Microsoft AZ-500 Online Practice Questions and Exam Preparation

Microsoft AZ-500 Online Questions & Answers

• Question 81:

  You plan to deploy Azure container instances.

  You have a containerized application that validates credit cards. The application is comprised of two containers: an application container and a validation container.

  The application container is monitored by the validation container. The validation container performs security checks by making requests to the application container and waiting for responses after every transaction.

  You need to ensure that the application container and the validation container are scheduled to be deployed together. The containers must communicate to each other only on ports that are not externally exposed.

  What should you include in the deployment?

  A. application security groups
  B. network security groups (NSGs)
  C. management groups
  D. container groups
  D. container groups

  ---

  Explanation

  Azure Container Instances supports the deployment of multiple containers onto a single host using a container group. A container group is useful when building an application sidecar for logging, monitoring, or any other configuration where a service needs a second attached process.

  https://docs.microsoft.com/en-us/azure/container-instances/container-instances-container-groups

• Question 82:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.

  

  You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:

  1. Assignments: Include Group1, exclude Group2

  2. Conditions: Sign-in risk level: Low and above

  3. Access: Allow access, Require multi-factor authentication

  You need to identify what occurs when the users sign in to Azure AD.

  What should you identify for each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

• Question 83:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You use Azure Security Center for the centralized policy management of three Azure subscriptions.

  You use several policy definitions to manage the security of the subscriptions.

  You need to deploy the policy definitions as a group to all three subscriptions.

  Solution: You create a policy definition and assignments that are scoped to resource groups.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  References:

  https://4sysops.com/archives/apply-governance-policy-to-multiple-azure-subscriptions-with-management-groups/

• Question 84:

  SIMULATION

  You need to create a web app named Intranet11597200 and enable users to authenticate to the web app by using Azure Active Directory (Azure AD).

  To complete this task, sign in to the Azure portal.

  A. See the explanation below.
  A. See the explanation below.

  ---

  Explanation

  1. In the Azure portal, type App services in the search box and select App services from the search results.

  2. Click the Create app service button to create a new app service.

  3. In the Resource Group section, click the Create new link to create a new resource group.

  4. Give the resource group a name such as Intranet11597200RG and click OK.

  5. In the Instance Details section, enter Intranet11597200 in the Name field.

  6. In the Runtime stack field, select any runtime stack such as .NET Core 3.1.

  7. Click the Review + create button.

  8. Click the Create button to create the web app.

  9. Click the Go to resource button to open the properties of the new web app.

  10.In the Settings section, click on Authentication / Authorization. 11.Click the App Service Authentication slider to set it to On. 12.In the Action to take when request is not authentication box, select Log in with Azure Active Directory. 13.Click Save to save the changes.

• Question 85:

  You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. EASM1 has discovery enabled and contains several inventory assets.

  You need to identify which inventory assets are vulnerable to the most critical web app security risks.

  Which Defender EASM dashboard should you use?

  A. Attack Surface Summary
  B. GDPRCompliance
  C. Security Posture
  D. OWASP Top 10
  D. OWASP Top 10

  ---

  Explanation

  Defender EASM provides four dashboards:

  * OWASP Top 10: this dashboard surfaces any assets that are vulnerable according to OWASP's list of the most critical web application security risks. On this dashboard, organizations can quickly identify assets with broken access control, cryptographic failures, injections, insecure designs, security misconfigurations and other critical risks as defined by OWASP.

  Incorrect:

  * Security Posture: this dashboard helps organizations understand the maturity and complexity of their security program based on the metadata derived from assets in your Approved inventory. It is comprised of technical and non-technical policies, processes and controls that mitigate risk of external threats. This dashboard provides insight on CVE exposure, domain administration and configuration, hosting and networking, open ports, and SSL certificate configuration.

  * Attack Surface Summary: this dashboard summarizes the key observations derived from your inventory. It provides a high-level overview of your Attack Surface and the asset types that comprise it, and surfaces potential vulnerabilities by severity (high, medium, low). This dashboard also provides key context on the infrastructure that comprises your Attack Surface, providing insight into cloud hosting, sensitive services, SSL certificate and domain expiry, and IP reputation.

  * GDPR Compliance: this dashboard surfaces key areas of compliance risk based on the General Data Protection Regulation (GDPR) requirements for online infrastructure that's accessible to European nations. This dashboard provides insight on the status of your websites, SSL certificate issues, exposed personal identifiable information (PII), login protocols, and cookie compliance.

  Note: Microsoft Defender External Attack Surface Management (Defender EASM) offers a series of four dashboards designed to help users quickly surface valuable insights derived from their Approved inventory. These dashboards help organizations prioritize the vulnerabilities, risks and compliance issues that pose the greatest threat to their Attack Surface, making it easy to quickly mitigate key issues.

  https://learn.microsoft.com/en-us/azure/external-attack-surface-management/understanding-dashboards

• Question 86:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You perform the following tasks:

  Create a managed identity named Managed1.

  Create a Microsoft 365 group named Group1.

  Register an enterprise application named App1.

  Enable a system-assigned managed identity for VM1.

  You need to identify which service principals were created and which identities can be assigned the Reader role for RG1.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 87:

  From Microsoft Defender for Cloud, you need to deploy SecPol1.

  What should you do first?

  A. Enable Microsoft Defender for Cloud.
  B. Create an Azure Management group.
  C. Create an initiative.
  D. Configure continuous export.
  A. Enable Microsoft Defender for Cloud.

• Question 88:

  You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.

  The User administrator role is assigned to a user named Admin1.

  An external partner has a Microsoft account that uses the [email protected] sign in.

  Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: "Unable to invite user [email protected] Generic authorization exception."

  You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.

  What should you do?

  A. From the Roles and administrators blade, assign the Security administrator role to Admin1.
  B. From the Organizational relationships blade, add an identity provider.
  C. From the Custom domain names blade, add a custom domain.
  D. From the Users blade, modify the External collaboration settings.
  D. From the Users blade, modify the External collaboration settings.

  ---

  Explanation

  You need to allow guest invitations in the External collaboration settings.

• Question 89:

  DRAG DROP

  You create an Azure subscription.

  You need to ensure that you can use Azure Active Directory (Azure AD) Privileged Identity Management (PIM) to secure Azure AD roles.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Consent to PIM

  

  Step: 2 Verify your identity by using multi-factor authentication (MFA)

  Click Verify my identity to verify your identity with Azure MFA. You'll be asked to pick an account.

  Step 3: Sign up PIM for Azure AD roles

  Once you have enabled PIM for your directory, you'll need to sign up PIM to manage Azure AD roles.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-getting-started

• Question 90:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that ServerAdmins can perform the following tasks:

  1. Create virtual machines in RG1 only.

  2. Connect the virtual machines to the existing virtual networks in RG2 only.

  The solution must use the principle of least privilege.

  Which two role-based access control (RBAC) roles should you assign to ServerAdmins? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a custom RBAC role for RG2
  B. the Network Contributor role for RG2
  C. the Contributor role for the subscription
  D. a custom RBAC role for the subscription
  E. the Network Contributor role for RG1
  F. the Virtual Machine Contributor role for RG1
  A. a custom RBAC role for RG2
  F. the Virtual Machine Contributor role for RG1

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles