AZ-500 practice questions 401–410

1. Question 401 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the following resources: ✑ An Azure key vault ✑ An Azure SQL database named Database1 Two Azure App Service web apps named AppSrv1 and AppSrv2 that are configured to use system-assigned managed identities and access Database1

   

   You need to implement an encryption solution for Database1 that meets the following requirements: ✑ The data in a column named Discount in Database1 must be encrypted so that only AppSrv1 can decrypt the data. ✑ AppSrv1 and AppSrv2 must be authorized by using managed identities to obtain cryptographic keys. How should you configure the encryption settings for Database1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell

   Source: Adapted from community discussion — BillBaits

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   

   Next question

2. Question 402 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the storage accounts shown in the following table.

   

   You need to configure authorization access. Which authorization types can you use for each storage account? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/storage/common/authorize-data-access

   Source: Adapted from community discussion — majstor86

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 403 · 496 in bank

   HOTSPOT - You have an Azure key vault named KeyVault1 that contains the items shown in the following table.

   

   In KeyVault1, the following events occur in sequence: ✑ Item1 is deleted. ✑ Item2 and Policy1 are deleted. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box1: No - Policies cannot be recovered. Box2: Soft delete is enabled by default on all key vaults. You cannot add a new key named Item1 because an object named Item1 exists in a soft-deleted state. Box3: Soft delete is now enabled by default on all key vaults so you can recover Item2. Reference: https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview https://docs.microsoft.com/en-us/azure/key-vault/general/soft-delete-change

   Source: Adapted from community discussion — wardy1983

   

   Next question

4. Question 404 · 496 in bank

   DRAG DROP - You have an Azure Storage account named storage1 and an Azure virtual machine named VM1. VM1 has a premium SSD managed disk. You need to enable Azure Disk Encryption for VM1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange then in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   

   Next question

5. Question 405 · 496 in bank

   SIMULATION - You need to enable Advanced Data Security for the SQLdb1 Azure SQL database. The solution must ensure that Azure Advanced Threat Protection (ATP) alerts are sent to User1@contoso.com. To complete this task, sign in to the Azure portal and modify the Azure resources.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   1. In the Azure portal, type SQL in the search box, select SQL databases from the search results then select SQLdb1. Alternatively, browse to SQL databases in the left navigation pane. 2. In the properties of SQLdb1, scroll down to the Security section and select Advanced data security. 3. Click on the Settings icon. 4. Tick the Enable Advanced Data Security at the database level checkbox. 5. Click Yes at the confirmation prompt. 6. In the Storage account select a storage account if one isn't selected by default. 7. Under Advanced Threat Protection Settings, enter User1@contoso.com in the Send alerts to box. 8. Click the Save button to save the changes. Reference: https://docs.microsoft.com/en-us/azure/azure-sql/database/advanced-data-security

   Source: Adapted from community discussion — Stuudent

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 406 · 496 in bank

   SIMULATION - You need to configure a weekly backup of an Azure SQL database named Homepage. The backup must be retained for eight weeks. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to configure the backup policy for the Azure SQL database. 1. In the Azure portal, type Azure SQL Database in the search box, select Azure SQL Database from the search results then select Homepage. Alternatively, browse to Azure SQL Database in the left navigation pane. 2. Select the server hosting the Homepage database and click on Manage backups. 3. Click on Configure policies. 4. Ensure that the Weekly Backups option is ticked. 5. Configure the How long would you like weekly backups to be retained option to 8 weeks. 6. Click Apply to save the changes.

   Source: Adapted from community discussion — Lexa

   References

   • Microsoft Learn

   Next question

7. Question 407 · 496 in bank

   SIMULATION - You need to ensure that when administrators deploy resources by using an Azure Resource Manager template, the deployment can access secrets in an Azure key vault named KV12345678. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to configure an option in the Advanced Access Policy of the key vault. 1. In the Azure portal, type Azure Key Vault in the search box, select Azure Key Vault from the search results then select the key vault named KV12345678. Alternatively, browse to Azure Key Vault in the left navigation pane. 2. In the properties of the key vault, click on Advanced Access Policies. 3. Tick the checkbox labelled Enable access to Azure Resource Manager for template deployment. 4. Click Save to save the changes.

   Source: Adapted from community discussion — MikeSA

   Next question

8. Question 408 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the storage accounts shown in the following table.

   

   You enable Azure Defender for Storage. Which storage services of storage5 are monitored by Azure Defender for Storage, and which storage accounts are protected by Azure Defender for Storage? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/storage/common/azure-defender-storage-configure?tabs=azure-security-center

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 409 · 496 in bank

   Select 2

   You have an Azure subscription that contains as Azure key vault and an Azure Storage account. The key vault contains customer-managed keys. The storage account is configured to use the customer-managed keys stored in the key vault. You plan to store data in Azure by using the following services: ✑ Azure Files ✑ Azure Blob storage ✑ Azure Table storage ✑ Azure Queue storage Which two services support data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ATable storage
   • BAzure Files
   • CBlob storage
   • DQueue storage

   Show answer

   Answer: BC

   Explanation

   BC is the answer. https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#customer-managed-keys-for-queues-and-tables Data stored in Queue and Table storage isn't automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services to be included in this protection at the time that you create the storage account. Data in Blob storage and Azure Files is always protected by customer-managed keys when customer-managed keys are configured for the storage account.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 410 · 496 in bank

    SIMULATION - You need to ensure that connections through an Azure Application Gateway named Homepage-AGW are inspected for malicious requests. To complete this task, sign in to the Azure portal. You do not need to wait for the task to complete.

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer:

    Explanation

    You need to enable the Web Application Firewall on the Application Gateway. 1. In the Azure portal, type Application gateways in the search box, select Application gateways from the search results then select the gateway named Homepage-AGW. Alternatively, browse to Application Gateways in the left navigation pane. 2. In the properties of the application gateway, click on Web application firewall. 3. For the Tier setting, select WAF V2. 4. In the Firewall status section, click the slider to switch to Enabled. 5. In the Firewall mode section, click the slider to switch to Prevention. 6. Click Save to save the changes.

    Source: Adapted from community discussion — Codelawdepp

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 401. 496 questions available.