Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 611:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the subnets shown in the following table.

  

  You plan to create an Azure web app named WebApp2 that will have the following configurations:

  1. Region: East US

  2. VNet integration: Enabled

  3. Scale out: Autoscale to up to 10 instances

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1: N because Subnet11 contains a VM (The feature requires an unused subnet that's an IPv4 /28 block or larger in an Azure Resource Manager virtual network.

  https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#limitations2:

  Y subnet has an unused /27 ip block, both app and subnet2 are in the same region. 3: N Subnet2 already integrated with another app and also located in a different region

• Question 612:

  Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory Azure (Azure AD) tenant named contoso.com.

  The company develops a mobile application named App1. App1 uses the OAuth 2 implicit grant type to acquire Azure AD access tokens.

  You need to register App1 in Azure AD.

  What information should you obtain from the developer to register the application?

  A. a redirect URI
  B. a reply URL
  C. a key
  D. an application ID
  A. a redirect URI

  ---

  Explanation

  For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code

• Question 613:

  DRAG DROP

  You have an Azure subscription that contains an Azure web app named App1.

  You plan to configure a Conditional Access policy for App1. The solution must meet the following requirements:

  1. Only allow access to App1 from Windows devices.

  2. Only allow devices that are marked as compliant to access App1.

  Which Conditional Access policy settings should you configure? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Conditions

  Only allow access to App1 from Windows devices.

  Set the device platform condition.

  Box 2: Cloud apps or actions

  Only allow devices that are marked as compliant to access App1.

  Cloud apps, actions, and authentication context are key signals in a Conditional Access policy. Conditional Access policies allow administrators to assign controls to specific applications, actions, or authentication context.

  * Administrators can choose from the list of applications that include built-in Microsoft applications and any Azure AD integrated applications including gallery, non-gallery, and applications published through Application Proxy.

  * Etc.

  https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#device-platforms

  https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps

• Question 614:

  You have an Azure subscription that contains an instance of Azure Firewall Standard named AzFWL

  You need to identify whether you can use the following features with AzFW1:

  1. TLS inspection

  2. Threat intelligence

  3. The network intrusion detection and prevention systems (IDPS)

  What can you use?

  A. TLS inspection only
  B. threat intelligence only
  C. TLS inspection and the IDPS only
  D. threat intelligence and the IDPS only
  E. TLS inspection, threat intelligence, and the IDPS
  B. threat intelligence only

  ---

  Explanation

  Azure Firewall Standard features include:

  * Threat intelligence

  Threat intelligence-based filtering can be enabled for your firewall to alert and deny traffic from/to known malicious IP addresses and domains. The IP addresses and domains are sourced from the Microsoft Threat Intelligence feed.

  Azure Firewall Premium features include:

  * TLS inspection

  The TLS (Transport Layer Security) protocol primarily provides cryptography for privacy, integrity, and authenticity using certificates between two or more communicating applications. It runs in the application layer and is widely used to encrypt the HTTP protocol.

  * IDPS - A network intrusion detection and prevention system (IDPS) allows you to monitor network activities for malicious activity, log information about this activity, report it, and optionally attempt to block it.

  https://learn.microsoft.com/en-us/azure/firewall/features

  https://learn.microsoft.com/en-us/azure/firewall/premium-features

• Question 615:

  HOTSPOT

  You have a Microsoft Entra tenant named contoso.com.

  You collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com. Fabrikam.com has multi-factor authentication (MFA) enabled for all users.

  Contoso.com has the Cross-tenant access settings configured as shown in the Cross-tenant access settings exhibit. (Click the Cross-tenant access settings tab.)

  

  Contoso.com has the External collaboration settings configured as shown in the External collaboration settings exhibit. (Click the External collaboration settings tab.)

  

  You create a Conditional Access policy that has the following settings:

  Name: CAPolicy1

  Assignments

  Guest or external users: B2B collaboration guest users Target resources Include: All cloud apps

  Access controls

  Grant access

  Require device to be marked as compliant Require multi-factor authentication

  Enable policy: On

  For each of the following statements, select Yes if the statement is true, otherwise select No.

  NOTE: Each correct section is worth one point.

  

  

• Question 616:

  You have an Azure AD tenant.

  You plan to implement an authentication solution to meet the following requirements:

  1. Require number matching.

  2. Display the geographical location when signing in.

  Which authentication method should you include in the solution?

  A. Microsoft Authenticator
  B. FIDO2 security key
  C. SMS
  D. Temporary Access Pass
  A. Microsoft Authenticator

• Question 617:

  You have an Azure subscription that contains an Azure Files share named share1 and a user named User1. Identity-based authentication is configured for share1.

  User1 attempts to access share1 from a Windows 10 device by using SMB.

  Which type of token will Azure Files use to authorize the request?

  A. OAuth 2.0
  B. JSON Web Token (JWT)
  C. SAML
  D. Kerberos
  D. Kerberos

  ---

  Explanation

  Azure Filessupports identity-based authentication over Server Message Block (SMB) throughtwo types of Domain Services: on-premises Active Directory Domain Services (AD DS) and Azure Active Directory Domain Services (Azure AD DS).

  Supported scenarios and restrictions include: Supports Kerberos authentication with AD with AES 256 encryption (recommended) and RC4-HMAC.

  Note: Kerberos is an authentication protocol that is used to verify the identity of a user or host.

  https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable

• Question 618:

  HOTSPOT

  You have an Azure subscription named Sub 1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

  

  Each user is assigned an Azure AD Premium P2 license.

  You plan to onboard and configure Azure AD Identity Protection.

  Which users can onboard Azure AD Identity Protection, remediate users, and configure policies? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 619:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your Company's Azure subscription includes a virtual network that has a single subnet configured.

  You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed.

  You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and Azure SQL databases via the service endpoint.

  You need to perform a task on the virtual machine prior to deploying containers.

  Solution: You create an application security group.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

• Question 620:

  SIMULATION

  You need to create a new Azure AD directory named 28681041.onmicrosoft.com. The new directory must contain a new user named [email protected].

  To complete this task, sign in to the Azure portal.

  A. Please check the answer in the explantion
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. Please check the answer in the explantion

  ---

  Explanation