Online Access Free AZ-500 Exam Questions

No.# A. Enable Azure Defender.

No.# A. Flow logs will be disabled for NSG1 and NSG2.

No.# D. blob index tags and container names only

No.# For this specific requirement of TLS unburdening, I will definitely go with AppGW.

AFD is more used for it's global and priority balancing qualities, but AppGW here would be the chosen option and what I would recommend to a customer to go with for good TLS performance.

https://learn.microsoft.com/en-us/azure/application-gateway/features#url-based-routing

URL-based routing
URL Path Based Routing allows you to route traffic to backend server pools based on URL Paths of the request. One of the scenarios is to route requests for different content types to different pool.

For example, requests for http://contoso.com/video/* are routed to VideoServerPool, and http://contoso.com/images/* are routed to ImageServerPool. DefaultServerPool is selected if none of the path patterns match.

No.# Y-Y-Y private endpoints do ignore Network Security Group (NSG) rules.

No.# For the field type:

"Microsoft.Resources/subscriptions/resourceGroups"
For the details type:

"Microsoft.Authorization/locks"
For the existenceCondition:

"existenceCondition"

No.# D. Enable the Microsoft Defender for SQL plan.

No.# The answer should be No, Yes, No.
Reference: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects
After the Resource Provider returns a success code on a Resource Manager mode request, AuditIfNotExists and DeployIfNotExists evaluate to determine whether additional compliance logging or action is required.
So overall order of evaluation: Disabled -> Append/Modify -> Deny -> Audit -> AuditIfNotExists/DeployIfNotExists.
1st: No. DeployIfNotExists will be triggered after a configurable delay when a Resource Provider handles a create or update subscription or resource request and has returned a success code. In this scenario, because SQL1 is already deployed so it can not be enabled automatically.
2nd: Yes. Deny is processed first so can't be deployed
3rd: No. Deny is processed first

No.# C. Initiative1 and Initiative2 only

No.# B. a shared access signature (SAS)

No.# ested with following results:
A: No
Security Admin cannot manage key vault properties
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#security-admin
B: No
Network Contributor or Key Vault Reader cannot change the key vault firewall
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor
C: YES
Key vault contributor can do that
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor
Note: "does not allow you to assign roles" - but here the question is to add access policies which works.

No.# d. Initiative1 and Initiative2 only Most Voted

No.# Correct answer: A. Move VM0 to Subnet1.

No.# Storage 1 and 2
https://docs.microsoft.com/en-us/azure/azure-sql/database/audit-log-format#:~:text=Blob%20audit,in%20the%20Azure%20storage%20account.
Log analytics 1,2 and 3

No.# tested in lab
Correct answers should be:

Email: XXXX ==> Default masking function is used (and not email function)
Birthday: 1900-01-01 ==> as explained in the documentation for date type using default

No.# Ans A: AWS, GCP

No.# c. a Log Analytics workspace

No.# A. storage1, storage2, and storage3 only Most Voted

No.# 1- Prompt for MFA -> User is excluded, but MFA is Enabled, user is always prompted for MFA.
2.- Prompt for MFA -> Risk is medium and policy applies
3.- Single Authentication -> Policy doesn't apply, risk low

No.# Always Encrypted by Using Azure Key Vault

Create an Access Policy in azure Key vault

https://docs.microsoft.com/en-us/azure/azure-sql/database/always-encrypted-azure-key-vault-configure?tabs=azure-powershell#create-a-key-vault-to-store-your-keys