AZ-500: Microsoft Azure Security Technologies Practice Questions Part 1

A company currently has three Azure subscriptions. They have defined a set of security policy definitions. They want to ensure that these definitions are deployed across all subscriptions.
You decide to create the security definitions and assignments and scope them at the resource group level.
Would this fulfill the requirement?

A company currently has three Azure subscriptions. They have defined a set of security policy definitions. They want to ensure that these definitions are deployed across all subscriptions.
You decide to create management groups and then scope the policies at the management group level.
Would this fulfill the requirement?

A company currently has three Azure subscriptions. They have defined a set of security policy definitions. They want to ensure that these definitions are deployed across all subscriptions.
You decide to create a central policy and then scope the policy at the subscription level.
Would this fulfill the requirement?

You have a virtual machine named “ipsvm” defined as part of your subscription. You have a vault named “ipsvault” defined in the same region as the virtual machine. You have to use the vault to enable Azure Disk Encryption on the virtual machine. Which of the following must be configured in the key vault to support the encryption process?

Your company has defined a set of virtual machines as part of their subscription. The company currently has Azure P2 Premium licenses for their users. They are using the free version of Azure Security Center.
They want to enable Just in time access for the virtual machines. They want to ensure that the solution minimizes costs.
Which of the following needs to be done first before one can enable just-in-time access?

Your company has defined a set of virtual machines as part of their subscription. The company currently has Azure P2 Premium licenses for their users. They are using the free version of Azure Security Center.
They want to enable Just in time access for the virtual machines. They want to ensure that the solution minimizes costs.
One of the virtual machines will have a web server installed. This is a Windows-based Azure virtual machine. Users will be accessing the web application via the URL “https://ipspecialist.net”. Which of the following port number is a candidate for enabling just-in-time access for the virtual machine?

Your company has defined a set of virtual machines as part of their subscription. The company currently has Azure P2 Premium licenses for their users. They are using the Standard version of Azure Security Center.
They want to enable Just in time access for the virtual machines. They want to ensure that the solution minimizes costs.
Which of the following Role-Based Access actions need to be allowed for a user that would request for Just-in-time access to a virtual machine? Select two answers from the options given below.

A company has an Azure SQL database defined as part of their subscription.
You have to prepare the database to authenticate by using identities defined in their Azure AD tenant.
You need to ensure that Azure AD identities can be used for authentication to the Azure SQL database.
Which of the following needs to be done as an initial step?

A company has an Azure SQL database defined as part of their subscription.
You have to prepare the database to authenticate by using identities defined in their Azure AD tenant.
Which of the following statement can be used to create a container user based on Azure AD in a SQL database?

Your company has a set of virtual machines defined as part of a virtual network in Azure. The virtual machines are part of a subnet named “subnetA”. The subnet has been assigned the following Network Security group.
Inbound Security Rules

Outbound Security Rules

• Internet Information Services is installed on a Windows virtual machine named “ipsvm”
• This virtual machine is part of “subnetA”
• A web application has been set up on the server and has been configured to listen via the URLs “https://ipspecialist.net” and “https://ipspecialist.net”
Would users on the Internet be able to access the URL “https://ipspecialist.net”?

Your company has a set of virtual machines defined as part of a virtual network in Azure. The virtual machines are part of a subnet named “subnetA”. The subnet has been assigned the following Network Security group.
Inbound Security Rules

Outbound Security Rules

• Internet Information Services is installed on a Windows virtual machine named “ipsvm”
• This virtual machine is part of “subnetA”
• A web application has been set up on the server and has been configured to listen via the URLs “https://ipspecialist.net” and “https://ipspecialist.net”
Would users on the Internet be able to access the URL “https://ipspecialist.net”?

Your company has a set of virtual machines defined as part of a virtual network in Azure. The virtual machines are part of a subnet named “subnetA”. The subnet has been assigned the following Network Security group.
Inbound Security Rules

Outbound Security Rules

• Internet Information Services is installed on a Windows virtual machine named “ipsvm”
• This virtual machine is part of “subnetA”
• A web application has been set up on the server and has been configured to listen via the URLs “https://ipspecialist.net” and “https://ipspecialist.net”
Would another machine defined in the same subnet “subnetA” be able to access the web server on “ipsvm” on port 80 via its private IP address?

