AZ-500 practice questions 291–300

1. Question 291 · 496 in bank

   Select 2

   You have an Azure subscription that contains 100 virtual machines and has Azure Defender enabled. You plan to perform a vulnerability scan of each virtual machine. You need to deploy the vulnerability scanner extension to the virtual machines by using an Azure Resource Manager template. Which two values should you specify in the code to automate the deployment of the extension to the virtual machines? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Athe user-assigned managed identity
   • Bthe workspace ID
   • Cthe Azure Active Directory (Azure AD) ID
   • Dthe Key Vault managed storage account key
   • Ethe system-assigned managed identity
   • Fthe primary shared key

   Show answer

   Answer: BE

   Explanation

   I am not fully sure about this one, but I agree the answer choices. Since we are deploying the template across several VMs and need to authenticate with the extension repository ( for downloading extensions), we need to provide the VM an identity to authenticate with the repository. This is best done by assigning the VM with a "user assigned managed identity". We can set up this managed identity to have the required permissions on the extension repository via RBAC roles. The managed identity requests permissions via the Azure IMDS from the Azure AD and hence needs to know the right Tenant ID to get the token from. I believe the Azure AD ID is the same as the Tenant ID.

   Source: Adapted from community discussion — rsharma007

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 292 · 496 in bank

   You have an Azure subscription that contains a user named Admin1 and a virtual machine named VM1. VM1 runs Windows Server 2019 and was deployed by using an Azure Resource Manager template. VM1 is the member of a backend pool of a public Azure Basic Load Balancer. Admin1 reports that VM1 is listed as Unsupported on the Just in time VM access blade of Azure Security Center. You need to ensure that Admin1 can enable just in time (JIT) VM access for VM1. What should you do?

   • ACreate and configure a network security group (NSG).
   • BCreate and configure an additional public IP address for VM1.
   • CReplace the Basic Load Balancer with an Azure Standard Load Balancer.
   • DAssign an Azure Active Directory Premium Plan 1 license to Admin1.

   Show answer

   Answer: A

   Explanation

   A is correct. https://docs.microsoft.com/en-us/azure/security-center/security-center-just-in-time?tabs=jit-config-asc%2Cjit-request-asc Unsupported - VMs without JIT enabled and which don't support the feature. Your VM might be in this tab for the following reasons: Missing network security group (NSG) - JIT requires an NSG to be configured Classic VM - JIT supports VMs that are deployed through Azure Resource Manager, not 'classic deployment'. Learn more about classic vs Azure Resource Manager deployment models. Other - Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group. Unsupported - VMs without JIT enabled and which don't support the feature. Your VM might be in this tab for the following reasons: Missing network security group (NSG) - JIT requires an NSG to be configured Classic VM - JIT supports VMs that are deployed through Azure Resource Manager, not 'classic deployment'. Learn more about classic vs Azure Resource Manager deployment models. Other - Your VM might be in this tab if the JIT solution is disabled in the security policy of the subscription or the resource group.

   Source: Adapted from community discussion — gills

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 293 · 496 in bank

   HOTSPOT - You have an Azure Sentinel workspace that contains an Azure Active Directory (Azure AD) connector, an Azure Log Analytics query named Query1, and a playbook named Playbook1. Query1 returns a subset of security events generated by Azure AD. You plan to create an Azure Sentinel analytic rule based on Query1 that will trigger Playbook1. You need to ensure that you can add Playbook1 to the new rule. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/tutorial-detect-threats-custom https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

   Source: Adapted from community discussion — gcpbrig01

   References

   • Microsoft Learn

   

   Next question

4. Question 294 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   An IP address of 10.1.0.4 is assigned to VM5. VM5 does not have a public IP address. VM5 has just in time (JIT) VM access configured as shown in the following exhibit.

