Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 481:

  HOTSPOT

  You implement the planned changes for ASG1 and ASG2.

  In which NSGs can you use ASG1, and the network interfaces of which virtual machines can you assign to ASG2?

  

  

• Question 482:

  You have an Azure subscription.

  You plan to create a workflow automation in Azure Security Center that will automatically remediate a security vulnerability.

  What should you create first?

  A. an automation account
  B. a managed identity
  C. an Azure logic app
  D. an Azure function app
  E. an alert rule
  C. an Azure logic app

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/security-center/workflow-automation

• Question 483:

  HOTSPOT

  You have the Azure virtual networks shown in the following table.

  

  You have the Azure virtual machines shown in the following table.

  

  The firewalls on all the virtual machines allow ping traffic.

  NSG1 is configured as shown in the following exhibit.

  Inbound security rules

  

  Outbound security rules

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  VM1 and VM3 are on peered VNets. The firewall rules with a source of ASG1 and ASG2 allow 'any' traffic on 'any' protocol so pings are allowed between VM1 and VM3.

  Box 2: No

  VM2 and VM4 are on separate VNets and the VNets are not peered. Therefore, the pings would have to go over the Internet. VM4 does have a public IP and the firewall allows pings. However, for VM2 to be able to ping VM4, VM2 would also need a public IP address. In Azure, pings don't go out through the default gateway as they would in a physical network. For an Azure VM to ping external IPs, the VM must have a public IP address assigned to it.

  Box 3: Yes

  VM3 has a public IP address and the firewall allows traffic on port 3389.

• Question 484:

  You have an Azure subscription that contains a virtual machine named VM1.

  You create an Azure key vault that has the following configurations:

  1. Name: Vault5

  2. Region: West US

  3. Resource group: RG1

  You need to use Vault5 to enable Azure Disk Encryption on VM1. The solution must support backing up VM1 by using Azure Backup.

  Which key vault settings should you configure?

  A. Access policies
  B. Secrets
  C. Keys
  D. Locks
  A. Access policies

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault

• Question 485:

  DRAG DROP

  You have an Azure Storage account named storage1 and an Azure virtual machine named VM1. VM1 has a premium SSD managed disk.

  You need to enable Azure Disk Encryption for VM1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange then in the correct order.

  Select and Place:

  

  

  ---

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault

• Question 486:

  You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1.

  VM1 is connected to a virtual network named VNet1.

  You need to allow access to Vault1 only from VM1.

  What should you do in the Networking settings of Vault1?

  A. From the Firewalls and virtual networks tab, add the IP address of VM1.
  B. From the Private endpoint connections tab, create a private endpoint for VM1.
  C. From the Firewalls and virtual networks tab, add VNet1.
  D. From the Firewalls and virtual networks tab, set Allow trusted Microsoft services to bypass this firewall to Yes for Vault1.
  A. From the Firewalls and virtual networks tab, add the IP address of VM1.

  ---

  
  

• Question 487:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to implement Microsoft Defender for Cloud.

  Which resources can be protected by using Defender for Cloud?

  A. VM1 only
  B. VM1 and storage1 only
  C. Vault1 and storage1 only
  D. VM1, Vault1, and storage1 only
  E. VNet1, VM1, Vault1, and storage1
  E. VNet1, VM1, Vault1, and storage1

• Question 488:

  HOTSPOT

  Your network contains an on-premises Active Directory domain named adatum.com that syncs to a Microsoft Entra tenant.

  The Microsoft Entra tenant contains the users shown in the following table.

  

  You configure the Microsoft Entra Password Protection settings for adatum.com as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 489:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a hybrid configuration of Azure Active Directory (Azure AD).

  You have an Azure HDInsight cluster on a virtual network.

  You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.

  You need to configure the environment to support the planned authentication.

  Solution: You deploy the On-premises data gateway to the on-premises network.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead, you connect HDInsight to your on-premises network by using Azure Virtual Networks and a VPN gateway.

  Note: To allow HDInsight and resources in the joined network to communicate by name, you must perform the following actions:

  1. Create Azure Virtual Network.

  2. Create a custom DNS server in the Azure Virtual Network.

  3. Configure the virtual network to use the custom DNS server instead of the default Azure Recursive Resolver.

  4. Configure forwarding between the custom DNS server and your on-premises DNS server.

  References:

  https://docs.microsoft.com/en-us/azure/hdinsight/connect-on-premises-network

• Question 490:

  SIMULATION

  You need to ensure that a user named user2-12345678 can manage the properties of the virtual machines in the RG1lod12345678 resource group. The solution must use the principle of least privilege.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  1. RBAC role: Virtual Machine Contributor

  Create and manage virtual machines, manage disks, install and run software, reset password of the root user of the virtual machine using VM extensions, and manage local user accounts using VM extensions. This role does not grant you management access to the virtual network or storage account the virtual machines are connected to. This role does not allow you to assign roles in Azure RBAC.

  Grant a user access to Azure resources using the Azure portal

  Azure role-based access control (Azure RBAC) is the way that you manage access to Azure resources.

  Here you will grant a user access to create and manage virtual machines in a resource group.

  Grant access

  In Azure RBAC, to grant access, you assign an Azure role.

  Step 1: In the list of Resource groups, open the RG1lod28681041 resource group.

  Step 2: In the navigation menu, click Access control (IAM).

  Step 3: Click the Role assignments tab to see the current list of role assignments.

  

  Step 4: Click Add > Add role assignment.

  Step 5: On the Role tab, select the Virtual Machine Contributor role.

  

  Step 6: On the Members tab, select yourself or another user.

  Step 7: On the Review + assign tab, review the role assignment settings.

  Step 8: Click Review + assign to assign the role.

  After a few moments, the user is assigned the Virtual Machine Contributor role at the RG1lod28681041 resource group scope.

  

  https://learn.microsoft.com/en-us/azure/role-based-access-control/quickstart-assign-role-user-portal

  https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#classic-virtual-machine-contributor