ExamGecko
Home / Microsoft / AZ-500 / List of questions
Ask Question

Microsoft AZ-500 Practice Test - Questions Answers, Page 8

List of questions

Question 71

Report
Export
Collapse

You have an Azure subscription that contains as Azure key vault and an Azure Storage account. The key vault contains customer-managed keys. The storage account is configured to use the customer-managed keys stored in the key vault.

You plan to store data in Azure by using the following services:

Azure Files

Azure Blob storage

Azure Log Analytics

Azure Table storage

Azure Queue storage

Which two services support data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Table storage
Table storage
Azure Files
Azure Files
Blob storage
Blob storage
Queue storage
Queue storage
Suggested answer: B, C

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption

asked 02/10/2024
MARTIN WEAVER
35 questions

Question 72

Report
Export
Collapse

DRAG DROP

You have an Azure subscription.

You plan to create a storage account.

You need to use customer-managed keys to encrypt the tables in the storage account.

From Azure Cloud Shell, which three cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.


Microsoft AZ-500 image Question 72 87510 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 72 87510 10022024015441000

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-key-vault?tabs=powershell

asked 02/10/2024
Marcelo Tamaki
36 questions

Question 73

Report
Export
Collapse

HOTSPOT

You have an Azure subscription that contains the following resources:

An Azure key vault

An Azure SQL database named Database1

Two Azure App Service web apps named AppSrv1 and AppSrv2 that are configured to use system-assigned managed identities and access Database1

You need to implement an encryption solution for Database1 that meets the following requirements:

The data in a column named Discount in Database1 must be encrypted so that only AppSrv1 can decrypt the data. AppSrv1 and AppSrv2 must be authorized by using managed identities to obtain cryptographic keys.

How should you configure the encryption settings for Database1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 73 87511 10022024015441000
Correct answer: Microsoft AZ-500 image answer Question 73 87511 10022024015441000

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell

asked 02/10/2024
Paula Castanheira
36 questions

Question 74

Report
Export
Collapse

You have an Azure subscription named Sub1. Sub1 contains a virtual network named VNet1 that contains one subnet named Subnet1. You create a service endpoint for Subnet1.

Subnet1 contains an Azure virtual machine named VM1 that runs Ubuntu Server 18.04.

You need to deploy Docker containers to VM1. The containers must be able to access Azure Storage resources and Azure SQL databases by using the service endpoint. What should you do on VM1 before you deploy the container?

Create an application security group and a network security group (NSG).
Create an application security group and a network security group (NSG).
Edit the docker-compose.yml file.
Edit the docker-compose.yml file.
Install the container network interface (CNI) plug-in.
Install the container network interface (CNI) plug-in.
Suggested answer: C

Explanation:

The Azure Virtual Network container network interface (CNI) plug-in installs in an Azure Virtual Machine. The plug-in supports both Linux and Windows platform. The plug-in assigns IP addresses from a virtual network to containers brought up in the virtual machine, attaching them to the virtual network, and connecting them directly to other containers and virtual network resources. The plug-in doesn’t rely on overlay networks, or routes, for connectivity, and provides the same performance as virtual machines. The following picture shows how the plug-in provides Azure Virtual Network capabilities to Pods:

Microsoft AZ-500 image Question 1 explanation 87323 10022024015440000000

References:

https://docs.microsoft.com/en-us/azure/virtual-network/container-networking-overview

asked 02/10/2024
marco giovinazzo
29 questions

Question 75

Report
Export
Collapse

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.

You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?

device configuration policies in Microsoft Intune
device configuration policies in Microsoft Intune
an Azure Desired State Configuration (DSC) virtual machine extension
an Azure Desired State Configuration (DSC) virtual machine extension
application security groups
application security groups
device compliance policies in Microsoft Intune
device compliance policies in Microsoft Intune
Suggested answer: B

Explanation:

The primary use case for the Azure Desired State Configuration (DSC) extension is to bootstrap a VM to the Azure Automation State Configuration (DSC) service. The service provides benefits that include ongoing management of the VM configuration and integration with other operational tools, such as Azure Monitoring. Using the extension to register VM's to the service provides a flexible solution that even works across Azure subscriptions.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview

asked 02/10/2024
de jong arjen
45 questions

Question 76

Report
Export
Collapse

You are configuring an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use the auto-generated service principal to authenticate to the Azure Container Registry. What should you create?

an Azure Active Directory (Azure AD) group
an Azure Active Directory (Azure AD) group
an Azure Active Directory (Azure AD) role assignment
an Azure Active Directory (Azure AD) role assignment
an Azure Active Directory (Azure AD) user
an Azure Active Directory (Azure AD) user
a secret in Azure Key Vault
a secret in Azure Key Vault
Suggested answer: B

Explanation:

When you create an AKS cluster, Azure also creates a service principal to support cluster operability with other Azure resources. You can use this auto-generated service principal for authentication with an ACR registry. To do so, you need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry. References: https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-auth-aks

asked 02/10/2024
Jeremiah Gem Galeon
43 questions

Question 77

Report
Export
Collapse

You have the Azure virtual machines shown in the following table.

