Summer Special Flat 65% Limited Time Discount offer - Ends in 0d 00h 00m 00s - Coupon code: suredis

Microsoft AZ-500 Microsoft Azure Security Technologies Exam Practice Test

Demo: 60 questions
Total 488 questions

Microsoft Azure Security Technologies Questions and Answers

Question 1

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You use Azure Security Center for the centralized policy management of three Azure subscriptions.

You use several policy definitions to manage the security of the subscriptions.

You need to deploy the policy definitions as a group to all three subscriptions.

Solution: You create an initiative and an assignment that is scoped to the Tenant Root Group management group.

Does this meet the goal?

Options:

A.

Yes

B.

No

Question 2

Lab Task

use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password. place your cursor in the Enter password box and click on the password below.

Azure Username: Userl -28681041@ExamUsers.com

Azure Password: GpOAe4@lDg

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support purposes only:

Lab Instance: 28681041

Task 8

You need to prevent HTTP connections to the rg1lod28681041n1 Azure Storage account.

Options:

Question 3

You have an Azure subscription that uses Microsoft Defender for Cloud.

Defender for Cloud has the security alerts shown in the following exhibit.

Options:

Question 4

You have an Azure subscription named Sub1 that contains the storage accounts shown in the following table

The storage3 storage account is encrypted by using customer-managed keys.

YOU need to enable Microsoft Defender for storage to meet the following requirements.

* The storage1 and storage2 account must be include in the defender for storage requirement.

* The storage3 account must be exclude from the Defender for Storage protections.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and them in the correct order.

Options:

Question 5

You have an Azure subscription.

You plan to create a workflow automation in Microsoft Defender for Cloud that will automatically remediate a security vulnerability.

What should you create first?

Options:

A.

an Azure function app

B.

an automation account

C.

a managed identity

D.

an alert rule

E.

an Azure logic app

Question 6

Your company plans to create separate subscriptions for each department. Each subscription will be

associated to the same Azure Active Directory (Azure AD) tenant.

You need to configure each subscription to have the same role assignments.

What should you use?

Options:

A.

Azure Security Center

B.

Azure Policy

C.

Azure AD Privileged Identity Management (PIM)

D.

Azure Blueprints

Question 7

You have an Azure subscription that contains the alerts shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Options:

Question 8

You have an Azure key vault named sk2311 configured as shown in the following exhibit.

Sk2311 contains the items shown in the following table.

In sk2311, the following events occur in sequence:

• Item1 is deleted.

• Item2 and Policy1 ate deleted.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 9

You have an Azure subscription named Subscription1.

You need to view which security settings are assigned to Subscription1 by default.

Which Azure policy or initiative definition should you review?

Options:

A.

the Audit diagnostic setting policy definition

B.

the Enable Monitoring in Azure Security Center initiative definition

C.

the Enable Azure Monitor for VMs initiative definition

D.

the Azure Monitor solution ‘Security and Audit’ must be deployed policy definition

Question 10

You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

You create a custom RBAC role in Subscription1 by using the following JSON file.

You assign Role1 to User1 on RG1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 11

You need to configure an access review. The review will be assigned to a new collection of reviews and reviewed by resource owners.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Options:

Question 12

You have an Azure SQL database named DB1 that contains a table named Table.

You need to configure DB1 to meet the following requirements;

• Sensitive data in Table1 must be identified automatically.

• Only the first character and last character of the sensitive data must be displayed in query results.

Which two features should you configure? To answer, select the features in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 13

You have an Azure subscription.

You create a new virtual network named VNet1.

You plan to deploy an Azure web app named App1 that will use VNet1 and will be reachable by using private IP addresses. The solution must support inbound and outbound network traffic.

What should you do?

Options:

A.

Create an Azure App Service Hybrid Connection.

B.

Configure regional virtual network integration.

C.

Create an App Service Environment

D.

Create an Azure application gateway.

Question 14

You have an Azure Active Directory (Azure AD) tenant that contains a user named User1.

