Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 511:

  You have an Azure web app named WebApp1.

  You upload a certificate to WebApp1.

  You need to make the certificate accessible to the app code of WebApp1.

  What should you do?

  A. Add a user-assigned managed identity to WebApp1.
  B. Add an app setting to the WebApp1 configuration.
  C. Enable system-assigned managed identity for the WebApp1.
  D. Configure the TLS/SSL binding for WebApp1.
  B. Add an app setting to the WebApp1 configuration.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate-in-code

• Question 512:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You have an Azure Cosmos DB account named cosmos1 configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  VM1 is in vnet1/subnet1.

  Access to the Azure Cosmos DB account is allowed from vnet1/subnet1. vnet1/subnet1 Endpoint status is enabled.

  Box 2: No

  VM2 is in vnet1/subnet2.

  Access to the Azure Cosmos DB account is allowed from vnet1/subnet2.

  However, the Endpoint status of vnet1/subnet2 is disabled.

  Box 3: Yes

  VM3 has the public IP address 40.122.155.212.

  The Firewall allows Access to the Azure Cosmos DB account from the 40.122.155.0/24 address range.

• Question 513:

  You have an Azure subscription that contains an Azure Data Lake Storage Gen2 account named storage1.

  You deploy an Azure Synapse Analytics workspace named synapsews1 to a managed virtual network.

  You need to enable access from synapsews1 to storage1.

  What should you configure?

  A. peering
  B. a private endpoint
  C. a network security group (NSG)
  D. a virtual network gateway
  B. a private endpoint

  ---

  Explanation

  Connect to workspace resources from a restricted network

  Suppose you are an IT administrator who is managing your organization's restricted network. You want to enable the network connection between Azure Synapse Analytics Studio and a workstation within this restricted network. This article shows you how.

  Step 1: Add network outbound security rules to the restricted network

  Step 2: Create private link hubs

  Step 3: Create a private endpoint for your Synapse Studio

  Step 4: Create private endpoints for your workspace resource

  https://learn.microsoft.com/en-us/azure/synapse-analytics/security/how-to-connect-to-workspace-from-restricted-network

• Question 514:

  DRAG DROP

  You have an Azure subscription named Sub1.

  You have an Azure Active Directory (Azure AD) group named Group1 that contains all the members of your IT team.

  You need to ensure that the members of Group1 can stop, start, and restart the Azure virtual machines in Sub1. The solution must use the principle of least privilege.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  References:

  https://www.petri.com/cloud-security-create-custom-rbac-role-microsoft-azure

• Question 515:

  Your company plans to create separate subscriptions for each department. Each subscription will be associated to the same Azure Active Directory (Azure AD) tenant.

  You need to configure each subscription to have the same role assignments.

  What should you use?

  A. Azure Security Center
  B. Azure Blueprints
  C. Azure AD Privileged Identity Management (PIM)
  D. Azure Policy
  B. Azure Blueprints

  ---

  Explanation

  Just as a blueprint allows an engineer or an architect to sketch a project's design parameters, Azure Blueprints enables cloud architects and central information technology groups to define a repeatable set of Azure resources that implements and adheres to an organization's standards, patterns, and requirements.

  Blueprints are a declarative way to orchestrate the deployment of various resource templates and other artifacts such as:

  1. Role Assignments

  2. Policy Assignments

  3. Azure Resource Manager templates

  4. Resource Groups Reference:

  https://docs.microsoft.com/en-us/azure/governance/blueprints/overview

• Question 516:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create a shared access token as shown in the following exhibit.

  

  Which resources can you access by using the shared access token and Key1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  Box 1: Container1

  Shared access token

  The Shared access token applies only to Container1.

  Box 2: container1 and share1 only

  Key1

  The account key applies to the storage account, in this case contoso2023 which include container1 and share1.

  https://learn.microsoft.com/en-us/azure/cognitive-services/translator/document-translation/how-to-guides/create-sas-tokens

• Question 517:

  You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry.

  You need to use automatically generated service principal for the AKS cluster to authenticate to the Azure Container Registry.

  What should you create?

  A. a secret in Azure Key Vault
  B. a role assignment
  C. an Azure Active Directory (Azure AD) user
  D. an Azure Active Directory (Azure AD) group
  B. a role assignment

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal

• Question 518:

  HOTSPOT

  Your company has an Azure subscription named Subscription1. Subscription1 is associated with the Azure Active Directory tenant that includes the users shown in the following table.

  

  The company is sold to a new owner.

  The company needs to transfer ownership of Subscription1.

  Which user can transfer the ownership and which tool should the user use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/billing-subscription-transfer

• Question 519:

  You have an Azure subscription named Subscription1 that is linked to a Microsoft Entra tenant named contoso.com and a resource group named RG1.

  You create a custom role named Role1 in contoso.com.

  Where can you use Role1 for permission delegation?

  A. contoso.com only
  B. contoso.com and RG1 only
  C. contoso.com and Subscription 1 only
  D. contoso.com. RG1. and Subscription1
  D. contoso.com. RG1. and Subscription1

• Question 520:

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  You have an Amazon Web Services (AWS) account.

  You need to ensure that when you deploy a new AWS Elastic Compute Cloud (EC2) instance, the Microsoft Defender for Servers agent installs automatically.

  What should you configure first?

  A. the classic cloud connector
  B. the Azure Monitor agent
  C. the Log Analytics agent
  D. the native cloud connector
  D. the native cloud connector

  ---

  Explanation

  Native cloud connector is the recommended way and provides an agentless connection to your AWS account that can extend with Defender for Cloud's Defender plans to secure the AWS resources.

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings