SIMULATION You need to grant the required permissions to a user named User2-1234578 to manage the virtual networks in the RG1lod1234578 resource group. The solution must use the principle of least privilege.To complete this task, sign in to the Azure portal.
Answer(s): A
1. In Azure portal, locate and select the RG1lod1234578 resource group.2. Click Access control (IAM).3. Click the Role assignments tab to view all the role assignments at this scope.4. Click Add > Add role assignment to open the Add role assignment pane.5. In the Role drop-down list, select the role Virtual Machine Contributor.Virtual Machine Contributor lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.6. In the Select list, select user User2-12345787. Click Save to assign the role.
https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor
SIMULATION You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod1234578 Azure Storage account.To complete this task, sign in to the Azure portal.
Step 1:1. In Azure portal go to the storage account you want to secure. Here: rg1lod12345782. Click on the settings menu called Firewalls and virtual networks.3. To deny access by default, choose to allow access from Selected networks. To allow traffic from all networks, choose to allow access from All networks.4. Click Save to apply your changes.Step 2:1. Go to the storage account you want to secure. Here: rg1lod12345782. Click on the settings menu called Firewalls and virtual networks.3. Check that you've selected to allow access from Selected networks.4. To grant access to a virtual network with a new network rule, under Virtual networks, click Add existing virtual network, select Virtual networks and Subnets options. Enter the 131.107.0.0/16 subnet and then click Add.Note: When network rules are configured, only applications requesting data over the specified set of networks can access a storage account. You can limit access to your storage account to requests originating from specified IP addresses, IP ranges or from a list of subnets in an Azure Virtual Network (VNet).
https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security
HOTSPOT (Drag and Drop is not supported) (Drag and Drop is not supported)You create resources in an Azure subscription as shown in the following table.VNET1 contains two subnets named Subnet1 and Subnet2. Subnet1 has a network ID of 10.0.0.0/24. Subnet2 has a network ID of 10.1.1.0/24.Contoso1901 is configured as shown in the exhibit. (Click the Exhibit tab.)For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Yes Access from Subnet1 is allowed.Box 2: No No access from Subnet2 is allowed.Box 3: Yes Access from IP address 193.77.10.2 is allowed.
You have an Azure subscription that contains the virtual machines shown in the following table.All the virtual networks are peered.You deploy Azure Bastion to VNET2.Which virtual machines can be protected by the bastion host?
https://docs.microsoft.com/en-us/azure/bastion/vnet-peering
You have Azure Resource Manager templates that you use to deploy Azure virtual machines.You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.What should you use?
Answer(s): B
You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines.Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC-Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on-premises.
https://docs.microsoft.com/en-us/azure/automation/automation-dsc-getting-started
Post your Comments and Discuss Microsoft AZ-500 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-500 content, but please register or login to continue.