AZ-500 practice questions 441–450

1. Question 441 · 496 in bank

   You have an Azure subscription. The subscription contains a virtual network named VNet1 that contains the subnets shown in the following table.

   

   The subscription contains the function apps shown in the following table.

   

   The outbound traffic of which app is controlled by using NSG1?

   • AApp4 only
   • BApp3 and App4 only
   • CApp2, App3, and App4 only
   • DApp1, App2, App3, and App4

   Show answer

   Answer: D

   Explanation

   Function apps deployed to a Premium plan can take advantage of virtual network integration for web apps. https://learn.microsoft.com/en-us/azure/azure-functions/functions-premium-plan?tabs=portal The virtual network integration feature: Requires a supported Basic or Standard, Premium, Premium v2, Premium v3, or Elastic Premium App Service pricing tier. https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

   Source: Adapted from community discussion — Viggy1212

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 442 · 496 in bank

   You have a Microsoft Entra tenant named contoso.com. You collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com. You need to create an allow list of cloud apps from fabrikam.com that can be used by the users in contoso.com. What should you do for contoso.com in the Microsoft Entra admin center?

   • AFrom Inbound access settings in Cross-tenant access settings, configure the B2B direct connect settings.
   • BFrom External collaboration settings, configure the Collaboration restrictions settings.
   • CFrom External collaboration settings, configure the Guest invite settings.
   • DFrom Outbound access settings in Cross-tenant access settings, configure the B2B collaboration settings.

   Show answer

   Answer: D

   Explanation

   Think of the different cross-tenant access settings this way: Inbound settings control external account access to your internal apps. Outbound settings control internal account access to external apps. Tenant restrictions control external account access to external apps. https://learn.microsoft.com/en-us/entra/external-id/tenant-restrictions-v2#tenant-restrictions-vs-inbound-and-outbound-settings By default, B2B collaboration with other Microsoft Entra organizations is enabled, and B2B direct connect is blocked. But the following comprehensive admin settings let you manage both of these features. Outbound access settings control whether your users can access resources in an external organization. You can apply these settings to everyone, or specify individual users, groups, and applications. Inbound access settings control whether users from external Microsoft Entra organizations can access resources in your organization. You can apply these settings to everyone, or specify individual users, groups, and applications. https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview

   Source: Adapted from community discussion — obaemf

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 443 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table.

   

   NSG1 rules restrict access to the internet from Subnet3. The subscription contains the function apps shown in the following table.

   

   Virtual network integration has the default settings. You need to configure network access for App1 and App2 to meet the following requirements: • Deny inbound access to App1 from Subnet1 and allow inbound access from Subnet2. • Deny outbound access from App2 to the internet. What should you do for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To deny outbound internet traffic from an Azure app, you can disable outbound internet traffic routing in the app portal: Go to Networking > Virtual network integration in the app portal Uncheck the Outbound internet traffic setting Select Apply to confirm Both Ans Correct

   Source: Adapted from community discussion — robluis1987

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 444 · 496 in bank

   SIMULATION - You need to ensure that User2-1234578 has all the key permissions for KeyVault1234578. To complete this task, sign in to the Azure portal and modify the Azure resources.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer:

   Explanation

   You need to assign the user the Key Vault Secrets Officer role. 1. In the Azure portal, type Key Vaults in the search box, select Key Vaults from the search results then select KeyVault1234578. Alternatively, browse to Key Vaults in the left navigation pane. 2. In the key vault properties, select Access control (IAM). 3. In the Add a role assignment section, click the Add button. 4. In the Role box, select the Key Vault Secrets Officer role from the drop-down list. 5. In the Select box, start typing User2-1234578 and select User2-1234578 from the search results. 6. Click the Save button to save the changes.

   Source: Adapted from community discussion — Pasapugazh

   Next question

5. Question 445 · 496 in bank

   You have an Azure web app named WebApp1. You upload a certificate to WebApp1. You need to make the certificate accessible to the app code of WebApp1. What should you do?

   • AAdd a user-assigned managed identity to WebApp1.
   • BAdd an app setting to the WebApp1 configuration.
   • CEnable system-assigned managed identity for WebApp1.
   • DConfigure the TLS/SSL binding for WebApp1.

