AZ-500 Practice Test 37 — 15 Questions

Question 1

Your company uses Azure SQL Managed Instance. You need to ensure that all connections from clients use TLS 1.2 or higher. What should you configure?

Accepted Answer

Set the 'Minimal TLS version' property to 1.2 in the Managed Instance settings. Azure SQL Managed Instance enforces TLS at the gateway level. To require a minimum TLS version, you can set the 'Minimal TLS version' property to 1.2. Option B is correct. Option A is wrong because firewall rules control IP access. Option C is wrong because encrypting connections is separate from TLS version. Option D is wrong because Azure Policy can audit but not enforce on the instance itself.

Answer

Configure a firewall rule to block non-TLS 1.2 connections

Answer

Create an Azure Policy to require TLS 1.2 for all SQL Managed Instances

Answer

Enable the 'Force encryption' option on the client side

Question 2

You need to prevent data from being exfiltrated from an Azure SQL Database by unauthorized users. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) policies can be applied to SQL Database to detect and prevent sensitive data exfiltration. Option B is correct. Information Protection focuses on classification and labeling. Insider Risk Management detects risky user activities. eDiscovery is for legal discovery.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Question 3

Your company uses Azure Blob Storage to store sensitive documents. You need to prevent data exfiltration by ensuring that all access to the storage account is through Microsoft's private network. What should you configure?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. Option C is correct because Azure Private Link with Private Endpoint ensures that traffic to the storage account stays within the Microsoft backbone network. Service endpoints also keep traffic on the Azure backbone but do not prevent exfiltration if the storage account is exposed to the internet. Option A is wrong because service endpoints do not block internet access. Option B is wrong because firewall rules only restrict IPs, but traffic may still leave Azure backbone. Option D is wrong because network security groups (NSGs) are for subnets, not storage accounts.

Answer

Apply a network security group (NSG) to the subnet with a deny rule for internet traffic.

Answer

Set the firewall to deny all and add a rule to allow only your VNet's public IP.

Answer

Enable service endpoints and configure a service endpoint policy.

Question 4

A company plans to migrate on-premises SQL Server databases to Azure SQL Managed Instance. The security team requires that all data at rest be encrypted using customer-managed keys stored in Azure Key Vault. Which feature should be enabled?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault is the feature for encrypting Azure SQL data at rest with customer-controlled keys. Option A is correct. Option B (Always Encrypted) encrypts data in use and at rest, but does not use Key Vault for TDE. Option C (Dynamic Data Masking) masks data to non-privileged users. Option D (Row-Level Security) restricts row access.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Answer

Always Encrypted with secure enclaves

Question 5

You have an Azure SQL Managed Instance that hosts a line-of-business application. The application requires that all connections use Windows Authentication. You need to ensure that the authentication is secure and that the managed instance can integrate with on-premises Active Directory. What should you configure?

Accepted Answer

Configure Azure AD Kerberos authentication and set up a trust with on-premises Active Directory. Option C is correct: Azure SQL Managed Instance supports Windows Authentication via Kerberos, and Azure AD Kerberos authentication allows on-premises AD integration. Option A (Azure AD passwordless) is for Azure AD, not on-premises AD. Option B (Always Encrypted) is for column encryption. Option D (VNet integration) is for networking.

Answer

Enable Always Encrypted with secure enclaves

Answer

Enable Azure AD authentication and configure passwordless sign-in

Answer

Configure VNet integration with a site-to-site VPN

Question 6

You need to protect Azure VM disks from unauthorized snapshot creation. Which configuration should you implement?

Accepted Answer

Apply a 'CanNotDelete' resource lock on the disk resource.. Azure Resource Locks prevent deletion or modification of resources, including snapshot creation. Option B is wrong because Azure Backup does not prevent snapshots. Option C is wrong because RBAC can allow snapshot creation if permissions are granted. Option D is wrong because Azure Policy can audit but not prevent.

Answer

Assign the 'Reader' role to all users on the disk.

Answer

Configure Azure Backup for the VM.

Answer

Use Azure Policy to audit snapshot creation.

Question 7

You are designing a backup strategy for Azure Virtual Machines that host a critical database. Compliance requires that backups be stored in a separate Azure region and be immutable for 90 days. What should you use?

Accepted Answer

Azure Backup with Geo-Redundant Storage (GRS) and enable soft delete. Azure Backup with geo-redundant storage (GRS) stores backups in a paired region. Immutable storage for Azure Backup is achieved by enabling soft delete and using backup policies with retention that prevents deletion. Option B is correct. Option A is incorrect because LRS does not provide cross-region storage. Option C is incorrect because Azure Site Recovery is for disaster recovery, not long-term backup. Option D is incorrect because Azure Disk Encryption encrypts disks but does not provide geo-redundancy or immutability.

Answer

Azure Backup with Locally Redundant Storage (LRS) and a retention policy of 90 days

Answer

Azure Disk Encryption with a backup policy stored in a different region

Answer

Azure Site Recovery with a recovery plan and retention of 90 days

Question 8

Refer to the exhibit. You run the Azure CLI command to create a storage account. After creation, you need to ensure that the storage account can only be accessed using TLS 1.2. Does the command achieve this?

Accepted Answer

Yes, because --min-tls-version 1.2 sets the minimum TLS version to 1.2.. Option A is correct. The --min-tls-version 1.2 parameter ensures that the minimum TLS version is 1.2, which effectively requires TLS 1.2 or higher. Option B is wrong because --https-only true enforces HTTPS but does not set a minimum TLS version. Option C is wrong because the command does include the parameter. Option D is wrong because the command is correct.

