Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 491:

  You are in the process of configuring an Azure policy via the Azure portal.

  Your policy will include an effect that will need a managed identity for it to be assigned.

  Which of the following is the effect in question?

  A. AuditIfNotExist
  B. Disabled
  C. DeployIfNotExist
  D. EnforceOPAConstraint
  C. DeployIfNotExist

  ---

  Explanation

  When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity.

  https://docs.microsoft.com/bs-latn-ba/azure/governance/policy/how-to/remediate-resources

• Question 492:

  HOTSPOT

  You have a Microsoft Entra tenant that contains the users shown in the following table.

  

  You configure a Conditional Access policy that has the following settings:

  Name: CAPolicy1

  Assignments

  Users or workload identities: Group1

  Target resources: All cloud apps

  Access controls

  Grant access: Require multifactor authentication

  From Microsoft Authenticator settings for the tenant, the Enable and Target settings are configured as shown in the Enable and Target exhibit. (Click the Enable and Target tab.)

  

  From Microsoft Authenticator settings for the tenant, the Configure settings are configured as shown in the Configure exhibit. (Click the Configure tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 493:

  You have been tasked with creating an Azure key vault using PowerShell. You have been informed that objects deleted from the key vault must be kept for a set period of 90 days.

  Which two of the following parameters must be used in conjunction to meet the requirement? (Choose two.)

  A. EnabledForDeployment
  B. EnablePurgeProtection
  C. EnabledForTemplateDeployment
  D. EnableSoftDelete
  B. EnablePurgeProtection
  D. EnableSoftDelete

  ---

  Explanation

  https://docs.microsoft.com/en-us/powershell/module/azurerm.keyvault/new-azurermkeyvault

  https://docs.microsoft.com/en-us/azure/key-vault/key-vault-ovw-soft-delete

• Question 494:

  SIMULATION

  You need to ensure that User2-11641655 has all the key permissions for KeyVault11641655.

  To complete this task, sign in to the Azure portal and modify the Azure resources.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to assign the user the Key Vault Secrets Officer role.

  1. In the Azure portal, type Key Vaults in the search box, select Key Vaults from the search results then select KeyVault11641655. Alternatively, browse to Key Vaults in the left navigation pane.

  2. In the key vault properties, select Access control (IAM).

  3. In the Add a role assignment section, click the Add button.

  4. In the Role box, select the Key Vault Secrets Officer role from the drop-down list.

  5. In the Select box, start typing User2-11641655 and select User2-11641655 from the search results.

  6. Click the Save button to save the changes.

• Question 495:

  You have three on-premises servers named Server1, Server2, and Server3 that run Windows. Server1 and Server2 and located on the Internal network. Server3 is located on the premises network. All servers have access to Azure.

  From Azure Sentinel, you install a Windows firewall data connector.

  You need to collect Microsoft Defender Firewall data from the servers for Azure Sentinel.

  What should you do?

  A. Create an event subscription from Server1, Server2 and Server3
  B. Install the On-premises data gateway on each server.
  C. Install the Microsoft Agent on each server.
  D. Install the Microsoft Agent on Server1 and Server2 install the on-premises data gateway on Server3.
  C. Install the Microsoft Agent on each server.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/sentinel/connect-windows-firewall

• Question 496:

  HOTSPOT

  You create a new Azure subscription that is associated to a new Azure Active Directory (Azure AD) tenant.

  You create one active conditional access policy named Portal Policy. Portal Policy is used to provide access to the Microsoft Azure Management cloud app.

  The Conditions settings for Portal Policy are configured as shown in the Conditions exhibit. (Click the Conditions tab.)

  

  The Grant settings for Portal Policy are configured as shown in the Grant exhibit. (Click the Grant tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  YES - Contoso location requires MFA to use AZ Portal NO - Contoso location does not require MFA to use web NO - External users from Contoso location are not required to use MFA for AZ portal

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-azure-mfa?toc=/azure/active-directory/conditional-access/toc.json&bc=/azure/active-directory/conditional-access/breadcrumb/toc.json#configure-the-conditions-for-multi-factor-authentication

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps#microsoft-cloud-applications

• Question 497:

  Your company's Azure subscription includes Windows Server 2016 Azure virtual machines.

  You are informed that every virtual machine must have a custom antimalware virtual machine extension installed. You are writing the necessary code for a policy that will help you achieve this.

  Which of the following is an effect that must be included in your code?

  A. Disabled
  B. Modify
  C. AuditIfNotExists
  D. DeployIfNotExists
  D. DeployIfNotExists

  ---

  Explanation

  DeployIfNotExists executes a template deployment when the condition is met.

  https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

• Question 498:

  You have an Azure subscription that contains a virtual network named VNet1. The subscription contains an Azure App Service web app named App1.

  You have an Azure Front Door profile named AFD1 that has an Azure Web Application Firewall (WAF) policy.

  You need to ensure that all inbound traffic to App1 is filtered through AFD1.

  What should you do?

  A. For VNet1, configure network security group (NSG) rules.
  B. For App1, configure the HTTP headers filter settings.
  C. For App1, enable virtual network integration.
  D. Configure Microsoft Entra application proxy.
  B. For App1, configure the HTTP headers filter settings.

• Question 499:

  HOTSPOT

  You have an Azure subscription.

  You need to create and deploy an Azure policy that meets the following requirements:

  1. When a new virtual machine is deployed, automatically install a custom security extension.

  2. Trigger an autogenerated remediation task for non-compliant virtual machines to install the extension.

  What should you include in the policy? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources

• Question 500:

  You need to ensure that you can meet the security operations requirements.

  What should you do first?

  A. Turn on Auto Provisioning in Security Center.
  B. Integrate Security Center and Microsoft Cloud App Security.
  C. Upgrade the pricing tier of Security Center to Standard.
  D. Modify the Security Center workspace configuration.
  C. Upgrade the pricing tier of Security Center to Standard.

  ---

  Explanation

  The Standard tier extends the capabilities of the Free tier to workloads running in private and other public clouds, providing unified security management and threat protection across your hybrid cloud workloads. The Standard tier also adds advanced threat detection capabilities, which uses built-in behavioral analytics and machine learning to identify attacks and zero-day exploits, access and application controls to reduce exposure to network attacks and malware, and more.

  Scenario: Security Operations Requirements

  Litware must be able to customize the operating system security configurations in Azure Security Center.

  References:

  https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing