AZ-500 Practice Test 10 — 10 Questions

Question 1

Your organization uses Azure Virtual Network Manager (AVNM) to manage network groups. You need to ensure that all virtual networks in a network group are automatically peered with a hub VNet. Which AVNM configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a connectivity configuration with Hub and Spoke topology. To automatically peer all virtual networks in a network group with a hub VNet, you need a connectivity configuration with Hub and Spoke topology. AVNM's connectivity configuration defines the network topology (e.g., hub-and-spoke or mesh) and automatically creates the necessary VNet peering connections between the hub and all spoke VNets in the assigned network group, without manual peering setup.

Answer

Create a network group and assign it to a connectivity configuration

Answer

Create a security admin configuration

Answer

Use Azure Policy to enforce peering

Question 2

You need to encrypt an Azure Storage account at rest using a customer-managed key stored in Azure Key Vault. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys. Azure Storage Service Encryption (SSE) encrypts data at rest automatically. By enabling customer-managed keys (CMK) in Azure Key Vault, you can control the encryption key used for SSE, meeting the requirement to encrypt the storage account with a key you manage.

Answer

Azure Information Protection

Answer

Azure Confidential Computing

Answer

Azure Disk Encryption

Question 3

You are a security engineer for Contoso. The company uses Azure Firewall for all inbound and outbound traffic. To prevent misconfiguration, you assign the Azure Policy shown in the exhibit at the management group scope. After assignment, a network administrator reports that they cannot create a new subnet in an existing virtual network. The subnet creation fails with a 'deny' policy error. You need to allow subnet creation while still blocking NSG rule changes. What should you do?

Accepted Answer

Modify the policy rule to remove the subnet condition from the anyOf array.. The policy rule uses an `anyOf` array that includes conditions for both NSG rule changes and subnet creation. By removing the subnet condition from the `anyOf` array, the policy will no longer evaluate subnet creation against the deny effect, allowing subnets to be created while still blocking NSG rule modifications. This directly addresses the administrator's issue without weakening the security posture for NSG changes.

Answer

Change the effect to 'audit' instead of 'deny'.

Answer

Add an exemption for the virtual network resource group.

Answer

Remove the policy assignment and create a custom role to block subnet creation.

Question 4

You have an Azure Storage account that contains sensitive documents. You need to generate a time-limited, secure URL that allows a specific user to download a file without requiring storage account keys. What should you use?

Accepted Answer

Shared Access Signature (SAS). A Shared Access Signature (SAS) is the correct choice because it provides delegated, time-limited access to a specific storage resource (e.g., a blob) without exposing the storage account keys. You can scope the SAS to a specific user by using a stored access policy or by generating a service SAS with fine-grained permissions, and you can enforce expiration and allowed IP ranges. This meets the requirement of a secure, time-bound URL for a single file download.

Answer

Azure Front Door custom domain

Answer

Storage account access key

Answer

Azure RBAC role assignment

Question 5

A Defender for Cloud recommendation is valid for most subscriptions but not for a legacy subscription with an approved exception. The team wants secure score to reflect the exception without disabling the recommendation everywhere. What should they do?

Accepted Answer

Create an exemption for the affected scope with a justification. Azure Policy exemptions allow you to exclude a specific scope (e.g., a subscription or resource group) from a policy or initiative effect while still having the policy enforced elsewhere. By creating an exemption for the legacy subscription with a justification, the Defender for Cloud recommendation remains active for all other subscriptions, and the secure score calculation will correctly reflect the exception without disabling the recommendation globally.

Answer

Delete the built-in initiative from the management group

Answer

Change the recommendation severity to Low

Answer

Disable Defender for Cloud on the legacy subscription

Question 6

A company is enabling Azure Disk Encryption (ADE) on Windows virtual machines. They have enabled soft-delete on Azure Key Vault and configured a Key Encryption Key (KEK). However, the disk encryption fails with an error indicating that the key vault does not have the required permissions. What is the most likely missing configuration?

Accepted Answer

The Key Vault access policy does not grant the Azure Disk Encryption service principal the 'unwrap key' and 'wrap key' permissions.. Azure Disk Encryption (ADE) requires the Azure Disk Encryption service principal (also known as the Azure Disk Encryption service) to have 'unwrap key' and 'wrap key' permissions on the Key Vault. These permissions allow the service to encrypt and decrypt the disk encryption keys using the Key Encryption Key (KEK). Without these specific cryptographic permissions, the encryption operation fails, even if soft-delete and a KEK are correctly configured.

Answer

The Key Vault firewall is blocking the Azure platform.

Answer

The VM does not have a managed identity assigned.

Answer

The KEK is in a different Azure region than the VM.

Question 7

A company plans to migrate on-premises SQL Server databases to Azure SQL Managed Instance. The security team requires that all data at rest be encrypted using customer-managed keys stored in Azure Key Vault. Which feature should be enabled?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault is the correct choice because it encrypts the entire database at rest using a symmetric key, and the option to use customer-managed keys (CMK) in Azure Key Vault satisfies the security team's requirement for full control over encryption keys. TDE performs real-time I/O encryption and decryption of data and log files, and when combined with Azure Key Vault, it supports bring-your-own-key (BYOK) scenarios, ensuring compliance with regulatory mandates for customer-managed key storage.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Answer

Always Encrypted with secure enclaves

Question 8

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

Accepted Answer

No, Azure does not support CMK from a different region than the storage account.. Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.

Answer

Yes, but the storage account must use a different key vault per region; no other implications.

Answer

Yes, but you must enable cross-region replication for the key vault and pay additional costs.

Answer

Yes, but you must use a managed identity from the storage account's region to access the key vault.

Question 9

A healthcare organization stores sensitive patient data in Azure SQL Database. They need to encrypt specific columns containing medical history so that even database administrators with highly privileged roles, such as 'sysadmin', cannot view the plaintext data. Additionally, they need to support complex queries on the encrypted data, including pattern matching and range comparisons. Which encryption technology should they implement?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves is correct because it encrypts specific columns at the client side, ensuring that even database administrators with sysadmin privileges cannot view the plaintext data. The secure enclave feature allows computations (such as pattern matching and range comparisons) to be performed on the encrypted data inside a trusted execution environment, which is required by the question's need for complex queries on encrypted columns.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Answer

Row-Level Security

Question 10

You need to securely store secrets, such as connection strings and API keys, for use by an Azure Functions app. The solution must automatically rotate the secrets and audit access. What should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like connection strings and API keys, with built-in support for automatic rotation via integration with Azure Key Vault references in Azure Functions and access auditing through diagnostic logs and Azure Monitor. This meets the requirements of secure storage, automated secret rotation, and audit trail generation.

Answer

Azure Blob Storage with encryption

Answer

Managed Identity

Answer

Application settings in the function app configuration