ExamGecko
Login
Home / Microsoft / AZ-500 / List of questions
Ask Question

Microsoft AZ-500 Practice Test - Questions Answers, Page 8

List of questions

Question 71

Report
Export
Collapse

You have an Azure subscription that contains as Azure key vault and an Azure Storage account. The key vault contains customer-managed keys. The storage account is configured to use the customer-managed keys stored in the key vault.

You plan to store data in Azure by using the following services:

Azure Files

Azure Blob storage

Azure Log Analytics

Azure Table storage

Azure Queue storage

Which two services support data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Table storage
Table storage
Azure Files
Azure Files
Blob storage
Blob storage
Queue storage
Queue storage
Suggested answer: B, C

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption

asked 02/10/2024
MARTIN WEAVER
35 questions

Question 72

Report
Export
Collapse

DRAG DROP

You have an Azure subscription.

You plan to create a storage account.

You need to use customer-managed keys to encrypt the tables in the storage account.

From Azure Cloud Shell, which three cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.


Microsoft AZ-500 image Question 72 87510 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 72 87510 10022024015441000

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-key-vault?tabs=powershell

asked 02/10/2024
Marcelo Tamaki
36 questions

Question 73

Report
Export
Collapse

HOTSPOT

You have an Azure subscription that contains the following resources:

An Azure key vault

An Azure SQL database named Database1

Two Azure App Service web apps named AppSrv1 and AppSrv2 that are configured to use system-assigned managed identities and access Database1

You need to implement an encryption solution for Database1 that meets the following requirements:

The data in a column named Discount in Database1 must be encrypted so that only AppSrv1 can decrypt the data. AppSrv1 and AppSrv2 must be authorized by using managed identities to obtain cryptographic keys.

How should you configure the encryption settings for Database1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 73 87511 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 73 87511 10022024015441000

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell

asked 02/10/2024
Paula Castanheira
36 questions

Question 74

Report
Export
Collapse

You have an Azure subscription named Sub1. Sub1 contains a virtual network named VNet1 that contains one subnet named Subnet1. You create a service endpoint for Subnet1.

Subnet1 contains an Azure virtual machine named VM1 that runs Ubuntu Server 18.04.

You need to deploy Docker containers to VM1. The containers must be able to access Azure Storage resources and Azure SQL databases by using the service endpoint. What should you do on VM1 before you deploy the container?

Create an application security group and a network security group (NSG).
Create an application security group and a network security group (NSG).
Edit the docker-compose.yml file.
Edit the docker-compose.yml file.
Install the container network interface (CNI) plug-in.
Install the container network interface (CNI) plug-in.
Suggested answer: C

Explanation:

The Azure Virtual Network container network interface (CNI) plug-in installs in an Azure Virtual Machine. The plug-in supports both Linux and Windows platform. The plug-in assigns IP addresses from a virtual network to containers brought up in the virtual machine, attaching them to the virtual network, and connecting them directly to other containers and virtual network resources. The plug-in doesn’t rely on overlay networks, or routes, for connectivity, and provides the same performance as virtual machines. The following picture shows how the plug-in provides Azure Virtual Network capabilities to Pods:

Microsoft AZ-500 image Question 1 explanation 87323 10022024015440000000

References:

https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview

asked 02/10/2024
marco giovinazzo
29 questions

Question 75

Report
Export
Collapse

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.

You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?

device configuration policies in Microsoft Intune
device configuration policies in Microsoft Intune
an Azure Desired State Configuration (DSC) virtual machine extension
an Azure Desired State Configuration (DSC) virtual machine extension
application security groups
application security groups
device compliance policies in Microsoft Intune
device compliance policies in Microsoft Intune
Suggested answer: B

Explanation:

The primary use case for the Azure Desired State Configuration (DSC) extension is to bootstrap a VM to the Azure Automation State Configuration (DSC) service. The service provides benefits that include ongoing management of the VM configuration and integration with other operational tools, such as Azure Monitoring. Using the extension to register VM's to the service provides a flexible solution that even works across Azure subscriptions.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview

asked 02/10/2024
de jong arjen
45 questions

Question 76

Report
Export
Collapse

You are configuring an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use the auto-generated service principal to authenticate to the Azure Container Registry. What should you create?

an Azure Active Directory (Azure AD) group
an Azure Active Directory (Azure AD) group
an Azure Active Directory (Azure AD) role assignment
an Azure Active Directory (Azure AD) role assignment
an Azure Active Directory (Azure AD) user
an Azure Active Directory (Azure AD) user
a secret in Azure Key Vault
a secret in Azure Key Vault
Suggested answer: B

Explanation:

When you create an AKS cluster, Azure also creates a service principal to support cluster operability with other Azure resources. You can use this auto-generated service principal for authentication with an ACR registry. To do so, you need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry. References: https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-auth-aks

asked 02/10/2024
Jeremiah Gem Galeon
43 questions

Question 77

Report
Export
Collapse

You have the Azure virtual machines shown in the following table.

Microsoft AZ-500 image Question 4 87326 10022024015440000000

You create an Azure Log Analytics workspace named Analytics1 in RG1 in the East US region.

Which virtual machines can be enrolled in Analytics1?

