Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AZ-500 > Test Questions > Flashcards

Test Questions Flashcards

1
Q

You have an Azure Subscription named Sub1.
You have an Azure Storage account named Sa1 in a resource group named RG1.
Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.
You discover that unauthorized users accessed both the file service and the blob service.
You need to revoke all access to Sa1.
Solution: You generate new SASs.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

Instead you should create a new stored access policy.
To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately affects all of the shared access signatures associated with it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

You have an Azure Subscription named Sub1.
You have an Azure Storage account named Sa1 in a resource group named RG1.
Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.
You discover that unauthorized users accessed both the file service and the blob service.
You need to revoke all access to Sa1.
Solution: You create a new stored access policy.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: A

To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately effects all of the shared access signatures associated with it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

You have a hybrid configuration of Azure Active Directory (Azure AD).
You have an Azure HDInsight cluster on a virtual network.
You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.
You need to configure the environment to support the planned authentication.
Solution: You deploy the On-premises data gateway to the on-premises network.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

Instead, you connect HDInsight to your on-premises network by using Azure Virtual Networks and a VPN gateway.
Note: To allow HDInsight and resources in the joined network to communicate by name, you must perform the following actions:
✑ Create Azure Virtual Network.
✑ Create a custom DNS server in the Azure Virtual Network.
✑ Configure the virtual network to use the custom DNS server instead of the default Azure Recursive Resolver.
✑ Configure forwarding between the custom DNS server and your on-premises DNS server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

You have a hybrid configuration of Azure Active Directory (Azure AD).
You have an Azure HDInsight cluster on a virtual network.
You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.
You need to configure the environment to support the planned authentication.
Solution: You create a site-to-site VPN between the virtual network and the on-premises network.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: A

You can connect HDInsight to your on-premises network by using Azure Virtual Networks and a VPN gateway.
Note: To allow HDInsight and resources in the joined network to communicate by name, you must perform the following actions:
✑ Create Azure Virtual Network.
✑ Create a custom DNS server in the Azure Virtual Network.
✑ Configure the virtual network to use the custom DNS server instead of the default Azure Recursive Resolver.
✑ Configure forwarding between the custom DNS server and your on-premises DNS server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Your network contains an Active Directory forest named contoso.com. The forest contains a single domain.
You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant.
You need to recommend an integration solution that meets the following requirements:
✑ Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant
✑Minimizes the number of servers required for the solution.

Which authentication method should you include in the recommendation?

A. federated identity with Active Directory Federation Services (AD FS)
B. password hash synchronization with seamless single sign-on (SSO)
C. pass-through authentication with seamless single sign-on (SSO)

A

Correct Answer: B

Password hash synchronization requires the least effort regarding deployment, maintenance, and infrastructure. This level of effort typically applies to organizations that only need their users to sign in to Office 365, SaaS apps, and other Azure AD-based resources. When turned on, password hash synchronization is part of the Azure AD Connect sync process and runs every two minutes.
Incorrect Answers:
A: A federated authentication system relies on an external trusted system to authenticate users. Some companies want to reuse their existing federated system investment with their Azure AD hybrid identity solution. The maintenance and management of the federated system falls outside the control of Azure AD. It’s up to the organization by using the federated system to make sure it’s deployed securely and can handle the authentication load.
C: For pass-through authentication, you need one or more (we recommend three) lightweight agents installed on existing servers. These agents must have access to your on-premises Active Directory Domain Services, including your on-premises AD domain controllers. They need outbound access to the Internet and access to your domain controllers. For this reason, it’s not supported to deploy the agents in a perimeter network.
Pass-through Authentication requires unconstrained network access to domain controllers. All network traffic is encrypted and limited to authentication requests.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Your network contains an on-premises Active Directory domain named corp.contoso.com.
You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.
You sync all on-premises identities to Azure AD.
You need to prevent users who have a givenName attribute that starts with TEST from being synced to Azure AD. The solution must minimize administrative effort.
What should you use?

A. Synchronization Rules Editor
B. Web Service Configuration Tool
C. the Azure AD Connect wizard
D. Active Directory Users and Computers

A

Correct Answer: A

Use the Synchronization Rules Editor and write attribute-based filtering rule.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Your company plans to create separate subscriptions for each department. Each subscription will be associated to the same Azure Active Directory (Azure AD) tenant.
You need to configure each subscription to have the same role assignments.
What should you use?

A. Azure Security Center
B. Azure Blueprints
C. Azure AD Privileged Identity Management (PIM)
D. Azure Policy

A

Correct Answer: C

The Azure AD Privileged Identity Management (PIM) service also allows Privileged Role Administrators to make permanent admin role assignments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

You have an Azure subscription.
You create an Azure web app named Contoso1812 that uses an S1 App service plan.
You create a DNS record for www.contoso.com that points to the IP address of Contoso1812.
You need to ensure that users can access Contoso1812 by using the https://www.contoso.com URL.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Turn on the system-assigned managed identity for Contoso1812.
B. Add a hostname to Contoso1812.
C. Scale out the App Service plan of Contoso1812.
D. Add a deployment slot to Contoso1812.
E. Scale up the App Service plan of Contoso1812.

A

Correct Answer: BE

B: You can configure Azure DNS to host a custom domain for your web apps. For example, you can create an Azure web app and have your users access it using either www.contoso.com or contoso.com as a fully qualified domain name (FQDN).
To do this, you have to create three records:
A root “A” record pointing to contoso.com
A root “TXT” record for verification
A “CNAME” record for the www name that points to the A record
E: To map a custom DNS name to a web app, the web app’s App Service plan must be a paid tier (Shared, Basic, Standard, Premium or Consumption for Azure
Functions). I -
Scale up the App Service plan: Select any of the non-free tiers (D1, B1, B2, B3, or any tier in the Production category).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

You have an Azure subscription named Sub1.
You have an Azure Storage account named Sa1 in a resource group named RG1.
Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.
You discover that unauthorized users accessed both the file service and the blob service.
You need to revoke all access to Sa1.
Solution: You create a lock on Sa1.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately affects all of the shared access signatures associated with it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

You have a hybrid configuration of Azure Active Directory (Azure AD).
You have an Azure HDInsight cluster on a virtual network.
You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.
You need to configure the environment to support the planned authentication.
Solution: You deploy Azure Active Directory Domain Services (Azure AD DS) to the Azure subscription.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

