AZ-500 — questions

You have an Azure subscription that contains four Azure SQL managed instances. You need to evaluate the vulnerability of the managed instances to SQL injection attacks. What should you do first?

You have an Azure subscription that contains a virtual machine named VM1. You create an Azure key vault that has the following configurations: • Name: Vault5 • Region: West US • Resource group: RG1 You need to use Vault5 to enable Azure Disk Encryption on VM1. The solution must support backing up VM1 by using Azure Backup. Which key vault settings should you configure?

You have an Azure subscription named Sub1 that contains the resources shown in the following table. You need to ensure that you can provide VM1 with secure access to a database on SQL1 by using a contained database user. What should you do?

You have an Azure subscription named Sub1 that contains the Azure key vaults shown in the following table: In Sub1, you create a virtual machine that has the following configurations: • Name: VM1 • Size: DS2v2 • Resource group: RG1 • Region: West Europe • Operating system: Windows Server 2016 You plan to enable Azure Disk Encryption on VM1. In which key vaults can you store the encryption key for VM1?

You have a web app named WebApp1. You create a web application firewall (WAF) policy named WAF1. You need to protect WebApp1 by using WAF1. What should you do first?

You have an Azure subscription that contains an Azure SQL database named sql1. You plan to audit sql1. You need to configure the audit log destination. The solution must meet the following requirements: • Support querying events by using the Kusto query language. • Minimize administrative effort. What should you configure?

You have an Azure subscription that contains as Azure key vault and an Azure Storage account. The key vault contains customer-managed keys. The storage account is configured to use the customer-managed keys stored in the key vault. You plan to store data in Azure by using the following services: • Azure Files • Azure Blob storage • Azure Table storage • Azure Queue storage Which two services support data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

You have an Azure subscription that contains an Azure SQL database named DB1 in the East US Azure region. You create the storage accounts shown in the following table. You plan to enable auditing for DB1. Which storage accounts can you use as the auditing destination for DB1?

You have an on-premises network and an Azure subscription. You have the Microsoft SQL Server instances shown in the following table. You plan to implement Microsoft Defender for SQL. Which SQL Server instances will be protected by Microsoft Defender for SQL?

You have an Azure subscription that contains an Azure SQL Database logic server named SQL1 and an Azure virtual machine named VM1. VM1 uses a private IP address only. The Firewall and virtual networks settings for SQL1 are shown in the following exhibit. You need to ensure that VM1 can connect to SQL1. The solution must use the principle of least privilege. What should you do?

You have an Azure Active Directory (Azure AD) tenant that contains a group named Group1. You need to ensure that the members of Group1 sign in by using passwordless authentication. What should you do?

You have an Azure subscription that contains the resources shown in the following table. You need to configure storage1 to regenerate keys automatically every 90 days. Which cmdlet should you run?

You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 has the Key Vault VM extension installed. For Vault1, you rotate the keys, secrets, and certificates. What will be updated automatically on VM1?

You have an Azure subscription that contains the resources shown in the following table. Both VM1 and VM2 connect to VNET1 and are configured to use NSG1. You need to ensure that only VM1 and VM2 can access DB1. What should you do?

You have an Azure AD tenant that contains a user named User1. You purchase an app named App1. User1 needs to publish App1 by using Azure AD Application Proxy. Which role should you assign to User1?

You have an Azure subscription that contains the virtual machines shown in the following table. Which computers will support file integrity monitoring?

You have an Azure AD tenant that contains the users shown in the following table. You need to ensure that the users cannot create app passwords. The solution must ensure that User1 can continue to use the Mail and Calendar app. What should you do?

You have an Azure subscription that contains the virtual machines shown in the following table. You are configuring Microsoft Defender for Servers. You plan to enable adaptive application controls to create an allowlist of known-safe apps on the virtual machines. Which virtual machines support the use of adaptive application controls?

You have an Azure subscription. The subscription contains a virtual network named VNet1 that contains the subnets shown in the following table. The subscription contains the function apps shown in the following table. The outbound traffic of which app is controlled by using NSG1?

You have a Microsoft Entra tenant named contoso.com. You collaborate with a partner organization that has a Microsoft Entra tenant named fabrikam.com. You need to create an allow list of cloud apps from fabrikam.com that can be used by the users in contoso.com. What should you do for contoso.com in the Microsoft Entra admin center?