Skip to Content

AZ-500 Microsoft Azure Security Technologies Exam Questions and Answers – 1 Part 1

By: Author Alex Lim

Posted on  - Last updated:

Categories Exam, Microsoft

The latest Microsoft AZ-500 Azure Security Technologies certification actual real practice exam question and answer (Q&A) dumps are available free, which are helpful for you to pass the Microsoft AZ-500 Azure Security Technologies exam and earn Microsoft AZ-500 Azure Security Technologies certification.

AZ-500 Microsoft Azure Security Technologies Exam Questions and Answers

AZ-500 Question 31

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016.
You need to deploy Microsoft Antimalware to the virtual machines.
Solution: You connect to each virtual machine and add a Windows feature.
Does this meet the goal?

A. Yes
B. No

Answer

B. No

Explanation

Microsoft Antimalware is deployed as an extension and not a feature.

AZ-500 Question 32

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server 2012 R2 or Windows Server 2016.
You need to deploy Microsoft Antimalware to the virtual machines.
Solution: You add an extension to each virtual machine.
Does this meet the goal?

A. Yes
B. No

Answer

A. Yes

Explanation

You can use Visual Studio to enable and configure the Microsoft Antimalware service. This entails selecting Microsoft Antimalware extension from the dropdown list under Installed Extensions and click Add to configure with default antimalware configuration.

AZ-500 Question 33

Question

You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.)

You are testing an Azure Kubernetes Service (AKS) cluster. The cluster is configured as shown in the exhibit. (Click the Exhibit tab.)

You plan to deploy the cluster to production. You disable HTTP application routing.
You need to implement application routing that will provide reverse proxy and TLS termination for AKS services by using a single IP address.
What should you do?

A. Create an AKS Ingress controller.
B. Install the container network interface (CNI) plug-in.
C. Create an Azure Standard Load Balancer.
D. Create an Azure Basic Load Balancer.

Answer

A. Create an AKS Ingress controller.

Explanation

An ingress controller is a piece of software that provides reverse proxy, configurable traffic routing, and TLS termination for Kubernetes services.

AZ-500 Question 34

Question

You have the Azure virtual machines shown in the following table.

Name Operating system Region Resource group
VM1 Windows Server 2012 East US RG1
VM2 Windows Server 2012 R2 West Europe RG1
VM3 Windows Server 2016 West Europe RG2
VM4 Red Hat Enterprise Linux 7.4 East US RG2

You create an Azure Log Analytics workspace named Analytics1 in RG1 in the East US region.
Which virtual machines can be enrolled in Analytics1?

A. VM1 only
B. VM1, VM2, and VM3 only
C. VM1, VM2, VM3, and VM4
D. VM1 and VM4 only

Answer

A. VM1 only

Explanation

Note: Create a workspace –

In the Azure portal, click All services. In the list of resources, type Log Analytics. As you begin typing, the list filters based on your input. Select Log Analytics.

Click Create, and then select choices for the following items:

Provide a name for the new Log Analytics workspace, such as DefaultLAWorkspace. OMS workspaces are now referred to as Log Analytics workspaces.
Select a Subscription to link to by selecting from the drop-down list if the default selected is not appropriate.
For Resource Group, select an existing resource group that contains one or more Azure virtual machines.
Select the Location your VMs are deployed to. For additional information, see which regions Log Analytics is available in.

Incorrect Answers:
B, C: A Log Analytics workspace provides a geographic location for data storage. VM2 and VM3 are at a different location.
D: VM4 is a different resource group.

AZ-500 Question 35

Question

HOTSPOT –
You have two Azure virtual machines in the East US 2 region as shown in the following table.

Name Operating system Type Tier
VM1 Windows Server 2008 R2 A3 Basic
VM2 Ubuntu 16.04-DAILY-LTS L4s Standard

You deploy and configure an Azure Key vault.
You need to ensure that you can enable Azure Disk Encryption on VM1 and VM2.
What should you modify on each virtual machine? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

VM1:

  • The operating system
  • The tier
  • The type

VM2:

  • The operating system
  • The tier
  • The type

Answer

VM1: The tier
VM2: The type

Explanation

VM1: The Tier –
The Tier needs to be upgraded to standard.
Disk Encryption for Windows and Linux IaaS VMs is in General Availability in all Azure public regions and Azure Government regions for Standard VMs and VMs with Azure Premium Storage.

VM2: The type –
Need to change the VMtype to any of A, D, DS, G, GS, F, and so on, series IaaS VMs.
Not the operating system version: Ubuntu 16.04 is supported.

