AZ 500 Practice

Your company has an Azure AD tenant and an Azure subscription named Staging. The user identities in the tenant are synced to Azure Active Directory via the use of Azure AD Connect. The company has added a new subscription. Which of the following needs to be done to ensure that the on-premises user accounts can be assigned roles in the new subscription?

• Ensure that pass-through authentication is configured in Azure AD Connect

• Ensure that password hash synchronization is configured in Azure AD Connect

Answer explanation

You need to ensure that the Azure AD tenant is linked to the new subscription. Then user identities defined in the Azure AD tenant can be assigned roles to resources in the new subscription.

Your team has deployed the Azure Storage Account shown in the image.

With that in mind, which of the following can the team use for authorization when it comes to the blob service in the storage account?

• Shared key only

• Shared Access Signature only

• Shared Key and Active Directory

• Shared Key, Shared Access Signature and Azure AD

• Shared Key and Shared Access Signature only

Answer explanation

All methods are supported when it comes to the blob service.

For more information on the authorization methods, one can visit the below URL:
https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage

Your company has a set of Azure virtual machines. They also have servers in their on-premises servers based on Windows Server 2019. They want to use Microsoft Defender for Cloud integrated vulnerability scanner for the on-premises servers.

Which of the following needs to be done for this requirement?

• Install the Log Analytics agent on servers

• Install the Azure Arc enabled servers Connected Machine agent on the servers

• Install the dependency on the servers

Answer explanation

For the on-premises servers, you have to ensure that they are arc-enabled servers.

For more information on Microsoft Defender for Cloud integrated vulnerability scanner, one can visit the below URL

https://docs.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm

Your team has deployed the Azure Storage Account shown in the image.

Which of the following can the team use for authorization when it comes to the file share service in the storage account via the REST API?

• Shared key only

• Shared Access Signature only

• Shared Key and Active Directory

• Shared Key, Shared Access Signature and Azure AD

• Shared Key and Shared Access Signature only

Answer explanation

Only the Shared Key and Shared Access Signature are supported with the Azure File share service.

For more information on the authorization methods, one can visit the below URL

https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage

Your Company's Azure subscription includes a virtual network that has a single subnet configured.
You have created a service endpoint for the subnet, which includes an Azure virtual machine that has Ubuntu Server 18.04 installed.
You are preparing to deploy Docker containers to the virtual machine. You need to make sure that the containers can access Azure Storage resources and Azure
SQL databases via the service endpoint.
You need to perform a task on the virtual machine prior to deploying containers.
Solution: You create an application security group.
Does the solution meet the goal?

• Yes

• No

Your company has a set of Windows Server 2019 Azure virtual machines created as part of an Azure subscription. Update Management needs to be enabled for the Azure virtual machines. You also have to ensure that any new machines are also added to the deployment schedule for the updates. Which of the following would you implement for this requirement?

• Dynamic Groups in update management

• Azure AD Dynamic Groups with Dynamic user assignment

• Azure AD Dynamic Groups with Dynamic device assignment

Answer explanation

You can make use of Dynamic Groups in Update management to ensure new machines are update with Update management.

For more information on Dynamic groups in Update Management, one can visit the below URL

https://docs.microsoft.com/en-us/azure/automation/update-management/configure-groups

Your company currently has the groups defined in the screenshot as part of their Azure AD tenant.

GroupC is based on the membership type of Dynamic Device.

Can you add GroupC as a member to GroupA?

• NO

• YES

Your company has an Azure SQL database deployed as part of their Azure subscription, shown in the image attached.

The company wants to protect the database against SQL Injection attacks. Which of the following can be configured for this requirement?

• Always Encrypted feature

• Transparent Data Encryption

• Microsoft Defender for SQL

• Server-Level Auditing

Answer explanation

You can make use of Advanced Threat detection that comes as part of Microsoft Defender for SQL

For more information on Advanced Threat Detection, one can visit the below URL

https://docs.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview

Your company currently has the groups defined in the screenshot as part of their Azure AD tenant.

GroupC is based on the membership type of Dynamic Device.

Can you add GroupC as a member to GroupB?

• NO

• YES

Answer explanation

No, this can't be added to a Microsoft 365 group.

Your company has an Azure Container Registry.
You have been tasked with assigning a user a role that allows for the uploading of images to the Azure Container Registry. The role assigned should not require more privileges than necessary.
Which of the following is the role you should assign?

• Owner

• Contributor

• AcrPush

• AcrPull

Answer explanation

https://docs.microsoft.com/bs-latn-ba/azure/container-registry/container-registry-roles