Your company has a set of virtual machines defined as part of a virtual network in Azure. The virtual machines are part of a subnet named “subnetA”. The subnet has been assigned the following Network Security group.
Inbound Security Rules

Outbound Security Rules

• Internet Information Services is installed on a Windows virtual machine named “ipsvm”
• This virtual machine is part of “subnetA”
• A web application has been set up on the server and has been configured to listen via the URLs “https://ipspecialist.net” and “https://ipspecialist.net”
Would another machine defined in the same subnet “subnetA” be able to access the web server on “ipsvm” on port 443 via its private IP address?

A company wants to synchronize their on-premises Active Directory with their Azure AD tenant. They want to set up a solution that would minimize the need for additional hardware deployment. They also want to ensure that they can keep their current login restrictions. It includes logon hours for their current Active Directory users. Which authentication method should they implement?

A company has a tenant and subscription created in Azure. They have the following users defined in Azure. The Multi-Factor authentication status is also mentioned for each user.

Would userA be requested to perform multi-factor authentication when trying to log into the Azure portal?

A company has a tenant and subscription created in Azure. They have the following users defined in Azure. The Multi-Factor authentication status is also mentioned for each user.

Would userB be requested to perform multi-factor authentication when trying to log into the Azure portal?

A company has a tenant and subscription created in Azure. They have the following users defined in Azure. The Multi-Factor authentication status is also mentioned for each user.

Would userC be requested to perform multi-factor authentication when trying to log into the Azure portal?

A company currently has several subscriptions. They are all associated with the same Azure AD tenant. You have to ensure that all subscriptions have the same role assignments. How can this be done effectively?

Your company has a virtual machine defined in Azure. An application written in .Net is going to be deployed to the Virtual machine. This application is going to retrieve a secret from an Azure Key Vault. The Key Vault and the secret are already in place. The interaction with the Azure Key Vault needs to be done via system identities.
You need to complete the below Azure CLI commands to set up the virtual machine and key vault.

Which of the following would go into Slot 1?

Your company has a virtual machine defined in Azure. An application written in .Net is going to be deployed to the Virtual machine. This application is going to retrieve a secret from an Azure Key Vault. The Key Vault and the secret are already in place. The interaction with the Azure Key Vault needs to be done via system identities.
You need to complete the below Azure CLI commands to set up the virtual machine and key vault.

Which of the following would go into Slot 2?

Your company has a virtual machine defined in Azure. An application written in .Net is going to be deployed to the Virtual machine. This application is going to retrieve a secret from an Azure Key Vault. The Key Vault and the secret are already in place. The interaction with the Azure Key Vault needs to be done via system identities.
You need to complete the below Azure CLI commands to set up the virtual machine and key vault.

Which of the following would go into Slot 3?

Your company has an Azure subscription. The Azure subscription has around 30 virtual machines that run either Windows Server 2012 R2 or Windows Server 2016. The company wants to ensure that Microsoft Antimalware is deployed to the virtual machines.
You connect to each virtual machine and add a Windows feature.
Would this fulfill the requirement?

Your company has an Azure subscription. The Azure subscription has around 30 virtual machines that run either Windows Server 2012 R2 or Windows Server 2016. The company wants to ensure that Microsoft Antimalware is deployed to the virtual machines.
You connect to each virtual machine and add a Windows role.
Would this fulfill the requirement?

Your company has an Azure subscription. The Azure subscription has around 30 virtual machines that run either Windows Server 2012 R2 or Windows Server 2016. The company wants to ensure that Microsoft Antimalware is deployed to the virtual machines.
You decide to add an extension to each virtual machine.
Would this fulfill the requirement?

Your company has a virtual network named “ipsnetwork” defined in Azure. Currently, there are virtual machines defined as part of the network in a subnet named “subnetA”. A new subnet named “subnetB” is created in the network. Here a virtual machine that would act as a firewall appliance is set up. You have to ensure that virtual machine traffic in the virtual network flows via the firewall appliance. Which of the following would you set up for this purpose?

