AZ-500 practice questions 381–390

1. Question 381 · 496 in bank

   SIMULATION - You plan to use Azure Disk Encryption for several virtual machine disks. You need to ensure that Azure Disk Encryption can retrieve secrets from the KeyVault12345678 Azure key vault. To complete this task, sign in to the Azure portal and modify the Azure resources.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. In the Azure portal, type Key Vaults in the search box, select Key Vaults from the search results then select KeyVault12345678. Alternatively, browse to Key Vaults in the left navigation pane. 2. In the Key Vault properties, scroll down to the Settings section and select Access Policies. 3. Select the Azure Disk Encryption for volume encryption 4. Click Save to save the changes.

   Source: Adapted from community discussion — JakeCallham

   

   Next question

2. Question 382 · 496 in bank

   Select 2

   You have an Azure SQL database. You implement Always Encrypted. You need to ensure that application developers can retrieve and decrypt data in the database. Which two pieces of information should you provide to the developers? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aa stored access policy
   • Ba shared access signature (SAS)
   • Cthe column encryption key
   • Duser credentials
   • Ethe column master key

   Show answer

   Answer: CE

   Explanation

   Read this article: Then You Will be Enlightened My Son https://www.pass.org/PASS-Blog/introducing-always-encrypted-with-secure-enclaves-in-sql-server-2019-1 Stay Away From the Brahamins at Microsoft Doc For They Would Lead You Astray My Son https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver15

   Source: Adapted from community discussion — DeepMoon

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 383 · 496 in bank

   You have a hybrid configuration of Azure Active Directory (Azure AD). All users have computers that run Windows 10 and are hybrid Azure AD joined. You have an Azure SQL database that is configured to support Azure AD authentication. Database developers must connect to the SQL database by using Microsoft SQL Server Management Studio (SSMS) and authenticate by using their on-premises Active Directory account. You need to tell the developers which authentication method to use to connect to the SQL database from SSMS. The solution must minimize authentication prompts. Which authentication method should you instruct the developers to use?

   • ASQL Login
   • BActive Directory ג€" Universal with MFA support
   • CActive Directory ג€" Integrated
   • DActive Directory ג€" Password

   Show answer

   Answer: C

   Explanation

   correct. Hybrid AD, and workstations are domain joined. Hence integrated authentication will use a kerberos ticket to authenticate itself to the SQL server using the logged in user of the workstation.

   Source: Adapted from community discussion — kristiann21

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 384 · 496 in bank

   DRAG DROP - You have an Azure subscription named Sub1 that contains an Azure Storage account named contosostorage1 and an Azure key vault named Contosokeyvault1. You plan to create an Azure Automation runbook that will rotate the keys of contosostorage1 and store them in Contosokeyvault1. You need to implement prerequisites to ensure that you can implement the runbook. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Create an Azure Automation account Runbooks live within the Azure Automation account and can execute PowerShell scripts. Step 2: Import PowerShell modules to the Azure Automation account Under 'Assets' from the Azure Automation account Resources section select 'to add in Modules to the runbook. To execute key vault cmdlets in the runbook, we need to add AzureRM.profile and AzureRM.key vault. Step 3: Create a connection resource in the Azure Automation account You can use the sample code below, taken from the AzureAutomationTutorialScript example runbook, to authenticate using the Run As account to manage Resource Manager resources with your runbooks. The AzureRunAsConnection is a connection asset automatically created when we created 'run as accounts' above. This can be found under Assets -> Connections. After the authentication code, run the same code above to get all the keys from the vault. $connectionName = "AzureRunAsConnection" try { # Get the connection "AzureRunAsConnection " $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName "Logging in to Azure..." Add-AzureRmAccount ` -ServicePrincipal ` -TenantId $servicePrincipalConnection.TenantId ` -ApplicationId $servicePrincipalConnection.ApplicationId ` -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint } Reference: https://www.rahulpnath.com/blog/accessing-azure-key-vault-from-azure-runbook/

   Source: Adapted from community discussion — ZakS

   

   Next question

5. Question 385 · 496 in bank

   HOTSPOT - You have an Azure Storage account that contains a blob container named container1 and a client application named App1. You need to enable App1 access to container1 by using Azure Active Directory (Azure AD) authentication. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://azure.microsoft.com/en-in/blog/announcing-the-preview-of-aad-authentication-for-storage/ https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/storage/common/storage-auth-aad-app.md

   Source: Adapted from community discussion — Psychosikh

   References

   • Microsoft Learn

   

   Next question

6. Question 386 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure key vault named ContosoKey1. You create users and assign them roles as shown in the following table.

   

   You need to identify which users can perform the following actions: ✑ Delegate permissions for ContosoKey1. ✑ Configure network access to ContosoKey1. Which users should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-gb/azure/key-vault/general/rbac-guide

   Source: Adapted from community discussion — cvarl

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 387 · 496 in bank

   You have an Azure subscription that contains four Azure SQL managed instances. You need to evaluate the vulnerability of the managed instances to SQL injection attacks. What should you do first?

   • ACreate an Azure Sentinel workspace.
   • BEnable Advanced Data Security.
   • CAdd the SQL Health Check solution to Azure Monitor.
   • DCreate an Azure Advanced Threat Protection (ATP) instance.

   Show answer

   Answer: B

   Explanation

   I would go for D. "Advanced Threat Protection provides a new layer of security, which enables customers to detect and respond to potential threats as they occur by providing security alerts on anomalous activities. Users receive an alert upon suspicious database activities, potential vulnerabilities, and SQL injection attacks, as well as anomalous database access and queries patterns." Source: https://docs.microsoft.com/en-gb/azure/azure-sql/database/threat-detection-overview

   Source: Adapted from community discussion — Narragr

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation

   Next question

8. Question 388 · 496 in bank

   DRAG DROP - You have an Azure subscription named Sub1. Sub1 contains an Azure virtual machine named VM1 that runs Windows Server 2016. You need to encrypt VM1 disks by using Azure Disk Encryption. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/encrypt-disks

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   

   Next question

9. Question 389 · 496 in bank

   You have an Azure subscription that contains a virtual machine named VM1. You create an Azure key vault that has the following configurations: ✑ Name: Vault5 ✑ Region: West US ✑ Resource group: RG1 You need to use Vault5 to enable Azure Disk Encryption on VM1. The solution must support backing up VM1 by using Azure Backup. Which key vault settings should you configure?

   • AAccess policies
   • BSecrets
   • CKeys
   • DLocks

   Show answer

   Answer: A

   Explanation

   Answer A, 100%. 1. Creating a resource group, if needed. 2. Creating a key vault. 3. Setting key vault advanced access policies. (***NOTE***: This is where you selected the checkbox to enable ADE) Ref link: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault#set-key-vault-advanced-access-policies

   Source: Adapted from community discussion — wooyourdaddy

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 390 · 496 in bank

    You have an Azure subscription named Sub1 that contains the resources shown in the following table.

    

    You need to ensure that you can provide VM1 with secure access to a database on SQL1 by using a contained database user. What should you do?

    • AEnable a managed identity on VM1.
    • BCreate a secret in KV1.
    • CConfigure a service endpoint on SQL1.
    • DCreate a key in KV1.

    Show answer

    Answer: A

    Explanation

    Given answer is correct The question is "secure access to a database on SQL1 by using a contained database user" by using contained database user... it means no need to enable manage identity

    Source: Adapted from community discussion — Super_Pun

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 381. 496 questions available.