AZ-500 Practice Test 36 — 15 Questions

Question 1

You are deploying a three-tier application on Azure VMs. The web tier must be accessible from the internet, but the application and database tiers must only accept traffic from the web tier. You need to implement network segmentation using Azure networking components. What is the most secure and manageable solution?

Accepted Answer

Use separate subnets for each tier in the same VNet and configure NSGs to allow traffic only from the previous tier.. Option B is correct because placing each tier in separate subnets with NSGs restricting traffic to the previous tier provides network segmentation and is manageable. Option A is wrong because VNet peering connects separate VNets but doesn't provide fine-grained control within a single VNet. Option C is wrong because a single subnet with NSGs is less secure due to lack of isolation. Option D is wrong because Azure Firewall is more expensive and complex than NSGs for this scenario.

Answer

Use a single subnet and configure NSGs on VM NICs to restrict traffic.

Answer

Use VNet peering to connect separate VNets for each tier and use NSGs.

Answer

Use a single VNet with one subnet and use Azure Firewall to filter traffic between tiers.

Question 2

You need to ensure that an Azure Storage account is accessible only from a specific virtual network (VNet) and only over HTTPS. You also want to deny access from any public IP. What should you configure?

Accepted Answer

Configure storage firewall rules to deny all public IPs, add the VNet as a service endpoint, and enable 'Secure transfer required' (HTTPS).. Option D is correct because you can configure firewall rules to deny all public IPs, add the VNet as a service endpoint, and enable the 'Secure transfer required' property. Option A is wrong because NSG on the subnet is not sufficient to block public internet access to the storage account. Option B is wrong because private endpoint creates a private IP, but you also need to block public access. Option C is wrong because SAS token does not restrict network location.

Answer

Generate a SAS token and require HTTPS.

Answer

Configure a Network Security Group (NSG) on the subnet to deny all inbound traffic.

Answer

Configure a private endpoint for the storage account and disable public network access.

Question 3

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Accepted Answer

Implement Azure Web Application Firewall (WAF). Option B and Option C are correct. Using parameterized queries prevents SQL injection by separating data from code. Web Application Firewall (WAF) can filter malicious input before it reaches the database. Option A is wrong because TDE encrypts data at rest, not preventing injection. Option D is wrong because firewall rules control network access, not injection. Option E is wrong because Always Encrypted encrypts columns but does not prevent injection.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure Azure SQL Database firewall rules

Answer

Enable Always Encrypted for sensitive columns

Question 4

You are designing a backup strategy for Azure Virtual Machines. Which THREE features should you enable to ensure recoverability and security?

Accepted Answer

Soft delete for backup data. Option A, Option B, and Option D are correct. Azure Backup provides automated backups. Soft delete prevents malicious deletion of backups. Encryption at rest secures backup data. Option C is wrong because geo-redundant storage (GRS) is a replication option, not a backup feature. Option E is wrong because Azure Site Recovery is for disaster recovery, not backup.

Answer

Geo-redundant storage (GRS)

Answer

Azure Site Recovery

Question 5

You need to secure an Azure Storage account that will host sensitive data. Which TWO configurations should you implement?

Accepted Answer

Enable 'Secure transfer required'. Option A and Option C are correct. Enabling 'Secure transfer required' enforces HTTPS. Using private endpoint ensures traffic stays within Microsoft network. Option B is wrong because a SAS token is for delegated access, not a security configuration. Option D is wrong because public network access should be disabled for sensitive data. Option E is wrong because Azure Files is a service, not a security configuration.

Answer

Generate a shared access signature (SAS)

Answer

Allow public network access from all networks

Answer

Enable Azure Files

Question 6

You need to encrypt an Azure Storage account at rest using a customer-managed key stored in Azure Key Vault. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys. Azure Storage Service Encryption (SSE) with customer-managed keys allows you to use your own keys from Key Vault. Option C is correct. Option A is wrong because Azure Disk Encryption is for VMs. Option B is wrong because Azure Information Protection is for classification. Option D is wrong because Azure Confidential Computing protects data in use.

Answer

Azure Information Protection

Answer

Azure Confidential Computing

Answer

Azure Disk Encryption

Question 7

Your company hosts a web application on Azure Virtual Machines. You need to ensure that all disks attached to the VMs are encrypted. You plan to use Azure Disk Encryption. What should you configure first?

Accepted Answer

Create an Azure Key Vault and configure a key encryption key. Azure Disk Encryption requires a Key Vault and a key encryption key (KEK) or secret. Option B is correct. Option A is wrong because Managed Identities are used for authentication, not for encryption. Option C is wrong because network security groups are unrelated. Option D is wrong because Azure Backup is for backup, not encryption.

Answer

Assign a system-assigned managed identity to the VMs

Answer

Configure a network security group to allow encryption traffic

Answer

Enable Azure Backup on the VMs

Question 8

Refer to the exhibit. You are reviewing the ARM template snippet for a managed disk. You need to ensure the disk uses a customer-managed key (CMK) from Azure Key Vault. However, you notice the deployment fails because the key version is specified. What is the likely issue?

Accepted Answer

The keyversion should be omitted to allow automatic rotation.. Option C is correct. When using CMK for managed disks, you should omit the key version to allow automatic key rotation. Specifying a version locks the key and causes rotation to break. Option A is wrong because the key vault URI is correct. Option B is wrong because the key name is correct. Option D is wrong because the key source is correct.

