Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 51:

  SIMULATION

  You need to ensure that connections through an Azure Application Gateway named Homepage-AGW are inspected for malicious requests.

  To complete this task, sign in to the Azure portal.

  You do not need to wait for the task to complete.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to enable the Web Application Firewall on the Application Gateway.

  1. In the Azure portal, type Application gateways in the search box, select Application gateways from the search results then select the gateway named Homepage-AGW. Alternatively, browse to Application Gateways in the left navigation pane.

  2. In the properties of the application gateway, click on Web application firewall.

  3. For the Tier setting, select WAF V2.

  4. In the Firewall status section, click the slider to switch to Enabled.

  5. In the Firewall mode section, click the slider to switch to Prevention.

  6. Click Save to save the changes.

• Question 52:

  You have an Azure virtual machine named VM1.

  From Azure Security Center, you get the following high-severity recommendation: "Install endpoint protection solutions on virtual machine".

  You need to resolve the issue causing the high-severity recommendation.

  What should you do?

  A. Add the Microsoft Antimalware extension to VM1.
  B. Install Microsoft System Center Security Management Pack for Endpoint Protection on VM1.
  C. Add the Network Watcher Agent for Windows extension to VM1.
  D. Onboard VM1 to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
  D. Onboard VM1 to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).

  ---

  
  

• Question 53:

  HOTSPOT

  You have an Azure subscription that contains a user named Admin1 and an Azure key vault named Vault1.

  You plan to implement Microsoft Entra Verified ID.

  You need to create an access policy to ensure that Admin1 has permissions to Vault1 that support the implementation of the Verified ID service. The solution must use the principle of least privilege.

  Which three key permissions should you select? To answer, select the appropriate permissions in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 54:

  Your company uses Azure DevOps.

  You need to recommend a method to validate whether the code meets the company's quality standards and code review standards.

  What should you recommend implementing in Azure DevOps?

  A. branch folders
  B. branch permissions
  C. branch policies
  D. branch locking
  C. branch policies

  ---

  Explanation

  Branch policies help teams protect their important branches of development. Policies enforce your team's code quality and change management standards.

  References:

  https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops&viewFallbackFrom=vsts

• Question 55:

  You have a Microsoft Entra tenant.

  You need to prevent nonprivileged Microsoft Entra users from creating service principals in Microsoft Entra ID.

  A. From the Properties blade, set Enable Security defaults to Yes.
  B. From the Properties blade, set Access management for Azure resources to No.
  C. From the User settings blade, set Restrict access to Microsoft Entra ID administration portal to Yes.
  D. From the User settings blade, set Users can register applications to No.
  D. From the User settings blade, set Users can register applications to No.

• Question 56:

  HOTSPOT

  You have an Azure subscription that has a managed identity named identity and is linked to an Azure Active Directory (Azure AD) tenant. The tenant contains the resources shown in the following table.

  Which resources can be added to AUI and AU2? To answer, select the appropriate options in the answer area.

  

  Which resources can be added to AU1 and AU2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  
  

• Question 57:

  You have an Azure Container Registry named ContReg1 that contains a container image named image1.

  You enable content trust for ContReg1.

  After content trust is enabled, you push two images to ContReg1 as shown in the following table.

  

  Which images are trusted images?

  A. image1 and image2 only
  B. image2 only
  C. image1, image2, and image3
  B. image2 only

  ---

  Explanation

  Azure Container Registry implements Docker's content trust model, enabling pushing and pulling of signed images.

  To push a trusted image tag to your container registry, enable content trust and push the image with docker push.

  To work with trusted images, both image publishers and consumers need to enable content trust for their Docker clients. As a publisher, you can sign the images you push to a content trust-enabled registry.

  https://docs.microsoft.com/en-us/azure/container-registry/container-registry-content-trust

• Question 58:

  HOTSPOT

  You have an Azure Active directory tenant that syncs with an Active Directory Domain Services (AD DS) domain.

  You plan to create an Azure file share that will contain folders and files.

  Which identity store can you use to assign permissions to the Azure file share and folders within the share? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box1 and Box2: AD DS Only

  Azure Files supports identity-based authentication for Windows file shares over Server Message Block (SMB) using the Kerberos authentication protocol through the following three methods:

  1. On-premises Active Directory Domain Services (AD DS) 2. Azure Active Directory Domain Services (Azure AD DS)

  3. Azure Active Directory (Azure AD) Kerberos for hybrid user identities

  Note

  Azure Files supports authentication for Azure AD DS with full or partial (scoped) synchronization with Azure AD. For environments with scoped synchronization present, administrators should be aware that Azure Files only honors Azure RBAC role assignments granted to principals that are synchronized. Role assignments granted to identities not synchronized from Azure AD to Azure AD DS will be ignored by the Azure Files service.

• Question 59:

  You have an Azure subscription named Sub1.

  In Azure Security Center, you have a security playbook named Play1. Play1 is configured to send an email message to a user named User1.

  You need to modify Play1 to send email messages to a distribution group named Alerts.

  What should you use to modify Play1?

  A. Azure DevOps
  B. Azure Application Insights
  C. Azure Monitor
  D. Azure Logic Apps Designer
  D. Azure Logic Apps Designer

  ---

  Explanation

  You can change an existing playbook in Security Center to add an action, or conditions. To do that you just need to click on the name of the playbook that you want to change, in the Playbooks tab, and Logic App Designer opens up.

  References:

  https://docs.microsoft.com/en-us/azure/security-center/security-center-playbooks

• Question 60:

  DRAG DROP

  You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a resource group named RG1 and an Azure policy named Policy1.

  You need to remediate the non-compliant resources in Sub1 based on Policy1.

  How should you complete the PowerShell script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once,

  or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  For the first blank, use Set-AzContext to set the current subscription context. For the second blank, use Start-AzPolicyRemediation to create and start a policy remediation for a policy assignment.

  The final script should look like this:

  $policyAssignmentId = "/subscriptions/f0710c27-9663-4c05-1978-1bdbedle86as/providers/Microsoft. Authorization/f Value Set-AzContext -Subscription "Sub1" Value Start-AzPolicyRemediation -PolicyAssignmentld $policyAssignmentId - Name "policy1" -ResourceDiscovery