Instead, you connect HDInsight to your on-premises network by using Azure Virtual Networks and a VPN gateway.
Note: To allow HDInsight and resources in the joined network to communicate by name, you must perform the following actions:
✑ Create Azure Virtual Network.
✑ Create a custom DNS server in the Azure Virtual Network.
✑ Configure the virtual network to use the custom DNS server instead of the default Azure Recursive Resolver.
✑ Configure forwarding between the custom DNS server and your on-premises DNS server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Your network contains an Active Directory forest named contoso.com. You have an Azure Directory (Azure AD) tenant named contoso.com.
You plan to configure synchronization by using the Express Settings installation option in Azure AD Connect.
You need to identify which roles and groups are required to perform the planned configuration. The solution must use the principle of least privilege.
Which two roles and groups should you identify? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. the Domain Admins group in Active Directory
B. the Security administrator role in Azure AD
C. the Global administrator role in Azure AD
D. the User administrator role in Azure AD
E. the Enterprise Admins group in Active Directory

A

Correct Answer: CE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

You have a hybrid configuration of Azure Active Directory (Azure AD).
You have an Azure HDInsight cluster on a virtual network.
You plan to allow users to authenticate to the cluster by using their on-premises Active Directory credentials.
You need to configure the environment to support the planned authentication.
Solution: You deploy an Azure AD Application Proxy.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B
Instead, you connect HDInsight to your on-premises network by using Azure Virtual Networks and a VPN gateway.
Note: To allow HDInsight and resources in the joined network to communicate by name, you must perform the following actions:
✑ Create Azure Virtual Network.
✑ Create a custom DNS server in the Azure Virtual Network.
✑ Configure the virtual network to use the custom DNS server instead of the default Azure Recursive Resolver.
✑ Configure forwarding between the custom DNS server and your on-premises DNS server.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

You have an Azure Subscription named Sub1.
You have an Azure Storage account named Sa1 in a resource group named RG1.
Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.
You discover that unauthorized users accessed both the file service and the blob service.
You need to revoke all access to Sa1.
Solution: You regenerate the access keys.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

Instead you should create a new stored access policy.
To revoke a stored access policy, you can either delete it, or rename it by changing the signed identifier. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Deleting or renaming the stored access policy immediately affects all of the shared access signatures associated with it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure SQL Database instance that is configured to support Azure AD authentication.
Database developers must connect to the database instance and authenticate by using their on-premises Active Directory account.
You need to ensure that developers can connect to the instance by using Microsoft SQL Server Management Studio. The solution must minimize authentication prompts.
Which authentication method should you recommend?

A. Active Directory - Password
B. Active Directory - Universal with MFA support
C. SQL Server Authentication
D. Active Directory - Integrated

A

Correct Answer: A

Use Active Directory password authentication when connecting with an Azure AD principal name using the Azure AD managed domain.
Use this method to authenticate to SQL DB/DW with Azure AD for native or federated Azure AD users. A native user is one explicitly created in Azure AD and being authenticated using user name and password, while a federated user is a Windows user whose domain is federated with Azure AD. The latter method
(using user & password) can be used when a user wants to use their windows credential, but their local machine is not joined with the domain (for example, using a remote access). In this case, a Windows user can indicate their domain account and password and can authenticate to SQL DB/DW using federated credentials.
Incorrect Answers:
D: Use Active Directory integrated authentication if you are logged in to Windows using your Azure Active Directory credentials from a federated domain.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

You plan to use Azure Resource Manager templates to perform multiple deployments of identically configured Azure virtual machines. The password for the administrator account of each deployment is stored as a secret in different Azure key vaults.
You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment.
The name of the key vault and the name of the secret will be provided as inline parameters.
What should you use to construct the resource ID?

A. a key vault access policy
B. a linked template
C. a parameters file
D. an automation account

A

Correct Answer: C

You reference the key vault in the parameter file, not the template.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.
An administrator named Admin1 has access to the following identities:
✑ An OpenID-enabled user account
✑ A Hotmail account
✑ An account in contoso.com
✑ An account in an Azure AD tenant named fabrikam.com
You plan to use Azure Account Center to transfer the ownership of Sub1 to Admin1.
To which accounts can you transfer the ownership of Sub1?

A. contoso.com only
B. contoso.com, fabrikam.com, and Hotmail only
C. contoso.com and fabrikam.com only
D. contoso.com, fabrikam.com, Hotmail, and OpenID-enabled user account

A

Correct Answer: C

When you transfer billing ownership of your subscription to an account in another Azure AD tenant, you can move the subscription to the new account’s tenant. If you do so, all users, groups, or service principals who had role based access (RBAC) to manage subscriptions and its resources lose their access. Only the user in the new account who accepts your transfer request will have access to manage the resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Your company plans to create separate subscriptions for each department. Each subscription will be associated to the same Azure Active Directory (Azure AD) tenant.
You need to configure each subscription to have the same role assignments.
What should you use?

A. Azure Security Center
B. Azure Policy
C. Azure AD Privileged Identity Management (PIM)
D. Azure Blueprints

A

Correct Answer: D

Just as a blueprint allows an engineer or an architect to sketch a project’s design parameters, Azure Blueprints enables cloud architects and central information technology groups to define a repeatable set of Azure resources that implements and adheres to an organization’s standards, patterns, and requirements.
Blueprints are a declarative way to orchestrate the deployment of various resource templates and other artifacts such as:
✑ Role Assignments
✑ Policy Assignments
✑ Azure Resource Manager templates
✑ Resource Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

You have an Azure subscription named Sub1. Sub1 contains a virtual network named VNet1 that contains one subnet named Subnet1.
Subnet1 contains an Azure virtual machine named VM1 that runs Ubuntu Server 18.04.
You create a service endpoint for MicrosoftStorage in Subnet1.
You need to ensure that when you deploy Docker containers to VM1, the containers can access Azure Storage resources by using the service endpoint.
What should you do on VM1 before you deploy the container?

A. Create an application security group and a network security group (NSG).
B. Edit the docker-compose.yml file.
C. Install the container network interface (CNI) plug-in.