Answer

No, because the command does not include any TLS version parameter.

Answer

Yes, because the default minimum TLS version is 1.2.

Answer

No, because --https-only true only enforces HTTPS without specifying TLS version.

Question 9

You are designing a secure backup strategy for Azure Virtual Machines. The backup data must be encrypted at rest and in transit. Which combination should you use?

Accepted Answer

Azure Backup automatically encrypts data at rest using Azure Storage Service Encryption and in transit using HTTPS. Azure Backup uses SSE for encryption at rest and HTTPS for in-transit encryption. Option D is correct. Option A is wrong because Azure Disk Encryption encrypts VM disks but not backup data. Option B is wrong because Azure Backup automatically uses SSE and HTTPS. Option C is wrong because Azure Storage Service Encryption is for storage accounts, but backup uses SSE already.

Answer

Azure Storage Service Encryption and HTTPS

Answer

Azure Backup with customer-managed keys and enforce HTTPS

Answer

Azure Disk Encryption on the VMs and Azure Backup

Question 10

Your company has an Azure Cosmos DB account that stores customer profiles. You need to ensure that only authenticated and authorized users can access the data. Which access control method should you use?

Accepted Answer

Use Azure RBAC with Microsoft Entra ID authentication.. Azure RBAC for Cosmos DB provides fine-grained access control using Microsoft Entra ID authentication. Option C is correct. Primary keys provide full access and are not user-specific. Resource tokens are used for granular permission but require master keys. IP firewall restricts network access, not user access.

Answer

Configure an IP firewall rule to allow only corporate IP ranges.

Answer

Use primary read-write keys with connection strings.

Answer

Use resource tokens generated from a master key.

Question 11

You have an Azure SQL Database that stores credit card numbers. You need to encrypt the column containing the credit card numbers so that only authorized applications can decrypt the data. The database administrator should not be able to view the plaintext data. Which feature should you use?

Accepted Answer

Always Encrypted with secure enclaves. Option D is correct because Always Encrypted with secure enclaves allows client-side encryption, and the database administrator cannot access the plaintext keys. Option A is wrong because Dynamic Data Masking only masks data at query time; the DBA can still access the underlying data. Option B is wrong because TDE encrypts at rest but the DBA can still query the data. Option C is wrong because column-level encryption in SQL Server is server-side and the DBA has access to keys.

Answer

Transparent Data Encryption (TDE)

Answer

Column-level encryption using SQL Server built-in functions

Answer

Dynamic Data Masking

Question 12

You are designing a secure compute solution for a critical application that must comply with PCI DSS. The application runs on Azure Virtual Machines with sensitive data. You need to ensure that ephemeral disks are encrypted at the host level. Which Azure Disk Encryption option should you use?

Accepted Answer

Encryption at host. Encryption at host encrypts the temp disk and OS/data disk caches, which is required for PCI DSS. Option C is correct. Option A (Azure Disk Encryption) encrypts OS/data disks but not temp disks. Option B (Server-side encryption with PMK) is default but does not encrypt temp disks. Option D (double encryption) encrypts at two layers but still does not cover temp disk unless host encryption is used.

Answer

Server-side encryption (SSE) with platform-managed keys

Answer

Azure Disk Encryption (ADE) with Key Vault

Answer

Double encryption (SSE with CMK and ADE)

Question 13

You run the above Kusto query in Azure Monitor Logs for an Azure Storage account. The query returns results showing multiple failed attempts to access PDF blobs with 403 errors from various IP addresses. What is the most likely cause of these failures?

Accepted Answer

The storage account firewall is blocking requests from these IP addresses.. 403 Forbidden errors indicate that the request was denied due to authorization failure. The most likely cause is that the IP addresses are not allowed by the storage account firewall. Option C is correct. Option A (blob not found) returns 404. Option B (SAS expiration) could be a cause but the query shows multiple IPs, suggesting a firewall issue. Option D (anonymous access) would return 401 or 403 if anonymous access is disabled.

Answer

Anonymous public access is enabled, but the blobs are not marked as public.

Answer

The PDF blobs have been deleted or moved to a different container.

Answer

The shared access signatures (SAS) used to access the blobs have expired.

Question 14

You need to ensure that an Azure Storage account's blob data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. What should you do first?

Accepted Answer

Create an Azure Key Vault with soft-delete and purge protection enabled.. Option B is correct because to use CMK, you must first create a Key Vault with soft-delete and purge protection enabled. Then you can configure the storage account to use that key. Option A (random password) is not relevant. Option C (system-assigned managed identity) is automatically created but must be granted access. Option D (Azure Information Protection) is for classification.

Answer

Generate a random 256-bit key and store it in the storage account.

Answer

Create a system-assigned managed identity for the storage account.

Answer

Enable Azure Information Protection for the storage account.

Question 15

You are designing a secure data solution for a financial application. The data must be encrypted at rest, in transit, and in use. You choose Azure SQL Database. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption, enforce TLS, and Always Encrypted. To encrypt data at rest, use Transparent Data Encryption (TDE). For in-transit, enforce TLS. For in-use, use Always Encrypted. Option C is correct. Option A is wrong because Dynamic Data Masking is for masking, not encryption. Option B is wrong because Azure Active Directory authentication is not encryption. Option D is wrong because column-level security is for access control.

Answer

Azure Information Protection, Dynamic Data Masking, and column-level security

Answer

Always Encrypted, Azure Active Directory authentication, and Azure Information Protection

Answer

Transparent Data Encryption, Dynamic Data Masking, and Azure Active Directory authentication