Plan and Implement Advanced Security for Compute AZ-500 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   Your company uses Azure Container Registry (ACR) to store images for multiple AKS clusters. You need to ensure that each AKS cluster can pull images only from its own repository within the registry, and that no other Azure service can access the registry. What should you do?

   • ACreate a repository-scoped token for each AKS cluster and configure the cluster to use that token for image pulls.
   • BAssign the 'AcrPull' role to each cluster's managed identity and use Azure RBAC to restrict access to specific repositories.
   • CUse a shared admin account for all clusters and rely on network rules to restrict access.
   • DCreate a separate ACR for each AKS cluster.
   Reveal Solution Discussion Select an answer first
2. 32expert · medium

   Your organization has a production AKS cluster that pulls images from an Azure Container Registry (ACR). The security team wants to ensure that only the AKS cluster can pull images from the ACR, and that the ACR is not accessible from the internet. They also want to detect if any malicious images are pulled. Which solution should you implement?

   • AUse ACR firewall rules to allow the AKS subnet and use admin credentials for the cluster
   • BUse ACR repository-scoped tokens and enable Azure Monitor for Containers
   • CEnable the ACR private endpoint and assign the AcrPull role to the AKS cluster's kubelet identity, and enable Microsoft Defender for Containers
   • DEnable ACR service endpoint and assign AcrPush to the AKS cluster
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which Azure feature encrypts data at rest at the host level, providing encryption for temporary disks and OS/data disks without requiring application changes?

   • AEncryption at host
   • BAzure Disk Encryption
   • CConfidential disk encryption
   • DAzure Storage Service Encryption
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   Your security team wants to reduce the attack surface of a set of domain-joined Windows VMs that are currently accessible via RDP from the internet. They want to allow RDP only when an administrator requests access, and only for a limited time. You need to implement a solution that requires minimal ongoing administrative effort. What should you do?

   • AEnable just-in-time (JIT) VM access in Microsoft Defender for Cloud and configure the RDP port with an approved time window.
   • BUse Azure Bastion and require administrators to use the Bastion service for RDP.
   • CCreate an NSG rule that allows RDP from a specific IP range and update it manually each time access is needed.
   • DConfigure Azure AD Conditional Access to require multi-factor authentication for RDP.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   Your organization runs a production AKS cluster and wants to detect suspicious activity, such as attempts to run privileged containers or access the Kubernetes API server from unexpected IPs. You need to enable threat detection for the cluster. What should you do?

   • AConfigure Azure Policy to enforce that all pods run as non-root.
   • BEnable Microsoft Defender for Containers in Microsoft Defender for Cloud.
   • CEnable Azure AD pod-managed identity for the cluster.
   • DDeploy Azure Sentinel and connect the AKS diagnostic settings to it.
   Reveal Solution Discussion Select an answer first