AZ-500 practice questions 221–230

1. Question 221 · 496 in bank

   From Azure Security Center, you create a custom alert rule. You need to configure which users will receive an email message when the alert is triggered. What should you do?

   • AFrom Azure Monitor, create an action group.
   • BFrom Security Center, modify the Security policy settings of the Azure subscription.
   • CFrom Azure Active Directory (Azure AD), modify the members of the Security Reader role group.
   • DFrom Security Center, modify the alert rule.

   Show answer

   Answer: A

   Explanation

   An action group is a collection of notification preferences defined by the owner of an Azure subscription. Azure Monitor and Service Health alerts use action groups to notify users that an alert has been triggered. Various alerts may use the same action group or different action groups depending on the user's requirements.

   Source: Adapted from community discussion — cunlu

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 222 · 496 in bank

   You are configuring and securing a network environment. You deploy an Azure virtual machine named VM1 that is configured to analyze network traffic. You need to ensure that all network traffic is routed through VM1. What should you configure?

   • Aa system route
   • Ba network security group (NSG)
   • Ca user-defined route

   Show answer

   Answer: C

   Explanation

   Custom routes==>User-defined You create custom routes by either creating user-defined routes or by exchanging border gateway protocol (BGP) routes between your on-premises network gateway and an Azure virtual network gateway. User-defined You can create custom, or user-defined(static), routes in Azure to override Azure's default system routes, or to add additional routes to a subnet's route table. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

   Source: Adapted from community discussion — deegadaze1

   References

   • Microsoft Learn

   Next question

3. Question 223 · 496 in bank

   HOTSPOT - You have a network security group (NSG) bound to an Azure subnet. You run Get-AzNetworkSecurityRuleConfig and receive the output shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: able to connect to East US 2 The StorageEA2Allow has DestinationAddressPrefix {Storage/EastUS2} Box 2: allowed - TCP Port 21 controls the FTP session. Contoso_FTP has SourceAddressPrefix {1.2.3.4/32} and DestinationAddressPrefix {10.0.0.5/32} Note: The Get-AzureRmNetworkSecurityRuleConfig cmdlet gets a network security rule configuration for an Azure network security group. Security rules in network security groups enable you to filter the type of network traffic that can flow in and out of virtual network subnets and network interfaces. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group

   Source: Adapted from community discussion — JohnCrawford

   References

   • Microsoft Learn

   

   Next question

4. Question 224 · 496 in bank

   You have an Azure subscription that contains the virtual networks shown in the following table.

   

   The subscription contains the virtual machines shown in the following table.

   

   On NIC1, you configure an application security group named ASG1. On which other network interfaces can you configure ASG1?

   • ANIC2 only
   • BNIC2, NIC3, NIC4, and NIC5
   • CNIC2 and NIC3 only
   • DNIC2, NIC3, and NIC4 only

   Show answer

   Answer: C

   Explanation

   https://docs.microsoft.com/en-us/azure/virtual-network/application-security-groups • All network interfaces assigned to an application security group have to exist in the same virtual network that the first network interface assigned to the application security group is in. For example, if the first network interface assigned to an application security group named AsgWeb is in the virtual network named VNet1, then all subsequent network interfaces assigned to ASGWeb must exist in VNet1. You cannot add network interfaces from different virtual networks to the same application security group.

   Source: Adapted from community discussion — HarryD

   References

   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   Next question

5. Question 225 · 496 in bank

   You have 15 Azure virtual machines in a resource group named RG1. All the virtual machines run identical applications. You need to prevent unauthorized applications and malware from running on the virtual machines. What should you do?

