AZ-500 practice questions 51–60

1. Question 51 · 496 in bank

   DRAG DROP - You need to deploy AKS1 to meet the platform protection requirements. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Scenario: Azure AD users must be able to authenticate to AKS1 by using their Azure AD credentials. Litware plans to deploy AKS1, which is a managed AKS (Azure Kubernetes Services) cluster. Step 1: Create a server application To provide Azure AD authentication for an AKS cluster, two Azure AD applications are created. The first application is a server component that provides user authentication. Step 2: Create a client application The second application is a client component that's used when you're prompted by the CLI for authentication. This client application uses the server application for the actual authentication of the credentials provided by the client. Step 3: Deploy an AKS cluster. Use the az group create command to create a resource group for the AKS cluster. Use the az aks create command to deploy the AKS cluster. Step 4: Create an RBAC binding. Before you use an Azure Active Directory account with an AKS cluster, you must create role-binding or cluster role-binding. Roles define the permissions to grant, and bindings apply them to desired users. These assignments can be applied to a given namespace, or across the entire cluster. Reference: https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration

   Source: Adapted from community discussion — bmanu

   References

   • Microsoft Learn

   

   Next question

2. Question 52 · 496 in bank

   You need to ensure that users can access VM0. The solution must meet the platform protection requirements. What should you do?

   • AMove VM0 to Subnet1.
   • BOn Firewall, configure a network traffic filtering rule.
   • CAssign RT1 to AzureFirewallSubnet.
   • DOn Firewall, configure a DNAT rule.

   Show answer

   Answer: A

   Explanation

   For anyone who couldn't infer from the other answers: JIT and FW used to have an incompatibility. The provided info indicates subnet0 has a user defined route to the FW , meaning JIT wouldn't have worked out of the box. Subnet1 did not have a route to the FW, which would have allowed JIT to work.

   Source: Adapted from community discussion — rawrkadia

   References

   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 53 · 496 in bank

   HOTSPOT - You need to deploy Microsoft Antimalware to meet the platform protection requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Scenario: Microsoft Antimalware must be installed on the virtual machines in RG1. RG1 is a resource group that contains Vnet1, VM0, and VM1. Box 1: DeployIfNotExists - DeployIfNotExists executes a template deployment when the condition is met. Azure policy definition Antimalware Incorrect Answers: Append: Append is used to add additional fields to the requested resource during creation or update. A common example is adding tags on resources such as costCenter or specifying allowed IPs for a storage resource. Deny: Deny is used to prevent a resource request that doesn't match defined standards through a policy definition and fails the request. Box 2: The Create a Managed Identity setting When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity. Azure Policy creates a managed identity for each assignment, but must have details about what roles to grant the managed identity. Reference: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

   Source: Adapted from community discussion — vijeet

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 54 · 496 in bank

   HOTSPOT - What is the membership of Group1 and Group2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: User1, User2, User3, User4 Contains "ON" is true for Montreal (User1), MONTREAL (User2), London (User 3), and Ontario (User4) as string and regex operations are not case sensitive. Box 2: Only User3 - Match "*on" is only true for London (User3) as 'London' is the only word that ends with 'on'. Scenario: Contoso.com contains the users shown in the following table. Contoso.com contains the security groups shown in the following table. References: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership

   Source: Adapted from community discussion — CASGTI

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 55 · 496 in bank

   HOTSPOT - You are evaluating the security of the network communication between the virtual machines in Sub2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes. All traffic is allowed out to the Internet so you can ping the public IP. NSG1, NSG2, NSG3, and NSG4 have the outbound security rules shown in the following table. Box 2: Yes. VM3 is on Subnet12. There is no NSG attached to Subnet12 so the traffic will be allowed by default. Box 3: No (because VM5 is in a separate VNet). Note: Sub2 contains the virtual machines shown in the following table.

   Source: Adapted from community discussion — nihao381

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 56 · 496 in bank

   HOTSPOT - You are evaluating the effect of the application security groups on the network communication between the virtual machines in Sub2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No. VM4 is in Subnet13 which has NSG3 attached to it. VM1 is in ASG1. NSG3 would only allow ICMP pings from ASG2 but not ASG1. Only TCP traffic is allowed from ASG1. NSG3 has the inbound security rules shown in the following table. Box 2: Yes. VM2 is in ASG2. Any protocol is allowed from ASG2 so ICMP ping would be allowed. Box3. VM1 is in ASG1. TCP traffic is allowed from ASG1 so VM1 could connect to the web server as connections to the web server would be on ports TCP 80 or TCP 443.

   Source: Adapted from community discussion — asdf12345a

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 57 · 496 in bank

   You need to meet the technical requirements for VNetwork1. What should you do first?

   • ACreate a new subnet on VNetwork1.
   • BRemove the NSGs from Subnet11 and Subnet13.
   • CAssociate an NSG to Subnet12.
   • DConfigure DDoS protection for VNetwork1.

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal Under Subnet name, select default and change it to AzureFirewallSubnet. The firewall will be in this subnet, and the subnet name must be AzureFirewallSubnet. The size of the AzureFirewallSubnet subnet is /26.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 58 · 496 in bank

   HOTSPOT - You are evaluating the security of VM1, VM2, and VM3 in Sub2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   VM1: Yes. NSG2 applies to VM1 and this allows inbound traffic on port 80. VM2: No. NSG2 and NSG1 apply to VM2. NSG2 allows the inbound traffic on port 80 but NSG1 does not allow it. VM3: Yes. There are no NSGs applying to VM3 so all ports will be open.

   Source: Adapted from community discussion — MarioMK

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 59 · 496 in bank

   HOTSPOT - You need to configure support for Microsoft Sentinel notebooks to meet the technical requirements. What is the minimum number of Azure container registries and Azure Machine Learning workspaces required? Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/sentinel/notebooks

   Source: Adapted from community discussion — Duncan

   References

   • Microsoft Learn

   

   Next question

10. Question 60 · 496 in bank

    From Microsoft Defender for Cloud, you need to deploy SecPol1. What should you do first?

    • AEnable Microsoft Defender for Cloud.
    • BCreate an Azure Management group.
    • CCreate an initiative.
    • DConfigure continuous export.

    Show answer

    Answer: A

    Explanation

    The only thing dealing with policies or initiatives in DfC is in the regulatory compliance section which requires enhanced features enabled. I would say A. https://learn.microsoft.com/en-us/azure/defender-for-cloud/enhanced-security-features-overview https://learn.microsoft.com/en-us/azure/defender-for-cloud/custom-security-policies?pivots=azure-portal

    Source: Adapted from community discussion — danlo

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 51. 496 questions available.