A

Correct Answer: C

The Azure Virtual Network container network interface (CNI) plug-in installs in an Azure Virtual Machine. The plug-in supports both Linux and Windows platform.
The plug-in assigns IP addresses from a virtual network to containers brought up in the virtual machine, attaching them to the virtual network, and connecting them directly to other containers and virtual network resources. The plug-in doesn’t rely on overlay networks, or routes, for connectivity, and provides the same performance as virtual machines.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.
You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.
What should you use?

A. device configuration policies in Microsoft Intune
B. an Azure Desired State Configuration (DSC) virtual machine extension
C. application security groups
D. Azure Logic Apps
E. security policies in Azure Security Center
F. Azure Advisor

A

Correct Answer: B

You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines.
Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

You are configuring an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry.
You need to use the auto-generated service principal to authenticate to the Azure Container Registry.
What should you create?

A. an Azure Active Directory (Azure AD) group
B. an Azure Active Directory (Azure AD) role assignment
C. an Azure Active Directory (Azure AD) user
D. a secret in Azure Key Vault

A

Correct Answer: B

When you create an AKS cluster, Azure also creates a service principal to support cluster operability with other Azure resources. You can use this auto-generated service principal for authentication with an ACR registry. To do so, you need to create an Azure AD role assignment that grants the cluster’s service principal access to the container registry.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

You use Azure Security Center for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a policy definition and assignments that are scoped to resource groups.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

You use Azure Security Center for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a resource graph and an assignment that is scoped to a management group.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

You have an Azure Subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016.
You need to deploy Microsoft Antimalware to the virtual machines.
Solution: You add an extension to each virtual machine.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: A

You can use Visual Studio to enable and configure the Microsoft Antimalware service. This entails selecting Microsoft Antimalware extension from the dropdown list under Installed Extensions and click Add to configure with default antimalware configuration.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

You have an Azure Subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016.
You need to deploy Microsoft Antimalware to the virtual machines.
Solution: You connect to each virtual machine and add a Windows feature.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

Microsoft Antimalware is deployed as an extension and not a feature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

From Azure Security Center, you create a custom alert rule.
You need to configure which users will receive an email message when the alert is triggered.
What should you do?

A. From Azure Monitor, create an action group.
B. From Security Center, modify the Security policy settings of the Azure subscription.
C. From Azure Active Directory (Azure AD), modify the members of the Security Reader role group.
D. From Security Center, modify the alert rule.

A

Correct Answer: A

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

You are configuring and securing a network environment.
You deploy an Azure virtual machine named VM1 that is configured to analyze network traffic.
You need to ensure that all network traffic is routed through VM1.
What should you configure?

A. a system route
B. a network security group (NSG)
C. a user-defined route

A

Correct Answer: C

Although the use of system routes facilitates traffic automatically for your deployment, there are cases in which you want to control the routing of packets through a virtual appliance. You can do so by creating user defined routes that specify the next hop for packets flowing to a specific subnet to go to your virtual appliance instead, and enabling IP forwarding for the VM running as the virtual appliance.

Note: User Defined Routes -
For most environments you will only need the system routes already defined by Azure. However, you may need to create a route table and add one or more routes in specific cases, such as:
✑ Force tunneling to the Internet via your on-premises network.
✑ Use of virtual appliances in your Azure environment.
✑ In the scenarios above, you will have to create a route table and add user defined routes to it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

You have 15 Azure virtual machines in a resource group named RG1.
All virtual machines run identical applications.
You need to prevent unauthorized applications and malware from running on the virtual machines.
What should you do?

A. Apply an Azure policy to RG1.
B. From Azure Security Center, configure adaptive application controls.
C. Configure Azure Active Directory (Azure AD) Identity Protection.
D. Apply a resource lock to RG1.

A

Correct Answer: B

Adaptive application control is an intelligent, automated end-to-end application whitelisting solution from Azure Security Center. It helps you control which applications can run on your Azure and non-Azure VMs (Windows and Linux), which, among other benefits, helps harden your VMs against malware. Security
Center uses machine learning to analyze the applications running on your VMs and helps you apply the specific whitelisting rules using this intelligence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

You plan to deploy Azure container instances.
You have a containerized application that validates credit cards. The application is comprised of two containers: an application container and a validation container.
The application container is monitored by the validation container. The validation container performs security checks by making requests to the application container and waiting for responses after every transaction.
You need to ensure that the application container and the validation container are scheduled to be deployed together. The containers must communicate to each other only on ports that are not externally exposed.
What should you include in the deployment?

A. application security groups
B. network security groups (NSGs)
C. management groups
D. container groups

A

Correct Answer: D

Azure Container Instances supports the deployment of multiple containers onto a single host using a container group. A container group is useful when building an application sidecar for logging, monitoring, or any other configuration where a service needs a second attached process.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

You use Azure Security Center for the centralized policy management of three Azure subscriptions.
You use several policy definitions to manage the security of the subscriptions.
You need to deploy the policy definitions as a group to all three subscriptions.
Solution: You create a policy initiative and assignments that are scoped to resource groups.
Does this meet the goal?

A. Yes
B. No

A

Correct Answer: B

Instead use a management group.
Management groups in Microsoft Azure solve the problem of needing to impose governance policy on more than one Azure subscription simultaneously.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.
You are assigned the Global administrator role for the tenant. You are responsible for managing Azure Security Center settings.
You need to create a custom sensitivity label.
What should you do?

A. Create a custom sensitive information type.
B. Elevate access for global administrators in Azure AD.
C. Change Azure Security Center to use Standard-tier-pricing.
D. Enable integration with Microsoft Cloud App Security.

A

Correct Answer: A

First, you need to create a new sensitive information type because you can’t directly modify the default rules.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

You have an Azure subscription named Sub1.
In Azure Security Center, you have a security playbook named Play1. Play1 is configured to send an email message to a user named User1.
You need to modify Play1 to send email messages to a distribution group named Alerts.
What should you use to modify Play1?

A. Azure DevOps
B. Azure Application Insights
C. Azure Monitor
D. Azure Logic Apps Designer

A

Correct Answer: D

You can change an existing playbook in Security Center to add an action, or conditions. To do that you just need to click on the name of the playbook that you want to change, in the Playbooks tab, and Logic App Designer opens up.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

You create a new Azure subscription.
You need to ensure that you can create custom alert rules in Azure Security Center.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Onboard Azure Active Directory (Azure AD) Identity Protection.
B. Create an Azure Storage account.
C. Implement Azure Advisor recommendations.
D. Create an Azure Log Analytics workspace.
E. Upgrade the pricing tier of Security Center to Standard.