You have two virtual networks in Azure. The networks are “ipsnetwork1” and “ipsnetwork2”. You have to establish communication between the virtual networks. You have to ensure that virtual machines in these virtual networks can communicate via their private IP addresses. Which of the following would you implement for this requirement?

You have a resource group named “ips-rg”. You need to ensure that a user named “ipsusr” is able to manage virtual networks in that resource group. You need to assign the least privilege for this solution. Which of the following RBAC role would you assign to the user?

Your company has a set of virtual machines set up in Azure. They want to ensure that IT administrators can request for access when they want to connect to the virtual machine. Which of the following could be used to fulfill this requirement?

You have a virtual network in Azure named “ips-rg-vnet” that has the following details.
Overview

Subnet

You have to deploy the Azure Firewall service to this virtual network.
Which of the following would you need to implement first for this virtual network?

You have a virtual network in Azure named “ips-rg-vnet” that has the following details.

Overview

Subnet

You have to deploy the Azure Firewall service to this virtual network.
You have to record all the Azure Firewall logs. Which of the following would you set for this requirement?

Your company has just created an Azure SQL database named “ipsdb”. You need to enable Advanced Threat detection for the database. You need to ensure that the alerts for threat detection are sent to a user defined in the Azure AD tenant.
Which of the following do you need to ensure that alerts are enabled for Advanced Threat Detection?

Your company has just created an Azure SQL database named “ipsdb”. You need to enable Advanced Threat detection for the database. You need to ensure that the alerts for threat detection are sent to a user defined in the Azure AD tenant.
Where would you configure the requirement?
You need to ensure the alerts for threat detection are sent to a user defined in the Azure AD tenant.

You have a Recovery Services vault named “ipsvault” in your Azure subscription. You need to ensure that the “AzureBackupReport” logs are stored so that analysis can be carried out later.
Which of the following would you set to ensure the logs are retained?

You have a Recovery Services vault named “ipsvault” in your Azure subscription. You need to ensure that the “AzureBackupReport” logs are stored so that analysis can be carried out at a later point in time.
Which of the following can you direct to the “AzureBackupReport” logs to? Choose three answers from the options given below.

You have a resource group in Azure named “ips-rg”. You need to ensure that no one has the ability to delete virtual networks from the resource group. The IT administrators should be able to add subnets to the virtual network. Which of the following would you implement to fulfill this requirement?

You have an Azure Key Vault named “ipsvault”. You have to ensure that a user named “ipsusr” has all the key permissions for the Key Vault. Which of the following needs to be set for this requirement?

You have an Azure Log Analytics workspace named “ipsworkspace2020”. You will be connecting several virtual machines to the log analytics workspace. You need to set the workspace to ensure that all system event logs from the virtual machines are logged in the workspace. Which of the following would you configure in the Log Analytics workspace for this requirement?

A company has an Azure Key Vault that has the following secrets defined.

When would a developer be able to retrieve the secret value of “ipspassword1”?

A company has an Azure Key Vault that has the following secrets defined.

When would a developer be able to retrieve the secret value of “ipspassword1”?

A company has an Azure subscription and a tenant associated with the subscription. They have Azure Premium P2 licenses. They have defined the following conditional access policy.
This is for a specific user-userB

The application for the conditional access policy is the “Microsoft Azure Management application”.

The condition specifies a location named “ipslocation” – This maps to an IP address range.

The following grant controls are in place.

The userB tries to log into the Azure Portal from an IP address belonging to the ipslocation” location. Would the user need to perform Multi-factor authentication?

A company has an Azure subscription and a tenant associated with the subscription. They have Azure Premium P2 licenses. They have defined the following conditional access policy.
This is for a specific user-userB

The application for the conditional access policy is the “Microsoft Azure Management application”.

The condition specifies a location named “ipslocation” – This maps to an IP address range.

The following grant controls are in place.

The userB tries to log into the Azure Portal from an IP address outside out of the “ipslocation” location. Would the user need to perform Multi-factor authentication?

