CertBlaze

Microsoft

AZ-500 Free Practice Questions — Page 9

Question 86

SIMULATION - You need to prevent HTTP connections to the rg1lod28681041n1 Azure Storage account. To complete this task, sign in to the Azure portal.

Show Answer
Correct Answer: Enable **Secure transfer required** on the Azure Storage account (rg1lod28681041n1).
Explanation:
Requiring secure transfer forces all requests to use HTTPS; any HTTP connections are rejected.

Question 87

You have an Azure subscription that is linked to an Azure AD tenant and contains the resources shown in the following table. Which resources can be assigned the Contributor role for VM1?

A. Managed1 and App1 only
B. Group1 and Managed1 only
C. Group1, Managed1, and VM2 only
D. Group1, Managed1, VM1, and App1 only
Show Answer
Correct Answer: D
Explanation:
Azure RBAC roles (such as Contributor) can be assigned to security principals: users, groups (including dynamic groups), service principals (enterprise applications), and managed identities. Group1 (dynamic group) is valid for Azure RBAC, Managed1 (managed identity) is valid, VM1 can be assigned a role via its managed identity, and App1 (enterprise application/service principal) is valid. Therefore, all listed in option D can be assigned the Contributor role for VM1.

Question 88

SIMULATION - You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account. To complete this task, sign in to the Azure portal.

Show Answer
Correct Answer: Azure portal → Storage account **rg1lod28681041** Networking (Firewalls and virtual networks) Allow access from **Selected networks** Add **IP network rule: 131.107.0.0/16** Save
Explanation:
To restrict access to a specific subnet range, configure the storage account firewall to allow only selected networks and explicitly permit the 131.107.0.0/16 CIDR using IP network rules. This ensures only devices from that subnet can access the storage account.

Question 89

HOTSPOT - You have an Azure subscription that contains the virtual machines shown in the following table. You have an Azure Cosmos DB account named cosmos1 configured as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 89 Illustration for AZ-500 question 89 Illustration for AZ-500 question 89
Show Answer
Correct Answer: VM1: No VM2: Yes VM3: Yes
Explanation:
Cosmos DB allows access from selected networks and specific public IP ranges. VM1 is in VNET1/Subnet1 where a Cosmos DB service endpoint is enabled, so traffic uses the Azure backbone and not the public internet. VM2 is in a subnet without a service endpoint and its public IP is allowed by the Cosmos DB firewall, so it can access over the internet. VM3 is in a different VNet with no service endpoint, and its public IP is also allowed, so it can access over the internet.

Question 90

HOTSPOT - You have an Azure subscription named Sub1 that contains the resource groups shown in the following table. You create the Azure Policy definition shown in the following exhibit. You assign the policy to Sub1. You plan to create the resources shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 90 Illustration for AZ-500 question 90 Illustration for AZ-500 question 90 Illustration for AZ-500 question 90
Show Answer
Correct Answer: You can create IPobject1: Yes You can create obj1: No You can create OBJ3: Yes
Explanation:
The policy denies a resource if **any** condition is true: (1) the resource location differs from its resource group, or (2) the resource name does not contain "obj" (case-insensitive). - **IPobject1**: Location matches RG2 (East US) and name contains "obj" → not denied. - **obj1 (resource group)**: Resource groups are evaluated by policy; the name condition applies and the policy blocks this creation per evaluation result. - **OBJ3**: Location matches RG1 (West US) and name contains "obj" → not denied.

Question 91

HOTSPOT - You have an Azure subscription that contains a user named Admin1 and an Azure key vault named Vault1. You plan to implement Microsoft Entra Verified ID. You need to create an access policy to ensure that Admin1 has permissions to Vault1 that support the implementation of the Verified ID service. The solution must use the principle of least privilege. Which three key permissions should you select? To answer, select the appropriate permissions in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 91
Show Answer
Correct Answer: Create Delete Sign
Explanation:
Microsoft Entra Verified ID requires access to an Azure Key Vault key for issuing and managing credentials. Least-privilege permissions allow the admin to create the signing key, delete it if needed during configuration, and use it to sign credentials. Other key or cryptographic permissions are not required for the Verified ID service setup.

Question 92

You have an Azure subscription that uses Microsoft Defender for Cloud. The subscription contains the Azure Policy definitions shown in the following table. Which definitions can be assigned as a security policy in Defender for Cloud?

A. Policy1 and Policy2 only
B. Initiative1 and Initiative2 only
C. Policy1 and Initiative1 only
D. Policy2 and Initiative2 only
E. Policy1, Policy2, Initiative1, and Initiative2
Show Answer
Correct Answer: B
Explanation:
In Microsoft Defender for Cloud, security policies are assigned at the subscription or management group level using Azure Policy initiatives, not individual policy definitions. Defender for Cloud applies security initiatives that bundle one or more policy definitions. As a result, only initiative definitions appear and can be assigned as security policies in Defender for Cloud, while standalone policy definitions cannot be directly assigned.

Question 93

You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You have the management group hierarchy shown in the following exhibit. You create the definitions shown in the following table. You need to use Defender for Cloud to add a security policy. Which definitions can you use as a security policy?

A. Policy1 only
B. Policy1 and Initiative1 only
C. Initiative1 and Initiative2 only
D. Initiative1, Initiative2, and Initiative3 only
E. Policy1, Initiative1, Initiative2, and Initiative3
Show Answer
Correct Answer: D
Explanation:
In Microsoft Defender for Cloud, security policies are implemented and assigned as Azure Policy initiatives, not individual policy definitions. Therefore, Policy1 cannot be used directly. Any initiative that is defined at the tenant root group, a management group, or the subscription—and whose scope applies to Sub1—can be used. Initiative1 (tenant root), Initiative2 (subscription), and Initiative3 (management group) are all valid initiatives that can be assigned as security policies, whereas Policy1 is not.

Question 95

You have an Azure subscription that contains an Azure SQL server named SQL1. SQL1 contains an Azure SQL database named DB1. You need to use Microsoft Defender for Cloud to complete a vulnerability assessment for DB1. What should you do first?

A. From Advanced Threat Protection types, select SQL injection vulnerability.
B. Configure the Send scan report to setting.
C. Set Periodic recurring scans to ON.
D. Enable the Microsoft Defender for SQL plan.
Show Answer
Correct Answer: D
Explanation:
To run a vulnerability assessment for an Azure SQL Database using Microsoft Defender for Cloud, the required prerequisite is that Microsoft Defender for SQL is enabled on the subscription. Vulnerability Assessment is part of the Microsoft Defender for SQL plan; without enabling this plan first, none of the VA features (scans, reports, recurring scans, or threat types) are available. Therefore, the first action must be to enable the Microsoft Defender for SQL plan.

Question 96

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. SQL1 has the following configurations: • Auditing: Enabled • Audit log destination: storage1, Workspace1 DB1 has the following configurations: • Auditing: Enabled • Audit log destination: storage2 DB2 has auditing disabled. Where are the audit logs for DB1 and DB2 stored? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-500 question 96 Illustration for AZ-500 question 96
Show Answer
Correct Answer: DB1: storage1, storage2, and Workspace1 DB2: storage1 and Workspace1
Explanation:
Server-level auditing on SQL1 is enabled and applies to all databases, sending logs to storage1 and Workspace1. DB1 also has database-level auditing enabled, which adds storage2 without overriding server settings, so DB1 is audited to all three destinations. DB2 has database-level auditing disabled but still inherits server-level auditing, so its logs go to storage1 and Workspace1.

$19

Get all 440 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-500 study guide →