AZ-500 practice questions
You have an Azure Stack Hub integrated system that uses an Azure Active Directory (Azure AD) identity provider. You have a computer that runs Windows 10. You use the computer to manage the integrated system. You create a custom marketplace item on the computer. You need to publish the item to Azure Stack Hub Marketplace. You create a storage account. What should you create next?
A. a container that has a public access level of private
B. a file share that has the performance tier set to Hot
C. a container that has a public access level of blob
D. a file share that has the performance tier set to Transaction optimized
Discussion forum
Question
You have an Azure Stack Hub integrated system. You plan to install the Event Hubs resource provider. You purchase a public wildcard certificate that has a subject name of *.eventhub.chicago.contoso.com. The path to the certificate is C:\Certificates\ssl.pfx. You need to validate whether the certificate meets the requirements of Azure Event Hubs. Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point. A. Install the AzureStack.Identity PowerShell module
B. Rename the certificate file as Eventhub.pfx
C. Run the Invoke-AzsHubEventHubsCertificateValidation cmdlet
D. Run the Invoke-AzsHubDeploymentCertificateValidation cmdlet
E. Install the Microsoft.AzureStack.ReadinessChecker Powershell module
F. Convert the Ssl.pfx file to a CER file
Discussion forum
Question
You have 15 Azure virtual machines in a resource group named RG1. All the virtual machines run identical applications. You need to prevent unauthorized applications and malware from running on the virtual machines. What should you do?
A. Apply an Azure policy to RG1.
B. From Azure Security Center, configure adaptive application controls.
C. Configure Azure Active Directory (Azure AD) Identity Protection.
D. Apply a resource lock to RG1.
Discussion forum
Question
You are configuring and securing a network environment. You deploy an Azure virtual machine named VM1 that is configured to analyze network traffic. You need to ensure that all network traffic is routed through VM1. What should you configure?
A. a system route
B. a network security group (NSG)
C. a user-defined route
Discussion forum
Question
From Azure Security Center, you create a custom alert rule. You need to configure which users will receive an email message when the alert is triggered. What should you do?
A. From Azure Monitor, create an action group.
B. From Security Center, modify the Security policy settings of the Azure subscription.
C. From Azure Active Directory (Azure AD), modify the members of the Security Reader role group.
D. From Security Center, modify the alert rule.
Discussion forum
Question
You have an Azure subscription that contains an Azure Container Registry named Registry1. Microsoft Defender for Cloud is enabled in the subscription. You upload several container images to Registry1. You discover that vulnerability security scans were not performed. You need to ensure that the container images are scanned for vulnerabilities when they are uploaded to Registry1. What should you do?
A. From the Azure portal, modify the Pricing tier settings.
B. From Azure CLI, lock the container images.
C. Upload the container images by using AzCopy.
D. Push the container images to Registry1 by using Docker.
Discussion forum
Question
You have an Azure Active Directory (Azure AD) tenant named Contoso.com and an Azure Kubernetes Service (AKS) cluster AKS1. You discover that AKS1 cannot be accessed by using accounts from Contoso.com. You need to ensure AKS1 can be accessed by using accounts from Contoso.com. The solution must minimize administrative effort. What should you do first?
A. From Azure, recreate AKS1.
B. From AKS1, upgrade the version of Kubernetes.
C. From Azure AD, implement Azure AD Premium P2
D. From Azure AD, configure the User settings.
Discussion forum
Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016. You need to deploy Microsoft Antimalware to the virtual machines. Solution: You connect to each virtual machine and add a Windows feature. Does this meet the goal?
A. Yes
B. No
Discussion forum
Question
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016. You need to deploy Microsoft Antimalware to the virtual machines. Solution: You add an extension to each virtual machine. Does this meet the goal?
A. Yes
B. No
Discussion forum
Question
You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?
A. device compliance policies in Microsoft Intune
B. Azure Automation State Configuration
C. application security groups
D. Azure Advisor
Discussion forum
Question
You have an Azure virtual machine named VM1. From Microsoft Defender for Cloud, you get the following high-severity recommendation: `Install endpoint protection solutions on virtual machine`. You need to resolve the issue causing the high-severity recommendation. What should you do?
A. Add the Microsoft Antimalware extension to VM1.
B. Install Microsoft System Center Security Management Pack for Endpoint Protection on VM1.
C. Add the Network Watcher Agent for Windows extension to VM1.
D. Onboard VM1 to Microsoft Defender for Endpoint.
Discussion forum
Question
You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?
A. device configuration policies in Microsoft Intune
B. an Azure Desired State Configuration (DSC) virtual machine extension
C. security policies in Azure Security Center
D. Azure Logic Apps
Discussion forum
Question
You are configuring an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use the auto-generated service principal to authenticate to the Azure Container Registry. What should you create?
A. an Azure Active Directory (Azure AD) group
B. an Azure Active Directory (Azure AD) role assignment
C. an Azure Active Directory (Azure AD) user
D. a secret in Azure Key Vault
Discussion forum
Question
You have Azure Resource Manager templates that you use to deploy Azure virtual machines. You need to disable unused Windows features automatically as instances of the virtual machines are provisioned. What should you use?
A. device configuration policies in Microsoft Intune
B. an Azure Desired State Configuration (DSC) virtual machine extension
C. application security groups
D. device compliance policies in Microsoft Intune
Discussion forum
Question
You have an Azure subscription named Sub1. Sub1 contains a virtual network named VNet1 that contains one subnet named Subnet1. Subnet1 contains an Azure virtual machine named VM1 that runs Ubuntu Server 18.04. You create a service endpoint for Microsoft.Storage in Subnet1. You need to ensure that when you deploy Docker containers to VM1, the containers can access Azure Storage resources by using the service endpoint. What should you do on VM1 before you deploy the container?
A. Create an application security group and a network security group (NSG).
B. Edit the docker-compose.yml file.
C. Install the container network interface (CNI) plug-in.
Discussion forum
Question