AZ-500 Practice Test 42 — 15 Questions

Question 1

Your company uses Azure Database for PostgreSQL flexible server. You need to enable auditing of all database-level events and ensure audit logs are retained for compliance purposes for 5 years. What should you configure?

Accepted Answer

Enable server parameters for pgAudit, set audit log destination to Azure Monitor, and configure diagnostic settings to stream logs to a Log Analytics workspace with 5-year retention.. Option C is correct because Azure Database for PostgreSQL flexible server can log audit events via server parameters (e.g., pgaudit.log) and send logs to a Log Analytics workspace or storage account for long retention. Option A (audit logs to table) is not supported. Option B (Azure SQL Database) is not PostgreSQL. Option D (diagnostic settings) must be configured for the PostgreSQL server, not for the entire subscription.

Answer

Configure Azure SQL Database auditing and point it to the PostgreSQL server.

Answer

Enable the pgAudit extension and write audit logs to a database table.

Answer

Enable diagnostic settings on the subscription and select the PostgreSQL server.

Question 2

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

Accepted Answer

Implement Always Encrypted and store the column encryption key in Azure Key Vault. Option D is correct because Always Encrypted ensures data is encrypted at rest and in transit, and only client applications with the column encryption key can decrypt it; server administrators cannot access plaintext. Option A is wrong because TDE protects at rest but server administrators can still access plaintext. Option B is wrong because Dynamic Data Masking masks data but does not encrypt it. Option C is wrong because Transparent Data Encryption alone does not prevent server administrators from reading data.

Answer

Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault

Answer

Use Dynamic Data Masking to mask the credit card column for non-privileged users

Answer

Implement Azure SQL Database's Always Encrypted with enclaves

Question 3

You are designing a solution for Azure Blob Storage that must prevent data from being overwritten or deleted for a specified retention period. Which feature should you enable?

Accepted Answer

Immutable storage with time-based retention policy. Option A is correct because immutability policies (WORM) prevent data modification or deletion for a set period. Option B is wrong because soft delete recovers deleted data but does not prevent deletion. Option C is wrong because versioning keeps multiple versions but allows deletion. Option D is wrong because lifecycle management automates tiering, not protection.

Answer

Blob versioning

Answer

Lifecycle management policies

Answer

Soft delete for blobs

Question 4

Your company stores sensitive customer data in Azure Blob Storage. You need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. The key must be automatically rotated every 90 days. Which Azure policy should you configure to enforce this requirement?

Accepted Answer

Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault with automatic key rotation. Option B is correct because 'Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault with automatic key rotation' enforces CMK and automatic rotation. Options A and C do not include rotation. Option D is for Azure SQL Database, not Blob Storage.

Answer

Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault

Answer

Configure Transparent Data Encryption for Azure SQL Database with customer-managed key

Answer

Deploy encryption of Azure Blob Storage using Azure Disk Encryption

Question 5

You manage Azure Storage accounts for a healthcare organization. To comply with HIPAA, you need to ensure that all data at rest is encrypted and that access keys are rotated automatically every 90 days. What should you implement?

Accepted Answer

Use customer-managed keys (CMK) in Azure Key Vault with automatic key rotation.. Customer-managed keys (CMK) with Azure Key Vault allow automatic key rotation. Option A is wrong because Azure RBAC doesn't handle encryption keys. Option B is wrong because infrastructure encryption is for double encryption, not key rotation. Option D is wrong because shared access keys are not rotated automatically.

Answer

Configure Azure RBAC roles for storage accounts.

Answer

Enable infrastructure encryption for storage accounts.

Answer

Generate new storage account access keys manually every 90 days.

Question 6

Your organization stores sensitive documents in Azure Blob Storage. You need to prevent data exfiltration by ensuring that authorized users can only access blobs from within the corporate network, and that any attempt to download blobs from outside the network is blocked. What should you configure?

Accepted Answer

Configure a storage account firewall to allow only the corporate IP range and deny all other traffic. Storage account firewalls and virtual network service endpoints allow you to restrict access to specific IP ranges or virtual networks. Option A is correct. Option B is incorrect because SAS tokens can be used from anywhere if not restricted. Option C is incorrect because Azure RBAC controls permissions but does not enforce network location. Option D is incorrect because Azure Information Protection labels classify but do not block access based on network.

Answer

Apply Azure Information Protection sensitivity labels to the blobs

Answer

Generate SAS tokens with a short expiration and distribute them to users

Answer

Assign Azure RBAC roles to users and require multi-factor authentication

Question 7

You are deploying a containerized application on Azure Kubernetes Service (AKS). The application needs to pull images from a private Azure Container Registry (ACR) and access secrets from Azure Key Vault. You want to minimize credential exposure. What should you configure?

Accepted Answer

Enable managed identity on the AKS cluster, grant the identity acrpull role on ACR, and use Azure Key Vault Provider for Secrets Store CSI Driver.. Option A is correct because AKS can use managed identity to authenticate to ACR (via acrpull role) and to Key Vault (via Secret Provider or CSI driver). Option B (service principal with secret) exposes a credential. Option C (admin account on ACR) is not recommended. Option D (image pull secrets with service principal) exposes credentials.

Answer

Use a service principal with certificate authentication, and rotate the certificate annually.

Answer

Create a service principal with a secret, assign it acrpull role, and store the secret in a Kubernetes secret for imagePullSecrets.

Answer

Enable the admin account on ACR and use the admin credentials in Kubernetes secrets.

Question 8

Which TWO actions should you take to secure an Azure Cosmos DB account? (Choose two.)

