Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 571:

  DRAG DROP

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to perform the following actions:

  Deploy a new app named App1 that will require access to Vault1.

  Configure a shared identity for VM1 and VM2 to access st1.

  You need to configure identities for each requirement. The solution must minimize administrative effort.

  Which type of identity should you configure for each requirement? To answer, drag the appropriate identity types to the correct requirements. Each identity type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 572:

  You have an Azure subscription that contains an Azure SQL database named DB1 in the East US Azure region.

  You create the storage accounts shown in the following table.

  

  You plan to enable auditing for DB1.

  Which storage accounts can you use as the auditing destination for DB1?

  A. storage1 and storage4 only
  B. storage1 only
  C. storage1, storage2, storage3, and storage4
  D. storage1, storage2, and storage3 only
  E. storage2 and storage3 only
  E. storage2 and storage3 only

  ---

  Explanation

  To enable writing to a storage account, the one has to be configured first. Storage accounts are containers used to store Azure Storage objects, including blobs, files, tables, etc, for the auditing needs, general-purpose standard storage accounts will support storing audit data trail, to learn more about storage accounts.

  Incorrect:

  Not A, Not C: Use a storage account in the same region as the managed instance to avoid cross-region reads/writes.

  https://www.sqlshack.com/getting-started-with-azure-sql-database-auditing-using-blob-storage/

  https://docs.microsoft.com/en-us/azure/azure-sql/managed-instance/auditing-configure

• Question 573:

  You want to gather logs from a large number of Windows Server 2016 computers using Azure Log Analytics.

  You are configuring an Azure Resource Manager template to deploy the Microsoft Monitoring Agent to all the servers automatically.

  Which of the following should be included in the template? (Choose all that apply.)

  A. WorkspaceID
  B. AzureADApplicationID
  C. WorkspaceKey
  D. StorageAccountKey
  A. WorkspaceID
  C. WorkspaceKey

  ---

  Explanation

  https://blogs.technet.microsoft.com/manageabilityguys/2015/11/19/enabling-the-microsoft-monitoring-agent-in-windows-json-templates/

• Question 574:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains two users named User1 and User2 and a registered app named App1.

  You create an app-specific role named Role1.

  You need to assign Role1 to User1 and enable User2 to request access to App1.

  Which two settings should you modify? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Roles and administrators

  Here you will find Role1 and be able to assign User1 to the role.

  Box 2: Self Service

  Under Self Service, there is an option to "Allow users to request access to this application".

• Question 575:

  You have an Azure subscription.

  You plan to map an online infrastructure and perform vulnerability scanning for the following:

  1. ASNs

  2. Hostnames

  3. IP addresses

  4. SSL certificates

  What should you use?

  A. Microsoft Defender for Cloud
  B. Microsoft Defender for Identity
  C. Microsoft Defender for Endpoint
  D. Microsoft Defender External Attack Surface Management (Defender EASM)
  D. Microsoft Defender External Attack Surface Management (Defender EASM)

• Question 576:

  HOTSPOT

  You need to create Role1 to meet the platform protection requirements.

  How should you complete the role definition of Role1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1) Microsoft.Compute/ 2) disks 3) /subscrption/{subscriptionId}/resourceGroups/{Resource Group Id}

  A new custom RBAC role named Role1 must be used to delegate the administration of the managed disks in Resource Group1. Role1 must be available only for Resource Group1.

• Question 577:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name.

  You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect.

  Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced.

  Solution: You recommend the use of pass-through authentication and seamless SSO with password hash synchronization.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  "must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant" keyword here in this question is 'synced'. So, answer is YES

  Password hash synchronization. A sign-in method that synchronizes a hash of a users on-premises AD password with Azure AD.

  Pass-through authentication. A sign-in method that allows users to use the same password on-premises and in the cloud, but doesn't require the additional infrastructure of a federated environment.

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

• Question 578:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that has Azure Active Directory Premium Plan 1 licenses.

  You need to create a group named Group1 that will be assigned the Global reader role.

  Which portal should you use to create Group1, and which type of group should you create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-create-eligible

• Question 579:

  You have an Azure virtual machine that runs Ubuntu 16.04-DAILY-LTS.

  You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine.

  Which of the following is TRUE with regards to Azure Disk Encryption for a Linux VM?

  A. It is NOT supported for basic tier VMs.
  B. It is NOT supported for standard tier VMs.
  C. OS drive encryption for Linux virtual machine scale sets is supported.
  D. Custom image encryption is supported.
  A. It is NOT supported for basic tier VMs.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-linux

• Question 580:

  SIMULATION

  You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod1234578 Azure Storage account.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below.

  ---

  Explanation

  Step 1:

  1. In Azure portal go to the storage account you want to secure.

  Here: rg1lod1234578

  2. Click on the settings menu called Firewalls and virtual networks.

  3. To deny access by default, choose to allow access from Selected networks. To allow traffic from all networks, choose to allow access from All networks.

  4. Click Save to apply your changes.

  Step 2:

  1. Go to the storage account you want to secure.

  Here: rg1lod1234578

  2. Click on the settings menu called Firewalls and virtual networks.

  3. Check that you've selected to allow access from Selected networks.

  4. To grant access to a virtual network with a new network rule, under Virtual networks, click Add existing virtual network, select Virtual networks and Subnets options. Enter the 131.107.0.0/16 subnet and then click Add.

  Note: When network rules are configured, only applications requesting data over the specified set of networks can access a storage account. You can limit access to your storage account to requests originating from specified IP addresses, IP ranges or from a list of subnets in an Azure Virtual Network (VNet).

  https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security