AZ-500 sample exam questions

The Microsoft Monitoring Agent extension needs the Log Analytics workspace ID in its public settings and the workspace key in protected settings to connect. No Entra application ID or storage account key is required. MMA is retired; the Azure Monitor Agent with data collection rules replaces it.

Privileged Role Administrator can create role-assignable groups, assign Microsoft Entra roles to groups and manage access reviews for them. Groups Administrator cannot manage role-assignable groups, Identity Governance Administrator cannot assign Entra roles, and Authentication Administrator is unrelated.

The MFA registration policy applies to Group1 minus Group2. User1 and User3 are in scope, and synced users register just like cloud-only users. User2 is excluded through Group2, so the policy never applies to User2.

Microsoft Antimalware for Azure is deployed as a VM extension (IaaSAntimalware), not by adding a Windows feature inside each VM. Manually adding a feature on 50 VMs does not deploy Microsoft Antimalware for Azure.

JIT VM access shows a VM as Unsupported when it has no network security group (or Azure Firewall) to control the management ports. Creating and associating an NSG with VM1's NIC or subnet makes it eligible. The load balancer type, extra public IPs and Entra licenses are not requirements.

Azure picks the route with the longest matching prefix. In Subnet1-1, the 10.1.0.0/16 VNet system route beats Rt1 (0.0.0.0/0). Rt3 sends 10.1.1.0/24 from Subnet2-1 to Fw1 across the peering. Subnet3-1 only has Rt4 for 10.2.1.0/24, so its internet traffic goes out directly.

A WAF policy cannot be attached to an App Service web app directly. It must be associated with a supported front end, so you first deploy Azure Front Door (or Application Gateway). Azure Firewall does not use WAF policies, and an extension is not how WAF is applied.

User1 must first be synced to Azure AD with Azure AD Connect (now Microsoft Entra Connect). Then enable AD DS identity-based authentication on storage1 for Azure Files, and assign a share-level RBAC role such as Storage File Data SMB Share Contributor. Private links and service endpoints only affect network access.

Endpoints are per service, not per resource. VNet1 needs Microsoft.Storage and Microsoft.AzureActiveDirectory; VNet2 needs Microsoft.Storage and Microsoft.KeyVault. Peering already covers traffic between the networks. The Azure AD endpoint is outdated and no longer a supported option.

Azure Firewall Manager creates secured virtual hubs in a Virtual WAN and manages firewall policies centrally, syncing rules across regions. Virtual Network Manager handles virtual network connectivity and admin rules, not secured hubs; Front Door and Network Function Manager do not fit.

A Cosmos DB for NoSQL private endpoint registers its records in the privatelink.documents.azure.com private DNS zone. The blob, azurewebsites and database.azure.com zones belong to other services, so they will not resolve Cosmos1.

Defender for Containers protects AKS, Amazon EKS and Google GKE clusters through multicloud connectors. The Defender for Storage plan protects Azure Storage only. Multicloud coverage changes often, so check the current Defender for Cloud support matrix.

HTTPS Only forces encrypted traffic to protect data in transit, and Incoming client certificates make the web app require client certificate authentication. Setting TLS 1.2 or uploading a public certificate does not by itself satisfy the stated requirements, and tier change is not needed.

Azure Disk Encryption requires the key vault to be in the same region and subscription as the VM and to have disk encryption access enabled. Only KeyVault1 satisfies that for VM4 according to the exhibit, so the others are excluded.

Platform protection requirements usually route subnet traffic through the firewall using the route table. VM0 is not in a subnet that reaches users correctly, so moving it to Subnet1 gives it the required path, whereas rules or route table changes do not solve this.