This page was exported from Free Exam Dumps Collection [ http://free.examcollectionpass.com ] Export date:Tue Apr 15 22:17:02 2025 / +0000 GMT ___________________________________________________ Title: Latest AZ-500 Pass Guaranteed Exam Dumps Certification Sample Questions [Q133-Q156] --------------------------------------------------- Latest AZ-500 Pass Guaranteed Exam Dumps Certification Sample Questions New AZ-500 Test Materials & Valid AZ-500 Test Engine QUESTION 133You need to deploy AKS1 to meet the platform protection requirements.Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select. ExplanationScenario: Azure AD users must be to authenticate to AKS1 by using their Azure AD credentials.Litewire plans to deploy AKS1, which is a managed AKS (Azure Kubernetes Services) cluster.Step 1: Create a server applicationTo provide Azure AD authentication for an AKS cluster, two Azure AD applications are created. The first application is a server component that provides user authentication.Step 2: Create a client applicationThe second application is a client component that’s used when you’re prompted by the CLI for authentication.This client application uses the server application for the actual authentication of the credentials provided by the client.Step 3: Deploy an AKS cluster.Use the az group create command to create a resource group for the AKS cluster.Use the az aks create command to deploy the AKS cluster.Step 4: Create an RBAC binding.Before you use an Azure Active Directory account with an AKS cluster, you must create role-binding or cluster role-binding. Roles define the permissions to grant, and bindings apply them to desired users. These assignments can be applied to a given namespace, or across the entire cluster.Reference:https://docs.microsoft.com/en-us/azure/aks/azure-ad-integrationQUESTION 134You have an Azure key vault named KeyVault1 that contains the items shown in the following table.In KeyVault, the following events occur in sequence:Item1 is deletedAdministrator enables soft deleteItem2 and Policy1 are deleted.For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point. QUESTION 135You assign User8 the Owner role for RG4, RG5, and RG6.In which resource groups can User8 create virtual networks and NSGs? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point. References:https://docs.microsoft.com/en-us/azure/governance/policy/overviewQUESTION 136You need to create Role1 to meet the platform protection requirements.How should you complete the role definition of Role1? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point. QUESTION 137SIMULATIONUse the following login credentials as needed:To enter your username, place your cursor in the Sign in box and click on the username below.To enter your password, place your cursor in the Enter password box and click on the password below.Azure Username: User1-10598168@ExamUsers.comAzure Password: Ag1Bh9!#BdThe following information is for technical support purposes only:Lab Instance: 10598168You need to add the network interface of a virtual machine named VM1 to an application security group named ASG1.To complete this task, sign in to the Azure portal.  *In the Search resources, services, and docs box at the top of the portal, begin typing the name of a virtual machine, VM1 that has a network interface that you want to add to, or remove from, an application security group.* When the name of your VM appears in the search results, select it.* Under SETTINGS, select Networking.  *In the Search resources, services, and docs box at the top of the portal, begin typing the name of a virtual machine, VM1 that has a network interface that you want to add to, or remove from, an application security group.* When the name of your VM appears in the search results, select it.* Under SETTINGS, select Networking. Select Configure the application security groups, select the application security groups that you want to add the network interface to, or unselect the application security groups that you want to remove the network interface from, and then select Save. Reference:https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interfaceQUESTION 138You have an Azure subscription that contains the following resources:* A network virtual appliance (NVA) that runs non-Microsoft firewall software and routes all outbound traffic from the virtual machines to the internet* An Azure function that contains a script to manage the firewall rules of the NVA* Azure Security Center standard tier enabled for all virtual machines* An Azure Sentinel workspace* 30 virtual machinesYou need to ensure that when a high-priority alert is generated in Security Center for a virtual machine, an incident is created in Azure Sentinel and then a script is initiated to configure a firewall rule for the NVA.How should you configure Azure Sentinel to meet the requirements? To answer, drag the appropriate components to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point. ExplanationReference:https://docs.microsoft.com/en-us/azure/sentinel/create-incidents-from-alertshttps://docs.microsoft.com/en-us/azure/sentinel/connect-azure-security-centerQUESTION 139Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You use Azure Security Center for the centralized policy management of three Azure subscriptions.You use several policy definitions to manage the security of the subscriptions.You need to deploy the policy definitions as a group to all three subscriptions.Solution: You create an initiative and an assignment that is scoped to a management group.Does this meet the goal?  Yes  No Reference:https://docs.microsoft.com/en-us/azure/governance/policy/overviewQUESTION 140You have an Azure subscription named Subcription1 that contains an Azure Active Directory (Azure AD) tenant named contosos.com and a resource group named RG1.You create a custom role named Role1 for contoso.com.You need to identify where you can use Role1 for permission delegation.What should you identify?  