Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 501:

  DRAG DROP

  You have five Azure subscriptions linked to a single Azure Active Directory (Azure AD) tenant.

  You create an Azure Policy initiative named SecurityPolicyInitiative1.

  You identify which standard role assignments must be configured on all new resource groups.

  You need to enforce SecurityPolicyInitiative1 and the role assignments when a new resource group is created.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  https://docs.microsoft.com/en-us/azure/governance/blueprints/create-blueprint-portal

  https://docs.microsoft.com/en-us/azure/azure-australia/azure-policy

• Question 502:

  You have a Microsoft Entra tenant that uses Microsoft Entra Permissions Management and contains the accounts shown in the following table:

  

  Which accounts will be listed as assigned to highly privileged roles on the Azure AD insights tab in the Entra Permissions Management portal?

  A. Admin1 only
  B. Admin2 and Admin3 only
  C. Admin2 and Admin4 only
  D. Admin1. Admin2, and Admin3 only
  E. Admin2. Admin3, and Admin4 only
  F. Admin1. Admin2, Admin3. and Admin4
  D. Admin1. Admin2, and Admin3 only

• Question 503:

  HOTSPOT

  You have the role assignments shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

• Question 504:

  You are collecting events from Azure virtual machines to an Azure Log Analytics workspace.

  You plan to create alerts based on the collected events.

  You need to identify which Azure services can be used to create the alerts.

  Which two services should you identify? Each correct answer presents a complete solution

  NOTE: Each correct selection is worth one point.

  A. Azure Monitor
  B. Azure Security Center
  C. Azure Analytics Services
  D. Azure Sentinel
  E. Azure Advisor
  A. Azure Monitor
  D. Azure Sentinel

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/analysis-services/analysis-services-overview

• Question 505:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  Subnet1 and Subnet2 have a Microsoft.Storage service endpoint configured.

  You have an Azure Storage account named storageacc1 that is configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  

  

  ---

  Box 1: Yes

  The public IP of VM1 is allowed through the firewall.

  Box 2: No

  The allowed virtual network list is empty so VM2 cannot access storageacc1 directly. The public IP address of VM2 is not in the allowed IP list so VM2 cannot access storageacc1 over the Internet.

  Box 3: No

  The allowed virtual network list is empty so VM3 cannot access storageacc1 directly. VM3 does not have a public IP address so it cannot access storageacc1 over the Internet.

  https://docs.microsoft.com/en-gb/azure/storage/common/storage-network-security

• Question 506:

  You have an Azure virtual machine that runs Windows Server R2.

  You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine.

  Which of the following is TRUE with regards to Azure Disk Encryption for a Windows VM?

  A. It is supported for basic tier VMs.
  B. It is supported for standard tier VMs.
  C. It is supported for VMs configured with software-based RAID systems.
  D. It is supported for VMs configured with Storage Spaces Direct (S2D).
  B. It is supported for standard tier VMs.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-windows

• Question 507:

  SIMULATION

  You need to grant the required permissions to a user named User211641655 to manage the virtual networks in the RG1lod11641655 resource group. The solution must use the principle of least privilege.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  1. In Azure portal, locate and select the RG1lod10598168 resource group.

  2. Click Access control (IAM).

  3. Click the Role assignments tab to view all the role assignments at this scope.

  4. Click Add > Add role assignment to open the Add role assignment pane.

  

  5. In the Role drop-down list, select the role Virtual Machine Contributor.

  Virtual Machine Contributor lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.

  6. In the Select list, select user user21059868 7. Click Save to assign the role.

  https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor

• Question 508:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company's Azure subscription is linked to their Azure Active Directory (Azure AD) tenant.

  After an internally developed application is registered in Azure AD, you are tasked with making sure that the application has the ability to access Azure Key Vault secrets on application the users' behalf.

  Solution: You configure a delegated permission with no admin consent.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  Delegated permissions - Your client application needs to access the web API as the signed-in user, but with access limited by the selected permission. This type of permission can be granted by a user unless the permission requires administrator consent.

  https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

• Question 509:

  You have an Azure Active Directory (Azure AD) tenant that contains 500 users and an administrative unit named AU1.

  From the Azure Active Directory admin center, you plan to add the users to AU1 by using Bulk add members.

  You need to create and upload a file for the bulk add.

  What should you include in the file?

  A. only the display name of each user
  B. only the user principal name (UPN) of each user
  C. only the user principal name (UPN) and display name of each user
  D. only the user principal name (UPN) and object identifier of each user
  E. only the object identifier of each user
  C. only the user principal name (UPN) and display name of each user

  ---

  Explanation

  To create users in bulk: Sign in to your Azure AD organization with an account that is a User administrator in the organization.

  In Azure AD, select Users > Bulk create.

  On the Bulk create user page, select Download to receive a valid comma-separated values (CSV) file of user properties, and then add users you want to create.

  Select a local CSV file in which you list the users you want to add

  Open the CSV file and add a line for each user you want to create. The only required values are Name, User principal name, Initial password and Block sign in (Yes/No). Then save the file.

  The CSV file contains names and IDs of the users to create

  On the Bulk create user page, under Upload your CSV file, browse to the file. When you select the file and click Submit, validation of the CSV file starts.

  After the file contents are validated, you'll see File uploaded successfully. If there are errors, you must fix them before you can submit the job.

  When your file passes validation, select Submit to start the Azure bulk operation that imports the new users.

  When the import operation completes, you'll see a notification of the bulk operation job status.

  https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/users-bulk-add

• Question 510:

  HOTSPOT

  You plan to deploy a custom policy initiative for Microsoft Defender for Cloud.

  You need to identify all the resource groups that have a Delete lock.

  How should you complete the policy definition? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/custom-security-policies?pivots=azure-portal