Accepted Answer

Configure IP firewall rules to restrict access to trusted IP ranges. Options A and D are correct. Option A: Using managed identities avoids storing keys in applications. Option D: IP firewall restricts network access. Option B is wrong because private endpoint does not replace key-based auth; you still need to disable key-based auth or use AAD. Option C is wrong because enabling public network access is not a security best practice. Option E is wrong because changing consistency level does not affect security.

Answer

Use a private endpoint and disable key-based authentication

Answer

Set the default consistency level to Strong

Answer

Enable public network access from all networks

Question 9

You are responsible for securing Azure Storage accounts that contain confidential documents. You need to implement a solution that prevents accidental deletion of storage accounts and ensures that deleted blobs can be recovered within 30 days. Which two actions should you take?

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Option A is correct because a resource lock prevents deletion of the storage account. Option D is correct because soft delete for blobs allows recovery within the specified retention period. Option B (containers) is for versioning for blobs, not deletion prevention. Option C (immutability policy) is for legal hold, not recovery. Option E (firewall) is for access control.

Answer

Configure an immutability policy

Answer

Enable container soft delete

Answer

Configure network rules to block all public access

Question 10

You are designing a backup strategy for Azure virtual machines. You need to ensure that backups are encrypted at rest and can be restored in a different Azure region in case of a regional disaster. Which two configurations should you use?

Accepted Answer

Enable encryption at rest for the Recovery Services vault using platform-managed keys. Option A is correct: Azure Backup uses encryption at rest by default. Option C is correct: Cross-region restore (CRR) allows restoring in a different region. Option B (geo-redundant storage) is used by Recovery Services vault but is not a restore option. Option D (Azure Site Recovery) is for disaster recovery, not backup. Option E (Azure Disk Encryption) is for VM disks, not backup.

Answer

Configure Azure Site Recovery for the VMs

Answer

Enable Azure Disk Encryption on the VMs

Answer

Use geo-redundant storage (GRS) for the Recovery Services vault

Question 11

You need to ensure that only approved applications can access your Azure storage account. What should you configure?

Accepted Answer

Configure firewall rules to allow only specific virtual networks and IP addresses.. Firewall and virtual network settings with service endpoints allow you to restrict access to specific VNets and IP ranges. Option B is wrong because shared access keys do not restrict by application. Option C is wrong because Azure RBAC controls user permissions, not application access. Option D is wrong because private endpoints provide private IP connectivity but still require additional controls to restrict by application.

Answer

Use shared access keys for all storage account access.

Answer

Assign Azure RBAC roles to the storage account.

Answer

Use private endpoints and disable public network access.

Question 12

A company has an Azure SQL Database that contains sensitive financial data. They want to audit all successful and failed login attempts for the database. What should they configure?

Accepted Answer

Azure SQL Database auditing. Azure SQL Database auditing tracks database events, including successful and failed logins, to an audit log in Azure Storage, Log Analytics, or Event Hubs. Option C is correct. Option A is incorrect because Azure AD audit logs track identity events, not SQL login attempts. Option B is incorrect because SQL Vulnerability Assessment checks for security misconfigurations. Option D is incorrect because Microsoft Defender for Cloud alerts on threats but does not provide detailed login audit trails.

Answer

SQL Vulnerability Assessment

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 13

Refer to the exhibit. You are implementing an Azure Policy to enforce encryption on managed disks. A user reports that they cannot create a VM even though they specified a disk encryption set. What is the most likely reason?

Accepted Answer

The user specified the disk encryption set in the VM properties but not on the disk resource.. The policy checks that the property 'diskEncryptionSet.id' exists on the OS disk. If the user specifies the encryption set at the VM level rather than the disk level, the property may not be present on the disk resource itself. Option B is correct. Option A is incorrect because the policy allows creation if the property exists. Option C is incorrect because the policy does not check for key validity. Option D is incorrect because the policy applies to all regions.

Answer

The user did not have permission to assign a disk encryption set.

Answer

The disk encryption set is in a different region than the VM.

Answer

The disk encryption set is not enabled for encryption.

Question 14

You are designing a backup strategy for Azure VMs running critical workloads. The VMs have Azure Disk Encryption enabled with Azure Key Vault. You need to ensure that backups can be restored securely. What should you configure?

Accepted Answer

Configure Azure Backup with the same Key Vault that holds the encryption keys and allow Backup service access to Key Vault.. Option A is correct because Azure Backup supports backing up encrypted VMs with KEK and BEK. During restore, you can specify the same Key Vault to restore the keys. Option B (separate Key Vault) complicates restore. Option C (disable encryption) is not secure. Option D (export keys) is risky.

Answer

Create a separate Key Vault for backup vault and copy the keys there.

Answer

Disable encryption before backup and re-enable after restore.

Answer

Export the encryption keys to a secure location and import them during restore.

Question 15

You need to ensure that only users with a valid Azure AD token can invoke an Azure Function app. No other authentication methods should be allowed. What should you configure?

Accepted Answer

Enable App Service Authentication with Azure AD as the provider and set 'Action to take when request is not authenticated' to 'Log in with Azure AD'.. Option D is correct because the Function app can be configured to require authentication via Azure AD (EasyAuth) and disable anonymous access. Option A (function keys) allows anonymous access. Option B (App Service Authentication) can be set to Azure AD, but must also disable unauthenticated access. Option C (IP restriction) does not enforce token authentication.

Answer

Enable App Service Authentication and set the action to 'Log in with Azure AD' but allow anonymous requests.

Answer

Configure function-level authorization and require function keys.

Answer

Configure IP restrictions to allow only known IP ranges.