AZ-500 Practice Test 39 — 15 Questions

Question 1

You are deploying an Azure Disk Encryption set with the above ARM template snippet. What is the result of this configuration?

Accepted Answer

The disk uses double encryption with both platform-managed and customer-managed keys. Option A is correct: The `keySource` is `Microsoft.Keyvault`, indicating a customer-managed key. `infrastructureEncryption` is `Enabled`, meaning double encryption (platform-managed + customer-managed). Option B is wrong because `infrastructureEncryption` is enabled. Option C is wrong because keySource is Keyvault. Option D is wrong because infrastructure encryption is enabled.

Answer

The disk uses only customer-managed key encryption

Answer

The disk encryption will fail because keyversion is empty

Answer

The disk uses only platform-managed key encryption

Question 2

Which three security configurations should you apply to an Azure SQL Database to meet a requirement for data protection at rest and in transit?

Accepted Answer

Use Always Encrypted for sensitive columns.. Correct: A, B, D. TDE encrypts at rest, firewall rules protect network access, and Always Encrypted protects sensitive columns in transit. Option C (auditing) is for monitoring, not encryption. Option E (threat detection) is for detection, not protection.

Answer

Enable Microsoft Defender for Azure SQL.

Answer

Enable Azure SQL Auditing.

Question 3

Your company uses Azure SQL Database to store customer data. You need to ensure that database administrators cannot access sensitive columns (e.g., credit card numbers) even during maintenance. What should you implement?

Accepted Answer

Always Encrypted. Always Encrypted ensures that sensitive data is encrypted at the client side and the database engine never sees the plaintext. Option C is correct. Option A is wrong because Dynamic Data Masking masks data but can be bypassed. Option B is wrong because Transparent Data Encryption encrypts at rest, not in use. Option D is wrong because row-level security controls access to rows, not columns.

Answer

Transparent Data Encryption

Answer

Dynamic Data Masking

Answer

Row-level security

Question 4

You are deploying an Azure SQL Database with a security alert policy as shown in the exhibit. Which statement is true?

Accepted Answer

Alerts are enabled and notifications are sent to both account admins and admin@contoso.com.. The policy enables alerts, sends email to admins and a specific address, and retains alerts for 30 days. Option D is correct. Option A is wrong because retentionDays is 30, not 0. Option B is wrong because emailAccountAdmins is true. Option C is wrong because disabledAlerts is empty, so all alerts are enabled.

Answer

Email notifications are sent only to admin@contoso.com.

Answer

Alerts are not retained because retentionDays is set to 30.

Answer

All alerts are disabled because disabledAlerts is empty.

Question 5

Which TWO actions are required to enable Azure Defender for SQL on an Azure SQL Database?

Accepted Answer

Enable Advanced Data Security on the server.. Azure Defender for SQL requires enabling Advanced Data Security on the server and configuring a Microsoft Defender for Cloud pricing tier. Options B and D are correct. Enabling auditing is optional for Defender. Configuring vulnerability assessment is a separate feature. Enabling threat detection is part of the process but not listed separately as an action.

Answer

Configure SQL Vulnerability Assessment.

Answer

Enable threat detection policies at the database level.

Answer

Enable SQL Auditing.

Question 6

You need to restrict access to an Azure Storage account so that only traffic from a specific virtual network (VNet) subnet is allowed. Which Azure Storage firewall setting should you configure?

Accepted Answer

Add a virtual network rule that references the VNet and subnet.. Option B is correct because Storage firewall rules can restrict access to specific VNets and subnets by adding a 'Virtual Network' rule. Option A is wrong because IP rules allow specific public IPs, not VNets. Option C is wrong because Private Endpoint is a separate feature that uses private IPs but requires Private Link. Option D is wrong because service endpoints are a prerequisite but the rule type is 'Virtual Network'.

Answer

Create a private endpoint for the storage account.

Answer

Enable service endpoints on the subnet and add an IP rule.

Answer

Add a firewall rule with the subnet's public IP address range.

Question 7

Refer to the exhibit. You are reviewing the JSON output of an Azure Storage account encryption configuration. What can you conclude about the encryption settings?

Accepted Answer

The storage account uses a customer-managed key from Azure Key Vault.. Option C is correct. The JSON shows 'keySource': 'Microsoft.Keyvault' indicating customer-managed keys (CMK). The key name, version, and vault URI are provided. Option A is wrong because platform-managed keys use 'Microsoft.Storage' as keySource. Option B is wrong because the configuration shows both blob and file encryption enabled. Option D is wrong because the configuration uses CMK, not SSE (which uses Microsoft-managed keys).

Answer

The encryption configuration is incomplete because keyVersion is '1'.

Answer

Only blob storage is encrypted; file storage is not.

Answer

The storage account uses platform-managed keys (SSE).

Question 8

You are configuring an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can securely access Azure Container Registry (ACR) without storing image pull secrets in the pod specification. What should you do?

Accepted Answer

Enable managed identity on AKS and assign the AcrPull role to the kubelet identity. Option B is correct because AKS can use managed identities to authenticate to ACR, and the kubelet can be assigned a managed identity with AcrPull role. Option A is wrong because admin credential is not recommended and requires managing secrets. Option C is wrong because a service principal requires managing a secret. Option D is wrong because using the default storage account credential is not for container registry authentication.