contoso.com only  contoso.com and RGT only  contoso.com and Subscription1 only  contoso.com, RG1, and Subcription1 Explanationhttps://docs.microsoft.com/en-us/azure/role-based-access-control/custom-rolesQUESTION 141You have an Azure Active Directory (Azure AD) tenant that contains the users shown in the following table.You create and enforce an Azure AD Identity Protection sign-in risk policy that has the following settings:* Assignments: Include Group1, exclude Group2* Conditions: Sign-in risk level: Medium and above* Access Allow access, Require multi-factor authenticationYou need to identify what occurs when the users sign in to Azure AD.What should you identify for each user? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point. ExplanationReferences:http://www.rebeladmin.com/2018/09/step-step-guide-configure-risk-based-azure-conditional-access-policies/https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policieshttps://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risksQUESTION 142You plan to use Azure Resource Manager templates to perform multiple deployments of identically configured Azure virtual machines. The password for the administrator account of each deployment is stored as a secret in different Azure key vaults.You need to identify a method to dynamically construct a resource ID that will designate the key vault containing the appropriate secret during each deployment. The name of the key vault and the name of the secret will be provided as inline parameters.What should you use to construct the resource ID?  a key vault access policy  a linked template  a parameters file  an automation account https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter?tabs=azure-cli#reference-secrets-with-dynamic-idQUESTION 143Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Subscription named Sub1.You have an Azure Storage account named Sa1 in a resource group named RG1.Users and applications access the blob service and the file service in Sa1 by using several shared access signatures (SASs) and stored access policies.You discover that unauthorized users accessed both the file service and the blob service.You need to revoke all access to Sa1.Solution: You create a new stored access policy.Does this meet the goal?  Yes  No QUESTION 144You need to configure WebApp1 to meet the data and application requirements.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.  Upload a public certificate.  Turn on the HTTPS Only protocol setting.  Set the Minimum TLS Version protocol setting to 1.2.  Change the pricing tier of the App Service plan.  Turn on the Incoming client certificates protocol setting. Section: [none]Explanation:A: To configure Certificates for use in Azure Websites Applications you need to upload a public Certificate.C: Over time, multiple versions of TLS have been released to mitigate different vulnerabilities. TLS 1.2 is the most current version available for apps running on Azure App Service.Incorrect Answers:B: We need support the http url as well.Note:References:https://docs.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-authhttps://azure.microsoft.com/en-us/updates/app-service-and-functions-hosted-apps-can-now-update-tls- versions/ Question Set 2QUESTION 145You have an Azure subscription.You plan to map an online infrastructure and perform vulnerability scanning for the following:* ASNs* Hostnames* IP addresses* SSL certificatesWhat should you use?  Microsoft Defender for Cloud  Microsoft Defender for Identity  Microsoft Defender for Endpoint  Microsoft Defender External Attack Surface Management (Defender EASM) QUESTION 146You have an Azure subscription that contains the virtual machines shown in the following table.From Azure Security Center, you turn on Auto Provisioning.You deploy the virtual machines shown in the following table.On which virtual machines is the Microsoft Monitoring agent installed?  VM3 only  VM1 and VM3 only  VM3 and VM4 only  VM1, VM2, VM3, and VM4 ExplanationWhen automatic provisioning is enabled, Security Center provisions the Microsoft Monitoring Agent on all supported Azure VMs and any new ones that are created.Supported Operating systems include: Ubuntu 14.04 LTS (x86/x64), 16.04 LTS (x86/x64), and 18.04 LTS (x64) and Windows Server 2008 R2, 2012, 2012 R2, 2016, version 1709 and 1803.References:https://docs.microsoft.com/en-us/azure/security-center/security-center-faqQUESTION 147Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Subscription named Sub1. Sub1 contains an Azure virtual machine named VM1 that runs Windows Server 2016.You need to encrypt VM1 disks by using Azure Disk Encryption.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Reference:https://docs.microsoft.com/en-us/azure/virtual-machines/windows/encrypt-disksQUESTION 148You have an Azure subscription that contains an Azure SQL database named SQLDB1. SQLDB1 contains the columns shown in the following table.For the Email and Birthday columns, you implement dynamic data masking by using the default masking function.Which value will the users see in each column? To answer, drag the appropriate values to the correct columns. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point. QUESTION 149SIMULATIONUse the following login credentials as needed:To enter your username, place your cursor in the Sign in box and click on the username below.To enter your password, place your cursor in the Enter password box and click on the password below.Azure Username: User1-10598168@ExamUsers.comAzure Password: Ag1Bh9!#BdThe following information is for technical support purposes only:Lab Instance: 10598168You need to prevent HTTP connections to the rg1lod10598168n1 Azure Storage account.To complete this task, sign in to the Azure portal.  The “Secure transfer required” feature is now supported in Azure Storage account. This feature enhances the security of your storage account by enforcing all requests to your account through a secure connection. This feature is disabled by default.1. In Azure Portal select you Azure Storage account rg1lod10598168n1.2. Select Configuration, and Secure Transfer required.  