Online Access Free AZ-500 Exam Questions

No.# C. Azure Files

D. Blob storage

No.# C. Register the web test app in Azure AD.

No.# update:
NO: traffic from subnet1-1 to subnet2-1 wont pass through FW as inter VN system traffic takes precedence over FW unless defined specifically.
Yes: Here it mentioned it specifically.
NO.

No.# updated: NNN
Soft Delete is now Enable by Default.
Box1: No -
Policies cannot be recovered.
Box2: Soft delete is enabled by default on all key vaults. You cannot add a new key named Item1 because an object named Item1 exists in a soft-deleted state.
Box3: Soft delete is now enabled by default on all key vaults so you cant create new Item2as it exists in a soft-deleted state.

No.# B. Role activation settings
https://learn.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-change-default-settings

No.# b. Enable the Microsoft Defender for SQL plan

No.# D, Initiative1, Initiative2
Microsoft Defender for Cloud applies security initiatives to the subscriptions.
So when you go to Environment Settings of Defender for Cloud you will be able to assign Initiative1 (inheritied from TRG) and 2 to Sub1.

MG1 does not have an Subscription so it wont even be an available option in Environment Settings.

No.# This exam question test about role-assignable group feature in Azure Active Directory.
Refer to Microsoft document on role-assignable group: “Group nesting is not supported. A group can't be added as a member of a role-assignable group.”

Reference
Create a role-assignable group in Azure Active Directory
https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-create-eligible

Use Azure AD groups to manage role assignments
https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept

No.# YYY.
Just tested it
Two VMs in two distincs Subnets, even though the private endpoint is assigned to one subnet , both VMs will have in their Network interface effective routes a destination to the private endpoint, because all traffcis is routed between the subnets by default

No.# DB1: storage1, storage2, and Workspace1
DB2: storage1 and workspace1

No.# Manually add the Azure CIS 1.4.0 standard. Its not added by default.
By default, there are:
PCI DSS, ISO 27001, SOC TSP and Microsoft Cloud Security Benchmark.

No.# B. When you create a custom initiative the policy get automatically assigned to the scope. In the Azure policy page you can find those custom initiative named [Assigned by MDC]

No.# Box1: Admin3 only
Box2: Admin1 and Admin4 Only

User Access Administrator (Which is Admin1) can:
Manage user access to Azure resources
Assign roles in Azure RBAC
Assign themselves or others the Owner role

No.# (user.city -match "on") = U1,U2,U3,U4
(user.city -contains "ON") = U1,U2,U3,U4

No.# 1 -- No, as traffic would be sourced from internet since it is destined to the public IP address of VM2.
2 -- Yes, as VM3 has no NSGs interfering and traffic is contained within the same vnet.
3 -- No, as VM5 is in a separate vnet and there is no mention of any peering going on.

No.# Yes: Rt1 will route from Subnet1-1 to any IP (0.0.0.0/0) including Subnet2-1 to the FW (10.1.3.4)
Yes: Rt3 will route from Subnet2-1 to Subnet1-1 (10.1.1.0/24) to the FW (10.1.3.4)
No: There is no configured route from Subnet3-1 to the internet via FW, thus it will go directly to the internet bypassing the FW

No.# E. AWS and GCP only

No.# Answer C
Azure Private Link is now generally available. Both Private Endpoint and Private Link service (service behind standard load balancer) are generally available.
https://learn.microsoft.com/en-us/azure/private-link/availability

No.# 1) Admin1,2,3 because policy naming blocks only apply to O365
2) Admin 1,3 because Global Admin and User Admin are exempt.
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-naming-policy

No.# C. a Log Analytics workspace