Answer

The keySource should be 'Microsoft.Storage' instead.

Answer

The keyvaulturi is incorrect.

Answer

The keyname is incorrect.

Question 9

You need to ensure that an Azure Key Vault is accessible only from a specific virtual network and that all operations are logged. What should you configure?

Accepted Answer

Key Vault firewall and virtual network service endpoints, and diagnostic settings. Key Vault firewall and virtual network service endpoints restrict network access. Diagnostic settings enable logging. Option A is correct. Option B is wrong because RBAC controls permissions, not network access. Option C is wrong because soft-delete is for recovery. Option D is wrong because Azure Policy can enforce settings but does not restrict network access to the vault.

Answer

Azure RBAC roles and diagnostic settings

Answer

Soft-delete and purge protection, and diagnostic settings

Answer

Azure Policy and diagnostic settings

Question 10

You are designing a solution to store sensitive documents in Azure Blob Storage. The documents must be encrypted at rest using a customer-managed key that is automatically rotated every 90 days. Microsoft Entra ID must be used to control access to the key. What should you use?

Accepted Answer

Azure Storage Service Encryption (SSE) with a customer-managed key stored in Azure Key Vault and configure key rotation.. Azure Key Vault with customer-managed keys and automatic rotation via Azure Policy or key rotation configuration meets the requirements. Option D is correct. SSE with PMK does not allow customer-managed keys. CSE uses client-side encryption, not server-side. Infrastructure encryption is additional encryption but does not involve customer key management.

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Answer

Client-side encryption (CSE) using Azure Key Vault.

Question 11

You need to backup Azure SQL Managed Instance databases to a separate region for disaster recovery. Which Azure service should you use?

Accepted Answer

Azure Backup with geo-redundant storage. Option B is correct because Azure Backup supports long-term retention and geo-restore for SQL Managed Instance. Option A is wrong because active geo-replication is for continuous replication, not backup. Option C is wrong because Azure Site Recovery is for VM replication. Option D is wrong because Azure Storage replication is for storage accounts, not SQL.

Answer

Active geo-replication

Answer

Geo-redundant storage (GRS) for Azure Storage

Answer

Azure Site Recovery

Question 12

Your organization uses Azure Storage for sensitive financial data. You need to restrict access to storage accounts based on the client's IP address. Which Azure Storage service feature should you configure?

Accepted Answer

Firewalls and virtual networks. Firewalls and virtual networks allow you to restrict access to storage accounts based on IP rules. Option B is correct. Option A (SAS) is for delegated access, not IP restriction. Option C (Private Link) is for private network access. Option D (Azure AD RBAC) controls data plane operations but not IP-level filtering.

Answer

Shared access signatures (SAS)

Answer

Azure Private Link

Answer

Azure AD role-based access control

Question 13

You run the above PowerShell script to change the access tier of all block blobs in the 'data' container from Cool to Hot. However, you receive an error that the operation is not allowed. What is the most likely reason?

Accepted Answer

The storage account's firewall is blocking the request from the current IP address.. The script does not include the -ErrorAction Stop or handle the case where the storage account firewall is blocking access. However, the most common issue is that the storage account requires Azure AD authentication and the script uses the storage account key (via context without explicit Azure AD). But the error message 'operation not allowed' suggests that the storage account has a firewall that denies the request. Option D is correct. Option A: BlobType is correct. Option B: AccessTier change is allowed. Option C: The script does not use SAS.

Answer

The script incorrectly filters for BlockBlob instead of PageBlob.

Answer

The storage account is using a shared access signature (SAS) token that has expired.

Answer

The access tier cannot be changed from Cool to Hot after 30 days of creation.

Question 14

You run the above PowerShell script. What is the effect on the storage account?

Accepted Answer

Block blobs with the prefix 'logs' are deleted after 30 days. Option B is correct: the script creates a management policy rule that deletes block blobs with prefix 'logs' after 30 days since last modification. Option A is wrong because it deletes after 30 days, not 90. Option C is wrong because the action is delete, not tier. Option D is wrong because it applies only to block blobs with prefix 'logs'.

Answer

Block blobs with the prefix 'logs' are deleted after 90 days

Answer

All block blobs are deleted after 30 days

Answer

Block blobs with the prefix 'logs' are moved to cool tier after 30 days

Question 15

Refer to the exhibit. You are analyzing the Always Encrypted configuration for an Azure SQL Database. The SSN column uses randomized encryption, and the CreditCard column uses deterministic encryption. Which statement is true regarding querying these columns?

Accepted Answer

Only the CreditCard column supports equality searches.. Option B is correct. Deterministic encryption allows equality comparisons (e.g., WHERE CreditCard = 'value') because it always generates the same ciphertext for a given plaintext. Randomized encryption does not allow any operations on encrypted data. Option A is wrong because randomized encryption does not allow equality checks. Option C is wrong because deterministic encryption does not allow pattern matching. Option D is wrong because both columns support point lookups via equality; randomized does not.

Answer

Both columns support equality searches.

Answer

Both columns support pattern matching with LIKE.

Answer

Only the SSN column supports point lookups.