The “Secure transfer required” feature is now supported in Azure Storage account. This feature enhances the security of your storage account by enforcing all requests to your account through a secure connection. This feature is disabled by default.1. In Azure Portal select you Azure Storage account rg1lod10598168n1.2. Select Configuration, and Secure Transfer required. Reference:https://techcommunity.microsoft.com/t5/Azure/quot-Secure-transfer-required-quot-is-available-in-Azure-Storage/m-p/82475QUESTION 150You have an Azure subscription that contains an Azure web app named Appl.You plan to configure a Conditional Access policy for Appl. The solution must meet the following requirements:* Only allow access to App1 from Windows devices.* Only allow devices that are marked as compliant to access Appl.Which Conditional Access policy settings should you configure? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point. QUESTION 151You have a hybrid configuration of Azure Active Directory (Azure AD).All users have computers that run Windows 10 and are hybrid Azure AD joined.You have an Azure SQL database that is configured to support Azure AD authentication.Database developers must connect to the SQL database by using Microsoft SQL Server Management Studio (SSMS) and authenticate by using their on-premises Active Directory account.You need to tell the developers which authentication method to use to connect to the SQL database from SSMS. The solution must minimize authentication prompts.Which authentication method should you instruct the developers to use?  SQL Login  Active Directory – Universal with MFA support  Active Directory – Integrated  Active Directory – Password ExplanationAzure AD can be the initial Azure AD managed domain. Azure AD can also be an on-premises Active Directory Domain Services that is federated with the Azure AD.Using an Azure AD identity to connect using SSMS or SSDTThe following procedures show you how to connect to a SQL database with an Azure AD identity using SQL Server Management Studio or SQL Server Database Tools.Active Directory integrated authenticationUse this method if you are logged in to Windows using your Azure Active Directory credentials from a federated domain.1. Start Management Studio or Data Tools and in the Connect to Server (or Connect to Database Engine) dialog box, in the Authentication box, select Active Directory – Integrated. No password is needed or can be entered because your existing credentials will be presented for the connection.2. Select the Options button, and on the Connection Properties page, in the Connect to database box, type the name of the user database you want to connect to. (The AD domain name or tenant ID” option is only supported for Universal with MFA connection options, otherwise it is greyed out.) References:https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/sql-database/sql-database-aad-authenticationQUESTION 152You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table.You schedule two update deployments named Update1 and Update2. Update1 updates VM3. Update2 updates VM6.Which additional virtual machines can be updated by using Update1 and Update2? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point. ExplanationUpdate1: VM1 and VM2 onlyVM3: Windows Server 2016 West US RG2Update2: VM4 and VM5 onlyVM6: CentOS 7.5 East US RG1For Linux, the machine must have access to an update repository. The update repository can be private or public.References:https://docs.microsoft.com/en-us/azure/automation/automation-update-managementQUESTION 153You have the hierarchy of Azure resources shown in the following exhibit.You create the Azure Blueprints definitions shown in the following table.To which objects can you assign Blueprint1 and Blueprint2? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point. Blueprints can only be assigned to subscriptions.QUESTION 154Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Subscription named Sub1. Sub1 contains an Azure virtual machine named VM1 that runs Windows Server 2016.You need to encrypt VM1 disks by using Azure Disk Encryption.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. ExplanationReferences:https://docs.microsoft.com/en-us/azure/virtual-machines/windows/encrypt-disksQUESTION 155You need to perform the planned changes for OU2 and User1.Which tools should you use? To answer, drag the appropriate tools to the correct resources. Each tool may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point. QUESTION 156You have an Azure Active Directory (Azure AD) tenant named Contoso.com and an Azure Service (AKS) cluster AKS1.You discover that AKS1 cannot be accessed by using accounts from Contoso.comYou need to ensure AKS1 can be accessed by using accounts from Contoso.com The solution must minimize administrative effort.What should you do first?  From Azure recreate AKS1,  From AKS1, upgrade the version of Kubermetes.  From Azure AD, implement Azure AD Premium P2.  From Azure AD, configure the User settings Reference:https://docs.microsoft.com/en-us/azure/aks/azure-ad-integration-cli Loading … Microsoft AZ-500 exam is an important certification for security professionals who work with Azure. It covers a wide range of topics related to Azure security and requires a good understanding of Azure services and experience with security technologies and practices. Earning the certification demonstrates your expertise in Azure security and can help you advance your career and increase your earning potential.   AZ-500 Sample with Accurate & Updated Questions: https://www.examcollectionpass.com/Microsoft/AZ-500-practice-exam-dumps.html --------------------------------------------------- Images: https://free.examcollectionpass.com/wp-content/plugins/watu/loading.gif https://free.examcollectionpass.com/wp-content/plugins/watu/loading.gif --------------------------------------------------- --------------------------------------------------- Post date: 2023-11-26 09:44:27 Post date GMT: 2023-11-26 09:44:27 Post modified date: 2023-11-26 09:44:27 Post modified date GMT: 2023-11-26 09:44:27