A company has an Azure subscription and a tenant associated with the subscription. They have Azure Premium P2 licenses. They have defined the following conditional access policy.
This is for a specific user-userB

The application for the conditional access policy is the “Microsoft Azure Management application”.

The condition specifies a location named “ipslocation” – This maps to an IP address range.

The following grant controls are in place.

The userB tries to access a web service from the subscription from an IP address belonging to the “ipslocation” location. Would the user need to perform Multi-factor authentication?

A company has provisioned 2 virtual machines as part of their Azure subscription. One is based on the Windows Server 2016 image and the other Ubuntu 20.04 LTS. The virtual machine names are “ipsvm1 and “ipsvm2”. They then configure Automatic provisioning for the Log Analytics agent and provisioned 2 more virtual machines. Again, one is based on the Windows Server 2016 image and the other Ubuntu 18.04 LTS. The virtual machine names are “ipsvm3” and “ipsvm4. Which of the following machines would have the Log Analytics agent installed?

A company has the following virtual networks defined as part of their Azure subscription.
Name Region
ipsnetwork1 East US
ipsnetwork2 East US

The networks have the following subnets defined.
Name Virtual Network
SubnetA ipsnetwork1
SubnetB ipsnetwork1
SubnetC ipsnetwork2
SubnetD ipsnetwork2

The subnets have the following Network Security Groups defined.
Name Virtual Network
SubnetA ipsnsg1
SubnetB ipsnsg2
SubnetC ipsnsg3
SubnetD ipsnsg4

An Application Security Group has been defined in the East US region with subnetA of the virtual networks ipsnetwork1.
Which of the following can you refer to the Application Security Group?

A company has a number of virtual machines created in their Azure subscription. They want to ensure the following.
• No unwanted software runs on these virtual machines
• Block attempts to run malicious applications
Which of the following could be used to fulfill this requirement?

Case Study
Overview
IPSpecialist is an online training provider.
Existing Environment
The existing environment for IPSpecialist currently consists of the following resources
• An on-premise data centre that hosts an Active Directory forest named ipspecialist.com
• The Active Directory contains users from different departments – IT, Finance, HR
The following table shows the On-premise infrastructure. All servers are running in a virtualized environment
On-premise server name Type of Virtualization Virtual Machine name
ips-ser1 VMware vCenter server demovm
ips-ser2 Hyper-V host demovm-test

There are 2 web applications that are hosted on the On-premise environment. The complete details of web applications are given below
• Programming Language – .Net
• Average memory used for each application -1 GB
Proposed Environment
• IPSpecialist is looking towards purchasing an Azure subscription and setting up their environment in Azure
• The 2 web applications are going to be containerized using Docker. They are going to be deployed to Kubernetes clusters on Azure
• A Kubernetes cluster with the name of “ipsclsuter” is to be setup in Azure
• Active Directory users need to be synced onto Azure AD

The following Virtual Networks and subnets are going to be setup in Azure
Virtual Network name Address space
ips-net1 10.0.0.0/16
ips-net2 10.1.0.0/16

Subnet name Virtual Network name Address space
SubnetA ips-net1 10.0.1.0/24
SubnetB ips-net2 10.1.1.0/24

Requirements
• Ensure security is implemented across all Azure based deployments
• Minimize costs wherever possible
• There should be an encrypted connection between the On-premise data centre and the virtual Network ips-net2
• Incoming Network packets for a virtual machine created in SubnetA need to be captured
• Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication

You have to enable pod security policies on the AKS cluster. The cluster has been set up. All the required features and providers have been set up. You need to complete the below Azure CLI command to enable pod security policies.

Which of the following would go into Slot 1?

