Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 551:

  You are troubleshooting a security issue for an Azure Storage account.

  You enable the diagnostic logs for the storage account.

  What should you use to retrieve the diagnostics logs?

  A. the Security & Compliance admin center
  B. SQL query editor in Azure
  C. File Explorer in Windows
  D. AzCopy
  D. AzCopy

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/storage/common/storage-analytics-logging?toc=%2fazure%2fstorage%2fblobs%2ftoc.json

• Question 552:

  HOTSPOT

  You have a hybrid Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1 and the servers shown in the following table.

  

  The tenant is linked to an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1.

  User1 is assigned the Storage File Data SMB Share Contributor role for storage1.

  The Security protocol settings for the file shares of storage1 are configured as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 553:

  You need to recommend which virtual machines to use to host App1. The solution must meet the technical requirements for KeyVault1.

  Which virtual machines should you use?

  A. VM1 only
  B. VM1, VM2, VM3, and VM4
  C. VM1 and VM2 only
  D. VM1, VM2, and VM4 only
  B. VM1, VM2, VM3, and VM4

• Question 554:

  SIMULATION

  You need to ensure that connections from the Internet to VNET1\subnet0 are allowed only over TCP port 7777. The solution must use only currently deployed resources.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to configure the Network Security Group that is associated with subnet0.

  1. In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET1. Alternatively, browse to Virtual Networks in the left navigation pane.

  2. In the properties of VNET1, click on Subnets. This will display the subnets in VNET1 and the Network Security Group associated to each subnet. Note the name of the Network Security Group associated to Subnet0.

  3. Type Network Security Groups into the search box and select the Network Security Group associated with Subnet0.

  4. In the properties of the Network Security Group, click on Inbound Security Rules.

  5. Click the Add button to add a new rule.

  6. In the Source field, select Service Tag.

  7. In the Source Service Tag field, select Internet.

  8. Leave the Source port ranges and Destination field as the default values (* and All).

  9. In the Destination port ranges field, enter 7777.

  10.Change the Protocol to TCP. 11.Leave the Action option as Allow. 12.Change the Priority to 100. 13.Change the Name from the default Port_8080 to something more descriptive such as Allow_TCP_7777_from_Internet. The name cannot contain spaces. 14.Click the Add button to save the new rule.

• Question 555:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to configure AFW1 to only allow traffic from VM1 to storage accounts in the West US Azure region. The solution must minimize administrative effort.

  What should you configure?

  A. a DNAT rule
  B. a network rule
  C. an SNAT private IP address range
  D. an application rule
  B. a network rule

• Question 556:

  HOTSPOT

  You have an Azure Storage account that contains a blob container named container1 and a client application named App1.

  You need to enable App1 access to container1 by using Azure Active Directory (Azure AD) authentication.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://azure.microsoft.com/en-in/blog/announcing-the-preview-of-aad-authentication-for-storage/

  https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/storage/common/storage-auth-aad-rbac-portal.md

• Question 557:

  You have a hybrid configuration of Azure Active Directory (Azure AD).

  All users have computers that run Windows 10 and are hybrid Azure AD joined.

  You have an Azure SQL database that is configured to support Azure AD authentication.

  Database developers must connect to the SQL database by using Microsoft SQL Server Management Studio (SSMS) and authenticate by using their on-premises Active Directory account.

  You need to tell the developers which authentication method to use to connect to the SQL database from SSMS. The solution must minimize authentication prompts.

  Which authentication method should you instruct the developers to use?

  A. SQL Login
  B. Active Directory - Universal with MFA support
  C. Active Directory - Integrated
  D. Active Directory - Password
  C. Active Directory - Integrated

  ---

  Explanation

  Azure AD can be the initial Azure AD managed domain. Azure AD can also be an on-premises Active Directory Domain Services that is federated with the Azure AD.

  Using an Azure AD identity to connect using SSMS or SSDT

  The following procedures show you how to connect to a SQL database with an Azure AD identity using SQL Server Management Studio or SQL Server Database Tools.

  Active Directory integrated authentication

  Use this method if you are logged in to Windows using your Azure Active Directory credentials from a federated domain.

  1. Start Management Studio or Data Tools and in the Connect to Server (or Connect to Database Engine) dialog box, in the Authentication box, select Active Directory - Integrated. No password is needed or can be entered because your existing credentials will be presented for the connection.

  

  2. Select the Options button, and on the Connection Properties page, in the Connect to database box, type the name of the user database you want to connect to. (The AD domain name or tenant ID" option is only supported for Universal with MFA connection options, otherwise it is greyed out.)

  References:

  https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/sql-database/sql-database-aad-authentication-configure.md

• Question 558:

  DRAG DROP

  You have an Azure subscription.

  You plan to implement Azure DDoS Protection. The solution must meet the following requirements:

  1. Provide access to DDoS rapid response support during active attacks.

  2. Protect Basic SKU public IP addresses.

  You need to recommend which type of DDoS Protection to use for each requirement.

  What should you recommend? To answer, drag the appropriate DDoS Protection types to the correct requirements. Each DDoS Protection type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-sku-comparison

• Question 559:

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  From Azure Security Center, you turn on Auto Provisioning.

  You deploy the virtual machines shown in the following table.

  

  On which virtual machines is the Log Analytics agent installed?

  On which virtual machines is the Microsoft Monitoring agent installed?

  A. VM3 only
  B. VM1 and VM3 only
  C. VM3 and VM4 only
  D. VM1, VM2, VM3, and VM4
  D. VM1, VM2, VM3, and VM4

  ---

  Explanation

  When automatic provisioning is On, Security Center provisions the Log Analytics Agent on all supported Azure VMs and any new ones that are created.

  Supported Operating systems include: Ubuntu 14.04 LTS (x86/x64), 16.04 LTS (x86/x64), and 18.04 LTS (x64) and Windows Server 2008 R2, 2012, 2012 R2, 2016, version 1709 and 1803

  https://docs.microsoft.com/en-us/azure/security-center/security-center-enable-data-collection

• Question 560:

  HOTSPOT

  You have an Azure Container Registry named Registry1.

  You add role assignment for Registry1 as shown in the following table.

  

  Which users can upload images to Registry1 and download images from Registry1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: User1 and User4 only

  Owner, Contributor and AcrPush can push images.

  Box 2: User1, User2, and User4

  All, except AcrImagineSigner, can download/pull images.

  

  References:

  https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-roles