AZ-500 — questions

You have an Azure subscription that contains a Microsoft Defender External Attack Surface Management (Defender EASM) resource named EASM1. You review the Attack Surface Summary dashboard. You need to identify the following insights: • Deprecated technologies that are no longer supported • Infrastructure that will soon expire Which section of the dashboard should you review?

You have an Azure subscription. You plan to deploy Microsoft Defender External Attack Surface Management (Defender EASM) to identify and monitor externally facing assets. You create a new Defender EASM instance named EASM1. What should you do next?

You have an Azure subscription that contains an Azure Key Vault Standard key vault named Vault1. Vault1 hosts a 2048-bit RSA key named key1. You need to ensure that key1 is rotated every 90 days. What should you do first?

You have an Azure subscription named Sub1 that has Security defaults disabled. The subscription contains the following users: • Five users that have owner permissions for Sub1. • Ten users that have owner permissions for Azure resources. None of the users have multi-factor authentication (MFA) enabled. Sub1 has the secure score as shown in the Secure Score exhibit. (Click the Secure Score tab.) You plan to enable MFA for the following users: • Five users that have owner permission for Sub1. • Five users that have owner permissions for Azure resources. By how many points will the secure score increase after you perform the planned changes?

You have an Azure subscription that uses Microsoft Defender for Cloud. You need to add a custom security recommendation to Defender for Cloud. The recommendation must be assigned the custom severity rating of the subscription. What should you create?

Your company has an Azure subscription named Sub1. You plan to create several security alerts by using Azure Monitor. You need to prepare Sub1 for the alerts. What should you create first?

You have an Azure subscription that contains the Azure App Service web apps shown in the following table. You upload a private key certificate named Cert1.pfx to App1. Which apps can use Cert1?

You have an Azure subscription that uses Microsoft Defender for Cloud. You have an Amazon Web Services (AWS) account. You need to add the AWS account to Defender for Cloud. What should you do first?

You have an Azure subscription that contains an Azure key vault. You create a storage account named storage1. You plan to store data in the following storage1 services: • Azure Files • Azure Blob storage • Azure Table storage • Azure Queue storage For which two services can you configure data encryption by using the keys stored in the key vault? Each correct answer presents a complete solution, NOTE: Each correct selection is worth one point.

You have an Azure subscription that contains an Azure SQL database named SQL1 and an Azure key vault named KeyVault1. KeyVault1 stores the keys shown in the following table. You need to configure Transparent Data Encryption (TDE). TDE will use a customer-managed key for SQL1. Which keys can you use?

You have an Azure SQL Database server named SQL1. For SQL1, you turn on Azure Defender for SQL to detect all threat detection types. Which action will Azure Defender for SQL detect as a threat?

Your company uses Azure DevOps. You need to recommend a method to validate whether the code meets the company's quality standards and code review standards. What should you recommend implementing in Azure DevOps?

You have an Azure web app named WebApp1. You upload a certificate to WebApp1. You need to make the certificate accessible to the app code of WebApp1. What should you do?

You have an Azure web app named webapp1. You need to configure continuous deployment for webapp1 by using an Azure Repo. What should you create first?

Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The company develops an application named App1. App1 is registered in Azure AD. You need to ensure that App1 can access secrets in Azure Key Vault on behalf of the application users. What should you configure?

Your company has an Azure subscription named Sub1 that is associated to an Azure Active Directory (Azure AD) tenant named contoso.com. The company develops a mobile application named App1. App1 uses the OAuth 2 implicit grant type to acquire Azure AD access tokens. You need to register App1 in Azure AD. What information should you obtain from the developer to register the application?

From the Azure portal, you are configuring an Azure policy. You plan to assign policies that use the DeployIfNotExist, AuditIfNotExist, Append, and Deny effects. Which effect requires a managed identity for the assignment?

You have an Azure subscription that contains an Azure key vault named Vault1. In Vault1, you create a secret named Secret1. An application developer registers an application in Azure Active Directory (Azure AD). You need to ensure that the application can use Secret1. What should you do?

You have an Azure SQL database. You implement Always Encrypted. You need to ensure that application developers can retrieve and decrypt data in the database. Which two pieces of information should you provide to the developers? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You have a hybrid configuration of Azure Active Directory (Azure AD). All users have computers that run Windows 10 and are hybrid Azure AD joined. You have an Azure SQL database that is configured to support Azure AD authentication. Database developers must connect to the SQL database by using Microsoft SQL Server Management Studio (SSMS) and authenticate by using their on-premises Active Directory account. You need to tell the developers which authentication method to use to connect to the SQL database from SSMS. The solution must minimize authentication prompts. Which authentication method should you instruct the developers to use?