plan to create a web app named App10598168 and to publish the app to https://www.contoso.com.

  You need to perform the following tasks:

  1. Ensure that App10598168 is registered to Azure Active Directory (Azure AD).

  2. Generate a password for App10598168.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  Register an application with the Microsoft identity platform (Steps 1-8 below)

  Register an application

  Registering your application establishes a trust relationship between your app and the Microsoft identity platform. The trust is unidirectional: your app trusts the Microsoft identity platform, and not the other way around. Once created, the application object cannot be moved between different tenants.

  Follow these steps to create the app registration:

  Step 1: Sign in to the Azure portal.

  Step 2: If you have access to multiple tenants, use the Directories + subscriptions filter in the top menu to switch to the tenant in which you want to register the application.

  Step 3: Search for and select Azure Active Directory.

  Step 4: Under Manage, select App registrations > New registration.

  Step 5: Enter a display Name for your application. Users of your application might see the display name when they use the app, for example during sign-in. You can change the display name at any time and multiple app registrations can share the same name. The app registration's automatically generated Application (client) ID, not its display name, uniquely identifies your app within the identity platform.

  Step 6: Specify who can use the application, sometimes called its sign-in audience.

  * Details omitted* Step 7: Don't enter anything for Redirect URI (optional). You'll configure a redirect URI in the next section.

  Step 8: Select Register to complete the initial app registration.

  

  Now for the password.

  Add a client secret

  Sometimes called an application password, a client secret is a string value your app can use in place of a certificate to identity itself.

  1. In the Azure portal, in App registrations, select your application.

  2. Select Certificates & secrets > Client secrets > New client secret.

  3. Add a description for your client secret.

  4. Select an expiration for the secret or specify a custom lifetime. Client secret lifetime is limited to two years (24 months) or less. You can't specify a custom lifetime longer than 24 months. Microsoft recommends that you set an expiration value of less than 12 months.

  5. Select Add.

  6. Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.

  https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app

• Question 475:

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain that syncs with an Azure AD tenant.

  You plan to implement single sign-on (SSO) for Azure AD resources.

  You need to configure an Intranet Zone setting for all users by using a Group Policy Object (GPO).

  Which setting should you configure?

  A. Logon options
  B. Allow updates to status bar via script
  C. Allow active scripting
  D. Access data sources across domains
  B. Allow updates to status bar via script

• Question 476:

  You have an Azure subscription and the computers shown in the following table.

  

  You need to perform a vulnerability scan of the computers by using Microsoft Defender for Cloud.

  Which computers can you scan?

  A. VM1 only
  B. VM1 and VM2 only
  C. Server1 and VMSS1.0 only
  D. VM1, VM2, and Server1 only
  E. VM1, VM2, Server1, and VMSS1.0
  D. VM1, VM2, and Server1 only

  ---

  Explanation

  Defender for Cloud's integrated Qualys vulnerability scanner for Azure and hybrid machines

  Availability:

  Machine types (hybrid scenarios):

  Azure virtual machines

  Azure Arc-enabled machines

  Note:

  Supported include:

  Red Hat, Enterprise Linux,

  Versions: 5.4+, 6, 7-7.9, 8-8.6, 9 beta

  Incorrect:

  Not E: Why does my machine show as "not applicable" in the recommendation?

  If you have machines in the not applicable resources group, Defender for Cloud can't deploy the vulnerability scanner extension on those machines because:

  The vulnerability scanner included with Microsoft Defender for Cloud is only available for machines protected by Microsoft Defender for Servers.

  (not E) It's a PaaS resource, such as an image in an AKS cluster or part of a virtual machine scale set.

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm

• Question 477:

  HOTSPOT

  You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016.

  You need to implement a policy to ensure that each virtual machine has a custom antimalware virtual machine extension installed.

  How should you complete the policy? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: DeployIfNotExists

  DeployIfNotExists executes a template deployment when the condition is met.

  Box 2: Template

  The details property of the DeployIfNotExists effects has all the subproperties that define the related resources to match and the template deployment to execute.

  Deployment [required]

  This property should include the full template deployment as it would be passed to the Microsoft.Resources/deployment

  References:

  https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

• Question 478:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Security Center for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create an initiative and an assignment that is scoped to a management group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/governance/policy/overview

• Question 479:

  HOTSPOT

  You have an Azure subscription that contains the key vaults shown in the following table.

  

  The subscription contains the users shown in the following table.

  

  On June 1, you perform the following actions:

  1. Delete a key named key1 from KeyVault1.

  2. Delete a secret named secret1 from KeyVault2.

  For each of the following statements, select Yes If the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Y - within 10 days

  N - purge protection enabled so no, also Secrets officer has not enough permission

  N - more than 15 days have passed, so already deleted and not possible to recover anymore

• Question 480:

  You need to consider the underlined segment to establish whether it is accurate.

  Your Azure Active Directory Azure (Azure AD) tenant has an Azure subscription linked to it.

  Your developer has created a mobile application that obtains Azure AD access tokens using the OAuth 2 implicit grant type.

  The mobile application must be registered in Azure AD.

  You require a redirect URI from the developer for registration purposes.

  Select "No adjustment required" if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

  A. No adjustment required
  B. a secret
  C. a login hint
  D. a client ID
  A. No adjustment required

  ---

  Explanation

  For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.

  https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code