Case Study
Overview
IPSpecialist is an online training provider.
Existing Environment
The existing environment for IPSpecialist currently consists of the following resources
• An on-premise data centre that hosts an Active Directory forest named ipspecialist.com
• The Active Directory contains users from different departments – IT, Finance, HR
The following table shows the On-premise infrastructure. All servers are running in a virtualized environment
On-premise server name Type of Virtualization Virtual Machine name
ips-ser1 VMware vCenter server demovm
ips-ser2 Hyper-V host demovm-test

There are 2 web applications that are hosted on the On-premise environment. The complete details of web applications are given below
• Programming Language – .Net
• Average memory used for each application -1 GB
Proposed Environment
• IPSpecialist is looking towards purchasing an Azure subscription and setting up their environment in Azure
• The 2 web applications are going to be containerized using Docker. They are going to be deployed to Kubernetes clusters on Azure
• A Kubernetes cluster with the name of “ipsclsuter” is to be setup in Azure
• Active Directory users need to be synced onto Azure AD

The following Virtual Networks and subnets are going to be setup in Azure
Virtual Network name Address space
ips-net1 10.0.0.0/16
ips-net2 10.1.0.0/16

Subnet name Virtual Network name Address space
SubnetA ips-net1 10.0.1.0/24
SubnetB ips-net2 10.1.1.0/24

Requirements
• Ensure security is implemented across all Azure based deployments
• Minimize costs wherever possible
• There should be an encrypted connection between the On-premise data centre and the virtual Network ips-net2
• Incoming Network packets for a virtual machine created in SubnetA need to be captured
• Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication

You have to enable pod security policies on the AKS cluster. The cluster has been set up. All the required features and providers have been set up. You need to complete the below Azure CLI command to enable pod security policies.

Which of the following would go into Slot 2?

Case Study
Overview
IPSpecialist is an online training provider.
Existing Environment
The existing environment for IPSpecialist currently consists of the following resources
• An on-premise data centre that hosts an Active Directory forest named ipspecialist.com
• The Active Directory contains users from different departments – IT, Finance, HR
The following table shows the On-premise infrastructure. All servers are running in a virtualized environment
On-premise server name Type of Virtualization Virtual Machine name
ips-ser1 VMware vCenter server demovm
ips-ser2 Hyper-V host demovm-test

There are 2 web applications that are hosted on the On-premise environment. The complete details of web applications are given below
• Programming Language – .Net
• Average memory used for each application -1 GB
Proposed Environment
• IPSpecialist is looking towards purchasing an Azure subscription and setting up their environment in Azure
• The 2 web applications are going to be containerized using Docker. They are going to be deployed to Kubernetes clusters on Azure
• A Kubernetes cluster with the name of “ipsclsuter” is to be setup in Azure
• Active Directory users need to be synced onto Azure AD

The following Virtual Networks and subnets are going to be setup in Azure
Virtual Network name Address space
ips-net1 10.0.0.0/16
ips-net2 10.1.0.0/16

Subnet name Virtual Network name Address space
SubnetA ips-net1 10.0.1.0/24
SubnetB ips-net2 10.1.1.0/24

Requirements
• Ensure security is implemented across all Azure based deployments
• Minimize costs wherever possible
• There should be an encrypted connection between the On-premise data centre and the virtual Network ips-net2
• Incoming Network packets for a virtual machine created in SubnetA need to be captured
• Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication

You have to implement the following requirement.
“There should be an encrypted connection between the On-premise data center and the Virtual Network ips-net2.”
You decide to implement virtual network peering.
Would this fulfill the requirement?

Case Study
Overview
IPSpecialist is an online training provider.
Existing Environment
The existing environment for IPSpecialist currently consists of the following resources
• An on-premise data centre that hosts an Active Directory forest named ipspecialist.com
• The Active Directory contains users from different departments – IT, Finance, HR
The following table shows the On-premise infrastructure. All servers are running in a virtualized environment
On-premise server name Type of Virtualization Virtual Machine name
ips-ser1 VMware vCenter server demovm
ips-ser2 Hyper-V host demovm-test

There are 2 web applications that are hosted on the On-premise environment. The complete details of web applications are given below
• Programming Language – .Net
• Average memory used for each application -1 GB
Proposed Environment
• IPSpecialist is looking towards purchasing an Azure subscription and setting up their environment in Azure
• The 2 web applications are going to be containerized using Docker. They are going to be deployed to Kubernetes clusters on Azure
• A Kubernetes cluster with the name of “ipsclsuter” is to be setup in Azure
• Active Directory users need to be synced onto Azure AD

