AZ-500 practice questions 361–370

1. Question 361 · 496 in bank

   You have an Azure subscription that contains a managed identity named Identity1 and the Azure key vaults shown in the following table.

   

   KeyVault1 contains an access policy that grants Identity1 the following key permissions: • Get • List • Wrap • Unwrap You need to provide Identity1 with the same permissions for KeyVault2. The solution must use the principle of least privilege. Which role should you assign to Identity1?

   • AKey Vault Crypto Service Encryption User
   • BKey Vault Crypto User
   • CKey Vault Reader
   • DKey Vault Crypto Officer

   Show answer

   Answer: A

   Explanation

   Why not Key Vault Crypto Service Encryption User "dataActions": [ "Microsoft.KeyVault/vaults/keys/read", List keys in the specified vault, or read properties and public material of a key. For asymmetric keys, this operation exposes public key and includes ability to perform public key algorithms such as encrypt and verify signature. Private keys and symmetric keys are never exposed. "Microsoft.KeyVault/vaults/keys/wrap/action", Wraps a symmetric key with a Key Vault key. Note that if the Key Vault key is asymmetric, this operation can be performed by principals with read access.javascript:void(0) "Microsoft.KeyVault/vaults/keys/unwrap/action" Unwraps a symmetric key with a Key Vault key.

   Source: Adapted from community discussion — Nick66

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 362 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains a user named User1. User1 is assigned the Reader role for the subscription. You plan to create a custom role named Role1 and assign Role1 to User1. You need to ensure that User1 can create and manage application security groups by using Azure portal. Which two permissions should you add to Role1? To answer, select the appropriate permissions in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Only need permission of Microsoft.Network. (1) To access Azure portal, User1 must be assigned the Reader role at the subscription level or higher. The Reader role allows users to view resources in Azure, but not modify them. If User1 is not assigned the Reader role, they will not be able to log in to Azure portal. User1 has been assigned the Reader role for the subscription. No further permission is required. (2) To create and manage application security groups by using Azure portal, User1 needs the following two permissions: - Microsoft.Network/applicationSecurityGroups/write - Microsoft.Network/applicationSecurityGroups/delete

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 363 · 496 in bank

   You have an Azure subscription named Sub1. In Microsoft Defender for Cloud, you have a workflow automation named WF1. WF1 is configured to send an email message to a user named User1. You need to modify WF1 to send email messages to a distribution group named Alerts. What should you use to modify WF1?

   • AAzure Logic Apps Designer
   • BAzure Application Insights
   • CAzure DevOps
   • DAzure Monitor

   Show answer

   Answer: A

   Explanation

   Azure Logic Apps Designer is a visual tool that allows you to create and manage logic apps. Logic apps are automated workflows that can integrate applications, data, systems, and services across organizations. To modify WF1 to send email messages to a distribution group named Alerts, you can use the Azure Logic Apps Designer to: 1. Open WF1 in the Azure Logic Apps Designer. 2. Find the action that is used to send email messages to User1. 3. Replace the email address of User1 with the email address of the distribution group Alerts. 4. Save and deploy WF1. Once you have modified WF1, it will start sending email messages to the distribution group Alerts instead of User1. Reference About the Standard logic app workflow designer in single-tenant Azure Logic Apps https://learn.microsoft.com/en-us/azure/logic-apps/designer-overview

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn

   Next question

4. Question 364 · 496 in bank

   DRAG DROP - You have an Azure subscription that contains a resource group named RG1 and an Azure policy named Policy1. You need to assign Policy1 to RG1. How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 365 · 496 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that contains the resource groups shown in the following table.

   

   You create the Azure Policy definition shown in the following exhibit.