   Show answer

   Answer: B

   Explanation

   Looks to me that B is the anwer? To access a certificate in your app code, add its thumbprint to the WEBSITE_LOAD_CERTIFICATES app setting, by running the following command in the Cloud Shell: Azure CLI Copy Try It az webapp config appsettings set --name --resource-group --settings WEBSITE_LOAD_CERTIFICATES=

   Source: Adapted from community discussion — mrwhite

   References

   • Microsoft Learn

   Next question

6. Question 446 · 496 in bank

   You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table.

   

   You create and assign the Azure policy shown in the following exhibit.

   

   What is the flow log status of NSG1 and NSG2 after the Azure policy is assigned?

   • AFlow logs will be enabled for NSG1 only.
   • BFlow logs will be enabled for NSG2 only.
   • CFlow logs will be enabled for NSG1 and NSG2.
   • DFlow logs will be disabled for NSG1 and NSG2.

   Show answer

   Answer: D

   Explanation

   https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-audit The audit effect is used to create a warning event in the activity log when evaluating a non-compliant resource, but it doesn't stop the request https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-basics Answer = D

   Source: Adapted from community discussion — ITFranz

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 447 · 496 in bank

   You need to meet the identity and access requirements for Group1. What should you do?

   • AAdd a membership rule to Group1.
   • BDelete Group1. Create a new group named Group1 that has a group type of Microsoft 365. Add users and devices to the group.
   • CModify the membership rule of Group1.
   • DChange the membership type of Group1 to Assigned. Create two groups that have dynamic memberships. Add the new groups to Group1.

   Show answer

   Answer: D

   Explanation

   I'll go for D. A, C: You can create a dynamic group for devices or for users, but you can't create a rule that contains both users and devices. B: Microsoft 365 group can have only users as its members. D: Security group can have users, devices, groups and service principals as its members.

   Source: Adapted from community discussion — Daniel9527

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 448 · 496 in bank

   HOTSPOT - You have an Azure Subscription that is connected to an on-premises datacenter and contains the resources shown in the following table.

   

   You need to configure virtual network service endpoints for VNet1 and VNet2. The solution must meet the following requirements: • The virtual machines that connect to the subnet of VNet1 must access storage1, storage2, and Azure AD by using the Microsoft backbone network. • The virtual machines that connect to the subnet of VNet2 must access storage1 and KeyVault1 by using the Microsoft backbone network. • The virtual machines must use the Microsoft backbone network to communicate between VNet1 and VNet2. How many service endpoints should you configure for each virtual network? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   VNet1: 1 > Microsoft.Storage only. VNet2: 2 > Microsoft.Storage and Microsoft.KeyVault Service endpoints are enabled for the entire service not per instance of a service. They are enabled per Vnet and subnet. Azure AD does not have a service endpoint currently. For Azure Storage you can additionally use a service endpoint policy to control access to specific storage instances within a subnet. https://jeffbrown.tech/azure-private-service-endpoint/ https://learn.microsoft.com/en-us/azure/virtual-network/vnet-integration-for-azure-services#compare-private-endpoints-and-service-endpoints https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

   Source: Adapted from community discussion — Kb80

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 449 · 496 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to deploy an Azure Private Link service named APL1. Which resource should you reference during the creation of APL1.

   • ALB1
   • BSQL1
   • CVMSS1
   • DVM1

   Show answer

   Answer: A

   Explanation

   The correct answer is A: LB1. Create a Private Link service behind the load balancer you created in the previous section. https://learn.microsoft.com/en-us/azure/private-link/create-private-link-service-portal?tabs=dynamic-ip

   Source: Adapted from community discussion — c12

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 450 · 496 in bank

    DRAG DROP - You have an on-premises datacenter. You have an Azure subscription that contains a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. VNet1 is connected to the on-premises datacenter by using a Site-to-Site (S2S) VPN. You plan to create an Azure storage account named storage1 and deploy an Azure web app named App1. You need to ensure that network communication to each resource meets the following requirements: • Connections to App1 must be allowed only from corporate network NAT addresses. • Connections from VNet1 to storage1 must use the Microsoft backbone network. • The solution must minimize costs. What should you configure for each resource? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    The solution must minimize costs: Private Endpoint & Private Link costs more. So: 1) Service Endpoint, 2) Access Restriction Rules.

    Source: Adapted from community discussion — Yesvanth1

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 441. 496 questions available.