AZ-500 practice questions 11–20

1. Question 11 · 496 in bank

   You have been tasked with enabling Advanced Threat Protection for an Azure SQL Database server. Advanced Threat Protection must be configured to identify all types of threat detection. Which of the following will happen if when a faulty SQL statement is generate in the database by an application?

   • AA Potential SQL injection alert is triggered.
   • BA Vulnerability to SQL injection alert is triggered.
   • CAn Access from a potentially harmful application alert is triggered.
   • DA Brute force SQL credentials alert is triggered.

   Show answer

   Answer: B

   Explanation

   A possible vulnerability to SQL Injection (SQL.VM_VulnerabilityToSqlInjection SQL.DB_VulnerabilityToSqlInjection SQL.MI_VulnerabilityToSqlInjection SQL.DW_VulnerabilityToSqlInjection) An application has generated a faulty SQL statement in the database. This can indicate a possible vulnerability to SQL injection attacks. There are two possible reasons for a faulty statement. A defect in application code might have constructed the faulty SQL statement. Or, application code or stored procedures didn't sanitize user input when constructing the faulty SQL statement, which can be exploited for SQL injection. ) https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-sql-db-and-warehouse

   Source: Adapted from community discussion — Rume

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 12 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of pass-through authentication and seamless SSO with password hash synchronization. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   We have 3 options for solution: 1) Password hash synchronization + Seamless SSO 2) Pass-through Authentication + Seamless SSO 3) Federation with AD FS 1 - doesn't support "password policies and user logon limitations". 2 and 3 - support, but 3 requres more servers.

   Source: Adapted from community discussion — kakakayayaya

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 13 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure Container Registry. You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal. Solution: You create an Azure Active Directory (Azure AD) role assignment. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Answer is B The question says to "make us of auto-generated service principal", not managed identity. You'll use CLI or Powershell to automate generation of service principal to link AKS to ACR. see additional links: https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli https://docs.microsoft.com/en-us/azure/active-directory/develop/app-objects-and-service-principals https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-powershell "use the New-AzAksCluster command to generate the service principal automatically, the service principal credentials are written to the file ~/.azure/acsServicePrincipal.json on the machine used to run the command"

   Source: Adapted from community discussion — Irishtk

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 14 · 496 in bank

   Select 2

   Your company has an Azure subscription that includes two virtual machines, named VirMac1 and VirMac2, which both have a status of Stopped (Deallocated). The virtual machines belong to different resource groups, named ResGroup1 and ResGroup2. You have also created two Azure policies that are both configured with the virtualMachines resource type. The policy configured for ResGroup1 has a policy definition of Not allowed resource types, while the policy configured for ResGroup2 has a policy definition of Allowed resource types. You then create a Read-only resource lock on VirMac1, as well as a Read-only resource lock on ResGroup2. Which of the following is TRUE with regards to the scenario? (Choose all that apply.)

   • AYou will be able to start VirMac1.
   • BYou will NOT be able to start VirMac1.
   • CYou will be able to create a virtual machine in ResGroup2.
   • DYou will NOT be able to create a virtual machine in ResGroup2.

   Show answer

   Answer: BD

   Explanation

   Correct answer is B and D, When you will create a virtual machine in ResGroup2 it will give you error "The selected resource group is read only"

   Source: Adapted from community discussion — SajjadKarim

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 15 · 496 in bank

   You have been tasked with delegate administrative access to your company's Azure key vault. You have to make sure that a specific user can set advanced access policies for the key vault. You also have to make sure that access is assigned based on the principle of least privilege. Which of the following options should you use to achieve your goal?

   • AAzure Information Protection B. RBAC
   • BAzure AD Privileged Identity Management (PIM)
   • CAzure DevOps

   Show answer

   Answer: A

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault

   Source: Adapted from community discussion — Mazhar1993

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 16 · 496 in bank

   You have been tasked with delegate administrative access to your company's Azure key vault. You have to make sure that a specific user is able to add and delete certificates in the key vault. You also have to make sure that access is assigned based on the principle of least privilege. Which of the following options should you use to achieve your goal?