You need to ensure that User1 can create and manage administrative units. The solution must use the principle of least privilege.

Which role should you assign to User1?

Options:

A.

Privileged role administrator

B.

Helpdesk administrator

C.

Global administrator

D.

Security administrator

Question 15

Your company has an Azure subscription named Subscription1. Subscription1 is associated with the Azure Active Directory tenant that includes the users shown in the following table.

The company is sold to a new owner.

The company needs to transfer ownership of Subscription1.

Which user can transfer the ownership and which tool should the user use? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 16

You have an Azure subscription.

You plan to use Microsoft Defender for Cloud to provide AI security posture management capabilities.

You need to recommend a Defender for Cloud plan that supports the deployment requirements. The solution must minimize costs.

What should you recommend?

Options:

A.

Microsoft Defender for App Service

B.

Microsoft Defender for APIs

C.

Foundational Cloud Security Posture Management (CSPM)

D.

Defender Cloud Security Posture Management (CSPM)

Question 17

You need to create an Azure key vault. The solution must ensure that any object deleted from the key vault be retained for 90 days.

How should you complete the command? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 18

You have an Azure subscription that contains the resources shown in the following table.

App1 uses Function 1, SQL1, and storage 1.

You need to secure the traffic between App1, Function1, SQL1. and storage1, by using private endpoints.

With which resources can App1 communicate by using a private endpoint?

Options:

A.

SQL1 only

B.

storage1 only

C.

Function1 only

D.

SQL1 and storage1 only

E.

storage1 and Function1 only

F.

storage1, SQL1, and Function1

Question 19

You have an Azure Active Din-dory (Azure AD) tenant named contoso.com that contains a user named User1.

You plan to publish several apps in the tenant.

You need to ensure that User1 can grant admin consent for the published apps.

Which two possible user roles can you assign to User! to achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Application developer

B.

Security administrator

C.

Application administrator

D.

User administrator

E.

Cloud application administrator

Question 20

You have an Azure subscription that uses Microsoft Defender for Cloud.

You have an Amazon Web Services (AWS) account.

You need to ensure that when you deploy a new AWS Elastic Compute Cloud (EC2) instance, the Microsoft Defender for Servers agent installs automatically.

What should you configure first?

Options:

A.

the log Analytics agent

B.

the Azure Monitor agent

C.

the native cloud connector

D.

the classic cloud connector

Question 21

You are evaluating the security of the network communication between the virtual machines in Sub2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 22

You have an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com.

You plan to implement an application that will consist of the resources shown in the following table.

Users will authenticate by using their Azure AD user account and access the Cosmos DB account by using resource tokens.

You need to identify which tasks will be implemented in CosmosDB1 and WebApp1.

Which task should you identify for each resource? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 23

Lab Task

Task 4

You need to ensure that when administrators deploy resources by using an Azure Resource Manager template, the deployment can access secrets in an Azure key vault named KV31330471.

Options:

Question 24

You have a network security group (NSG) bound to an Azure subnet.

You run Get-AzureRmNetworkSecurityRuleConfig and receive the output shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

Options:

Question 25

You have an Azure subscription that contains a SQL Server on Azure Virtual Machines instance named SQt1 and a Microsoft Sentinel workspace named Sentinel1.

You need to monitor security incidents on SQL1 by using Sentinel1.

What should you do first?

Options:

A.

On SQL1, enable SQL1 Server audit.

B.

On SQL1. install the Connected Machine agent for Azure Arc-enabled servers.

C.

From the Azure portal, create a Log Analytics workspace.

D.

From Sentinel1, enable VM insights.

Question 26

Lab Task

Task 7

You need to ensure that connections through an Azure Application Gateway named Homepage-AGW are inspected for malicious requests.

Options:

Question 27

You have three Azure subscriptions and a user named User1.

You need to provide User1 with the ability to manage and view costs for the resources across all three subscriptions. The solution must use the principle of least privilege.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

Options:

Question 28

Lab Task

Task 5

A user named Debbie has the Azure app installed on her mobile device.