A

Correct Answer: BD

D: You need write permission in the workspace that you select to store your custom alert.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

You have an Azure subscription named Sub1 that contains an Azure Log Analytics workspace named LAW1.
You have 100 on-premises servers that run Windows Server 2012 R2 and Windows Server 2016. The servers connect to LAW1. LAW1 is configured to collect security-related performance counters from the connected servers.
You need to configure alerts based on the data collected by LAW1. The solution must meet the following requirements:
✑ Alert rules must support dimensions.
✑ The time it takes to generate an alert must be minimized.
✑ Alert notifications must be generated only once when the alert is generated and once when the alert is resolved.
Which signal type should you use when you create the alert rules?

A. Log
B. Log (Saved Query)
C. Metric
D. Activity Log

A

Correct Answer: C

Metric alerts in Azure Monitor provide a way to get notified when one of your metrics cross a threshold. Metric alerts work on a range of multi-dimensional platform metrics, custom metrics, Application Insights standard and custom metrics.
Note: Signals are emitted by the target resource and can be of several types. Metric, Activity log, Application Insights, and Log.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

You have 10 virtual machines on a single subnet that has a single network security group (NSG).
You need to log the network traffic to an Azure Storage account.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Install the Network Performance Monitor solution.
B. Enable Azure Network Watcher.
C. Enable diagnostic logging for the NSG.
D. Enable NSG flow logs.
E. Create an Azure Log Analytics workspace.

A

Correct Answer: BD

A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). You can log network traffic that flows through an NSG with Network Watcher’s NSG flow log capability. Steps include:
✑ Create a VM with a network security group
✑ Enable Network Watcher and register the Microsoft.Insights provider
✑ Enable a traffic flow log for an NSG, using Network Watcher’s NSG flow log capability
✑ Download logged data
✑ View logged data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.
The company develops an application named App1. App1 is registered in Azure AD.
You need to ensure that App1 can access secrets in Azure Key Vault on behalf of the application users.
What should you configure?

A. an application permission without admin consent
B. a delegated permission without admin consent
C. a delegated permission that requires admin consent
D. an application permission that requires admin consent

A

Correct Answer: B

Delegated permissions - Your client application needs to access the web API as the signed-in user, but with access limited by the selected permission. This type of permission can be granted by a user unless the permission requires administrator consent.
Incorrect Answers: A, D
Application permissions - Your client application needs to access the web API directly as itself (no user context). This type of permission requires administrator consent and is also not available for public (desktop and mobile) client applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory Azure (Azure AD) tenant named contoso.com.
The company develops a mobile application named App1. App1 uses the OAuth 2 implicit grant type to acquire Azure AD access tokens.
You need to register App1 in Azure AD.
What information should you obtain from the developer to register the application?

A. a redirect URI
B. a reply URL
C. a key
D. an application ID

A

Correct Answer: A

For Native Applications you need to provide a Redirect URI, which Azure AD will use to return token responses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

From the Azure portal, you are configuring an Azure policy.
You plan to assign policies that use the DeployIfNotExist, AuditIfNotExist, Append, and Deny effects.
Which effect requires a managed identity for the assignment?

A. AuditIfNotExist
B. Append
C. DeployIfNotExist
D. Deny

A

Correct Answer: C

When Azure Policy runs the template in the deployIfNotExists policy definition, it does so using a managed identity.

38
Q

You have an Azure subscription that contains an Azure key vault named Vault1.
In Vault1, you create a secret named Secret1.
An application developer registers an application in Azure Active Directory (Azure AD).
You need to ensure that the application can use Secret1.
What should you do?

A. In Azure AD, create a role.
B. In Azure Key Vault, create a key.
C. In Azure Key Vault, create an access policy.
D. In Azure AD, enable Azure AD Application Proxy.

A

Correct Answer: A

Azure Key Vault provides a way to securely store credentials and other keys and secrets, but your code needs to authenticate to Key Vault to retrieve them.
Managed identities for Azure resources overview makes solving this problem simpler, by giving Azure services an automatically managed identity in Azure Active
Directory (Azure AD). You can use this identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without having any credentials in your code.
Example: How a system-assigned managed identity works with an Azure VM
After the VM has an identity, use the service principal information to grant the VM access to Azure resources. To call Azure Resource Manager, use role-based access control (RBAC) in Azure AD to assign the appropriate role to the VM service principal. To call Key Vault, grant your code access to the specific secret or key in Key Vault.

39
Q

You have an Azure SQL database.
You implement Always Encrypted.
You need to ensure that application developers can retrieve and decrypt data in the database.
Which two pieces of information should you provide to the developers? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. a stored access policy
B. a shared access signature (SAS)
C. the column encryption key
D. user credentials
E. the column master key
A

Correct Answer: CE

Always Encrypted uses two types of keys: column encryption keys and column master keys. A column encryption key is used to encrypt data in an encrypted column. A column master key is a key-protecting key that encrypts one or more column encryption keys.

40
Q

You have a hybrid configuration of Azure Active Directory (Azure AD).
All users have computers that run Windows 10 and are hybrid Azure AD joined.
You have an Azure SQL database that is configured to support Azure AD authentication.
Database developers must connect to the SQL database by using Microsoft SQL Server Management Studio (SSMS) and authenticate by using their on-premises
Active Directory account.
You need to tell the developers which authentication method to use to connect to the SQL database from SSMS. The solution must minimize authentication prompts.
Which authentication method should you instruct the developers to use?

A. SQL Login
B. Active Directory “” Universal with MFA support
C. Active Directory “” Integrated
D. Active Directory “” Password

A

Correct Answer: C

Azure AD can be the initial Azure AD managed domain. Azure AD can also be an on-premises Active Directory Domain Services that is federated with the Azure
AD.
Using an Azure AD identity to connect using SSMS or SSDT
The following procedures show you how to connect to a SQL database with an Azure AD identity using SQL Server Management Studio or SQL Server Database
Tools.
Active Directory integrated authentication
Use this method if you are logged in to Windows using your Azure Active Directory credentials from a federated domain.
1. Start Management Studio or Data Tools and in the Connect to Server (or Connect to Database Engine) dialog box, in the Authentication box, select Active
Directory - Integrated. No password is needed or can be entered because your existing credentials will be presented for the connection.
2. Select the Options button, and on the Connection Properties page, in the Connect to database box, type the name of the user database you want to connect to.
(The AD domain name or tenant ID” option is only supported for Universal with MFA connection options, otherwise it is greyed out.)