   • AA key vault access policy
   • BAzure policy
   • CAzure AD Privileged Identity Management (PIM)
   • DAzure DevOps

   Show answer

   Answer: A

   Explanation

   The answer is A: These operations are done on the key vault's data plane. The suitable built-in role would be a Key Vault Certificates Officer - able to perform any action on the certificates of a key vault, except manage permissions. https://docs.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli#azure-built-in-roles-for-key-vault-data-plane-operations

   Source: Adapted from community discussion — in_da_cloud

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 17 · 496 in bank

   You have an Azure virtual machine that runs Windows Server R2. You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine. Which of the following is TRUE with regards to Azure Disk Encryption for a Windows VM?

   • AIt is supported for basic tier VMs.
   • BIt is supported for standard tier VMs.
   • CIt is supported for VMs configured with software-based RAID systems.
   • DIt is supported for VMs configured with Storage Spaces Direct (S2D).

   Show answer

   Answer: B

   Explanation

   The answer is correct. It seems there is quite a few Key Vault questions so far. There is a guy "John Savill" on Youtube who has an excellent "deep dive" course on Azure Key Vault that is worth watching. Link: https://www.youtube.com/results?search_query=john+savill+key+vault

   Source: Adapted from community discussion — cfsxtuv33

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 18 · 496 in bank

   You have an Azure virtual machine that runs Ubuntu 16.04-DAILY-LTS. You plan to deploy and configure an Azure Key vault, and enable Azure Disk Encryption for the virtual machine. Which of the following is TRUE with regards to Azure Disk Encryption for a Linux VM?

   • AIt is NOT supported for basic tier VMs.
   • BIt is NOT supported for standard tier VMs.
   • COS drive encryption for Linux virtual machine scale sets is supported.
   • DCustom image encryption is supported.

   Show answer

   Answer: A

   Explanation

   option A is correct . you can find Unsupported scenarios Azure Disk Encryption does not work for the following Linux scenarios, features, and technology: Encrypting basic tier VM or VMs created through the classic VM creation method. Disabling encryption on an OS drive or data drive of a Linux VM when the OS drive is encrypted. Encrypting the OS drive for Linux virtual machine scale sets. Encrypting custom images on Linux VMs. Integration with an on-premises key management system. Azure Files (shared file system). Network File System (NFS). Dynamic volumes. Ephemeral OS disks.

   Source: Adapted from community discussion — azcourse

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 19 · 496 in bank

   You need to consider the underlined segment to establish whether it is accurate. You have configured an Azure Kubernetes Service (AKS) cluster in your testing environment. You are currently preparing to deploy the cluster to the production environment. After disabling HTTP application routing, you want to replace it with an application routing solution that allows for reverse proxy and TLS termination for AKS services via a solitary IP address. You must create an AKS Ingress controller. Select `No adjustment required` if the underlined segment is accurate. If the underlined segment is inaccurate, select the accurate option.

   • ANo adjustment required.
   • Ba network security group
   • Can application security group
   • Dan Azure Basic Load Balancer

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/aks/ingress-basic An ingress controller is a piece of software that provides reverse proxy, configurable traffic routing, and TLS termination for Kubernetes services. Kubernetes ingress resources are used to configure the ingress rules and routes for individual Kubernetes services. When you use an ingress controller and ingress rules, a single IP address can be used to route traffic to multiple services in a Kubernetes cluster.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 20 · 496 in bank

    Select 2

    You want to gather logs from a large number of Windows Server 2016 computers using Azure Log Analytics. You are configuring an Azure Resource Manager template to deploy the Microsoft Monitoring Agent to all the servers automatically. Which of the following should be included in the template? (Choose all that apply.)

    • AWorkspaceID
    • BAzureADApplicationID
    • CWorkspaceKey
    • DStorageAccountKey

    Show answer

    Answer: AC

    Explanation

    AC is the answer. https://learn.microsoft.com/en-us/services-hub/health/mma-setup#download-and-install-the-microsoft-monitoring-agent-setup-file On the Overview, Settings Dashboard page, select Connected Sources, and then copy and paste the Workspace ID and Workspace Key (Primary Key) from the log analytics portal.

    Source: Adapted from community discussion — zellck

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 11. 496 questions available.