You need to ensure that debbie@contoso.com is alerted when a resource lock is deleted.

Options:

Question 29

You have a management group named MG1 that contains an Azure subscription named Sub1.

Sub1 contains the resources shown in the following table.

You create an Azure Virtual Network Manager instance named AVNM1 that has the following configurations:

• Management scope: MG1

• Network groups:

o Name: Group1

■ Group members: VNet1

• Security admin configuration:

o Name: SAT

o Rule collections:

■ Name: SACollection1

■ Target network groups: Group1

■ Security admin rules:

■ Name: SARule1

■ Priority: 500

■ Action: Deny

■ Direction: Inbound

■ Source type: Any

■ Source port *

SA1 is deployed to all Azure regions.

You create a Virtual Network Manager instance named AVNM2 that has the following configurations:

• Management scope: Sub1

• Network groups:

o Name: Group2

■ Group members: VNet1

• Security admin configuration:

o Name: SA2

o Rule collections:

■ Name: SACollection2

■ Target network groups: Group2

■ Security admin rules:

■ Name: SARule2

■ Priority: 500

■ Action: Always allow

■ Direction: Inbound

■ Source type: Any

■ Source port: *

SA2 is deployed to all Azure regions.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE Each correct selection is worth one point.

Options:

Question 30

You have an Azure subscription named Sub1 that contains the Azure key vaults shown in the following table.

In Sub1, you create a virtual machine that has the following configurations:

• Name:VM1

• Size: DS2v2

• Resource group: RG1

• Region: West Europe

• Operating system: Windows Server 2016

You plan to enable Azure Disk Encryption on VM1.

In which key vaults can you store the encryption key for VM1?

Options:

A.

Vault1 or Vault3 only

B.

Vault1, Vault2, Vault3, or Vault4

C.

Vault1 only

D.

Vault1 or Vault2 only

Question 31

You need to implement the planned change for SQLdb1.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Create a compliance policy.

B.

Configure Microsoft Entra authentication for SQLServer1.

C.

Create a Conditional Access policy.

D.

Configure a user-assigned managed identity for SQLdb1.

E.

Configure Federated client identity for SQLdb1.

Question 32

You need to delegate a user to implement the planned change for Defender for Cloud.

The solution must follow the principle of least privilege.

Which user should you choose?

Options:

A.

Admin1

B.

Admin2

C.

Admin3

D.

Admin4

Question 33

You need to implement the planned change for WAF1.

The solution must minimize administrative effort

What should you do?

Options:

A.

Create an Azure policy.

B.

Modify the Azure-managed DRS.

C.

Add a custom rule.

D.

Modify the Bot Manager 1.1 rule set.

Question 34

You need to implement the planned change for VM1 to access storage1.

The solution must meet the technical requirements.

What should you do first?

Options:

A.

Configure a system-assigned managed identity on VM1.

B.

Configure federated identity credentials for ID1.

C.

Assign the Storage Blob Data Reader role to storage 1.

D.

Assign ID1 to VM1.

E.

Add a role assignment condition to storage1.

Question 35

You implement the planned changes for the key vaults.

To which key vaults can you restore AKV1 backups?

Options:

A.

AKV4only

B.

AKV3 and AKV4 only

C.

AKV4 and AKV5 only

D.

AKV2, AKV3, and AKV4 only

E.

AKV2, AKV3, AKV4, and AKV5

Question 36

You need to configure the AKS1 and ID1 managed identities to meet the technical requirements. The solution must follow the principle of least privilege.

Which role should you assign to each identity? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 37

You need to recommend an encryption solution for the planned ExpressRoute implementation. The solution must meet the technical requirements.

Which ExpressRoute circuit should you recommend for each type of encryption? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 38

: 2 HOTSPOT

Which virtual networks in Sub1 can User2 modify and delete in their current state? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 39

You need to meet the technical requirements for VNetwork1.

What should you do first?

Options:

A.

Create a new subnet on VNetwork1.

B.