The following Virtual Networks and subnets are going to be setup in Azure
Virtual Network name Address space
ips-net1 10.0.0.0/16
ips-net2 10.1.0.0/16

Subnet name Virtual Network name Address space
SubnetA ips-net1 10.0.1.0/24
SubnetB ips-net2 10.1.1.0/24

Requirements
• Ensure security is implemented across all Azure based deployments
• Minimize costs wherever possible
• There should be an encrypted connection between the On-premise data centre and the virtual Network ips-net2
• Incoming Network packets for a virtual machine created in SubnetA need to be captured
• Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication

You have to implement the following requirement.
“There should be an encrypted connection between the On-premise data center and the Virtual Network ips-net2.”
You decide to implement virtual network service endpoints.
Would this fulfill the requirement?

Case Study
Overview
IPSpecialist is an online training provider.
Existing Environment
The existing environment for IPSpecialist currently consists of the following resources
• An on-premise data centre that hosts an Active Directory forest named ipspecialist.com
• The Active Directory contains users from different departments – IT, Finance, HR
The following table shows the On-premise infrastructure. All servers are running in a virtualized environment
On-premise server name Type of Virtualization Virtual Machine name
ips-ser1 VMware vCenter server demovm
ips-ser2 Hyper-V host demovm-test

There are 2 web applications that are hosted on the On-premise environment. The complete details of web applications are given below
• Programming Language – .Net
• Average memory used for each application -1 GB
Proposed Environment
• IPSpecialist is looking towards purchasing an Azure subscription and setting up their environment in Azure
• The 2 web applications are going to be containerized using Docker. They are going to be deployed to Kubernetes clusters on Azure
• A Kubernetes cluster with the name of “ipsclsuter” is to be setup in Azure
• Active Directory users need to be synced onto Azure AD

The following Virtual Networks and subnets are going to be setup in Azure
Virtual Network name Address space
ips-net1 10.0.0.0/16
ips-net2 10.1.0.0/16

Subnet name Virtual Network name Address space
SubnetA ips-net1 10.0.1.0/24
SubnetB ips-net2 10.1.1.0/24

Requirements
• Ensure security is implemented across all Azure based deployments
• Minimize costs wherever possible
• There should be an encrypted connection between the On-premise data centre and the virtual Network ips-net2
• Incoming Network packets for a virtual machine created in SubnetA need to be captured
• Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication

You have to implement the following requirement.
“There should be an encrypted connection between the On-premise data center and the Virtual Network ips-net2.”
You decide to implement a site-to-site VPN connection.
Would this fulfill the requirement?

Case Study
Overview
IPSpecialist is an online training provider.
Existing Environment
The existing environment for IPSpecialist currently consists of the following resources
• An on-premise data centre that hosts an Active Directory forest named ipspecialist.com
• The Active Directory contains users from different departments – IT, Finance, HR
The following table shows the On-premise infrastructure. All servers are running in a virtualized environment
On-premise server name Type of Virtualization Virtual Machine name
ips-ser1 VMware vCenter server demovm
ips-ser2 Hyper-V host demovm-test

There are 2 web applications that are hosted on the On-premise environment. The complete details of web applications are given below
• Programming Language – .Net
• Average memory used for each application -1 GB
Proposed Environment
• IPSpecialist is looking towards purchasing an Azure subscription and setting up their environment in Azure
• The 2 web applications are going to be containerized using Docker. They are going to be deployed to Kubernetes clusters on Azure
• A Kubernetes cluster with the name of “ipsclsuter” is to be setup in Azure
• Active Directory users need to be synced onto Azure AD

The following Virtual Networks and subnets are going to be setup in Azure
Virtual Network name Address space
ips-net1 10.0.0.0/16
ips-net2 10.1.0.0/16

Subnet name Virtual Network name Address space
SubnetA ips-net1 10.0.1.0/24
SubnetB ips-net2 10.1.1.0/24

Requirements
• Ensure security is implemented across all Azure based deployments
• Minimize costs wherever possible
• There should be an encrypted connection between the On-premise data centre and the virtual Network ips-net2
• Incoming Network packets for a virtual machine created in SubnetA need to be captured
• Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication

You need to fulfill the below requirement.
Incoming Network packets for a virtual machine created in SubnetA need to be captured
Which of the following tool would you use for this requirement?

