Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 71:

  HOTSPOT

  You have an Azure subscription that contains an Azure Sentinel workspace.

  Azure Sentinel is configured to ingest logs from several Azure workloads. A third-party service management platform is used to manage incidents.

  You need to identify which Azure Sentinel components to configure to meet the following requirements:

  1. When Azure Sentinel identifies a threat, an incident must be created.

  2. A ticket must be logged in the service management platform when an incident is created in Azure Sentinel.

  Which component should you identify for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://docs.microsoft.com/en-us/azure/sentinel/create-incidents-from-alerts

  https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

• Question 72:

  You have an Azure subscription named Subscription1 that contains a resource group named RG1 and the users shown in the following table.

  

  You perform the following tasks:

  1. Assign User1 the Network Contributor role for Subscription1.

  2. Assign User2 the Contributor role for RG1.

  To Subscription1 and RG1, you assign the following policy definition: External accounts with write permissions should be removed from your subscription.

  What is the Compliance State of the policy assignments?

  A. The Compliance State of both policy assignments is Non-compliant.
  B. The Compliance State of the policy assignment to Subscription1 is Compliant, and the Compliance State of the policy assignment to RG1 is Non-compliant.
  C. The Compliance State of the policy assignment to Subscription1 is Non-compliant, and the Compliance State of the policy assignment to RG1 is Compliant.
  D. The Compliance State of both policy assignments is Compliant.
  A. The Compliance State of both policy assignments is Non-compliant.

• Question 73:

  DRAG DROP

  You have an Azure subscription that contains a Microsoft SQL server named Server1 and an Azure key vault named vault1. Server1 hosts a database named DB1. Vault1 contains an encryption key named key1.

  You need to ensure that you can enable Transparent Data Encryption (TDE) on DB1 by using key1.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 74:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Security Center for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create a resource graph and an assignment that is scoped to a management group.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Management groups in Microsoft Azure solve the problem of needing to impose governance policy on more than one Azure subscription simultaneously. However, you need to use an initiative, not a resource graph to bundle the policy definitions into a group that can be applied to the management group.

  References:

  https://4sysops.com/archives/apply-governance-policy-to-multiple-azure-subscriptions-with-management-groups/

• Question 75:

  HOTSPOT

  You have an Azure subscription that contains a virtual machine named VM1.

  You have a network security group (NSG) named NSG1 that is associated to the network interface of VM1 and is cfiognured as shown in the following exhibit.

  

  Just-in-time (JIT) VM access is enabled on VM1 and has the following con figurations:

  1. Management ports: 3389, 22

  2. Maximum time range: 3 hours

  3. Allowed source IP addresses: Any

  You activate the JIT rule and connect to VM1 by using SSH.

  For each of the following statements, select Yes if the statement is true, otherwise select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 76:

  You have an Azure subscription that contains the resources shown in the following table.

  

  Both VM1 and VM2 connect to VNET1 and are configured to use NSG1.

  You need to ensure that only VM1 and VM2 can access DB1.

  What should you do?

  A. For NSG1, configure a rule that has a service tag.
  B. Add the IP address range of VNET1 to the Firewall settings of DB1.
  C. Create an application security group.
  D. Configure DB1 to allow access from only VNET1.
  A. For NSG1, configure a rule that has a service tag.

  ---

  Explanation

  You can use virtual network service tags to achieve network isolation and protect your Azure Cosmos DB resources from the general Internet. Use service tags in place of specific IP addresses when you create security rules. By specifying the service tag name (for example, AzureCosmosDB) in the appropriate source or destination field of a rule, you can allow or deny the traffic for the corresponding service.

  Note: Service tags simplify security for Azure virtual machines and Azure virtual networks by enabling you to easily restrict network access to just the Azure services that you use.

  You can use service tags in your network security group (NSG) rules to allow or deny traffic to a specific Azure service globally or per Azure region. Azure provides the maintenance of IP addresses underlying each tag. This preview includes Storage, Sql, and AzureTrafficManager tags.

  https://learn.microsoft.com/en-us/azure/cosmos-db/database-security

  https://azure.microsoft.com/en-us/updates/service-tags-nsgs-ga/

• Question 77:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your Company's Azure subscription includes a virtual network that has a single subnet configured.

  You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed.

  You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and Azure SQL databases via the service endpoint.

  You need to perform a task on the virtual machine prior to deploying containers.

  Solution: You install the container network interface (CNI) plug-in.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  The Azure Virtual Network container network interface (CNI) plug-in installs in an Azure Virtual Machine. The plug-in supports both Linux and Windows platform.

  The plug-in assigns IP addresses from a virtual network to containers brought up in the virtual machine, attaching them to the virtual network, and connecting them directly to other containers and virtual network resources. The plug-in doesn't rely on overlay networks, or routes, for connectivity, and provides the same performance as virtual machines.

  The following picture shows how the plug-in provides Azure Virtual Network capabilities to Pods:

  

  https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview

• Question 78:

  HOTSPOT

  You have two Azure virtual machines in the East US2 region as shown in the following table.

  

  You deploy and configure an Azure Key vault.

  You need to ensure that you can enable Azure Disk Encryption on VM1 and VM2.

  What should you modify on each virtual machine? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  VM1: The Tier

  The Tier needs to be upgraded to standard.

  Disk Encryption for Windows and Linux IaaS VMs is in General Availability in all Azure public regions and Azure Government regions for Standard VMs and VMs with Azure Premium Storage.

  VM2: The type

  Need to change the VMtype to any of A, D, DS, G, GS, F, and so on, series IaaS VMs.

  Not the operating system version: Ubuntu 16.04 is supported.

  References:

  https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-overview

  https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-faq#bkmk_LinuxOSSupport

• Question 79:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains a user named User1.

  You plan to publish several apps in the tenant.

  You need to ensure that User1 can grant admin consent for the published apps.

  Which two possible user roles can you assign to User1 to achieve this goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Security administrator
  B. Cloud application administrator
  C. Application administrator
  D. User administrator
  E. Application developer
  B. Cloud application administrator
  C. Application administrator

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent

• Question 80:

  SIMULATION

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password. place your cursor in the Enter password box and click on the password below.

  Azure Username: Userl [email protected]

  Azure Password: GpOAe4@lDg

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 28681041

  You need to ensure that only devices connected to a 131-107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account.

  A. Please check the answer in the explantion
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. Please check the answer in the explantion

  ---

  Explanation

  In the Azure portal, search for and select the storage account named rg1lod28681041.

  In the left pane, select Firewalls and virtual networks.

  In the Firewalls and virtual networks pane, select Selected networks.

  In the Selected networks pane, select Add existing virtual network.

  In the Add existing virtual network pane, select the virtual network that contains the 131-107.0.0/16 subnet.

  Select Add.

  https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security