41
Q

You have an Azure SQL Database server named SQL1.
You plan to turn on Advanced Threat Protection for SQL1 to detect all threat detection types.
Which action will Advanced Threat Protection detect as a threat?

A. A user updates more than 50 percent of the records in a table.
B. A user attempts to sign as select * from table1.
C. A user is added to the db_owner database role.
D. A user deletes more than 100 records from the same table.

A

Correct Answer: B

Advanced Threat Protection can detect potential SQL injections: This alert is triggered when an active exploit happens against an identified application vulnerability to SQL injection. This means the attacker is trying to inject malicious SQL statements using the vulnerable application code or stored procedures.

42
Q

Your company uses Azure DevOps.
You need to recommend a method to validate whether the code meets the company’s quality standards and code review standards.
What should you recommend implementing in Azure DevOps?

A. branch folders
B. branch permissions
C. branch policies
D. branch locking

A

Correct Answer: C

Branch policies help teams protect their important branches of development. Policies enforce your team’s code quality and change management standards.

43
Q

You have an Azure subscription that contains a virtual machine named VM1.
You create an Azure key vault that has the following configurations:
✑ Name: Vault5
✑ Region: West US
✑ Resource group: RG1
You need to use Vault5 to enable Azure Disk Encryption on VM1. The solution must support backing up VM1 by using Azure Backup.
Which key vault settings should you configure?

A. Access policies
B. Secrets
C. Keys
D. Locks

A

Correct Answer: A

44
Q

You have an Azure web app named webapp1.
You need to configure continuous deployment for webapp1 by using an Azure Repo.
What should you create first?

A. an Azure Application Insights service
B. an Azure DevOps organizations
C. an Azure Storage account
D. an Azure DevTest Labs lab

A

Correct Answer: B

To use Azure Repos, make sure your Azure DevOps organization is linked to your Azure subscription.

45
Q

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.
You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.
What should you use?

A. device compliance policies in Microsoft Intune
B. Azure Automation State Configuration
C. application security groups
D. Azure Advisor

A

Correct Answer: B

You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines.
Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.

46
Q

Your network contains an Active Directory forest named contoso.com. The forest contains a single domain.
You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to deploy Azure AD Connect and to integrate Active Directory and the Azure AD tenant.
You need to recommend an integration solution that meets the following requirements:
✑ Ensures that password policies and user logon restrictions apply to user accounts that are synced to the tenant

✑ Minimizes the number of servers required for the solution.
Which authentication method should you include in the recommendation?

A. federated identity with Active Directory Federation Services (AD FS)
B. password hash synchronization with seamless single sign-on (SSO)
C. pass-through authentication with seamless single sign-on (SSO)

A

Correct Answer: B

Password hash synchronization requires the least effort regarding deployment, maintenance, and infrastructure. This level of effort typically applies to organizations that only need their users to sign in to Office 365, SaaS apps, and other Azure AD-based resources. When turned on, password hash synchronization is part of the Azure AD Connect sync process and runs every two minutes.

Incorrect Answers:
A: A federated authentication system relies on an external trusted system to authenticate users. Some companies want to reuse their existing federated system investment with their Azure AD hybrid identity solution. The maintenance and management of the federated system falls outside the control of Azure AD. It’s up to the organization by using the federated system to make sure it’s deployed securely and can handle the authentication load.
C: For pass-through authentication, you need one or more (we recommend three) lightweight agents installed on existing servers. These agents must have access to your on-premises Active Directory Domain Services, including your on-premises AD domain controllers. They need outbound access to the Internet and access to your domain controllers. For this reason, it’s not supported to deploy the agents in a perimeter network.
Pass-through Authentication requires unconstrained network access to domain controllers. All network traffic is encrypted and limited to authentication requests.

47
Q

You are securing access to the resources in an Azure subscription.
A new company policy states that all the Azure virtual machines in the subscription must use managed disks.
You need to prevent users from creating virtual machines that use unmanaged disks.
What should you do?

A. Azure Monitor
B. Azure Policy
C. Azure Security Center
D. Azure Service Health

A

Correct Answer: B

48
Q

You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry.
You need to use automatically generated service principal for the AKS cluster to authenticate to the Azure Container Registry.
What should you create?

A. a secret in Azure Key Vault
B. a role assignment
C. an Azure Active Directory (Azure AD) user
D. an Azure Active Directory (Azure AD) group

A

Correct Answer: B

49
Q

You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ConReg1.
You enable content trust for ContReg1.
You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege.
Which two roles should you assign to User1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. AcrQuarantineReader
B. Contributor
C. AcrPush
D. AcrImageSigner
E. AcrQuarantineWriter
A

Correct Answer: CD

50
Q

You are troubleshooting a security issue for an Azure Storage account.
You enable the diagnostic logs for the storage account.
What should you use to retrieve the diagnostics logs?

A. the Security & Compliance admin center
B. SQL query editor in Azure
C. File Explorer in Windows
D. AzCopy

A

Correct Answer: D

51
Q

You have an Azure Storage account named storage1 that has a container named container1.
You need to prevent the blobs in container1 from being modified.
What should you do?

A. From container1, change the access level.
B. From container1, add an access policy.
C. From container1, modify the Access Control (IAM) settings.
D. From storage1, enable soft delete for blobs.

A

Correct Answer: B

52
Q

You company has an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to create several security alerts by using Azure Monitor.
You need to prepare the Azure subscription for the alerts.
What should you create first?

A. An Azure Storage account
B. an Azure Log Analytics workspace
C. an Azure event hub
D. an Azure Automation account

A

Correct Answer: B

53
Q

You company has an Azure subscription named Sub1. Sub1 contains an Azure web app named WebApp1 that uses Azure Application Insights. WebApp1 requires users to authenticate by using OAuth 2.0 client secrets.
Developers at the company plan to create a multi-step web test app that preforms synthetic transactions emulating user traffic to Web App1.
You need to ensure that web tests can run unattended.
What should you do first?

