Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 531:

  You have an Azure SQL database.

  You implement Always Encrypted.

  You need to ensure that application developers can retrieve and decrypt data in the database.

  Which two pieces of information should you provide to the developers? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a stored access policy
  B. a shared access signature (SAS)
  C. the column encryption key
  D. user credentials
  E. the column master key
  C. the column encryption key
  E. the column master key

  ---

  Explanation

  Always Encrypted uses two types of keys: column encryption keys and column master keys. A column encryption key is used to encrypt data in an encrypted column. A column master key is a key-protecting key that encrypts one or more column encryption keys.

  References:

  https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine

• Question 532:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  NSG1 rules restrict access to the internet from Subnet3.

  The subscription contains the function apps shown in the following table.

  

  Virtual network integration has the default settings.

  You need to configure network access for App1 and App2 to meet the following requirements:

  1. Deny inbound access to App1 from Subnet1 and allow inbound access from Subnet2.

  2. Deny outbound access from App2 to the internet.

  What should you do for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 533:

  You have an Azure environment.

  You need to identify any Azure configurations and workloads that are non-compliant with ISO 27001 standards.

  What should you use?

  A. Azure Sentinel
  B. Azure Active Directory (Azure AD) Identity Protection
  C. Azure Security Center
  D. Azure Advanced Threat Protection (ATP)
  C. Azure Security Center

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/security-center/security-center-compliance-dashboard

• Question 534:

  SIMULATION

  The developers at your company plan to create a web app named App28681041 and to publish the app to https://www.contoso.com.

  You need to perform the following tasks:

  1. Ensure that App28681041 is registered to Azure AD.

  2. Generate a password for App28681041.

  To complete this task, sign in to the Azure portal.

  A. Check the Explanation below
  B. Place Holder
  C. Place Holder
  D. Place Holder
  A. Check the Explanation below

  ---

  Explanation

  Register an application with the Microsoft identity platform (Steps 1-8 below)

  Register an application

  Registering your application establishes a trust relationship between your app and the Microsoft identity platform. The trust is unidirectional: your app trusts the Microsoft identity platform, and not the other way around. Once created, the application object canot be moved between different tenants

  Follow these steps to create the app registration:

  Step 1: Sign in to the Azure portal.

  Step 2: If you have access to multiple tenants, use the Directories + subscriptions filter in the top menu to switch to the tenant in which you want to register the application

  Step 3: Search for and select Azure Active Directory

  Step 4: Under Manage, select App registrations > New registration.

  Step 5: Enter a display Name for your application. Users of your application might see the display name when they use the app, for example during sign-in. You can change the display name at any time and multiple app registrations can share the same name. The app registration's automatically generated Application (client) ID, not its display name, uniquely identifies your app within the identity platform.

  Step 6: Specify who can use the application, sometimes called its sign-in audience.

  * Details omitted* Step 7: Don't enter anything for Redirect URI (optional). Youll configure a redirect URI in the next section.

  Step 8: Select Register to complete the initial app registration.

  

  Now for the password.

  Add a client secret

  Sometimes called an application password, a client secret is a string value your app can use in place of a certificate to identity itself.

  1. In the Azure portal, in App registrations, select your application.

  2. Select Certificates & secrets > Client secrets > New client secret.

  3. Add a description for your client secret.

  4. Select an expiration for the secret or specify a custom lifetime. Client secret lifetime is limited to two years (24 months) or less. You can't specify a custom ifetime longer than 24 months. Microsoft recommends that you set an expiration value of less than 12 months.

  5. Select Add 6. Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.

  https:/learn.microsoff.com/en-us/azure/active-directory/develop/quickstart-register-app

• Question 535:

  You have an Azure subscription that contains the resources shown in the following Table.

  

  You plan to enable Microsoft Defender for Cloud for the subscription.

  Which resources can be protected by using Microsoft Defender for Cloud?

  A. VM1, VNET1, and storage1 only
  B. VM1, storage1, and Vault1 only
  C. VM1.VNET1, storage1, and Vault1
  D. VM1 and storage1 only
  E. VM1 and VNET only
  C. VM1.VNET1, storage1, and Vault1

• Question 536:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  VNet1 connects to a remote site by using a Site-to-Site (S2S) VPN that uses forced tunneling.

  VNet1 contains the subnets shown in the following table.

  

  The SQL subnet contains SQL1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 537:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Security Center for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create a policy initiative and assignments that are scoped to resource groups.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead use a management group.

  Management groups in Microsoft Azure solve the problem of needing to impose governance policy on more than one Azure subscription simultaneously.

  https://4sysops.com/archives/apply-governance-policy-to-multiple-azure-subscriptions-with-management-groups/

• Question 538:

  HOTSPOT

  You have a network security group (NSG) bound to an Azure subnet.

  You run Get-AzureRmNetworkSecurityRuleConfig and receive the output shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: able to connect to East US 2

  The StorageEA2Allow has DestinationAddressPrefix {Storage/EastUS2}

  Box 2: DROPPED (because the cidr notation is a /32 which means only one IP, which is different from the IP in the rule. so the packet would be dropped. Note:

  The Get-AzureRmNetworkSecurityRuleConfig cmdlet gets a network security rule configuration for an Azure network security group. Security rules in network security groups enable you to filter the type of network traffic that can flow in and out of virtual network subnets and network interfaces.

  https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group

• Question 539:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Azure subscription that includes an Azure key vault. You have previously created a secret in the key vault.

  After an application developer registers an application in Azure Active Directory (Azure AD), you are instructed to make sure that the application is able to use the secret you created.

  Solution: You should create a DLP policy.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 540:

  You have an Azure SQL Database server named SQL1.

  You plan to turn on Advanced Threat Protection for SQL1 to detect all threat detection types.

  Which action will Advanced Threat Protection detect as a threat?

  A. A user updates more than 50 percent of the records in a table.
  B. A user attempts to sign as select * from table1.
  C. A user is added to the db_owner database role.
  D. A user deletes more than 100 records from the same table.
  B. A user attempts to sign as select * from table1.

  ---

  Explanation

  Advanced Threat Protection can detect potential SQL injections: This alert is triggered when an active exploit happens against an identified application vulnerability to SQL injection. This means the attacker is trying to inject malicious SQL statements using the vulnerable application code or stored procedures.

  References:

  https://docs.microsoft.com/en-us/azure/sql-database/sql-database-threat-detection-overview