Microsoft AZ-500 Practice Test - Questions Answers, Page 11

Answer: A

Explanation:

To enable the RDP port in an NSG, follow these steps:

1. Sign in to the Azure portal.

2. In Virtual Machines, select VM1

3. In Settings, select Networking.

4. In Inbound port rules, check whether the port for RDP is set correctly. The following is an example of the configuration:

Priority: 300

Name: Port_3389

Port(Destination): 3389

Protocol: TCP

Source: Any

Destinations: Any

Action: Allow

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-nsg-problem

Answer: A

Explanation:

1. In the Search resources, services, and docs box at the top of the portal, begin typing the name of a virtual machine, VM1 that has a network interface that you want to add to, or remove from, an application security group.

2. When the name of your VM appears in the search results, select it.

3. Under SETTINGS, select Networking. Select Configure the application security groups, select the application security groups that you want to add the network interface to, or unselect the application security groups that you want to remove the network interface from, and then select Save.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

Answer: A

Explanation:

Deploy the Microsoft Antimalware Extension using the Azure Portal for single VM deployment

1. In Azure Portal, go to the Azure VM1’s blade, navigate to the Extensions section and press Add.

2. Select the Microsoft Antimalware extension and press Create.

3. Fill the “Install extension” form as desired and press OK.

Scheduled: Enable

Scan type: Full

Scan day: Sunday

Reference:

https://www.e-apostolidis.gr/microsoft/azure/azure-vm-antimalware-extension-management/

Answer: A

Explanation:

Locking prevents other users in your organization from accidentally deleting or modifying critical resources, such as Azure subscription, resource group, or resource.

Note: In Azure, the term resource refers to an entity managed by Azure. For example, virtual machines, virtual networks, and storage accounts are all referred to as Azure resources.

1. In the Settings blade for virtual network VNET, select Locks.

2. To add a lock, select Add.

3. For Lock type select Delete lock, and click OK

Reference:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

Answer: A

Explanation:

1. In Azure portal, locate and select the RG1lod10598168 resource group.

2. Click Access control (IAM).

3. Click the Role assignments tab to view all the role assignments at this scope.

4. Click Add > Add role assignment to open the Add role assignment pane.

5. In the Role drop-down list, select the role Virtual Machine Contributor.

Virtual Machine Contributor lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.

6. In the Select list, select user user21059868

7. Click Save to assign the role.

Reference:

https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor

Answer: A

Explanation:

Step 1:

1. In Azure portal go to the storage account you want to secure. Here: rg1lod10598168

2. Click on the settings menu called Firewalls and virtual networks.

3. To deny access by default, choose to allow access from Selected networks. To allow traffic from all networks, choose to allow access from All networks.

4. Click Save to apply your changes.

Step 2:

1. Go to the storage account you want to secure. Here: rg1lod10598168

2. Click on the settings menu called Firewalls and virtual networks.

3. Check that you've selected to allow access from Selected networks.

4. To grant access to a virtual network with a new network rule, under Virtual networks, click Add existing virtual network, select Virtual networks and Subnets options. Enter the 131.107.0.0/16 subnet and then click Add.

Note: When network rules are configured, only applications requesting data over the specified set of networks can access a storage account. You can limit access to your storage account to requests originating from specified IP addresses, IP ranges or from a list of subnets in an Azure Virtual Network (VNet).

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines.

Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

Reference:

https://docs.microsoft.com/en-us/azure/automation/automation-dsc-getting-started

Reference:

https://docs.microsoft.com/en-us/mem/intune/protect/security-baselines

Answer: A

Explanation:

You need to configure the Network Security Group that is associated with subnet0.

1. In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET1. Alternatively, browse to Virtual Networks in the left navigation pane.

2. In the properties of VNET1, click on Subnets. This will display the subnets in VNET1 and the Network Security Group associated to each subnet. Note the name of the Network Security Group associated to Subnet0.

3. Type Network Security Groups into the search box and select the Network Security Group associated with Subnet0.

4. In the properties of the Network Security Group, click on Inbound Security Rules.

5. Click the Add button to add a new rule.

6. In the Source field, select Service Tag.

7. In the Source Service Tag field, select Internet.

8. Leave the Source port ranges and Destination field as the default values (* and All).

9. In the Destination port ranges field, enter 7777.

10. Change the Protocol to TCP.

11. Leave the Action option as Allow.

12. Change the Priority to 100.

13. Change the Name from the default Port_8080 to something more descriptive such as Allow_TCP_7777_from_Internet. The name cannot contain spaces. 14. Click the Add button to save the new rule.