ExamGecko
Login
Home / Microsoft / AZ-500 / List of questions
Ask Question

Microsoft AZ-500 Practice Test - Questions Answers, Page 13

Add to Whishlist

List of questions

Question 121

Report Export Collapse

You have an Azure subscription that contains a virtual network. The virtual network contains the subnets shown in the following table.

Microsoft AZ-500 image Question 48 87370 10022024015441000000

The subscription contains the virtual machines shown in the following table.

Microsoft AZ-500 image Question 48 87370 10022024015441000000

You enable just in time (JIT) VM access for all the virtual machines.

You need to identify which virtual machines are protected by JIT.

Which virtual machines should you identify?

VM4 only
VM4 only
VM1 and VM3 only
VM1 and VM3 only
VM1, VM3 and VM4 only
VM1, VM3 and VM4 only
VM1, VM2, VM3, and VM4
VM1, VM2, VM3, and VM4
Suggested answer: C
Explanation:

An NSG needs to be enabled, either at the VM level or the subnet level.

Reference:

https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time

asked 02/10/2024
Ali Diaz
34 questions

Question 122

Report Export Collapse

HOTSPOT

You have an Azure subscription that contains the virtual machines shown in the following table.

Microsoft AZ-500 image Question 49 87371 10022024015441000000

Subnet1 and Subnet2 have a Microsoft.Storage service endpoint configured.

You have an Azure Storage account named storageacc1 that is configured as shown in the following exhibit.

Microsoft AZ-500 image Question 49 87371 10022024015441000000

For each of the following statements, select Yes if the statement is true. Otherwise, select No.


Microsoft AZ-500 image Question 122 87371 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 122 87371 10022024015441000
Explanation:

Box 1: Yes

The public IP of VM1 is allowed through the firewall.

Box 2: No

The allowed virtual network list is empty so VM2 cannot access storageacc1 directly. The public IP address of VM2 is not in the allowed IP list so VM2 cannot access storageacc1 over the Internet.

Box 3: No

The allowed virtual network list is empty so VM3 cannot access storageacc1 directly. VM3 does not have a public IP address so it cannot access storageacc1 over the Internet.

Reference:

https://docs.microsoft.com/en-gb/azure/storage/common/storage-network-security

asked 02/10/2024
Javier Rodriguez
43 questions

Question 123

Report Export Collapse

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.

You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.

What should you use?

device compliance policies in Microsoft Intune
device compliance policies in Microsoft Intune
Azure Automation State Configuration
Azure Automation State Configuration
application security groups
application security groups
Azure Advisor
Azure Advisor
Suggested answer: B
Explanation:

You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager),on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines. Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

asked 02/10/2024
Matthew Wunder
44 questions

Question 124

Report Export Collapse

You have an Azure Container Registry named Registry1.

From Azure Security Center, you enable Azure Container Registry vulnerability scanning of the images in Registry1.

You perform the following actions:

Push a Windows image named Image1 to Registry1.

Push a Linux image named Image2 to Registry1.

Push a Windows image named Image3 to Registry1.

Modify Image1 and push the new image as Image4 to Registry1.

Modify Image2 and push the new image as Image5 to Registry1.

Which two images will be scanned for vulnerabilities? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Image4
Image4
Image2
Image2
Image1
Image1
Image3
Image3
Image5
Image5
Suggested answer: B, E
Explanation:

Only Linux images are scanned. Windows images are not scanned.

Reference:

https://docs.microsoft.com/en-us/azure/security-center/azure-container-registry-integration

asked 02/10/2024
Ryan Lee
28 questions

Question 125

Report Export Collapse

You have an Azure subscription that contains the virtual machines shown in the following table.

Microsoft AZ-500 image Question 52 87374 10022024015441000000

All the virtual networks are peered.

You deploy Azure Bastion to VNET2.

Which virtual machines can be protected by the bastion host?

VM1, VM2, VM3, and VM4
VM1, VM2, VM3, and VM4
VM1, VM2, and VM3 only
VM1, VM2, and VM3 only
VM2 and VM4 only
VM2 and VM4 only
VM2 only
VM2 only
Suggested answer: A
Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/bastion/vnet-peering

asked 02/10/2024
Herr Eylem Bulut
52 questions

Question 126

Report Export Collapse

You have an Azure Active Directory (Azure AD) tenant named Contoso.com and an Azure Kubernetes Service (AKS) cluster AKS1.

You discover that AKS1 cannot be accessed by using accounts from Contoso.com.

You need to ensure AKS1 can be accessed by using accounts from Contoso.com. The solution must minimize administrative effort.

What should you do first?

From Azure recreate AKS1.
From Azure recreate AKS1.
From AKS1, upgrade the version of Kubernetes.
From AKS1, upgrade the version of Kubernetes.
From Azure AD, implement Azure AD Premium.
From Azure AD, implement Azure AD Premium.
From Azure AD, configure the User settings.
From Azure AD, configure the User settings.
Suggested answer: A
Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration-cli

asked 02/10/2024
charles ratchagaraj
49 questions

Question 127

Report Export Collapse

You have an Azure subscription that contains an Azure Container Registry named Registry1. Azure Defender is enabled in the subscription. You upload several container images to Register1.

You discover that vulnerability security scans were not performed.

You need to ensure that the container images are scanned for vulnerabilities when they are uploaded to Registry1.

What should you do?

