AZ-500 Practice Test 44 — 15 Questions

Question 1

You are designing a secure Azure SQL Database deployment. The database must support real-time analytics and reporting without impacting the performance of the transactional workload. You need to ensure that the reporting queries have an isolated copy of the data that is automatically kept up to date. The solution must also encrypt the data at rest using a customer-managed key. What should you include in the design?

Accepted Answer

Hyperscale service tier with named replicas. Option C is correct because Azure SQL Database Hyperscale service tier with named replicas provides a scalable read-only replica for reporting, and it supports TDE with CMK. Geo-replication (A) is for disaster recovery, not reporting. Failover groups (B) are for high availability. Serverless (D) is for compute scaling, not read replicas.

Answer

Active geo-replication with a readable secondary

Answer

Serverless compute tier with auto-pause

Answer

Failover groups with automatic failover

Question 2

You need to securely store connection strings and secrets for an Azure function app. The solution must automatically rotate the secrets every 90 days and provide audit logs for access. What should you use?

Accepted Answer

Azure Key Vault with key rotation policy and diagnostic logging. Option A is correct: Azure Key Vault with automatic rotation and audit logging. Option B (App Service application settings) stores secrets in plaintext. Option C (Azure Cosmos DB) is not for secrets. Option D (Azure SQL Database) is not appropriate.

Answer

Azure SQL Database with Always Encrypted

Answer

Azure Cosmos DB with encryption at rest

Answer

Azure App Service application settings with slot-sticky settings

Question 3

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to restrict a user to only view data from the 'Sales' schema, without granting permissions to other schemas. What should you do?

Accepted Answer

Create a user mapped to the Entra ID user and grant SELECT on the Sales schema only.. Creating a user in the database mapped to the Entra ID user and granting SELECT only on the Sales schema meets the requirement. Option A is wrong because roles at the server level grant broader permissions. Option B is wrong because denying permissions is less secure and can be overridden. Option D is wrong because contained database users do not use Entra ID.

Answer

Add the user to the db_datareader role in the database.

Answer

Use a DENY statement on all other schemas for the user.

Answer

Create a contained database user with password and assign to db_datareader.

Question 4

You are designing a secure data solution for a financial services company. Data must be encrypted at rest and in transit. Additionally, you need to prevent administrators from accessing the encryption keys. What should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys and a key vault access policy that denies key operations for the admin group.. Azure Storage encryption with customer-managed keys stored in a key vault with vault access policy set to deny all key operations for administrators meets the requirement. Option A is wrong because infrastructure encryption does not prevent admin access. Option B is wrong because Microsoft-managed keys do not meet the requirement. Option D is wrong because encryption in transit alone does not address at-rest encryption.

Answer

Azure Storage encryption with service-side encryption and HTTPS enforced.

Answer

Azure Storage encryption with Microsoft-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Question 5

You have an Azure SQL Database that contains sensitive customer data. You need to ensure that database administrators (DBAs) cannot view the data in the 'CreditCard' column. What should you implement?

Accepted Answer

Use Always Encrypted with column encryption key stored in Azure Key Vault.. Dynamic Data Masking (DDM) obfuscates sensitive data to non-privileged users, while DBAs with elevated permissions can still see the unmasked data unless excluded. Option B is wrong because Always Encrypted protects data from DBAs. Option C is wrong because TDE encrypts at rest, not at query time. Option D is wrong because auditing tracks access but does not prevent viewing.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Answer

Implement Azure SQL Auditing for the database.

Answer

Configure Dynamic Data Masking for the 'CreditCard' column.

Question 6

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed key. Azure Storage Service Encryption with customer-managed keys allows you to use your own key stored in Azure Key Vault. Option B is correct because it uses CMK. Option A is incorrect because SSE with PMK uses Microsoft-managed keys. Option C is incorrect because Azure Disk Encryption is for VMs. Option D is incorrect because Azure Information Protection is for classification and labeling.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption (SSE) with platform-managed key

Answer

Azure Information Protection

Question 7

Your company has an Azure SQL Managed Instance that stores sensitive customer data. You need to implement a solution that automatically classifies and protects the sensitive data in the database, with minimal manual intervention. The solution should integrate with Microsoft Purview. What should you use?

Accepted Answer

Microsoft Defender for SQL (Data Discovery & Classification). Option B is correct because Microsoft Defender for SQL includes data discovery and classification, which can be integrated with Purview. Option A is wrong because Azure Policy is for compliance enforcement, not classification. Option C is wrong because Dynamic Data Masking masks data but does not classify it. Option D is wrong because SQL Server Audit logs access but does not classify data.

Answer

SQL Server Audit

Answer

Azure Policy with built-in SQL classification policy

Answer

Dynamic Data Masking

Question 8

You need to protect Azure VMs from ransomware by ensuring that encrypted file systems cannot be read by attackers. Which solution should you implement?

Accepted Answer

Enable Azure Disk Encryption on the VMs.. Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt the OS and data disks, protecting against offline attacks. Option B is wrong because Defender for Cloud is for threat detection, not encryption. Option C is wrong because Azure Backup provides recovery, not encryption. Option D is wrong because NSGs control network traffic, not disk encryption.

Answer

Apply network security groups (NSGs) to block unauthorized access.

