AZ-500: Microsoft Azure Security TechnologiesDemo

You have an Azure subscription containing the virtual networks shown in the following table.

The subscription includes the virtual machines shown in the following table.

All virtual machines have private IP addresses only.

You deploy Azure Bastion to VNet1 as shown in the following exhibit.

For each statement below, select Yes if it is true. Otherwise, select No.

You have a Microsoft Entra tenant named contoso.com.

You plan to collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com.

Fabrikam.com uses these identity providers:

• Google Cloud Platform (GCP)
• Microsoft accounts
• Microsoft Entra ID

You need to configure the Cross-tenant access settings for B2B collaboration.

Which identity providers support cross-tenant access?

After creating a new Azure subscription, you are tasked with ensuring that custom alert rules can be created in Azure Security Center.

You have created an Azure Storage account.

Which action should you take?

Your company uses an Azure Container Registry.

You must assign a user a role that permits uploading images to the Azure Container Registry. The assigned role must provide no more privileges than necessary.

Which of the following roles should you assign?

HOTSPOT -

You have an Azure subscription containing the alerts shown in the following exhibit.

Use the drop-down menus to choose the answer that completes each statement based on the information in the graphic.

HOTSPOT -

You have an Azure subscription named Sub1.

You create a virtual network containing one subnet. You provision the virtual machines on that subnet as shown in the following table.

No network security groups (NSGs) have been provisioned yet. You need to implement network security that meets these requirements:

• Allow traffic to VM4 only from VM3.
• Allow Internet traffic only to VM1 and VM2.
• Minimize the number of NSGs and network security rules.

How many NSGs and network security rules should you create?

You have an Azure subscription containing an Azure SQL database named SQLDB1. SQLDB1 includes the columns shown in the following table.

For the Email and Birthday columns, dynamic data masking is implemented by using the default masking function. Which value will users see in each column?

Each value may be used once, more than once, or not at all.

You have an Azure environment.

You need to identify Azure configurations and workloads that do not comply with ISO 27001:2013 standards.

What should you use?

You have an Azure subscription containing an Azure web app named App1 and a virtual machine named VM1. VM1 runs Microsoft SQL Server and connects to a virtual network named VNet1. App1, VM1, and VNet1 are located in the US Central Azure region.

You need to make sure that App1 can connect to VM1. The solution must minimize costs.

What should you include in the solution?

You have an Azure subscription.

You plan to deploy a new Conditional Access policy named CAPolicy1.

You need to use the What If tool to evaluate how CAPolicy1 will affect users. The solution must minimize CAPolicy1's impact on users.

What should you set the Enable policy setting for CAPolicy1 to?

You have an Azure subscription.

You create an Azure web app named Contoso1812 that uses an S1 App Service plan.

You plan to:

• Create a CNAME DNS record for www.contoso.com that points to Contoso1812.

You need to ensure that users can access Contoso1812 by using the https://www.contoso.com URL.

Which two actions should you take? Each correct answer provides part of the solution.

NOTE: Each correct selection is worth one point.

You have 15 Azure virtual machines in a resource group called RG1.

All of the virtual machines run the same applications.

You need to stop unauthorized applications and malware from running on the virtual machines.

What should you do?

You have an Azure Container Registry named Registry1.

From Azure Security Center, you enable Azure Container Registry vulnerability scanning for the images in Registry1.

You perform the following actions:

• Push a Windows image named Image1 to Registry1.
• Push a Linux image named Image2 to Registry1.
• Push a Windows image named Image3 to Registry1.
• Modify Image1 and push the new image as Image4 to Registry1.
• Modify Image2 and push the new image as Image5 to Registry1.

Which two images will be scanned for vulnerabilities? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

HOTSPOT -

You have an Azure subscription containing the virtual machines listed in the following table.

Subnet1 and Subnet2 are configured with a Microsoft.Storage service endpoint.

You have an Azure Storage account named storageacc1, configured as shown in the following exhibit.

For each of the following statements, select Yes if it is true. Otherwise, select No.

You must evaluate the underlined segment to determine whether it is correct.

You have been assigned to create a separate subscription for every division in your company. However, all subscriptions will be associated with one Azure Active Directory (Azure AD) tenant.

You need to ensure that every subscription has the same role assignments.

You use Azure AD Privileged Identity Management (PIM).

Select No adjustment required if the underlined segment is correct. If it is incorrect, select the correct option.

You have the Azure resource hierarchy shown in the following exhibit.

RG1, RG2, and RG3 are resource groups. RG2 contains a virtual machine named VM2. You assign Azure role-based access control (RBAC) roles to the users shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

You have five Azure subscriptions linked to one Azure Active Directory (Azure AD) tenant.

You create an Azure Policy initiative named SecurityPolicyInitiative1.

You determine the standard role assignments that must be configured on all new resource groups.

You need to enforce SecurityPolicyInitiative1 and the role assignments whenever a new resource group is created.

Which three actions should you perform, in sequence?

You have an Azure subscription that contains the Azure App Service web apps displayed in the following table.

You upload a private-key certificate named Cert1.pfx to App1.

Which apps can use Cert1?

You have an Azure SQL database and implement Always Encrypted.

You need to ensure that application developers can retrieve and decrypt data in the database.

Which two pieces of information should you give the developers? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Your network has an on-premises Active Directory domain named adatum.com that synchronizes with a Microsoft Entra tenant.

The Microsoft Entra tenant includes the users in the following table.

You configure Microsoft Entra Password Protection for adatum.com as shown in the following exhibit.

For each statement, select Yes if it is true; otherwise, select No.

You are investigating a security issue with an Azure Storage account.

You enable Azure Storage Analytics logs and archive them to a storage account. What should you use to retrieve the diagnostic logs?

Your company has an Azure subscription named Sub1 that is associated with an Azure Active Directory (Azure AD) tenant named contoso.com.

The company develops a mobile application named App1. App1 uses the OAuth 2 implicit grant type to acquire Azure AD access tokens.

You need to register App1 in Azure AD.

Which information should you obtain from the developer to register the application?

You have the Azure virtual machines shown in the following table.

Each virtual machine has one network interface.

You add VM1's network interface to an application security group named ASG1.

You need to identify the virtual machines whose network interfaces can be added to ASG1.

What should you identify?

In Azure Security Center, you create a custom alert rule.

You need to configure the users who receive an email message when the alert is triggered.

What should you do?