Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 61:

  You make use of Azure Resource Manager templates to deploy Azure virtual machines.

  You have been tasked with making sure that Windows features that are not in use, are automatically inactivated when instances of the virtual machines are provisioned.

  Which of the following actions should you take?

  A. You should make use of Azure DevOps.
  B. You should make use of Azure Automation State Configuration.
  C. You should make use of network security groups (NSG).
  D. You should make use of Azure Blueprints.
  B. You should make use of Azure Automation State Configuration.

  ---

  Explanation

  You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines.

  Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

  https://docs.microsoft.com/en-us/azure/automation/automation-dsc-getting-started

• Question 62:

  HOTSPOT

  You have an Azure subscription that contains an Azure key vault and an Azure SQL database named SQL1.

  You generate a key named Key1.

  You need to enable Transparent Data Encryption (TDE) for SQL1 by using Key1.

  Which two settings should you modify for Key1? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 63:

  You have an Azure subscription that contains four Azure SQL managed instances.

  You need to evaluate the vulnerability of the managed instances to SQL injection attacks.

  What should you do first?

  A. Create an Azure Sentinel workspace.
  B. Enable Advanced Data Security.
  C. Add the SQL Health Check solution to Azure Monitor.
  D. Create an Azure Advanced Threat Protection (ATP) instance.
  B. Enable Advanced Data Security.

• Question 64:

  SIMULATION

  You need to ensure that the rg1lod28681041n1 Azure Storage account is encrypted by using a key stored in the KeyVault28681041 Azure key vault.

  To complete this task, sign in to the Azure portal.

  A. See the explanation below
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See the explanation below

  ---

  Explanation

  Configure customer-managed keys in the same tenant for an existing storage account

  Azure Storage encrypts all data in a storage account at rest. By default, data is encrypted with Microsoft-managed keys. For additional control over encryption keys, you can manage your own keys. Customer-managed keys must be stored in Azure Key Vault or Key Vault Managed Hardware Security Model (HSM).

  Configure encryption for manual updating of key versions

  Step 1: In the Azure portal, navigate to the Storage accounts page, and select rgllod28681041nl.

  Step 2: On the Encryption tab, indicate for which services you want to enable support for customer-managed keys in the Enable support for customer-managed keys field.

  Step 3: In the Encryption type field, select Customer-managed keys (CMK).

  Step 4: To locate the key URI in the Azure portal, navigate to your key vault, and select the Keys setting. Select the desired key, then select the key to view its versions. Select a key version to view the settings for that version.

  Step 5: Copy the value of the Key Identifier field which provides the URI.

  

  Step 6: In the Encryption key settings for your storage account, choose the Enter key URI option.

  Step 7: Paste the URI that you copied into the Key URI field. Include the key version on the URI to configure manual updating of the key version.

  Step 8: Specify a user-assigned managed identity by choosing the Select an identity link.

  

• Question 65:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Sub1.

  You have an Azure Storage account named sa1 in a resource group named RG1.

  Users and applications access the blob service and the file service in sa1 by using several shared access signatures (SASs) and stored access policies.

  You discover that unauthorized users accessed both the file service and the blob service.

  You need to revoke all access to sa1.

  Solution: You regenerate the Azure storage account access keys.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  Generating new storage account keys will invalidate all SAS's that were based on the previous keys.

• Question 66:

  You need to implement the planned change for SQLdb1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create a compliance policy.
  B. Configure Microsoft Entra authentication for SQLServer1.
  C. Create a Conditional Access policy.
  D. Configure a user-assigned managed identity for SQLdb1.
  E. Configure Federated client identity for SQLdb1.
  B. Configure Microsoft Entra authentication for SQLServer1.
  C. Create a Conditional Access policy.

• Question 67:

  HOTSPOT

  You have an Azure subscription that contains a blob container named cont1. Cont1 has the access policies shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: 4 - A container can have up to 5 stored access policies.

  Maximum number of stored access policies per blob container: 5

  Box 2: 1 -

  Blob version supports one version-level immutability policy and one legal hold. A policy on a blob version can override a default policy specified on the account or container.

  https://docs.microsoft.com/en-us/azure/storage/blobs/scalability-targets

  https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview

• Question 68:

  You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant.

  When a developer attempts to register an app named App1 in the tenant, the developer receives the error message shown in the following exhibit.

  

  You need to ensure that the developer can register App1 in the tenant.

  What should you do for the tenant?

  A. Modify the User settings
  B. Set Enable Security default to Yes.
  C. Modify the Directory properties.
  D. Configure the Consent and permissions settings for enterprise applications.
  A. Modify the User settings

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-how-applications-are-added

• Question 69:

  HOTSPOT

  On Monday, you configure an email notification in Azure Security Center to email notifications to [email protected].

  On Tuesday, Security Center generates the security alerts shown in the following table.

  

  How many email notifications will [email protected] receive on Tuesday? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  a maximum of one email per 6 hours (4 emails per day) for high-severity alerts a maximum of one email per 12 hours (2 emails per day) for medium-severity alerts a maximum of one email per 24 hours for low-severity alerts

  https://docs.microsoft.com/en-us/azure/security-center/security-center-provide-security-contact-details

• Question 70:

  You have an Azure AD tenant that contains the users shown in the following table.

  

  You need to ensure that the users cannot create app passwords. The solution must ensure that User1 can continue to use the Mail and Calendar app.

  What should you do?

  A. Assign User1 the Authentication Policy Administrator role.
  B. Enable Azure AD Password Protection.
  C. Configure a multi-factor authentication (MFA) registration policy.
  D. Create a new app registration.
  E. From multi-factor authentication, configure the service settings.
  E. From multi-factor authentication, configure the service settings.