AZ-500 practice questions 191–200

1. Question 191 · 496 in bank

   HOTSPOT - You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016. You need to implement a policy to ensure that each virtual machine has a custom antimalware virtual machine extension installed. How should you complete the policy? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: DeployIfNotExists - DeployIfNotExists executes a template deployment when the condition is met. Box 2: Template - The details property of the DeployIfNotExists effects has all the subproperties that define the related resources to match and the template deployment to execute. Deployment [required] This property should include the full template deployment as it would be passed to the Microsoft.Resources/deployment References: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

   Source: Adapted from community discussion — wardy1983

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 192 · 496 in bank

   You are configuring an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use the auto-generated service principal to authenticate to the Azure Container Registry. What should you create?

   • Aan Azure Active Directory (Azure AD) group
   • Ban Azure Active Directory (Azure AD) role assignment
   • Can Azure Active Directory (Azure AD) user
   • Da secret in Azure Key Vault

   Show answer

   Answer: B

   Explanation

   1. When you create an AKS cluster, Azure also creates a service principal to support cluster operability with other Azure resources. 2. This service principal can already authenticate to AAD (since it was created in AAD). 3. But it needs to be RBAC permissions on the ACR Registry to pull images. To do so, you need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry.

   Source: Adapted from community discussion — DeepMoon

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 193 · 496 in bank

   You have an Azure subscription that contains the Azure virtual machines shown in the following table.

   

   You create an MDM Security Baseline profile named Profile1. You need to identify to which virtual machines Profile1 can be applied. Which virtual machines should you identify?

   • AVM1 only
   • BVM1, VM2, and VM3 only
   • CVM1 and VM3 only
   • DVM1, VM2, VM3, and VM4

   Show answer

   Answer: A

   Explanation

   Servers are not Mobile and MDM is Mobile Device Management, so the only answer to choose here is Windows 10 as it can be installed on a laptop making it Mobile. HOPE this helps.

   Source: Adapted from community discussion — DarkCyberGhost

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 194 · 496 in bank

   SIMULATION - You need to ensure that connections from the Internet to VNET1\subnet0 are allowed only over TCP port 7777. The solution must use only currently deployed resources. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to configure the Network Security Group that is associated with subnet0. 1. In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET1. Alternatively, browse to Virtual Networks in the left navigation pane. 2. In the properties of VNET1, click on Subnets. This will display the subnets in VNET1 and the Network Security Group associated to each subnet. Note the name of the Network Security Group associated to Subnet0. 3. Type Network Security Groups into the search box and select the Network Security Group associated with Subnet0. 4. In the properties of the Network Security Group, click on Inbound Security Rules. 5. Click the Add button to add a new rule. 6. In the Source field, select Service Tag. 7. In the Source Service Tag field, select Internet. 8. Leave the Source port ranges and Destination field as the default values (* and All). 9. In the Destination port ranges field, enter 7777. 10.Change the Protocol to TCP. 11.Leave the Action option as Allow. 12.Change the Priority to 100. 13.Change the Name from the default Port_8080 to something more descriptive such as Allow_TCP_7777_from_Internet. The name cannot contain spaces. 14.Click the Add button to save the new rule.

   Source: Adapted from community discussion — Mic8888

   Next question

5. Question 195 · 496 in bank

   SIMULATION - You need to prevent administrators from performing accidental changes to the Homepage app service plan. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to configure a 'lock' for the app service plan. A read-only lock ensures that no one can make changes to the app service plan without first deleting the lock. 1. In the Azure portal, type App Service Plans in the search box, select App Service Plans from the search results then select Homepage. Alternatively, browse to App Service Plans in the left navigation pane. 2. In the properties of the app service plan, click on Locks. 3. Click the Add button to add a new lock. 4. Enter a name in the Lock name field. It doesn't matter what name you provide for the exam. 5. For the Lock type, select Read-only. 6. Click OK to save the changes.

   Next question

6. Question 196 · 496 in bank

   You have an Azure Container Registry named ContReg1 that contains a container image named image1. You enable content trust for ContReg1. After content trust is enabled, you push two images to ContReg1 as shown in the following table.

   

   Which images are trusted images?

   • Aimage1 and image2 only
   • Bimage2 only
   • Cimage1, image2, and image3

   Show answer

   Answer: B

   Explanation

   Well that's part of testing your knowledge. Microsoft validates if you are aware what the setting of image 1 will be AFTER setting contenttrust. Thats the whole point. The setting is also known, you don'' t have to see it, as it wasn't enabled.

   Source: Adapted from community discussion — JakeCallham

   Next question

7. Question 197 · 496 in bank

   SIMULATION - You need to ensure that a user named Danny1234578 can sign in to any SQL database on a Microsoft SQL server named web1234578 by using SQL Server Management Studio (SSMS) and Azure Active Directory (Azure AD) credentials. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to provision an Azure AD Admin for the SQL Server. 1. In the Azure portal, type SQL Server in the search box, select SQL Server from the search results then select the server named web1234578. Alternatively, browse to SQL Server in the left navigation pane. 2. In the SQL Server properties page, click on Active Directory Admin. 3. Click the Set Admin button. 4. In the Add Admin window, search for and select Danny1234578. 5. Click the Select button to add Danny1234578. 6. Click the Save button to save the changes. Reference: https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell

   Next question

8. Question 198 · 496 in bank

   SIMULATION - You need to configure a Microsoft SQL server named Web1234578 only to accept connections from the Subnet0 subnet on the VNET01 virtual network. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to allow access to Azure services and configure a virtual network rule for the SQL Server. 1. In the Azure portal, type SQL Server in the search box, select SQL Server from the search results then select the server named web1234578. Alternatively, browse to SQL Server in the left navigation pane. 2. In the properties of the SQL Server, click Firewalls and virtual networks. 3. In the Virtual networks section, click on Add existing. This will open the Create/Update virtual network rule window. 4. Give the rule a name such as Allow_VNET01-Subnet0 (it doesn't matter what name you enter for the exam). 5. In the Virtual network box, select VNET01. 6. In the Subnet name box, select Subnet0. 7. Click the OK button to save the rule. 8. Back in the Firewall / Virtual Networks window, set the Allow access to Azure services option to On.

   Source: Adapted from community discussion — ylfr

   Next question

9. Question 199 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual machines shown in the following table.

   

   You create the Azure policies shown in the following table.

   

   You create the resource locks shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   References: https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

   Source: Adapted from community discussion — snelkoppeling

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 200 · 496 in bank

    HOTSPOT - You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains the users shown in the following table.

    

    You create a resource group named RG1. Which users can modify the permissions for RG1 and which users can create virtual networks in RG1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: Only an owner can change permissions on resources. Box 2: A Contributor can create/modify/delete anything in the subscription but cannot change permissions.

    Source: Adapted from community discussion — gcpbrig01

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 191. 496 questions available.