Remove the NSGs from Subnet11 and Subnet13.

C.

Associate an NSG to Subnet12.

D.

Configure DDoS protection for VNetwork1.

Question 40

You are evaluating the effect of the application security groups on the network communication between the virtual machines in Sub2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 41

You assign User8 the Owner role for RG4, RG5, and RG6.

In which resource groups can User8 create virtual networks and NSGs? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 42

You are evaluating the security of the network communication between the virtual machines in Sub2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 43

You need to ensure that User2 can implement PIM.

What should you do first?

Options:

A.

Assign User2 the Global administrator role.

B.

Configure authentication methods for contoso.com.

C.

Configure the identity secure score for contoso.com.

D.

Enable multi-factor authentication (MFA) for User2.

Question 44

You are evaluating the security of VM1, VM2, and VM3 in Sub2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Options:

Question 45

What is the membership of Group1 and Group2? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 46

You need to ensure that the Azure AD application registration and consent configurations meet the identity and access requirements.

What should you use in the Azure portal? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 47

You need to deploy Microsoft Antimalware to meet the platform protection requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 48

You need to configure SQLDB1 to meet the data and application requirements.

Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Options:

Question 49

You need to ensure that you can meet the security operations requirements.

What should you do first?

Options:

A.

Turn on Auto Provisioning in Security Center.

B.

Integrate Security Center and Microsoft Cloud App Security.

C.

Upgrade the pricing tier of Security Center to Standard.

D.

Modify the Security Center workspace configuration.

Question 50

You need to meet the identity and access requirements for Group1.

What should you do?

Options:

A.

Add a membership rule to Group1.

B.

Delete Group1. Create a new group named Group1 that has a membership type of Office 365. Add users and devices to the group.

C.

Modify the membership rule of Group1.

D.

Change the membership type of Group1 to Assigned. Create two groups that have dynamic memberships. Add the new groups to Group1.

Question 51

You need to ensure that users can access VM0. The solution must meet the platform protection requirements.

What should you do?

Options:

A.

Move VM0 to Subnet1.

B.

On Firewall, configure a network traffic filtering rule.

C.

Assign RT1 to AzureFirewallSubnet.

D.

On Firewall, configure a DNAT rule.

Question 52

You need to create Role1 to meet the platform protection requirements.

How should you complete the role definition of Role1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Options:

Question 53

You need to deploy AKS1 to meet the platform protection requirements.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

Options:

Question 54

You need to configure WebApp1 to meet the data and application requirements.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options:

A.

Upload a public certificate.

B.

Turn on the HTTPS Only protocol setting.

C.

Set the Minimum TLS Version protocol setting to 1.2.

D.

Change the pricing tier of the App Service plan.

E.

Turn on the Incoming client certificates protocol setting.

Question 55

From Azure Security Center, you need to deploy SecPol1.

What should you do first?

Options:

A.

Enable Azure Defender.

B.

Create an Azure Management group.

C.

Create an initiative.

D.

Configure continuous export.

Question 56

You need to configure support for Azure Sentinel notebooks to meet the technical requirements.

What is the minimum number of Azure container registries and Azure Machine Learning workspaces required?

Options:

Question 57

You plan to implement JIT VM access. Which virtual machines will be supported?

Options:

A.

VM1 and VM3 only

B.

VM1. VM2. VM3, and VM4

C.

VM2, VM3, and VM4 only

D.

VM1 only

Question 58

You plan to configure Azure Disk Encryption for VM4. Which key vault can you use to store the encryption key?

Options:

A.

KeyVault1

B.

KeyVault3

C.

KeyVault2

Question 59

You implement the planned changes for ASG1 and ASG2.

In which NSGs can you use ASG1. and the network interfaces of which virtual machines can you assign to ASG2?

Options:

Question 60

You need to delegate the creation of RG2 and the management of permissions for RG1. Which users can perform each task? To answer select the appropriate options in the answer area. NOTE: Each correct selection is worth one point

Options:

Demo: 60 questions
Total 488 questions