Answer

Configure Azure Backup for the VMs.

Answer

Enable Microsoft Defender for Cloud on the subscription.

Question 9

You are deploying a web application that stores user-uploaded files in Azure Blob Storage. You need to ensure that only authenticated users can upload files, and that uploaded files are automatically scanned for malware. What should you use?

Accepted Answer

Enable Azure AD authentication for the storage account and enable Microsoft Defender for Storage. Option D is correct: Azure AD authentication for the storage account ensures only authenticated users can access, and Microsoft Defender for Storage provides malware scanning. Option A (SAS tokens) are shared access signatures, not user-specific. Option B (Event Grid) is for event handling, not authentication. Option C (Azure Firewall) is network-level, not application-level.

Answer

Use Azure Event Grid to trigger a function for malware scanning

Answer

Configure Azure Firewall to allow only the web app's IP address

Answer

Use shared access signatures (SAS) with stored access policies

Question 10

Refer to the exhibit. You have an Azure Storage account with the encryption configuration shown. Users report that they cannot upload files to the storage account. What is the most likely cause?

Accepted Answer

The key version is pinned; if the key was rotated, the old version may be disabled.. The key version is pinned to a specific version. If the key is rotated, the old version may be disabled or deleted, causing access failures. Option A is wrong because the key source is Key Vault, not Microsoft-managed. Option B is wrong because the key vault URI is valid. Option D is wrong because key permissions are not directly indicated.

Answer

The storage account does not have permissions to access the key vault.

Answer

The key vault URI is incorrect.

Answer

The encryption key source is set to Microsoft.Keyvault but should be Microsoft.Storage.

Question 11

Which TWO actions should you take to secure managed database backups in Azure SQL Managed Instance?

Accepted Answer

Configure geo-redundant backup storage (RA-GRS). Option B (geo-redundant storage) ensures backups are replicated to another region for disaster recovery. Option D (soft delete) protects backups from accidental or malicious deletion. Option A is incorrect because TDE encrypts data at rest, but backups are automatically encrypted if TDE is enabled. Option C is incorrect because retention policies do not provide cross-region redundancy. Option E is incorrect because auditing does not protect backups directly.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure auditing for the managed instance

Answer

Set a long-term retention policy for backups

Question 12

You are designing security for an Azure SQL Database that will store personally identifiable information (PII). The database will be accessed by multiple applications, some of which are legacy and cannot use Azure AD authentication. Your requirements include: encrypting data at rest, encrypting data in transit, and dynamically masking PII columns for non-privileged users. Which THREE features should you implement?

Accepted Answer

Configure Dynamic Data Masking (DDM) for the PII columns.. Option A: Transparent Data Encryption (TDE) encrypts data at rest. Option C: Dynamic Data Masking (DDM) masks PII columns for non-privileged users. Option D: Enforce minimal TLS version 1.2 ensures data in transit is encrypted. Option B (Always Encrypted) is client-side encryption but not required if TDE is used and the client does not support it. Option E (Azure Information Protection) is not for database-level encryption.

Answer

Implement Always Encrypted for the PII columns.

Answer

Apply Azure Information Protection labels to the database.

Question 13

Which THREE measures should you implement to secure a Linux virtual machine running a web application on Azure?

Accepted Answer

Enable Azure Disk Encryption for OS and data disks. Option A (just-in-time VM access) reduces exposure by opening ports only when needed. Option C (Azure Disk Encryption) encrypts OS and data disks at rest. Option E (Microsoft Defender for Servers) provides threat detection and vulnerability management. Option B is incorrect because NSGs filter traffic but do not encrypt data. Option D is incorrect because Azure Backup protects against data loss but does not encrypt disks themselves; backup encryption is separate.

Answer

Configure network security groups to allow only HTTP and HTTPS

Answer

Configure Azure Backup for the VM

Question 14

Which TWO configurations are required to ensure that an Azure Storage account is accessible only via HTTPS and that access keys are not used?

Accepted Answer

Set the 'Secure transfer required' property to Enabled. Option A (secure transfer required) enforces HTTPS. Option D (disable shared key access) prevents use of access keys. Option B is incorrect because enabling firewall does not disable access keys. Option C is incorrect because enabling logging does not enforce HTTPS or disable keys. Option E is incorrect because enabling versioning does not affect encryption or key usage.

Answer

Enable blob versioning

Answer

Enable diagnostic settings for the storage account

Answer

Configure the storage account firewall to allow only selected virtual networks

Question 15

Refer to the exhibit. You have an Azure Disk Encryption policy assignment. An administrator reports that encryption of a new VM fails. What is the most likely cause?

Accepted Answer

The key version referenced in the policy is no longer valid because the key was rotated.. The exhibit shows encryption configuration with keySource as Microsoft.Keyvault and a specific key version. If the key version is specified, Azure Disk Encryption will attempt to use that exact version. If the key is rotated or archived, the specified version becomes invalid. Option A is correct. Option B is incorrect because the key vault URI is present. Option C is incorrect because the key exists. Option D is incorrect because key rotation is not inherently a problem if the version is updated in the policy.

Answer

The disk encryption set does not have purge protection enabled.

Answer

The key does not exist in the key vault.

Answer

The key vault URI is incorrect or inaccessible.