AZ-500 practice questions 341–350

1. Question 341 · 496 in bank

   You have an Azure subscription. You plan to create a workflow automation in Azure Security Center that will automatically remediate a security vulnerability. What should you create first?

   • Aan automation account
   • Ba managed identity
   • Can Azure logic app
   • Dan Azure function app
   • Ean alert rule

   Show answer

   Answer: C

   Explanation

   Don't we need a (B) managed account first to be the authentication for the (C) Logic Apps? Azure Automation does not automatically create the Run As account, it has been replaced by using managed identities. https://learn.microsoft.com/en-us/azure/automation/automation-security-overview#managed-identities https://learn.microsoft.com/en-us/azure/automation/enable-managed-identity-for-automation https://learn.microsoft.com/en-us/azure/automation/quickstarts/create-azure-automation-account-portal

   Source: Adapted from community discussion — ITTesters

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 342 · 496 in bank

   You onboard Azure Sentinel. You connect Azure Sentinel to Azure Security Center. You need to automate the mitigation of incidents in Azure Sentinel. The solution must minimize administrative effort. What should you create?

   • Aan alert rule
   • Ba playbook
   • Ca function app
   • Da runbook

   Show answer

   Answer: B

   Explanation

   Ans B. "A playbook can help automate and orchestrate your response, and can be set to run automatically when specific alerts or incidents are generated, by being attached to an analytics rule or an automation rule, respectively" https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC

   Source: Adapted from community discussion — Irishtk

   References

   • Microsoft Learn

   Next question

3. Question 343 · 496 in bank

   SIMULATION - A user named Debbie has the Azure app installed on her mobile device. You need to ensure that debbie@contoso.com is alerted when a resource lock is deleted. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to configure an alert rule in Azure Monitor. 1. Type Monitor into the search box and select Monitor from the search results. 2. Click on Alerts. 3. Click on +New Alert Rule. 4. In the Scope section, click on the Select resource link. 5. In the Filter by resource type box, type locks and select Management locks (locks) from the filtered results. 6. Select the subscription then click the Done button. 7. In the Condition section, click on the Select condition link. 8. Select the Delete management locks condition the click the Done button. 9. In the Action group section, click on the Select action group link. 10.Click the Create action group button to create a new action group. 11.Give the group a name such as Debbie Mobile App (it doesn't matter what name you enter for the exam) then click the Next: Notifications > button. 12.In the Notification type box, select the Email/SMS message/Push/Voice option. 13.In the Email/SMS message/Push/Voice window, tick the Azure app Push Notifications checkbox and enter debbie@contoso.com in the Azure account email field. 14.Click the OK button to close the window. 15.Enter a name such as Debbie Mobile App in the notification name box. 16.Click the Review & Create button then click the Create button to create the action group. 17.Back in the Create alert rule window, in the Alert rule details section, enter a name such as Management lock deletion in the Alert rule name field. 18.Click the Create alert rule button to create the alert rule.

   Source: Adapted from community discussion — mrt007

   Next question

4. Question 344 · 496 in bank

   SIMULATION - You plan to connect several Windows servers to the WS12345678 Azure Log Analytics workspace. You need to ensure that the events in the System event logs are collected automatically to the workspace after you connect the Windows servers. To complete this task, sign in to the Azure portal and modify the Azure resources.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Azure Monitor can collect events from the Windows event logs or Linux Syslog and performance counters that you specify for longer term analysis and reporting, and take action when a particular condition is detected. Follow these steps to configure collection of events from the Windows system log and Linux Syslog, and several common performance counters to start with. Data collection from Windows VM - 1. In the Azure portal, locate the WS12345678 Azure Log Analytics workspace then select Advanced settings. 2. Select Data, and then select Windows Event Logs. 3. You add an event log by typing in the name of the log. Type System and then select the plus sign +. 4. In the table, check the severities Error and Warning. (for this question, select all severities to ensure that ALL logs are collected). 5. Select Save at the top of the page to save the configuration. Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm

   Source: Adapted from community discussion — Amit3

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 345 · 496 in bank

   SIMULATION - You need to ensure that the AzureBackupReport log for the Vault1 Recovery Services vault is stored in the WS12345678 Azure Log Analytics workspace. To complete this task, sign in to the Azure portal and modify the Azure resources.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. In the Azure portal, type Recovery Services Vaults in the search box, select Recovery Services Vaults from the search results then select Vault1. Alternatively, browse to Recovery Services Vaults in the left navigation pane. 2. In the properties of Vault1, scroll down to the Monitoring section and select Diagnostic Settings. 3. Click the Add a diagnostic setting link. 4. Enter a name in the Diagnostic settings name box. 5. In the Log section, select AzureBackupReport. 6. In the Destination details section, select Send to log analytics 7. Select the WS12345678 Azure Log Analytics workspace. 8. Click the Save button to save the changes. Reference: https://docs.microsoft.com/en-us/azure/backup/backup-azure-diagnostic-events

   Source: Adapted from community discussion — AzureJobsTillRetire

   

   Next question

6. Question 346 · 496 in bank

   SIMULATION - You need to ensure that the audit logs from the SQLdb1 Azure SQL database are stored in the WS12345678 Azure Log Analytics workspace. To complete this task, sign in to the Azure portal and modify the Azure resources.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. In the Azure portal, type SQL in the search box, select SQL databases from the search results then select SQLdb1. Alternatively, browse to SQL databases in the left navigation pane. 2. In the properties of SQLdb1, scroll down to the Security section and select Auditing. 3. Turn auditing on if it isn't already, tick the Log Analytics checkbox then click on Configure. 4. Select the WS12345678 Azure Log Analytics workspace. 5. Click Save to save the changes.

   Source: Adapted from community discussion — jaacqu

   References

   • Microsoft Learn

   

   Next question

7. Question 347 · 496 in bank

   HOTSPOT - You are configuring just in time (JIT) VM access to a Windows Server 2019 Azure virtual machine. You need to grant users PowerShell access to the virtual machine by using JIT VM access. What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Read 2. 5986 https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks#what-permissions-are-needed-to-configure-and-use-jit https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage#enable-jit-on-your-vms-from-microsoft-defender-for-cloud The JIT VM access page opens listing the ports that Defender for Cloud recommends protecting: - 5986 - WinRM

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 348 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You create the Azure Storage accounts shown in the following table.

   

   You need to configure auditing for SQL1. Which storage accounts and Log Analytics workspaces can you use as the audit log destination? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Storage needs to be in same region (East US). Hence Storage - Storage1 and Storage2 only. Log Analytics can be in any region. Hence it can be Storage1, Storage2 or Storage3

   Source: Adapted from community discussion — rraviska

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 349 · 496 in bank

   Select 2

   You have an Azure Sentinel workspace. You need to create a playbook. Which two triggers will start the playbook? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AAn Azure Sentinel scheduled query rule is executed.
   • BAn Azure Sentinel data connector is added.
   • CAn Azure Sentinel alert is generated.
   • DAn Azure Sentinel hunting query result is returned.
   • EAn Azure Sentinel incident is created.

   Show answer

   Answer: CE

   Explanation

   CE is the answer. https://learn.microsoft.com/en-us/azure/sentinel/playbook-triggers-actions#microsoft-sentinel-triggers-summary Though the Microsoft Sentinel connector can be used in a variety of ways, the connector's components can be divided into three flows, each triggered by a different Microsoft Sentinel occurrence: - Microsoft Sentinel incident (Preview) - Microsoft Sentinel alert (Preview) - Microsoft Sentinel entity (Preview)

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 350 · 496 in bank

    You have an Azure Active Directory (Azure AD) tenant named contoso.com. You need to configure diagnostic settings for contoso.com. The solution must meet the following requirements: ✑ Retain logs for two years. ✑ Query logs by using the Kusto query language. ✑ Minimize administrative effort. Where should you store the logs?

    • Aan Azure event hub
    • Ban Azure Log Analytics workspace
    • Can Azure Storage account

    Show answer

    Answer: B

    Explanation

    B - correct. Worth mentioning, that you can also store logs in Storage Account and configure retention as well, but the keyword here is Kusto, you cannot use Kusto to query logs stored in storage account, I believe.

    Source: Adapted from community discussion — v078

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 341. 496 questions available.