Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 591:

  HOTSPOT

  You need to configure support for Azure Sentinel notebooks to meet the technical requirements.

  What is the minimum number of Azure container registries and Azure Machine Learning workspaces required?

  

  

  ---

  https://docs.microsoft.com/en-us/azure/sentinel/notebooks

• Question 592:

  You have an Azure web app named webapp1.

  You need to configure continuous deployment for webapp1 by using an Azure Repo.

  What should you create first?

  A. an Azure Application Insights service
  B. an Azure DevOps organizations
  C. an Azure Storage account
  D. an Azure DevTest Labs lab
  B. an Azure DevOps organizations

  ---

  Explanation

  To use Azure Repos, make sure your Azure DevOps organization is linked to your Azure subscription.

  https://docs.microsoft.com/en-us/azure/app-service/deploy-continuous-deployment

• Question 593:

  SIMULATION

  You need to prevent administrators from performing accidental changes to the Homepage app service plan.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  You need to configure a 'lock' for the app service plan. A read-only lock ensures that no one can make changes to the app service plan without first deleting the lock.

  1. In the Azure portal, type App Service Plans in the search box, select App Service Plans from the search results then select Homepage. Alternatively, browse to App Service Plans in the left navigation pane.

  2. In the properties of the app service plan, click on Locks.

  3. Click the Add button to add a new lock.

  4. Enter a name in the Lock name field. It doesn't matter what name you provide for the exam.

  5. For the Lock type, select Read-only.

  6. Click OK to save the changes.

• Question 594:

  You need to meet the identity and access requirements for Group1.

  What should you do?

  A. Add a membership rule to Group1.
  B. Delete Group1. Create a new group named Group1 that has a membership type of Office 365. Add users and devices to the group.
  C. Modify the membership rule of Group1.
  D. Change the membership type of Group1 to Assigned. Create two groups that have dynamic memberships. Add the new groups to Group1.
  D. Change the membership type of Group1 to Assigned. Create two groups that have dynamic memberships. Add the new groups to Group1.

  ---

  Explanation

  When you create dynamic groups, they can either contain users or devices. Hence here we need to create two separate dynamic groups and assign those groups to an Assigned group.

  Incorrect Answers:

  A, C: You can create a dynamic group for devices or users, but you can't create a rule that contains both users and devices.

  Scenario:

  Litware identifies the following identity and access requirements: All San Francisco users and their devices must be members of Group1.

  The tenant currently contains this group:

  

  https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal

• Question 595:

  Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

  The company develops an application named App1. App1 is registered in Azure AD.

  You need to ensure that App1 can access secrets in Azure Key Vault on behalf of the application users.

  What should you configure?

  A. an application permission without admin consent
  B. a delegated permission without admin consent
  C. a delegated permission that requires admin consent
  D. an application permission that requires admin consent
  B. a delegated permission without admin consent

  ---

  Explanation

  Delegated permissions - Your client application needs to access the web API as the signed-in user, but with access limited by the selected permission. This type of permission can be granted by a user unless the permission requires administrator consent.

  Incorrect Answers:

  A, D: Application permissions - Your client application needs to access the web API directly as itself (no user context). This type of permission requires administrator consent and is also not available for public (desktop and mobile) client applications.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

• Question 596:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  In Azure AD Privileged Identity Management (PIM), the Role settings for the Contributor role are configured as shown in the exhibit. (Click the Exhibit tab.)

  

  You assign users the Contributor role on May 1, 2019 as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pimresource-roles-assign-roles

• Question 597:

  You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ConReg1.

  You enable content trust for ContReg1.

  You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege.

  Which two roles should you assign to User1? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. AcrQuarantineReader
  B. Contributor
  C. AcrPush
  D. AcrImageSigner
  E. AcrQuarantineWriter
  C. AcrPush
  D. AcrImageSigner

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/container-registry/container-registry-content-trust

  https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles

• Question 598:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  VM1 and VM2 are stopped.

  You create an alert rule that has the following settings:

  1. Resource: RG1

  2. Condition: All Administrative operations

  3. Actions: Action groups configured for this alert rule: ActionGroup1

  4. Alert rule name: Alert1

  You create an action rule that has the following settings:

  1. Scope: VM1

  2. Filter criteria: Resource Type = "Virtual Machines"

  3. Define on this scope: Suppression

  4. Suppression config: From now (always)

  5. Name: ActionRule1

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  Note: Each correct selection is worth one point.

  

  

  ---

  Box 1:

  The scope for the action rule is set to VM1 and is set to suppress alerts indefinitely.

  Box 2:

  The scope for the action rule is not set to VM2.

  Box 3:

  Adding a tag is not an administrative operation.

  References:

  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-activity-log

  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-action-rules

• Question 599:

  You have an Azure subscription named Subscription1.

  You deploy a Linux virtual machine named VM1 to Subscription1.

  You need to monitor the metrics and the logs of VM1.

  What should you use?

  A. the AzurePerformanceDiagnostics extension
  B. Azure HDInsight
  C. Linux Diagnostic Extension (LAD) 3.0
  D. Azure Analysis Services
  C. Linux Diagnostic Extension (LAD) 3.0

  ---

  Explanation

  AzurePerformanceDiagnostics extension can be installed only on Windows machine.

  Linux Diagnostic Extension (LAD) 3.0 can be used to capture metric and logs from Linux VMs.

  https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/diagnostics-linux

• Question 600:

  DRAG DROP

  You have a Microsoft Entra tenant.

  On January 1, you configure a multi-factor authentication (MFA) registration policy that has the following settings:

  1. Assignments: All users

  2. Require Microsoft Entra ID multifactor authentication registration: Enabled

  3. Enforce policy: On

  On January 3, you create two new users named User1 and User2.

  On January 5, User1 authenticates to Microsoft Entra ID for the first time. On January 7, User2 authenticates to Microsoft Entra ID for the first time.

  On which date will User1 and User2 be forced to register for MFA? To answer, drag the appropriate dates to the correct users. Each date may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place: