HOTSPOT (Drag and Drop is not supported) (Drag and Drop is not supported)You have Azure virtual machines that have Update Management enabled. The virtual machines are configured as shown in the following table.You schedule two update deployments named Update1 and Update2. Update1 updates VM3. Update2 updates VM6.Which additional virtual machines can be updated by using Update1 and Update2? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
An update deployment can apply to Windows VMs or Linux VMs but not both. The VMs can be in different regions, different subscriptions and different resource groups.Update1: VM1 and VM2 only VM3: Windows Server 2016.Update2: VM4 and VM5 only VM6: CentOS 7.5.For Linux, the machine must have access to an update repository. The update repository can be private or public.
https://docs.microsoft.com/en-us/azure/automation/update-management/overview
HOTSPOT (Drag and Drop is not supported) (Drag and Drop is not supported)You have an Azure subscription named Sub1.You create a virtual network that contains one subnet. On the subnet, you provision the virtual machines shown in the following table.Currently, you have not provisioned any network security groups (NSGs).You need to implement network security to meet the following requirements:-Allow traffic to VM4 from VM3 only.-Allow traffic from the Internet to VM1 and VM2 only.-Minimize the number of NSGs and network security rules.How many NSGs and network security rules should you create? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
NSGs: 2 Network security rules: 3 Not 2: You cannot specify multiple service tags or application groups) in a security rule.References:https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
References:https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
HOTSPOT (Drag and Drop is not supported) (Drag and Drop is not supported)You have an Azure key vault.You need to delegate administrative access to the key vault to meet the following requirements:-Provide a user named User1 with the ability to set advanced access policies for the key vault.-Provide a user named User2 with the ability to add and delete certificates in the key vault.-Use the principle of least privilege.What should you use to assign access to each user? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
User1: RBAC RBAC is used as the Key Vault access control mechanism for the management plane. It would allow a user with the proper identity to:- set Key Vault access policies- create, read, update, and delete key vaults- set Key Vault tagsNote: Role-based access control (RBAC) is a system that provides fine-grained access management of Azure resources. Using RBAC, you can segregate duties within your team and grant only the amount of access to users that they need to perform their jobs.User2: A key vault access policyA key vault access policy is the access control mechanism to get access to the key vault data plane. Key Vault access policies grant permissions separately to keys, secrets, and certificates.References:https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault
References:https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault
You have Azure Resource Manager templates that you use to deploy Azure virtual machines.You need to disable unused Windows features automatically as instances of the virtual machines are provisioned.What should you use?
Answer(s): B
You can use Azure Automation State Configuration to manage Azure VMs (both Classic and Resource Manager), on-premises VMs, Linux machines, AWS VMs, and on-premises physical machines. Note: Azure Automation State Configuration provides a DSC pull server similar to the Windows Feature DSC Service so that target nodes automatically receive configurations, conform to the desired state, and report back on their compliance. The built-in pull server in Azure Automation eliminates the need to set up and maintain your own pull server. Azure Automation can target virtual or physical Windows or Linux machines, in the cloud or on- premises.
You have an Azure Container Registry named Registry1.From Azure Security Center, you enable Azure Container Registry vulnerability scanning of the images in Registry1.You perform the following actions:-Push a Windows image named Image1 to Registry1.-Push a Linux image named Image2 to Registry1.-Push a Windows image named Image3 to Registry1.-Modify Image1 and push the new image as Image4 to Registry1.Modify Image2 and push the new image as Image5 to Registry1.Which two images will be scanned for vulnerabilities? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.
Answer(s): B,E
Only Linux images are scanned. Windows images are not scanned.
https://docs.microsoft.com/en-us/azure/security-center/azure-container-registry-integration
Post your Comments and Discuss Microsoft AZ-500 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-500 content, but please register or login to continue.