Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 601:

  You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.)

  

  You plan to deploy the cluster to production. You disable HTTP application routing.

  You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address.

  What should you do?

  A. Create an AKS Ingress controller.
  B. Install the container network interface (CNI) plug-in.
  C. Create an Azure Standard Load Balancer.
  D. Create an Azure Basic Load Balancer.
  A. Create an AKS Ingress controller.

  ---

  Explanation

  An ingress controller is a piece of software that provides reverse proxy, configurable traffic routing, and TLS termination for Kubernetes services.

  References:

  https://docs.microsoft.com/en-us/azure/aks/ingress-tls

• Question 602:

  HOTSPOT

  Your network contains an on-premises Active Directory domain that syncs to a Microsoft Entra tenant. The tenant contains the users shown in the following table.

  

  The tenant contains the groups shown in the following table.

  

  You configure a multi-factor authentication (MFA) registration policy that has the following settings:

  1. Assignments:

  Include: Group1

  Exclude: Group2

  2. Controls: Require Azure MFA registration

  3. Enforce Policy: On

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 603:

  You have an Azure subscription.

  You need to deploy an Azure virtual WAN to meet the following requirements:

  1. Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.

  2. Ensure that security rules sync between the regions.

  What should you use?

  A. Azure Firewall Manager
  B. Azure Virtual Network Manager
  C. Azure Network Function Manager
  D. Azure Front Door
  A. Azure Firewall Manager

• Question 604:

  SIMULATION

  You need to ensure that the events in the NetworkSecurityGroupRuleCounter log of the VNET01-Subnet0-NSG network security group (NSG) are stored in the logs1234578 Azure Storage account.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below.

  ---

  Explanation

  

• Question 605:

  Your network contains an on-premises Active Directory domain named corp.contoso.com.

  You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

  You sync all on-premises identities to Azure AD.

  You need to prevent users who have a givenName attribute that starts with TEST from being synced to Azure AD. The solution must minimize administrative effort.

  What should you use?

  A. Synchronization Rules Editor
  B. Web Service Configuration Tool
  C. the Azure AD Connect wizard
  D. Active Directory Users and Computers
  A. Synchronization Rules Editor

  ---

  Explanation

  Use the Synchronization Rules Editor and write attribute-based filtering rule.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-change-the-configuration

• Question 606:

  After creating a new Azure subscription, you are tasked with making sure that custom alert rules can be created in Azure Security Center.

  You have created an Azure Storage account.

  Which of the following is the action you should take?

  A. You should make sure that Azure Active Directory (Azure AD) Identity Protection is removed.
  B. You should create a DLP policy.
  C. You should create an Azure Log Analytics workspace.
  D. You should make sure that Security Center has the necessary tier configured.
  C. You should create an Azure Log Analytics workspace.

  ---

  Explanation

  C: You need write permission in the workspace that you select to store your custom alert.

  https://docs.microsoft.com/en-us/azure/security-center/security-center-custom-alert

• Question 607:

  HOTSPOT

  You have an Azure subscription named Sub1 that contains two resource groups named RGnet and NET.

  You have the Azure Policy definition shown in the following exhibit.

  

  You assign the policy definition to Sub1 and NET.

  You plan to deploy the resources shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 608:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016.

  You need to deploy Microsoft Antimalware to the virtual machines.

  Solution: You add an extension to each virtual machine.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  You can use Visual Studio to enable and configure the Microsoft Antimalware service. This entails selecting Microsoft Antimalware extension from the dropdown list under Installed Extensions and click Add to configure with default antimalware configuration.

  References:

  https://docs.microsoft.com/en-us/azure/security/fundamentals/antimalware

• Question 609:

  HOTSPOT

  You create resources in an Azure subscription as shown in the following table.

  

  VNET1 contains two subnets named Subnet1 and Subnet2. Subnet1 has a network ID of 10.0.0.0/24. Subnet2 has a network ID of 10.1.1.0/24.

  Contoso1901 is configured as shown in the exhibit. (Click the Exhibit tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Access from Subnet1 is allowed.

  Box 2: No

  No access from Subnet2 is allowed.

  Box 3: Yes

  Access from IP address 193.77.10.2 is allowed.

• Question 610:

  You have an Azure subscription that uses Microsoft Defender for Cloud. The subscription contains an instance of Azure Database for PostgreSQL.

  You need to ensure that an email alert is triggered when a suspected brute force attack on the database is detected. The solution must minimize administrative effort.

  What should you configure?

  A. an Azure Monitor alert rule
  B. Microsoft Defender for open-source relational databases
  C. the Azure Monitor activity log
  D. the PostgreSQL Audit extension (pgAudit)
  B. Microsoft Defender for open-source relational databases