AZ-500 Question 36

Question

You have an Azure Container Registry named Registry1.
From Azure Security Center, you enable Azure Container Registry vulnerability scanning of the images in Registry1.
You perform the following actions:

  • Push a Windows image named Image1 to Registry1.
  • Push a Linux image named Image2 to Registry1.
  • Push a Windows image named Image3 to Registry1.
  • Modify Image1 and push the new image as Image4 to Registry1.
  • Modify Image2 and push the new image as Image5 to Registry1.

Which two images will be scanned for vulnerabilities? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. Image4
B. Image2
C. Image1
D. Image3
E. Image5

Answer

B. Image2
E. Image5

Explanation

Only Linux images are scanned. Windows images are not scanned.

AZ-500 Question 37

Question

You have Azure Resource Manager templates that you use to deploy Azure virtual machines.
You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.
What should you use?

A. device compliance policies in Microsoft Intune
B. Azure Automation State Configuration
C. application security groups
D. Azure Advisor

Answer

B. Azure Automation State Configuration

Explanation

You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines. Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on- premises.

AZ-500 Question 38

Question

HOTSPOT –
You have an Azure key vault.
You need to delegate administrative access to the key vault to meet the following requirements:

  • Provide a user named User1 with the ability to set advanced access policies for the key vault.
  • Provide a user named User2 with the ability to add and delete certificates in the key vault.
  • Use the principle of least privilege.

What should you use to assign access to each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

User1:

  • A key vault access policy
  • Azure Policy
  • Managed identities for Azure resources
  • RBAC

User2:

  • A key vault access policy
  • Azure Policy
  • Managed identities for Azure resources
  • RBAC

Answer

User1: RBAC
User2: A key vault access policy

Explanation

User1: RBAC –
RBAC is used as the Key Vault access control mechanism for the management plane. It would allow a user with the proper identity to:

  • set Key Vault access policies
  • create, read, update, and delete key vaults
  • set Key Vault tags

Note: Role-based access control (RBAC) is a system that provides fine-grained access management of Azure resources. Using RBAC, you can segregate duties within your team and grant only the amount of access to users that they need to perform their jobs.
User2: A key vault access policy
A key vault access policy is the access control mechanism to get access to the key vault data plane. Key Vault access policies grant permissions separately to keys, secrets, and certificates.

Reference

Azure Security Key Vault General
Azure Key Vault security

AZ-500 Question 39

Question

HOTSPOT –
You have an Azure subscription named Sub1.
You create a virtual network that contains one subnet. On the subnet, you provision the virtual machines shown in the following table.

Name Network Interface Application security group assignment IP address
VM1 NIC1 AppGroup12 10.0.0.10
VM2 NIC2 AppGroup12 10.0.0.11
VM3 NIC3 AppGroup3 10.0.0.100
VM4 NIC4 AppGroup4 10.0.0.200

Currently, you have not provisioned any network security groups (NSGs).
You need to implement network security to meet the following requirements:

  • Allow traffic to VM4 from VM3 only.
  • Allow traffic from the Internet to VM1 and VM2 only.
  • Minimize the number of NSGs and network security rules.

How many NSGs and network security rules should you create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

NSGs:

  • 1
  • 2
  • 3
  • 4

Network security rules:

  • 1
  • 2
  • 3
  • 4

Answer

NSGs: 2
Network security rules: 3

Explanation

NSGs: 2 –

Network security rules: 3 –
Not 2: You cannot specify multiple service tags or application groups) in a security rule.

AZ-500 Question 40

Question

HOTSPOT –
You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table.

Name Operating system Region Resource group
VM1 Windows Server 2012 East US RG1
VM2 Windows Server 2012 R2 West US RG1
VM3 Windows Server 2016 West US RG2
VM4 Ubuntu Server 18.04 LTS West US RG2
VM5 Red Hat Enterprise Linux 7.4 East US RG1
VM6 CentOS 7.5 East US RG1

You schedule two update deployments named Update1 and Update2. Update1 updates VM3. Update2 updates VM6.
Which additional virtual machines can be updated by using Update1 and Update2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Update 1:

  • VM2 only
  • VM4 only
  • VM1 and VM2 only
  • VM1, VM2, VM4, VM5, and VM6

Update 2:

  • VM5 only
  • VM1 and VM5 only
  • VM4 and VM5 only
  • VM1, VM2, and VM5 only
  • VM1, VM2, VM3, VM4, and VM5

Answer

Update 1: VM1 and VM2 only
Update 2: VM4 and VM5 only

Explanation

An update deployment can apply to Windows VMs or Linux VMs but not both. The VMs can be in different regions, different subscriptions and different resource groups.

Update1: VM1 and VM2 only –
VM3: Windows Server 2016.

Update2: VM4 and VM5 only –
VM6: CentOS 7.5.
For Linux, the machine must have access to an update repository. The update repository can be private or public.