AZ-500 Assessment - 2

What type of disk encryption is used for Linux disks?

†

†

• BitLocker

• DM-Crypt

• FileVault

Answer explanation

Explanation

DM-Crypt . Azure Disk Encryption is a capability that lets you encrypt your Windows and Linux IaaS VM

disks. Azure Disk Encryption uses the industry standard BitLocker feature of Windows and the `DM-Crypt`

feature of Linux to provide OS and data disk encryption to help protect and safeguard your data.

A company, with both Azure and on-premises virtual machines, needs to ensure your virtual machines are

kept up to date with security patches. Update Management is the Azure tool they will use, hopefully at

limited cost. Will Update management monitor their virtual machines for updates?

†

†.

• The Microsoft Monitoring Agent must be installed for both Windows and Linux virtual machines

  on-premises.

  †

• † Both the Update Management feature and the log data storage are free for the customer.

• Update Management only pertains to cloud deployed virtual machines

Answer explanation

Explanation

Update Management only pertains to cloud deployed virtual machines. Update Management pertains to

virtual machines in on-premises environments, and in other cloud environments.

Which of the following recommendations from Security Center is a medium-severity recommendation for

virtual machines and servers?

†

†

• Disk encryption should be applied on virtual machines.

• Install endpoint protection solution on virtual machines.

• System updates should be installed on your machines.

Answer explanation

Explanation

Install endpoint protection solution on virtual machines is a medium-severity recommendation.

Which of the following items should be stored in Azure Key Vault?

• Secret

  †

  †

• Links to external certificate

  †

• † Identity management

A select group of users must be able to create and delete keys in the key vault. When authenticating to

the data plane using Azure AD, what security tool should be used the authorize access at a role level to

these users?

†

†

• Key vault access policies

• Role-based Access Control

  †

• Azure AD authentication

Answer explanation

Explanation

Role-based Access Control. To create and delete key vaults the data plane you should grant access with

RBAC. For example, Key Vault Contributor. Using Access Policies would not give you role level control, and

does not follow least privilege rules.

Which of these statements best describes Azure Key Vault's authentication and authorization process?

†

†

• Applications authenticate to a vault with the username and password of the lead developer and have

  full access to all secrets in the vault.

• Applications and users authenticate to a vault with their Azure Active Directory identities and are

  authorized to perform actions on all secrets in the vault.

  †

• † Applications and users authenticate to a vault with a Microsoft account and are authorized to access

  specific secrets.

Answer explanation

Explanation

Authentication to Key Vault uses Azure Active Directory identities. Access policies are used to provide

authorization for actions that apply to every secret in the vault.

What type of Managed Service Identities can be created?

†

• † Application-assigned and VM-assigned

  †

• † Database-assigned and unsigned

• System-assigned and User-assigned

Answer explanation

Explanation

System-assigned, user assigned. There are two types of managed identities: A system-assigned managed

identity is enabled directly on an Azure service instance. When the identity is enabled, Azure creates an

identity for the instance in the Azure AD tenant that's trusted by the subscription of the instance. Creating

an app with a user-assigned identity requires that an organization create the identity and then add its

resource identifier to the app config.

An App Service application stores page graphics in an Azure storage account. The app needs to authenti-

cate programmatically to the storage account, what should be configured?

†

†

• Create an Azure AD system user

• Create a managed identity

  †

  †

• Create a RBAC role assignment

Answer explanation

Explanation

Create a managed identity. A managed identity is an Azure AD security principal that represents the

resource (app). Managed identities can be user or system managed.

There is a need to provide a contingent staff employee temporary read-only access to the contents of an

Azure storage account container named “Media”. It is important to grant access while adhering to the

security principle of least-privilege. What should be configured?

†

†

• Set the public access level to container.

• Generate a shared access signature (SAS) token for the container.

  †

• † Share the container entity tag (Etag) with the contingent staff member.

Answer explanation

Explanation

Generate a SAS token for the container. The SAS can provide read-only access.

When configuring an Azure File share for the business group, which of the following is true?

• Azure Files can authenticate to Azure Active Directory Domain Services.

  †

• † Azure Files cannot authenticate to on-premises Active Directory Domain Services.

  †

• † Azure Files can use RBAC for share-level or directory/file permissions.