AZ-500 practice questions 21–30

1. Question 21 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant. As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings. You are currently preparing to create a custom sensitivity label. Solution: You start by altering the pricing tier of the Security Center. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Here is the documentation for this question. 1- Create Sensitive Info type 2- Create Pattern 3- Choose Confidence level 4- Choose and define primary elements 5- Value for char prox 6- Choose recommend confidence level 7 - Submit

   Source: Adapted from community discussion — salmantarik

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 22 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant. As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings. You are currently preparing to create a custom sensitivity label. Solution: You start by integrating Security Center and Microsoft Cloud App Security. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   To follow this, you do not need to connect Security Center or enable MDCA prior to creating a custom Sensitive Information Type. This can be done by the Microsoft Purview portal today, and could have before been done via the AIP portal (legacy). Therefore, it's still B...because this technology is redundant in the process of creating a SIT.

   Source: Adapted from community discussion — Holii

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 23 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has an Active Directory forest with a single domain, named weylandindustries.com. They also have an Azure Active Directory (Azure AD) tenant with the same name. You have been tasked with integrating Active Directory and the Azure AD tenant. You intend to deploy Azure AD Connect. Your strategy for the integration must make sure that password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant, and that the amount of necessary servers are reduced. Solution: You recommend the use of federation with Active Directory Federation Services (AD FS). Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   - "password policies and user logon limitations affect user accounts that are synced to the Azure AD tenant" → Federation or PTA - "the amount of necessary servers are reduced" → Federation > PTA > PHS (number of server) So the answer is PTA.

   Source: Adapted from community discussion — trevax

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 24 · 496 in bank

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has Azure subscription linked to their Azure Active Directory (Azure AD) tenant. As a Global administrator for the tenant, part of your responsibilities involves managing Azure Security Center settings. You are currently preparing to create a custom sensitivity label. Solution: You start by creating a custom sensitive information type. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   I get the answer is correct but I am confused as to what MS AIP has to do with managing Azure Security Center settings. I find this question misleading, unless I am missing the connection.

   Source: Adapted from community discussion — adamsca

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 25 · 496 in bank

   You have a sneaking suspicion that there are users trying to sign in to resources which are inaccessible to them. You decide to create an Azure Log Analytics query to confirm your suspicions. The query will detect unsuccessful user sign-in attempts from the last few days. You want to make sure that the results only show users who had failed to sign-in more than five times. Which of the following should be included in your query?

   • AThe EventID and CountIf() parameters.
   • BThe ActivityID and CountIf() parameters.
   • CThe EventID and Count() parameters.
   • DThe ActivityID and Count() parameters.

   Show answer

   Answer: C

   Explanation

   -- KUSTO Query let timeframe = 1d; SecurityEvent | where TimeGenerated > ago(1d) | where AccountType == 'User' and EventID == 4625 // 4625 - failed log in | summarize failed_login_attempts=count(), latest_failed_login=arg_max(TimeGenerated, Account) by Account | where failed_login_attempts > 5 | project-away Account1

   Source: Adapted from community discussion — Ram9533

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 26 · 496 in bank

   Select 2

   Your company uses Azure DevOps with branch policies configured. Which of the following is TRUE with regards to branch policies? (Choose all that apply.)

   • AIt enforces your team's change management standards.
   • BIt controls who can read and update the code in a branch.
   • CIt enforces your team's code quality.
   • DIt places a branch into a read-only state.

   Show answer

   Answer: AC

   Explanation

   AC is the answer. https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies Branch policies help teams protect their important branches of development. Policies enforce your team's code quality and change management standards.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 27 · 496 in bank

   After creating a new Azure subscription, you are tasked with making sure that custom alert rules can be created in Azure Security Center. You have created an Azure Storage account. Which of the following is the action you should take?

   • AYou should make sure that Azure Active Directory (Azure AD) Identity Protection is removed.
   • BYou should create a DLP policy.
   • CYou should create an Azure Log Analytics workspace.
   • DYou should make sure that Security Center has the necessary tier configured.

   Show answer

   Answer: C

   Explanation

   C. You should create an Azure Log Analytics workspace. Azure Security Center leverages Azure Log Analytics to store and analyze security-related data and generate alerts. By creating an Azure Log Analytics workspace, you provide the necessary storage and analysis capabilities for Security Center to generate and manage custom alert rules. Option A, removing Azure Active Directory (Azure AD) Identity Protection, is unrelated to enabling the creation of custom alert rules in Security Center. Option B, creating a Data Loss Prevention (DLP) policy, is not directly related to enabling custom alert rules in Security Center. DLP policies are used for managing and preventing data loss in various services and applications. Option D, configuring the necessary tier in Security Center, may impact the availability of certain features and capabilities, but it is not specifically required to enable the creation of custom alert rules.

   Source: Adapted from community discussion — Andre369

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 28 · 496 in bank

   Your company's Azure subscription includes an Azure Log Analytics workspace. Your company has a hundred on-premises servers that run either Windows Server 2012 R2 or Windows Server 2016, and is linked to the Azure Log Analytics workspace. The Azure Log Analytics workspace is set up to gather performance counters associated with security from these linked servers. You have been tasked with configuring alerts according to the information gathered by the Azure Log Analytics workspace. You have to make sure that alert rules allow for dimensions, and that alert creation time should be kept to a minimum. Furthermore, a single alert notification must be created when the alert is created and when the alert is sorted out. You need to make use of the necessary signal type when creating the alert rules. Which of the following is the option you should use?

   • AYou should make use of the Activity log signal type.
   • BYou should make use of the Application Log signal type.
   • CYou should make use of the Metric signal type.
   • DYou should make use of the Audit Log signal type.

   Show answer

   Answer: C

   Explanation

   Correct There are four signal type : Metric, Activity log, Application Insights, and Log. Guys always read the question properly and look for the key words. The key word in the question is "gather PERFORMANCE COUNTERS", the performance counter directly linked to the Metric signal type.

   Source: Adapted from community discussion — salmantarik

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 29 · 496 in bank

   Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled. You have been tasked with retrieving the identity of the user that removed a virtual machine fifteen days ago. You have already accessed Azure Monitor. Which of the following options should you use?

   • AApplication Log
   • BMetrics
   • CActivity Log
   • DLogs

   Show answer

   Answer: C

   Explanation

   Activity logs provide " insight into the operations on each Azure resource in the subscription from the outside (the management plane) in addition to updates on Service Health events. Use the Activity Log, to determine the what, who, and when for any write operations (PUT, POST, DELETE) taken on the resources in your subscription. There is a single Activity log for each Azure subscription. https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/platform-logs-overview

   Source: Adapted from community discussion — Irishtk

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 30 · 496 in bank

    Your company's Azure subscription includes a hundred virtual machines that have Azure Diagnostics enabled. You have been tasked with analyzing the security events of a Windows Server 2016 virtual machine. You have already accessed Azure Monitor. Which of the following options should you use?

    • AApplication Log
    • BMetrics
    • CActivity Log
    • DLogs

    Show answer

    Answer: D

    Explanation

    D is the answer. https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-types#choose-the-right-alert-type - Log alert You can use log alerts to perform advanced logic operations on your data. If the data you want to monitor is available in logs, or requires advanced logic, you can use the robust features of Kusto Query Language (KQL) for data manipulation by using log alerts.

    Source: Adapted from community discussion — zellck

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 21. 496 questions available.