Case Study
Overview
IPSpecialist is an online training provider.
Existing Environment
The existing environment for IPSpecialist currently consists of the following resources
• An on-premise data centre that hosts an Active Directory forest named ipspecialist.com
• The Active Directory contains users from different departments – IT, Finance, HR
The following table shows the On-premise infrastructure. All servers are running in a virtualized environment
On-premise server name Type of Virtualization Virtual Machine name
ips-ser1 VMware vCenter server demovm
ips-ser2 Hyper-V host demovm-test

There are 2 web applications that are hosted on the On-premise environment. The complete details of web applications are given below
• Programming Language – .Net
• Average memory used for each application -1 GB
Proposed Environment
• IPSpecialist is looking towards purchasing an Azure subscription and setting up their environment in Azure
• The 2 web applications are going to be containerized using Docker. They are going to be deployed to Kubernetes clusters on Azure
• A Kubernetes cluster with the name of “ipsclsuter” is to be setup in Azure
• Active Directory users need to be synced onto Azure AD

The following Virtual Networks and subnets are going to be setup in Azure
Virtual Network name Address space
ips-net1 10.0.0.0/16
ips-net2 10.1.0.0/16

Subnet name Virtual Network name Address space
SubnetA ips-net1 10.0.1.0/24
SubnetB ips-net2 10.1.1.0/24

Requirements
• Ensure security is implemented across all Azure based deployments
• Minimize costs wherever possible
• There should be an encrypted connection between the On-premise data centre and the virtual Network ips-net2
• Incoming Network packets for a virtual machine created in SubnetA need to be captured
• Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication

You need to fulfill the below requirement.
Users who log into the Azure Portal from untrusted locations need to authenticate using Multi-factor authentication.

Which of the following would you use to fulfill the requirement?
A. Conditional Access Policies
B. Azure Security Center
C. Azure Policies
D. Azure Privileged Identity Management

You have an Azure storage account named “ipsstore2020”. You go ahead and create the following shared access signature.

Can a user using the Azure storage explorer from a workstation with an IP address of 12.10.10.100 on 10th September 2019 access the Blob service?

You have an Azure storage account named “ipsstore2020”. You go ahead and create the following shared access signature.

Can a user using the Azure storage explorer from a workstation with an IP address of 12.10.10.100 on 10th October 2019 access the Blob service?

You have an Azure storage account named “ipsstore2020”. You go ahead and create the following shared access signature.

If key1 for the storage account is rotated, can a user using the Azure storage explorer from a workstation with an IP address of 12.10.10.100 on 10th September 2019 access the Blob service?

You have created an Azure Key Vault in your subscription named “ipsvault”. You have a secret named “ipspassword”. You have an application registered in Azure AD. You have to ensure the application can use the secret defined in Azure Key Vault.
Which one of the following would you implement to fulfill this requirement?

You have an Azure SQL database created as part of the subscription, a column in a tale has been encrypted using the “Always Encrypted” feature. It needs to be ensured that an application can retrieve and decrypt data in database. Which of the following would be needed for the application to decrypt the data in the column? Choose the answers from the options given below.

You have a virtual machine defined as part of an Azure subscription. The virtual machine runs Windows Server 2016. You need to encrypt the virtual machine disks using Azure Disk Encryption. Which of the following would you implement for this requirement? Choose 3 answers from the options given below.

You plan to deploy Azure container instances. You have a containerized application that validates credit cards. The application is comprised of two containers: an application container and a validation container. The application container is monitored by the validation container. The validation container performs security checks by making requests to the application container and waiting for responses after every transaction. You need to ensure that the application container and the validation container are scheduled to be deployed together. The containers must communicate to each other only on ports that are not externally exposed.
What should you include in the deployment?

You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use automatically generated service principal for the AKS cluster to authenticate to the Azure Container Registry.
What should you create?