   

   You enable JIT VM access for VM5. NSG1 has the inbound rules shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Just tested in Lab environment: 1. In case if rule 100 is deleted manually the access will not work. So the answer is - YES 2. RDP is not blocked because rule 100 is in place and we should consider it as it is. - NO 3. Azure Bastion host is not enabling RDP from the internet. This is the key feature of Bastion - allowing access to VMs which does not have a public IP address. So the answer is - NO

   Source: Adapted from community discussion — nexel

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 295 · 496 in bank

   You have an Azure Active Directory (Azure AD) tenant and a root management group. You create 10 Azure subscriptions and add the subscriptions to the root management group. You need to create an Azure Blueprints definition that will be stored in the root management group. What should you do first?

   • AModify the role-based access control (RBAC) role assignments for the root management group.
   • BAdd an Azure Policy definition to the root management group.
   • CCreate a user-assigned identity.
   • DCreate a service principal.

   Show answer

   Answer: A

   Explanation

   When I tried to create a Blueprint at the root management group, I got the following message: Deploy blueprint to root management group: "You require additional permissions to manage blueprints within this management group. Contact the administrator of the management group to request Contributor rights." Had to elevate myself to a Contributor at the root group, then I could create the blueprint. Therefore option A is definitely correct.

   Source: Adapted from community discussion — Stuudent

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 296 · 496 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table.

   

   Contoso.com contains a group naming policy. The policy has a custom blocked word list rule that includes the word Contoso. Which users can create a group named Contoso Sales in contoso.com? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-naming-policy

   Source: Adapted from community discussion — Roger_Smurf

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 297 · 496 in bank

   DRAG DROP - You have five Azure subscriptions linked to a single Azure Active Directory (Azure AD) tenant. You create an Azure Policy initiative named SecurityPolicyInitiative1. You identify which standard role assignments must be configured on all new resource groups. You need to enforce SecurityPolicyInitiative1 and the role assignments when a new resource group is created. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/governance/blueprints/create-blueprint-portal https://docs.microsoft.com/en-us/azure/azure-australia/azure-policy

   Source: Adapted from community discussion — Azseon

   

   Next question

8. Question 298 · 496 in bank

   You have three on-premises servers named Server1, Server2, and Server3 that run Windows Server 2019. Server1 and Server2 are located on the internal network. Server3 is located on the perimeter network. All servers have access to Azure. From Azure Sentinel, you install a Windows firewall data connector. You need to collect Microsoft Defender Firewall data from the servers for Azure Sentinel. What should you do?

   • ACreate an event subscription from Server1, Server2, and Server3.
   • BInstall the On-premises data gateway on each server.
   • CInstall the Microsoft Monitoring Agent on each server.
   • DInstall the Microsoft Monitoring Agent on Server1 and Server2. Install the On-premises data gateway on Server3.

   Show answer

   Answer: C

   Next question

9. Question 299 · 496 in bank

   You have an Azure subscription that contains several Azure SQL databases and an Azure Sentinel workspace. You need to create a saved query in the workspace to find events reported by Azure Defender for SQL. What should you do?

   • AFrom Azure CLI, run the Get-AzOperationalInsightsWorkspace cmdlet.
   • BFrom the Azure SQL Database query editor, create a Transact-SQL query.
   • CFrom the Azure Sentinel workspace, create a Kusto query language query.
   • DFrom Microsoft SQL Server Management Studio (SSMS), create a Transact-SQL query.

   Show answer

   Answer: C

   References

   • Microsoft Learn

   Next question

10. Question 300 · 496 in bank

    You have an Azure Storage account named storage1 that has a container named container1. You need to prevent the blobs in container1 from being modified. What should you do?

    • AFrom container1, change the access level.
    • BFrom container1, add an access policy.
    • CFrom container1, modify the Access Control (IAM) settings.
    • DFrom storage1, enable soft delete for blobs.

    Show answer

    Answer: B

    Explanation

    Why not A? it meets the goal as described in https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure?tabs=portal. In the other hand, Access policy sounds tricky as an answer althoug immutable storage is a kind of policy https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage. What do you think?

    Source: Adapted from community discussion — arytech

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 291. 496 questions available.