A. In Microsoft Visual Studio, modify the .webtest file.
B. Upload the .webtest file to Application Insights.
C. Register the web test app in Azure AD.
D. Add a plug-in to the web test app.

A

Correct Answer: B

54
Q

You are troubleshooting a security issue for an Azure Storage account.
You enable the diagnostic logs for the storage account.
What should you use to retrieve the diagnostics logs?

A. the Security & Compliance admin center
B. Azure Security Center
C. Azure Cosmos DB explorer
D. AzCopy

A

Correct Answer: D

55
Q

You are securing access to the resources in an Azure subscription.
A new company policy states that all the Azure virtual machines in the subscription must use managed disks.
You need to prevent users from creating virtual machines that use unmanaged disks.
What should you do?

A. Azure Monitor
B. Azure Policy
C. Azure Security Center
D. Azure Service Health

A

Correct Answer: B

56
Q

You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry.
You need to use automatically generated service principal for the AKS cluster to authenticate to the Azure Container Registry.
What should you create?

A. a secret in Azure Key Vault
B. a role assignment
C. an Azure Active Directory (Azure AD) user
D. an Azure Active Directory (Azure AD) group

A

Correct Answer: B

57
Q

You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ConReg1.
You enable content trust for ContReg1.
You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege.
Which two roles should you assign to User1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. AcrQuarantineReader
B. Contributor
C. AcrPush
D. AcrImageSigner
E. AcrQuarantineWriter
A

Correct Answer: CD

58
Q

You are troubleshooting a security issue for an Azure Storage account.
You enable the diagnostic logs for the storage account.
What should you use to retrieve the diagnostics logs?

A. the Security & Compliance admin center
B. SQL query editor in Azure
C. File Explorer in Windows
D. AzCopy

A

Correct Answer: D

59
Q

You have an Azure Storage account named storage1 that has a container named container1.
You need to prevent the blobs in container1 from being modified.
What should you do?

A. From container1, change the access level.
B. From container1, add an access policy.
C. From container1, modify the Access Control (IAM) settings.
D. From storage1, enable soft delete for blobs.

A

Correct Answer: B

60
Q

You company has an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to create several security alerts by using Azure Monitor.
You need to prepare the Azure subscription for the alerts.
What should you create first?

A. An Azure Storage account
B. an Azure Log Analytics workspace
C. an Azure event hub
D. an Azure Automation account

A

Correct Answer: B

61
Q

You company has an Azure subscription named Sub1. Sub1 contains an Azure web app named WebApp1 that uses Azure Application Insights. WebApp1 requires users to authenticate by using OAuth 2.0 client secrets.
Developers at the company plan to create a multi-step web test app that preforms synthetic transactions emulating user traffic to Web App1.
You need to ensure that web tests can run unattended.
What should you do first?

A. In Microsoft Visual Studio, modify the .webtest file.
B. Upload the .webtest file to Application Insights.
C. Register the web test app in Azure AD.
D. Add a plug-in to the web test app.

A

Correct Answer: B

62
Q

You are troubleshooting a security issue for an Azure Storage account.
You enable the diagnostic logs for the storage account.
What should you use to retrieve the diagnostics logs?

A. the Security & Compliance admin center
B. Azure Security Center
C. Azure Cosmos DB explorer
D. AzCopy

A

Correct Answer: D

63
Q

You have a web app named WebApp1.
You create a web application firewall (WAF) policy named WAF1.
You need to protect WebApp1 by using WAF1.
What should you do first?

A. Deploy an Azure Front Door.
B. Add an extension to WebApp1.
C. Deploy Azure Firewall.

A

Correct Answer: A

64
Q

You have an Azure subscription.
You configure the subscription to use a different Azure Active Directory (Azure AD) tenant.
What are two possible effects of the change? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. Role assignments at the subscription level are lost.
B. Virtual machine managed identities are lost.
C. Virtual machine disk snapshots are lost.
D. Existing Azure resources are deleted.

A

Correct Answer: AB

65
Q

You have an Azure subscription that contains virtual machines.
You enable just in time (JIT) VM access to all the virtual machines.
You need to connect to a virtual machine by using Remote Desktop.
What should you do first?

A. From Azure Directory (Azure AD) Privileged Identity Management (PIM), activate the Security administrator user role.
B. From Azure Active Directory (Azure AD) Privileged Identity Management (PIM), activate the Owner role for the virtual machine.
C. From the Azure portal, select the virtual machine, select Connect, and then select Request access.
D. From the Azure portal, select the virtual machine and add the Network Watcher Agent virtual machine extension.

A

Correct Answer: C

66
Q

You have an Azure virtual machine named VM1.
From Azure Security Center, you get the following high-severity recommendation: “Install endpoint protection solutions on virtual machine”.
You need to resolve the issue causing the high-severity recommendation.
What should you do?

A. Add the Microsoft Antimalware extension to VM1.
B. Install Microsoft System Center Security Management Pack for Endpoint Protection on VM1.
C. Add the Network Watcher Agent for Windows extension to VM1.
D. Onboard VM1 to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).

A

Correct Answer: A

67
Q

You have an Azure web app named WebApp1.
You upload a certificate to WebApp1.
You need to make the certificate accessible to the app code of WebApp1.
What should you do?

A. Add a user-assigned managed identity to WebApp1.
B. Add an app setting to the WebApp1 configuration.
C. Enable system-assigned managed identity for the WebApp1.
D. Configure the TLS/SSL binding for WebApp1.

A

Correct Answer: B

68
Q

A company has an Azure subscription and an Azure tenant. The company is planning to deploy a web application that will work with a CosmosDB account. The CosmosDB account will consist of a database that will be the back-end tier for the application. The Web application will be deployed using the Azure Web App service. Users will need to authenticate using their Azure AD account and access the CosmosDB account by using resource tokens. Which of the following tasks would you implement for the CosmosDB account for authentication purposes?

A. Authenticate Azure AD users and generate resource tokens.
B. Authenticate Azure AD users and relay resource tokens.
C. Create database users and generate resource tokens.
D. Create database users and relay resource tokens.

A

Correct Answer: C

Design patterns provided in MS documentation indicate that an application can request tokens when interacting with a CosmosDB account.

Incorrect Answers: A and B are incorrect since the application is responsible for authenticating the users with Azure AD.
Option D is incorrect since CosmosDB would not relay the resource tokens.