   

   You assign the policy to Sub1. You plan to create the resources shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure#conditions The condition states "While match and notMatch are case-sensitive, all other conditions that evaluate a stringValue are case-insensitive. Case-insensitive alternatives are available in matchInsensitively and notMatchInsensitively." This shows that the "notContains" as a string comparison is actually case-INSENSITIVE. The other thing we have to look at is if (not same region of RG). This sums up, if we look at another perspective, is if (RG same region AND contains "obj") -> accept else -> deny Therefore the answer should be Y N Y

   Source: Adapted from community discussion — BooMz

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 366 · 496 in bank

   Your on-premises network contains a Hyper-V virtual machine named VM1. You need to use Azure Arc to onboard VM1 to Microsoft Defender for Cloud. What should you install first?

   • Athe guest configuration agent
   • Bthe Azure Monitor agent
   • Cthe Log Analytics agent
   • Dthe Azure Connected Machine agent

   Show answer

   Answer: D

   Explanation

   Azure Arc allows you to manage and govern your on-premises, multi-cloud, and edge environments from a single control plane in Azure. To onboard your on-premises VM1 to Microsoft Defender for Cloud, you need to first install the Azure Connected Machine agent on the VM. This agent enables VM1 to connect to Azure Arc, and from there, you can enable Microsoft Defender for Cloud.

   Source: Adapted from community discussion — Cock

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 367 · 496 in bank

   You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You have the management group hierarchy shown in the following exhibit.

   

   You create the definitions shown in the following table.

   

   You need to use Defender for Cloud to add a security policy. Which definitions can you use as a security policy?

   • APolicy1 only
   • BPolicy1 and Initiative1 only
   • CInitiative1 and Initiative2 only
   • DInitiative1, Initiative2, and Initiative3 only
   • EPolicy1, Initiative1, Initiative2, and Initiative3

   Show answer

   Answer: B

   Explanation

   C, Initiative1, Initiative2 Microsoft Defender for Cloud applies security initiatives to the subscriptions. So when you go to Environment Settings of Defender for Cloud you will be able to assign Initiative1 (inheritied from TRG) and 2 to Sub1. MG1 does not have an Subscription so it wont even be an available option in Environment Settings.

   Source: Adapted from community discussion — ppolychron

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 368 · 496 in bank

   You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. EASM1 has discovery enabled and contains several inventory assets. You need to identify which inventory assets are vulnerable to the most critical web app security risks. Which Defender EASM dashboard should you use?

   • ASecurity Posture
   • BOWASP Top 10
   • CAttack Surface Summary
   • DGDPR Compliance

   Show answer

   Answer: B

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 369 · 496 in bank

   You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to review regulatory compliance with the Azure CIS 1.4.0 standard. The solution must minimize administrative effort. What should you do first?

   • AAssign an Azure policy.
   • BDisable one of the Out of the box standards.
   • CManually add the Azure CIS 1.4.0 standard.
   • DAdd a custom initiative.

   Show answer

   Answer: C

   Explanation

   To assign an Azure policy for the Azure CIS 1.4.0 standard: 1. Go to the Azure portal. 2. Click Security Center. 3. Click Regulatory compliance. 4. Click Add standard. 5. Select Azure CIS 1.4.0 and click Add. 6. Select the scope of the policy and click Assign. The question is about 'What should you do first', so do the 'add' before 'assign'.

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 370 · 496 in bank

    You have an Azure subscription that contains an Azure SQL database named SQL1 and an Azure key vault named KeyVault1. KeyVault1 stores the keys shown in the following table.

    

    You need to configure Transparent Data Encryption (TDE). TDE will use a customer-managed key for SQL1. Which keys can you use?

    • AKey2 only
    • BKey1 only
    • CKey2 and Key3 only
    • DKey1, Key2, Key3, and Key4
    • EKey1 and Key2 only

    Show answer

    Answer: E

    Explanation

    TDE protector can only be an asymmetric, RSA, or RSA HSM key. The supported key lengths are 2048 bytes and 3072 bytes. https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview?view=azuresql#requirements-for-configuring-tde-protector

    Source: Adapted from community discussion — Jhill777

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 361. 496 questions available.