VM1 only
VM1 only
VM1, VM2, and VM3 only
VM1, VM2, and VM3 only
VM1, VM2, VM3, and VM4
VM1, VM2, VM3, and VM4
VM1 and VM4 only
VM1 and VM4 only
Suggested answer: A

Explanation:

Note: Create a workspace

In the Azure portal, click All services. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics. Click Create, and then select choices for the following items:

Provide a name for the new Log Analytics workspace, such as DefaultLAWorkspace. OMS workspaces are now referred to as Log Analytics workspaces. Select a Subscription to link to by selecting from the drop-down list if the default selected is not appropriate. For Resource Group, select an existing resource group that contains one or more Azure virtual machines. Select the Location your VMs are deployed to. For additional information, see which regions Log Analytics is available in. Incorrect Answers:

B, C: A Log Analytics workspace provides a geographic location for data storage. VM2 and VM3 are at a different location. D: VM4 is a different resource group.

References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access

asked 02/10/2024
Himanshu Sachdeva
36 questions

Question 78

Report
Export
Collapse

You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.)

Microsoft AZ-500 image Question 5 87327 10022024015440000000

You plan to deploy the cluster to production. You disable HTTP application routing.

You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address.

What should you do?

Create an AKS Ingress controller.
Create an AKS Ingress controller.
Install the container network interface (CNI) plug-in.
Install the container network interface (CNI) plug-in.
Create an Azure Standard Load Balancer.
Create an Azure Standard Load Balancer.
Create an Azure Basic Load Balancer.
Create an Azure Basic Load Balancer.
Suggested answer: A

Explanation:

An ingress controller is a piece of software that provides reverse proxy, configurable traffic routing, and TLS termination for Kubernetes services. References: https://docs.microsoft.com/en-us/azure/aks/ingress-tls

asked 02/10/2024
Tiago Martins
33 questions

Question 79

Report
Export
Collapse

DRAG DROP

You have an Azure subscription that contains the virtual networks shown in the following table.

Microsoft AZ-500 image Question 6 87328 10022024015440000000

The Azure virtual machines on SpokeVNetSubnet0 can communicate with the computers on the on-premises network.

You plan to deploy an Azure firewall to HubVNet.

You create the following two routing tables:

RT1: Includes a user-defined route that points to the private IP address of the Azure firewall as a next hop address RT2: Disables BGP route propagation and defines the private IP address of the Azure firewall as the default gateway

You need to ensure that traffic between SpokeVNetSubnet0 and the on-premises network flows through the Azure firewall.

To which subnet should you associate each route table? To answer, drag the appropriate subnets to the correct route tables. Each subnet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 79 87328 10022024015440000
Correct answer: Microsoft AZ-500 image answer Question 79 87328 10022024015440000

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal#create-the-routes

asked 02/10/2024
Do Hien
47 questions

Question 80

Report
Export
Collapse

HOTSPOT

You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016.

You need to implement a policy to ensure that each virtual machine has a custom antimalware virtual machine extension installed.

How should you complete the policy? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 80 87329 10022024015440000
Correct answer: Microsoft AZ-500 image answer Question 80 87329 10022024015440000

Explanation:

Box 1: DeployIfNotExists

DeployIfNotExists executes a template deployment when the condition is met.

Box 2: Template

The details property of the DeployIfNotExists effects has all the subproperties that define the related resources to match and the template deployment to execute. Deployment [required]

This property should include the full template deployment as it would be passed to the Microsoft.Resources/deployment

References:

https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

asked 02/10/2024
Aaron Case
47 questions
Total 442 questions
Go to page: of 45
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016. You need to deploy Microsoft Antimalware to the virtual machines. Solution: You add an extension to each virtual machine. Does this meet the goal?
Simulation LAB Task 1 You need to ensure that connections from the Internet to VNET1\subnet0 are allowed only over TCP port 7777. The solution must use only currently deployed resources.
You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?
You are configuring and securing a network environment. You deploy an Azure virtual machine named VM1 that is configured to analyze network traffic. You need to ensure that all network traffic is routed through VM1. What should you configure?
HOTSPOT You have an Azure subscription that contains the resources shown in the following table. Transparent Data Encryption (TDE) is disabled on SQL1. You assign policies to the resource groups as shown in the following table. You plan to deploy Azure SQL databases by using an Azure Resource Manager (ARM) template. The databases will be configured as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
You have an Azure subscription that contains the Azure virtual machines shown in the following table. You create an MDM Security Baseline profile named Profile1. You need to identify to which virtual machines Profile1 can be applied. Which virtual machines should you identify?
HOTSPOT You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table. You schedule two update deployments named Update1 and Update2. Update1 updates VM3. Update2 updates VM6. Which additional virtual machines can be updated by using Update1 and Update2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.) You plan to deploy the cluster to production. You disable HTTP application routing. You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address. What should you do?
HOTSPOT You have an Azure key vault. You need to delegate administrative access to the key vault to meet the following requirements: Provide a user named User1 with the ability to set advanced access policies for the key vault. Provide a user named User2 with the ability to add and delete certificates in the key vault. Use the principle of least privilege. What should you use to assign access to each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT You have an Azure subscription that contains the following resources: An Azure key vault An Azure SQL database named Database1 Two Azure App Service web apps named AppSrv1 and AppSrv2 that are configured to use system-assigned managed identities and access Database1 You need to implement an encryption solution for Database1 that meets the following requirements: The data in a column named Discount in Database1 must be encrypted so that only AppSrv1 can decrypt the data. AppSrv1 and AppSrv2 must be authorized by using managed identities to obtain cryptographic keys. How should you configure the encryption settings for Database1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.