69
Q

You have to configure an Azure policy as part of your subscription. You have to assign policies that need to push out one or more resources. Which of the following type of effect would require a managed identity for assignment purpose?

A. AuditIfNotExist
B. Append
C. Deny
D. DeployIfNotExist

A

Correct Answer: D

Since the effect of “DeployIfNotExist” looks at deployment, it would need a managed service identity.

70
Q

How would you ensure the following requirement is fulfilled?
“All users and devices located in the New York office must be members of whizlabgrp1.”

A. Change the membership type of the group whizlabgrp1 to Assigned. Create 2 separate groups that have dynamic memberships. Add the groups to whizlabgrp1.
B. Add a membership rule for devices to whizlabgrp1.
C. Change the membership rule for whizlabgrp1.
D. Delete the group whizlabgrp1. Create a new group that has the membership type of Office365

A

Correct Answer: A

When you want to create a Dynamic Group, the group can either have a “Dynamic User” or “Dynamic Device” membership. So, the ideal approach is to have two separate groups, one for users, and one for devices. Then, add these groups to the main whizlabgrp1 group. Due to the restriction of having anyone either users or devices in one dynamic group, all other options are incorrect.

71
Q

A company wants to implement Just-In-Time access for whizlabvm1. The company decides to upgrade the Azure Security Center. Is this required to implement Just-In-Time access for this VM?

A. Yes
B. No

A

Correct Answer: A

You first have to upgrade the tier of Azure Security Center from Free to Standard to enable Just-In-Time access.

72
Q

A company has an Azure subscription. They have around 50 VMs defined as part of the subscription. Azure Diagnostics have been enabled on all of the VMs.
You have to get the following details with regard to the VMs.
•Identify the user who stopped the VM the previous week.
•Query the security events for the virtual machines
Which of the following would you use in Azure Monitor for the following requirement?
“Query the security events for the virtual machines”

A. Activity Log
B. Logs
C. Metrics
D. Service Health

A

Correct Answer: B

For any security-related events, you should check
Logs –> SecurityEvent

73
Q

A company has a set of Azure subscriptions. They want to Transfer billing ownership of a subscription to another Azure Account owner. Which of the following can be used to transfer the billing ownership of the subscription?

A. Azure resource portal
B. Azure Subscription portal
C. Azure Account portal
D. Azure Management Center

A

Correct Answer: C

If you go to the Azure Account Portal, you can actually transfer the ownership of a subscription.

74
Q

Your company has a resource group that contains VMs, Virtual Networks and storage accounts. You have to delegate access to a user with the following privileges to the resource group.
• Ability to manage the VMs
• Not have access to the VMs themselves
• Not have access to virtual networks or storage accounts in the resource group
You need to assign the least privilege principle role for the user. Which of the following could be assigned to the user?

A. Owner
B. Contributor
C. Virtual Machine Contributor
D. Virtual Machine Administrator Login

A

Correct Answer: C

This is the right role for the requirements.
Description: Lets you manage VMs, but not access them, and not the virtual network or storage account they’re connected to.

75
Q

Your Company has defined a set of VMs as part of their subscription. The company currently has Azure P2 Premium licenses for their users. They are using Standard version of Azure Security Center.
They want to enable Just-In-Time access for the VMs. They want to ensure the solution minimizes costs. Which of the following Role-Based Access actions need to be allowed for a user that would request for Just-In-Time access to a virtual machine? Choose two answers from the options below.

A. Microsoft.Security/locations/jitNetworkAccessPolicies/write
B. Microsoft.Security/locations/jitNetworkAccessPolicies/initiate/action
C. Microsoft.Compute/virtualMachines/write
D. Microsoft.Compute/virtualMachines/read

A

Correct Answers: B and D

76
Q

A company currently has several subscriptions. They are all associated with the same Azure AD tenant. You have to ensure that all subscriptions have the same role assignments. How can this be done effectively?

A. By using Azure Security Center policies
B. By using Azure Blueprints
C. By using Azure AD Privileged Identity Management
D. By using Azure Policy

A

Correct Answer: B

If you want to deploy the same settings across subscriptions, you can create an Azure Blueprint. Then you can apply the Blueprint to other subscriptions.

77
Q

You company has a set of VMs set up in Azure. They want to ensure that IT administrators can request for access when they want to connect to the VMs. Which of the following could be used to fulfill this requirement?

A. Azure Identity Protection
B. Just-in-time access
C. Azure Policies
D. Azure Automation

A

Correct Answer: B

You can use just-in-time access so that IT admins can request access which would open the required ports for the VM.

78
Q

A company has the following requirement.
Users who log into the Azure Portal from untrusted locations need to authenticate using MFA.
Which of the following fulfills this requirement?

A. Azure Policies
B. Azure Security Center
C. Conditional Access Policies
D. Azure Privileged Identity Management

A

Correct Answer: C

You can use conditional access policies to ensure users who sign-in from untrusted locations are prompted to authenticate using MFA.

In the Grant section of a conditional access policy you can specify that users need to authenticate using MFA.

79
Q

Your company is planning to implement conditional access policies. You have to implement the policies based on the existing risk events available for Azure AD. Which of the following is the risk level associated with the following risk event?
“Users with leaked credentials”

A. Low
B. Medium
C. High
D. Critical

A

Correct Answer: C

This event is associated with the “High” risk level.

80
Q

Your company is planning to implement conditional access policies. You have to implement the policies based on the existing risk events available for Azure AD. Which of the following is the risk level associated with the following risk event?
“Impossible travels to atypical locations”

A. Low
B. Medium
C. High
D. Critical

A

Correct Answer: B

This event is associated with the “Medium” risk level.

81
Q

Your company is planning to implement conditional access policies. You have to implement the policies based on the existing risk events available for Azure AD. Which of the following is the risk level associated with the following risk event?
“Sign-in from unfamiliar locations”

A. Low
B. Medium
C. High
D. Critical

A

Correct Answer: B

This event is associated with the “Medium” risk level.

82
Q

A company currently has an on-premise forest defined via Active Directory. The forest contains a domain named whizlabs.com. They have set up an Azure subscription. They want to deploy Azure AD Connect to integrate their on-premise Active Directory domain with Azure AD. They have the following key requirements.
•Ensure that password policies are applied to user accounts that are synched to Azure AD.
•Ensure that login restrictions are applied to user accounts that are synched to Azure AD.
•Minimize the number of servers required for the entire implementation

Which of the following would you consider for the implementation?