Answer

Create a service principal and store the secret in a Kubernetes secret, then reference it in the pod spec

Answer

Enable admin account on ACR and use the admin username and password in the pod spec

Answer

Use the storage account key of the attached Azure storage account

Question 9

You are deploying a virtual machine that will host a legacy application. The application writes temporary files to the local disk. You must ensure that any data written to the temporary disk is encrypted at rest with a platform-managed key. What should you do?

Accepted Answer

Enable encryption at host on the VM. Option A is correct because Azure Disk Encryption encrypts OS and data disks, but the temporary disk (D: drive) is not encrypted by default. EncryptingHostVmWithCustomerManagedKey is a VM feature that encrypts the temporary disk with a customer-managed key. However, the question specifies a platform-managed key. Actually, the correct answer is to use a VM with encryption at host enabled, which uses platform-managed keys by default. Option A (Azure Disk Encryption) does not encrypt temporary disk. Option B (encryption at host) encrypts temporary disk with PMK. Option C is for storage account. Option D is for SQL.

Answer

Enable Azure Disk Encryption on the VM

Answer

Configure storage service encryption on the managed disk

Answer

Use Always Encrypted with secure enclaves

Question 10

Your company has a policy to disable TLS versions older than 1.2 for Azure Storage accounts. You configure the minimum TLS version setting to 1.2. After a week, an audit reveals that some clients are still connecting with TLS 1.0. What is the most likely reason?

Accepted Answer

Some clients have established persistent connections before the change.. The minimum TLS version setting may not be enforced immediately for existing connections; clients with persistent connections may continue using older TLS. Option A is wrong because the setting applies to all storage services. Option B is wrong because the setting is not related to IP rules. Option D is wrong because TLS 1.0 is not required by default.

Answer

Clients are accessing the storage account through a private endpoint with IP rules.

Answer

The storage account is configured to allow TLS 1.0 by default.

Answer

The setting does not apply to Azure Files.

Question 11

Your organization uses Azure Storage blobs to store sensitive documents. You need to enforce that all blob access must be via HTTPS and that storage account keys are rotated every 90 days. Which two actions should you take? (Each correct answer presents part of the solution.)

Accepted Answer

Use a PowerShell script to regenerate storage account keys every 90 days. To enforce HTTPS, enable 'Secure transfer required' in storage account settings. To rotate keys, use the storage account key regeneration feature. Option B and Option D are correct. Option A is wrong because Azure Policy can audit but not automatically rotate keys. Option C is wrong because SAS tokens are not for key rotation. Option E is wrong because Azure Key Vault can store keys but does not automatically rotate storage account keys.

Answer

Configure an Azure Policy to require HTTPS

Answer

Generate a shared access signature (SAS) with HTTPS only

Answer

Store storage account keys in Azure Key Vault and enable automatic rotation

Question 12

You need to ensure that an Azure Storage account only allows access from a specific virtual network. Which configuration should you use?

Accepted Answer

Configure a service endpoint for Azure Storage and add the virtual network subnet to the firewall rules.. Service endpoints allow restricting access to Azure services from a specific virtual network. Option C is correct. Firewalls and IP rules are for public IP addresses, not VNets. Private endpoints provide private IP connectivity but do not block public access by default. Access keys don't restrict network access.

Answer

Enable Azure Private Link and assign a private endpoint.

Answer

Configure firewall rules to allow only the virtual network's public IP range.

Answer

Generate new storage account access keys and share them only with the virtual network.

Question 13

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. SSE with CMK provides automatic encryption, key rotation support, and audit of key usage. Options A, C, and D are correct. Client-side encryption is separate. Access control via RBAC is possible but not a capability of SSE itself.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.

Question 14

You have an Azure Cosmos DB account with multiple containers. You need to ensure that data is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which steps should you take?

Accepted Answer

Configure the Cosmos DB account to use a customer-managed key from Key Vault and assign the appropriate RBAC role.. Option C is correct because Cosmos DB supports customer-managed keys (CMK) through integration with Azure Key Vault. You must configure the key in the Cosmos DB encryption settings and grant the Cosmos DB managed identity access to the Key Vault. Option A is wrong because Always Encrypted is for SQL Server. Option B is wrong because Azure Disk Encryption is for VMs. Option D is wrong because TDE is for Azure SQL Database.

Answer

Use Azure Disk Encryption on the VMs hosting Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) and bring your own key (BYOK) from Key Vault.

Answer

Enable Always Encrypted on the Cosmos DB account and reference the key from Key Vault.

Question 15

Refer to the exhibit. You are querying the sys.column_master_keys view in an Azure SQL Database. What is the purpose of this query?

Accepted Answer

To retrieve the column master key configuration for Always Encrypted.. Option B is correct. The view sys.column_master_keys returns information about column master keys used in Always Encrypted, including the key store provider (e.g., Azure Key Vault) and key path. Option A is wrong because TDE does not use column master keys. Option C is wrong because Dynamic Data Masking does not use keys. Option D is wrong because column-level encryption (non-Always Encrypted) uses server-side keys, not column master keys.

Answer

To check the Dynamic Data Masking policies.

Answer

To verify the configuration of Transparent Data Encryption (TDE).

Answer

To list the encryption keys used for column-level encryption.

AZ-500 Practice Test 39 — 15 Questions

Exhibit

AZ-500 Practice Test 39 — 15 Questions

Exhibit