AZ-500 — questions

You have an Azure Active Directory (Azure AD) tenant that contains a user named User1. You plan to enable passwordless authentication for the tenant. You need to ensure that User1 can enable the combined registration experience. The solution must use the principle of least privilege. Which role should you assign to User1?

You are troubleshooting a security issue for an Azure Storage account. You enable Azure Storage Analytics logs and archive it to a storage account. What should you use to retrieve the diagnostics logs?

You have the Azure resources shown in the following table. You need to meet the following requirements: • Internet-facing virtual machines must be protected by using network security groups (NSGs). • All the virtual machines must have disk encryption enabled. What is the minimum number of security policies that you should create in Microsoft Defender for Cloud?

You have an Azure subscription that contains a resource group named RG1 and the network security groups (NSGs) shown in the following table. You create the Azure policy shown in the following exhibit. You assign the policy to RG1. What will occur if you assign the policy to NSG1 and NSG2?

You have an Azure Active Directory (Azure AD) tenant. You need to prevent nonprivileged Azure AD users from creating service principles in Azure AD. What should you do in the Azure Active Directory admin center of the tenant?

You have an Azure subscription that contains a managed identity named Identity1 and the Azure key vaults shown in the following table. KeyVault1 contains an access policy that grants Identity1 the following key permissions: • Get • List • Wrap • Unwrap You need to provide Identity1 with the same permissions for KeyVault2. The solution must use the principle of least privilege. Which role should you assign to Identity1?

You have an Azure subscription named Sub1. In Microsoft Defender for Cloud, you have a workflow automation named WF1. WF1 is configured to send an email message to a user named User1. You need to modify WF1 to send email messages to a distribution group named Alerts. What should you use to modify WF1?

Your on-premises network contains a Hyper-V virtual machine named VM1. You need to use Azure Arc to onboard VM1 to Microsoft Defender for Cloud. What should you install first?

You have an Azure subscription named Sub1 that uses Microsoft Defender for Cloud. You have the management group hierarchy shown in the following exhibit. You create the definitions shown in the following table. You need to use Defender for Cloud to add a security policy. Which definitions can you use as a security policy?

You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. EASM1 has discovery enabled and contains several inventory assets. You need to identify which inventory assets are vulnerable to the most critical web app security risks. Which Defender EASM dashboard should you use?

You have an Azure subscription that uses Microsoft Defender for Cloud. You need to use Defender for Cloud to review regulatory compliance with the Azure CIS 1.4.0 standard. The solution must minimize administrative effort. What should you do first?

You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. You need to allow access to Vault1 only from VM1. What should you do in the Networking settings of Vault1?

You have an Azure subscription. You create a new virtual network named VNet1. You plan to deploy an Azure web app named App1 that will use VNet1 and will be reachable by using private IP addresses. The solution must support inbound and outbound network traffic. What should you do?

You have an Azure subscription and the computers shown in the following table. You need to perform a vulnerability scan of the computers by using Microsoft Defender for Cloud. Which computers can you scan?

You have an Azure subscription that uses Microsoft Defender for Cloud. The subscription contains the Azure Policy definitions shown in the following table. Which definitions can be assigned as a security policy in Defender for Cloud?

You have an Azure subscription that uses Microsoft Defender for Cloud. You have accounts for the following cloud services: • Alibaba Cloud • Amazon Web Services (AWS) • Google Cloud Platform (GCP) What can you add to Defender for Cloud?

You have an Azure subscription. You plan to map an online infrastructure and perform vulnerability scanning for the following: • ASNs • Hostnames • IP addresses • SSL certificates What should you use?

You have an Azure subscription that uses Microsoft Defender for Cloud. You have an Amazon Web Services (AWS) account. You need to ensure that when you deploy a new AWS Elastic Compute Cloud (EC2) instance, the Microsoft Defender for Servers agent installs automatically. What should you configure first?

You have an Azure subscription that uses Microsoft Defender for Cloud. You have an Amazon Web Services (AWS) account named AWS1 that is connected to Defender for Cloud. You need to ensure that AWS1 uses AWS Foundational Security Best Practices. The solution must minimize administrative effort. What should you do in Defender for Cloud?

You are troubleshooting a security issue for an Azure Storage account. You enable Azure Storage Analytics logs and archive it to a storage account. What should you use to retrieve the diagnostics logs?