Microsoft AZ-500 image Question 4 87326 10022024015440000000

You create an Azure Log Analytics workspace named Analytics1 in RG1 in the East US region.

Which virtual machines can be enrolled in Analytics1?

VM1 only
VM1 only
VM1, VM2, and VM3 only
VM1, VM2, and VM3 only
VM1, VM2, VM3, and VM4
VM1, VM2, VM3, and VM4
VM1 and VM4 only
VM1 and VM4 only
Suggested answer: A

Explanation:

Note: Create a workspace

In the Azure portal, click All services. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics. Click Create, and then select choices for the following items:

Provide a name for the new Log Analytics workspace, such as DefaultLAWorkspace. OMS workspaces are now referred to as Log Analytics workspaces. Select a Subscription to link to by selecting from the drop-down list if the default selected is not appropriate. For Resource Group, select an existing resource group that contains one or more Azure virtual machines. Select the Location your VMs are deployed to. For additional information, see which regions Log Analytics is available in. Incorrect Answers:

B, C: A Log Analytics workspace provides a geographic location for data storage. VM2 and VM3 are at a different location. D: VM4 is a different resource group.

References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/manage-access

asked 02/10/2024
Himanshu Sachdeva
36 questions

Question 78

Report
Export
Collapse

You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.)

Microsoft AZ-500 image Question 5 87327 10022024015440000000

You plan to deploy the cluster to production. You disable HTTP application routing.

You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address.

What should you do?

Create an AKS Ingress controller.
Create an AKS Ingress controller.
Install the container network interface (CNI) plug-in.
Install the container network interface (CNI) plug-in.
Create an Azure Standard Load Balancer.
Create an Azure Standard Load Balancer.
Create an Azure Basic Load Balancer.
Create an Azure Basic Load Balancer.
Suggested answer: A

Explanation:

An ingress controller is a piece of software that provides reverse proxy, configurable traffic routing, and TLS termination for Kubernetes services. References: https://docs.microsoft.com/en-us/azure/aks/ingress-tls

asked 02/10/2024
Tiago Martins
33 questions

Question 79

Report
Export
Collapse

DRAG DROP

You have an Azure subscription that contains the virtual networks shown in the following table.

Microsoft AZ-500 image Question 6 87328 10022024015440000000

The Azure virtual machines on SpokeVNetSubnet0 can communicate with the computers on the on-premises network.

You plan to deploy an Azure firewall to HubVNet.

You create the following two routing tables:

RT1: Includes a user-defined route that points to the private IP address of the Azure firewall as a next hop address RT2: Disables BGP route propagation and defines the private IP address of the Azure firewall as the default gateway

You need to ensure that traffic between SpokeVNetSubnet0 and the on-premises network flows through the Azure firewall.

To which subnet should you associate each route table? To answer, drag the appropriate subnets to the correct route tables. Each subnet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 79 87328 10022024015440000
Correct answer: Microsoft AZ-500 image answer Question 79 87328 10022024015440000

Explanation:

Reference:

https://docs.microsoft.com/en-us/azure/firewall/tutorial-hybrid-portal#create-the-routes

asked 02/10/2024
Do Hien
47 questions

Question 80

Report
Export
Collapse

HOTSPOT

You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016.

You need to implement a policy to ensure that each virtual machine has a custom antimalware virtual machine extension installed.

How should you complete the policy? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.


Microsoft AZ-500 image Question 80 87329 10022024015440000
Correct answer: Microsoft AZ-500 image answer Question 80 87329 10022024015440000

Explanation:

Box 1: DeployIfNotExists

DeployIfNotExists executes a template deployment when the condition is met.

Box 2: Template

The details property of the DeployIfNotExists effects has all the subproperties that define the related resources to match and the template deployment to execute. Deployment [required]

This property should include the full template deployment as it would be passed to the Microsoft.Resources/deployment

References:

https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

asked 02/10/2024
Aaron Case
47 questions
Total 442 questions
Go to page: of 45
Search

Related questions