A. Federated Identity using Active Directory Federation Services
B. Password Hash sync using AD Federation services
C. Password Hash sync with seamless single sign-on
D. Pass-through authentication with seamless single sign-on

A

Correct Answer: D

Options A and B are incorrect since you need additional servers for AD Federation Services. Failing to meet the requirement to reduce the number of servers required.

Option C is incorrect since this would not allow for the enforcement of AD rules.

83
Q

A company has an Azure tenant in place named whizlab.com. The company wants to deploy a service named “whizlabsrv” that would run on a virtual machine running Windows Server 2016. The service needs to authenticate to the tenant and access Microsoft Graph to read the directory data.

You need to delegate the minimum required permissions for the service.

Which of the following steps would you perform in Azure? Choose 3 answers from the options below.

A. Add a delegated permission.
B. Add an app registration.
C. Add an application permission.
D. Configure an Azure AD Application Proxy.
E. Grant permissions.
A

Correct Answer: B, C and E

First, you need to add an application registration. The Microsoft documentation mentions the following.

When it comes to types of permissions, the Microsoft documentation mentions that you have to use Application permissions for

And then, finally you grant the required permissions services.

84
Q

A company has an Azure SQL database created as part of their subscription. They want to implement the “Always Encrypted” feature to encrypt a column within a table of the database. You have to decide on the key provider that can be used to implement the “Always Encrypted” feature.

You decide to use an Azure Key Vault.

Would this satisfy the requirement?

A. Yes
B. No

A

Correct Answer: A

When you implement the “Always Encrypted” feature, you can use either a Windows certificate store or an Azure key vault to store the master key.

85
Q

A company currently has an on-premise data center and an Azure subscription. An Azure SQL database is in place that supports Azure AD authentication. The database developers need to authenticate to the database using Microsoft SQL Server Management Studio. They need to authenticate using their on-premise Active Directory account. They also want to ensure that the solution minimizes the authentication prompts. Which of the following authentication type should they use in Microsoft SQL Server Management Studio to connect?

A. SQL Login
B. Active Directory – Universal with MFA support
C. Active Directory – Integrated
D. Active Directory – Password

A

Correct Answer: C

When you need to use a federated solution with your on-premise Active Directory you should use the authentication type as Active Directory – Integrated in Microsoft SQL Server Management Studio

86
Q

Your company has an Azure subscription. An Azure storage account and an Azure Keyvault have been created as part of the subscription. The company wants to use an Azure automation runbook. It would be used to rotate the keys of the storage account and store them in the key vault. You need to implement the pre-requisites to ensure that the runbook can be implemented. Which of the following actions would you need to perform for this? Choose four answers from the options given below.

A. Run the Set-AzureRmKeyVaultAccess policy cmdlet.
B. Create an Azure Automation account.
C. Import the Powershell modules to the Azure Automation account.
D. Create a new user-assigned managed identity.
E. Create a connection resource in the Azure Automation Account.

A

Answer – A, B, C and E

The first step is to create an Azure Automation account.

The next step is to import the required Powershell modules. This is given as a note in the Microsoft documentation when you are looking at Key rotation using Azure Automation.

Next, you also need to have a connection in place. This is also mentioned as a step in the documentation

87
Q

Your company currently has around 100 virtual machines defined as part of their subscription. They also have an Azure Log Analytics workspace defined as part of the subscription. All of the virtual machines run Windows Server 2016. All of the virtual machines are enrolled in the Log Analytics workspace. You have to deploy a System update assessment solution to the Log Analytics workspace. You have to ensure that the System Update Assessment related logs are uploaded to the Log Analytics workspace from the virtual machines only. Which of the following steps do you need to implement for this requirement? Choose three answers from the options given below.

A. Create a new log analytics workspace.
B. Apply the scope configuration to the solution.
C. Create a new scope configuration.
D. Create a computer group.
E. Define a data source.
A

Answer – B, C and D

If you need target monitoring solutions to a set of virtual machines, you need to follow the below steps that are mentioned in the Microsoft documentation.

  1. Create a computer group
  2. Create a scope configuration
  3. Apply the scope configuration to a solution
88
Q

You need to comply with the below requirement.

The company wants to use Azure AD identities. It wants to secure the connection between the Azure Web app “whizlabapp2020” and the Azure SQL database “whizlabdb1.”

Which of the following steps would you implement for this requirement? Choose three answers from the options given below.

A. In the Azure SQL database, create contained users
B. In the Azure Portal, create new database users
C. Connect to the database using SQL Server Management studio
D. In Azure AD, create a system assigned managed identity
E. In Azure AD, create a user assigned managed identity

A

Answer – A, D and E

To use Azure Active Directory authentication with SQL, you can go ahead and create contained users in the Azure SQL database.

To secure access from the application to the database, you need to use a managed identity.

Option B is incorrect since you need to use the SQL Server management studio to create the users.

Option C is incorrect here. Web app needs to interact with Azure SQL Server and there is no manual interaction required. This option is good where manual login is required.

89
Q

Which of the following authentication technique would users in whizlabgrp2 use to log into the Azure SQL database when using SQL Server Management Studio? Choose two answers from the options given below

A. Active Directory Password
B. Active Directory Integrated
C. Active Directory Universal with MFA
D. Using Application token authentication

A

Answer – A and C

For every contained user relative to an Azure AD user, you can log into the database using either Active Directory Universal with MFA or Active Directory Password.

Option B is incorrect since this is used if you have already logged into your on-premise Active Directory domain.

Option D is incorrect since this is used to connect from an application.

90
Q

The company wants to deploy an Azure Kubernetes cluster. Azure AD users need to authenticate the cluster using their Azure AD credentials.

Which of the following steps would you implement for this solution? Choose four answers from the options created below.

A. Create a server application.
B. Create a client application.
C. Deploy the AKS cluster.
D. Create a service principal.
E. Create an RBAC binding.
F. Create a cluster role.
A

Answer – A, B, C and E

The steps for this are given in the Microsoft documentation.

We need to create the following steps-

  1. Create Azure AD server component.
  2. Create Azure AD client component.
  3. Deploy the cluster.
  4. Create RBAC binding.
  5. Access cluster with Azure AD.

AZ-500 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions