Microsoft AZ-500 Practice Test - Questions Answers, Page 3

From scenario: Deploy Azure Firewall to VNetwork1 in Sub2.

Azure firewall needs a dedicated subnet named AzureFirewallSubnet.

References:

https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

VM1: Yes. NSG2 applies to VM1 and this allows inbound traffic on port 80.

VM2: No. NSG2 and NSG1 apply to VM2. NSG2 allows the inbound traffic on port 80 but NSG1 does not allow it. VM3: Yes. There are no NSGs applying to VM3 so all ports will be open.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime

Box 1: Admin3 only

The Contributor role has the necessary write permissions to create the resource group.

Box 2: Admin4 only

You need Owner level access to be able to manage permissions. The Contributor role can do most things but cannot modify permissions on existing objects.

The Standard tier extends the capabilities of the Free tier to workloads running in private and other public clouds, providing unified security management and threat protection across your hybrid cloud workloads. The Standard tier also adds advanced threat detection capabilities, which uses built-in behavioral analytics and machine learning to identify attacks and zero-days exploits, access and application controls to reduce exposure to network attacks and malware, and more.

Scenario: Security Operations Requirements

Litware must be able to customize the operating system security configurations in Azure Security Center.

Reference:

https://docs.microsoft.com/en-us/azure/security-center/security-center-pricing

Delegated permissions - Your client application needs to access the web API as the signed-in user, but with access limited by the selected permission. This type of permission can be granted by a user unless the permission requires administrator consent.

Incorrect Answers:

A, D: Application permissions - Your client application needs to access the web API directly as itself (no user context). This type of permission requires administrator consent and is also not available for public (desktop and mobile) client applications.

References: https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses. References: https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-protocols-oauth-code

When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity. References: https://docs.microsoft.com/bs-latn-ba/azure/governance/policy/how-to/remediate-resources