   • AApply an Azure policy to RG1.
   • BFrom Azure Security Center, configure adaptive application controls.
   • CConfigure Azure Active Directory (Azure AD) Identity Protection.
   • DApply a resource lock to RG1.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls#what-are-adaptive-application-controls Adaptive application controls are an intelligent and automated solution for defining allowlists of known-safe applications for your machines. Often, organizations have collections of machines that routinely run the same processes. Microsoft Defender for Cloud uses machine learning to analyze the applications running on your machines and create a list of the known-safe software. Allowlists are based on your specific Azure workloads, and you can further customize the recommendations using the following instructions.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 226 · 496 in bank

   You have a web app hosted on an on-premises server that is accessed by using a URL of https://www.contoso.com. You plan to migrate the web app to Azure. You will continue to use https://www.contoso.com. You need to enable HTTPS for the Azure web app. What should you do first?

   • AExport the public key from the on-premises server and save the key as a P7b file.
   • BExport the private key from the on-premises server and save the key as a PFX file that is encrypted by using TripleDES.
   • CExport the public key from the on-premises server and save the key as a CER file.
   • DExport the private key from the on-premises server and save the key as a PFX file that is encrypted by using AES256.

   Show answer

   Answer: B

   Explanation

   https://docs.microsoft.com/en-us/azure/app-service/configure-ssl-certificate Private certificate requirements: Azure Web Apps does not support AES256 and all pfx files should be encrypted with TripleDES.

   Source: Adapted from community discussion — Coldriver

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 227 · 496 in bank

   SIMULATION - You need to perform a full malware scan every Sunday at 02:00 on a virtual machine named VM1 by using Microsoft Antimalware for Virtual Machines. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Deploy the Microsoft Antimalware Extension using the Azure Portal for single VM deployment 1. In Azure Portal, go to the Azure VM1's blade, navigate to the Extensions section and press Add. 2. Select the Microsoft Antimalware extension and press Create. 3. Fill the ג€Install extensionג€ form as desired and press OK. Scheduled: Enable - Scan type: Full - Scan day: Sunday - Reference: https://www.e-apostolidis.gr/microsoft/azure/azure-vm-antimalware-extension-management/

   Source: Adapted from community discussion — souvik123

   References

   • Microsoft Learn

   

   Next question

8. Question 228 · 496 in bank

   You plan to deploy Azure container instances. You have a containerized application that is comprised of two containers: an application container and a validation container. The application container is monitored by the validation container. The validation container performs security checks by making requests to the application container and waiting for responses after every transaction. You need to ensure that the application container and the validation container are scheduled to be deployed together. The containers must communicate to each other only on ports that are not externally exposed. What should you include in the deployment?

   • Aapplication security groups
   • Bnetwork security groups (NSGs)
   • Cmanagement groups
   • Dcontainer groups

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups#what-is-a-container-group A container group is a collection of containers that get scheduled on the same host machine. The containers in a container group share a lifecycle, resources, local network, and storage volumes. It's similar in concept to a pod in Kubernetes.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 229 · 496 in bank

   DRAG DROP - You are configuring network connectivity for two Azure virtual networks named VNET1 and VNET2. You need to implement VPN gateways for the virtual networks to meet the following requirements: ✑ VNET1 must have six site-to-site connections that use BGP. ✑ VNET2 must have 12 site-to-site connections that use BGP. ✑ Costs must be minimized. Which VPN gateway SKU should you use for each virtual network? To answer, drag the appropriate SKUs to the correct networks. Each SKU may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   References: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwsku

   Source: Adapted from community discussion — WMG

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 230 · 496 in bank

    You are securing access to the resources in an Azure subscription. A new company policy states that all the Azure virtual machines in the subscription must use managed disks. You need to prevent users from creating virtual machines that use unmanaged disks. What should you use?

    • AAzure Monitor
    • BAzure Policy
    • CAzure Security Center
    • DAzure Service Health

    Show answer

    Answer: B

    Explanation

    B. Azure Policy To prevent users from creating virtual machines that use unmanaged disks in an Azure subscription, you should use Azure Policy. Azure Policy allows you to define and enforce rules for resource properties during resource creation and updates. In this case, you can create a custom policy that enforces the use of managed disks for virtual machines and assign it to your subscription. This way, any attempt to create a virtual machine with unmanaged disks would be denied based on the policy.

    Source: Adapted from community discussion — alfaAzure

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 221. 496 questions available.