From the Azure portal modify the Pricing tier settings.
From the Azure portal modify the Pricing tier settings.
From Azure CLI, lock the container images.
From Azure CLI, lock the container images.
Upload the container images by using AzCopy.
Upload the container images by using AzCopy.
Push the container images to Registry1 by using Docker
Push the container images to Registry1 by using Docker
Suggested answer: A
Explanation:

Reference:

https://charbelnemnom.com/scan-container-images-in-azure-container-registry-with-azure-security-center/

asked 02/10/2024
Florence Li
47 questions

Question 128

Report Export Collapse

HOTSPOT

You have a network security group (NSG) bound to an Azure subnet.

You run Get-AzNetworkSecurityRuleConfig and receive the output shown in the following exhibit.

Microsoft AZ-500 image Question 55 87377 10022024015441000000

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 128 87377 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 128 87377 10022024015441000
Explanation:

Box 1: able to connect to East US 2

The StorageEA2Allow has DestinationAddressPrefix {Storage/EastUS2}

Box 2: allowed

TCP Port 21 controls the FTP session. Contoso_FTP has SourceAddressPrefix {1.2.3.4/32} and DestinationAddressPrefix {10.0.0.5/32}

Note:

The Get-AzureRmNetworkSecurityRuleConfig cmdlet gets a network security rule configuration for an Azure network security group. Security rules in network security groups enable you to filter the type of network traffic that can flow in and out of virtual network subnets and network interfaces.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group

asked 02/10/2024
Marco Morsiani
47 questions

Question 129

Report Export Collapse

You have a web app hosted on an on-premises server that is accessed by using a URL of https://www.contoso.com.

You plan to migrate the web app to Azure. You will continue to use https://www.contoso.com.

You need to enable HTTPS for the Azure web app.

What should you do first?

Export the public key from the on-premises server and save the key as a P7b file.
Export the public key from the on-premises server and save the key as a P7b file.
Export the private key from the on-premises server and save the key as a PFX file that is encrypted by using TripleDES.
Export the private key from the on-premises server and save the key as a PFX file that is encrypted by using TripleDES.
Export the public key from the on-premises server and save the key as a CER file.
Export the public key from the on-premises server and save the key as a CER file.
Export the private key from the on-premises server and save the key as a PFX file that is encrypted by using AES256.
Export the private key from the on-premises server and save the key as a PFX file that is encrypted by using AES256.
Suggested answer: B
Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate#private-certificate-requirements

asked 02/10/2024
Timo Fahlenbck
39 questions

Question 130

Report Export Collapse

HOTSPOT

You have an Azure subscription that contains a storage account named storage1 and several virtual machines. The storage account and virtual machines are in the same Azure region. The network configurations of the virtual machines are shown in the following table.

Microsoft AZ-500 image Question 57 87379 10022024015441000000

The virtual network subnets have service endpoints defined as shown in the following table.

Microsoft AZ-500 image Question 57 87379 10022024015441000000

You configure the following Firewall and virtual networks settings for storage1:

Allow access from: Selected networks

Virtual networks: VNET3\Subnet3

Firewall – Address range: 52.233.129.0/24

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 130 87379 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 130 87379 10022024015441000
Explanation:

Box 1: No

VNet1 has a service endpoint configure for Azure Storage. However, the Azure storage does not allow access from VNet1 or the public IP address of VM1.

Box 2: Yes

VNet2 does not have a service endpoint configured. However, the Azure storage allows access from the public IP address of VM2.

Box 3: No

Azure storage allows access from VNet3. However, VNet3 does not have a service endpoint for Azure storage. The Azure storage also does not allow access from the public IP of VM3.

asked 02/10/2024
Pawel Szalek
41 questions
Total 442 questions
Go to page: of 45
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016. You need to deploy Microsoft Antimalware to the virtual machines. Solution: You add an extension to each virtual machine. Does this meet the goal?
Simulation LAB Task 1 You need to ensure that connections from the Internet to VNET1\subnet0 are allowed only over TCP port 7777. The solution must use only currently deployed resources.
You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?
You are configuring and securing a network environment. You deploy an Azure virtual machine named VM1 that is configured to analyze network traffic. You need to ensure that all network traffic is routed through VM1. What should you configure?
HOTSPOT You have an Azure subscription that contains the resources shown in the following table. Transparent Data Encryption (TDE) is disabled on SQL1. You assign policies to the resource groups as shown in the following table. You plan to deploy Azure SQL databases by using an Azure Resource Manager (ARM) template. The databases will be configured as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
You have an Azure subscription that contains the Azure virtual machines shown in the following table. You create an MDM Security Baseline profile named Profile1. You need to identify to which virtual machines Profile1 can be applied. Which virtual machines should you identify?
HOTSPOT You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table. You schedule two update deployments named Update1 and Update2. Update1 updates VM3. Update2 updates VM6. Which additional virtual machines can be updated by using Update1 and Update2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.) You plan to deploy the cluster to production. You disable HTTP application routing. You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address. What should you do?
HOTSPOT You have an Azure key vault. You need to delegate administrative access to the key vault to meet the following requirements: Provide a user named User1 with the ability to set advanced access policies for the key vault. Provide a user named User2 with the ability to add and delete certificates in the key vault. Use the principle of least privilege. What should you use to assign access to each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT You have an Azure subscription that contains the following resources: An Azure key vault An Azure SQL database named Database1 Two Azure App Service web apps named AppSrv1 and AppSrv2 that are configured to use system-assigned managed identities and access Database1 You need to implement an encryption solution for Database1 that meets the following requirements: The data in a column named Discount in Database1 must be encrypted so that only AppSrv1 can decrypt the data. AppSrv1 and AppSrv2 must be authorized by using managed identities to obtain cryptographic keys. How should you configure the encryption settings for Database1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.