AZ-500 practice questions 281–290

1. Question 281 · 496 in bank

   Select 2

   You have an Azure subscription that contains an Azure key vault. You create a storage account named storage1. You plan to store data in the following storage1 services: • Azure Files • Azure Blob storage • Azure Table storage • Azure Queue storage For which two services can you configure data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution, NOTE: Each correct selection is worth one point.

   • ABlob storage
   • BTable storage
   • CQueue storage
   • DAzure Files

   Show answer

   Answer: AD

   Explanation

   Question is pretty old and now when creating Storage Account, you can select what services you want to protect with customer managed keys. You can select either "blobs and files" or "all service types". Note that you can't change this setting after creation of storage account

   Source: Adapted from community discussion — JackGelder

   References

   • Microsoft Learn

   Next question

2. Question 282 · 496 in bank

   You have 10 virtual machines on a single subnet that has a single network security group (NSG). You need to log the network traffic to an Azure Storage account. What should you do?

   • AInstall the Network Performance Monitor solution.
   • BCreate an Azure Log Analytics workspace.
   • CEnable diagnostic logging for the NSG.
   • DEnable NSG flow logs.

   Show answer

   Answer: D

   Explanation

   From the material I have, there is additional line below as following: Which 2 actions should you perform? Each answer presents part of the solution. ANS: B & D B: Enable Azure Network Watcher D: Enable NSG flow logs. There is a E selection, which is not the correct answer anyway. E: Create an Azure Log Analytics workspace Just watch out for the real question.

   Source: Adapted from community discussion — kumax

   References

   • Microsoft Learn

   Next question

3. Question 283 · 496 in bank

   You have an Azure subscription that contains the virtual machines shown in the following table.

   

   From Azure Security Center, you turn on Auto Provisioning. You deploy the virtual machines shown in the following table.

   

   On which virtual machines is the Log Analytics Agent installed?

   • AVM3 only
   • BVM1 and VM3 only
   • CVM3 and VM4 only
   • DVM1, VM2, VM3, and VM4

   Show answer

   Answer: D

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 284 · 496 in bank

   HOTSPOT - You plan to use Azure Log Analytics to collect logs from 200 servers that run Windows Server 2016. You need to automate the deployment of the Microsoft Monitoring Agent to all the servers by using an Azure Resource Manager template. How should you complete the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://blogs.technet.microsoft.com/manageabilityguys/2015/11/19/enabling-the-microsoft-monitoring-agent-in-windows-json-templates/

   Source: Adapted from community discussion — gcpbrig01

   References

   • Microsoft Learn

   

   Next question

5. Question 285 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the alerts shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   References: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-overview

   Source: Adapted from community discussion — nihao381

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 286 · 496 in bank

   You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. You are assigned the Global administrator role for the tenant. You are responsible for managing Azure Security Center settings. You need to create a custom sensitivity label. What should you do?

   • ACreate a custom sensitive information type.
   • BElevate access for global administrators in Azure AD.
   • CUpgrade the pricing tier of the Security Center to Standard.
   • DEnable integration with Microsoft Cloud App Security.

   Show answer

   Answer: A

   Explanation

   Sensitive information types (SITs) are part of the new Microsoft Purview (compliance) service offering and are not covered in the 2022 exam. Rather this will be covered in the SC-400 exam. To create a SIT users should visit the Purview Compliance portal at ( https://compliance.microsoft.com/dataclassification ) , select the "Sensitive info types", followed by "Create sensitive info type".

   Source: Adapted from community discussion — NinjaSchoolProfessor

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 287 · 496 in bank

   HOTSPOT - You have the hierarchy of Azure resources shown in the following exhibit.

   

   You create the Azure Blueprints definitions shown in the following table.

   

   To which objects can you assign Blueprint1 and Blueprint2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Blueprints can only be assigned to subscriptions.

   Source: Adapted from community discussion — cvarl

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 288 · 496 in bank

   You have an Azure subscription that contains the Azure Log Analytics workspaces shown in the following table.

   

   You create the virtual machines shown in the following table.

   

   You plan to use Azure Sentinel to monitor Windows Defender Firewall on the virtual machines. Which virtual machines you can connect to Azure Sentinel?

   • AVM1 only
   • BVM1 and VM3 only
   • CVM1, VM2, VM3, and VM4
   • DVM1 and VM2 only

   Show answer

   Answer: C

   Explanation

   Azure Sentinel is built on top of a Log Analytics workspace(ref: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants). Windows Firewall requires a Log Analytics Agent( or MMA) which again logs to a log analytic workspace. Although at first it it might appear that only VM1 and VM3 can be monitored by Sentinel, it is not correct. VM2 and VM4 can be monitored by Sentinel too by simply configuring the Log Analytics Agent to forward to Workspace1 in addition to Workspace2. If the machines were Linux VMs rather than Windows VMs this wouldn't be possible as multi-homing Linux VMs to multiple Log Analytics workspace is not supported( this limitation goes away with Azure Monitoring Agent( latest agent that will eventually replace Log Analytics Agent). HTH Answer - all 4 VMs.

   Source: Adapted from community discussion — rsharma007

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 289 · 496 in bank

   HOTSPOT - You have an Azure subscription named Sub1. Sub1 has an Azure Storage account named storage1 that contains the resources shown in the following table.

   

   You generate a shared access signature (SAS) to connect to the blob service and the file service. Which tool can you use to access the contents in Container1 and Share1 by using the SAS? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   - Azure Storage Explorer This one is simple enough. - Azure Storage Explorer You do not map a file share from azure with SAS. You can use SAS with storage explorer though. https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows#mount-the-azure-file-share

   Source: Adapted from community discussion — JerryGolais

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 290 · 496 in bank

    HOTSPOT - You have an Azure subscription that contains a user named Admin1 and a resource group named RG1. In Azure Monitor, you create the alert rules shown in the following table.

    

    Admin1 performs the following actions on RG1: ✑ Adds a virtual network named VNET1 ✑ Adds a Delete lock named Lock1 Which rules will trigger an alert as a result of the actions of Admin1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Administrative category This category contains the record of all create, update, delete, and action operations performed through Resource Manager. Examples of the types of events you would see in this category include "create virtual machine" and "delete network security group" Every action taken by a user or application using Resource Manager is modeled as an operation on a particular resource type. If the operation type is Write, Delete, or Action, the records of both the start and success or fail of that operation are recorded in the Administrative category. The Administrative category also includes any changes to Azure role-based access control in a subscription.

    Source: Adapted from community discussion — glowglow

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 281. 496 questions available.