AZ-500 Practice Exam 57 — 20 Questions

Question 1

Refer to the exhibit. You are assigned a policy that deploys the Log Analytics agent to Linux VMs. After assigning this policy to a subscription, you notice that existing Linux VMs are not getting the agent deployed, but newly created VMs receive the agent. What is the most likely reason?

Accepted Answer

The policy assignment requires a remediation task to be created for existing non-compliant VMs. Option A is correct because the policy uses 'deployIfNotExists' effect, which requires remediation tasks to be triggered on existing resources; the policy assignment does not automatically remediate existing VMs. Option B is wrong because the policy evaluates all VMs regardless of region. Option C is wrong because the policy does not require a managed identity for deployment; the 'deployIfNotExists' effect uses the system-assigned identity. Option D is wrong because the workspace ID is a required parameter, and if not provided, the assignment would fail.

Answer

The policy only applies to VMs in specific regions

Answer

The workspace ID parameter was not specified during assignment

Answer

The policy requires a managed identity to deploy the extension

Question 2

A company is deploying Microsoft Sentinel in a new Azure subscription. The security team wants to ingest Windows security events from on-premises servers. Which data connector should they use?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent). Option A is correct because the Windows Security Events via AMA connector is the current recommended method for streaming Windows security events to Azure Sentinel using the Azure Monitor Agent. Option B is wrong because the Azure Active Directory connector is for Microsoft Entra ID logs, not Windows events. Option C is wrong because the Office 365 connector is for Office logs. Option D is wrong because the Common Event Format (CEF) connector is for syslog from security appliances, not Windows security events.

Answer

Office 365 connector

Answer

Azure Active Directory connector

Answer

Common Event Format (CEF) connector

Question 3

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key stored in Azure Key Vault. The Key Vault is configured with a firewall that denies all public access. The SQL server must be able to access the key. What additional configuration is necessary?

Accepted Answer

Enable trusted Microsoft services on the Key Vault firewall. When Azure Key Vault's firewall denies all public access, enabling 'Allow trusted Microsoft services' is necessary because Azure SQL Database's TDE key retrieval is considered a trusted service operation. This setting bypasses the firewall for specific Azure services like SQL Database that are authenticated and authorized to access the vault, without requiring a private endpoint or service endpoint.

Answer

Create a private endpoint for Key Vault

Answer

Assign the SQL server's managed identity to the Key Vault

Answer

Configure a service endpoint on the SQL server

Question 4

A company deploys a public-facing web application behind Azure Application Gateway. They want to enable the Web Application Firewall (WAF) to protect against SQL injection and cross-site scripting attacks. During the initial testing phase, they want to identify malicious requests without blocking them, to tune the WAF rules before enabling full protection. Which WAF mode should they configure?

Accepted Answer

Detection mode. Detection mode logs WAF alerts and records the full request details without blocking any traffic. This allows the security team to analyze malicious requests, tune rule exclusions, and validate that legitimate traffic is not falsely flagged before switching to Prevention mode. It is the correct choice for the initial testing phase described.

Answer

Prevention mode

Answer

Logging mode

Answer

Off

Question 5

Your organization is planning to use Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) for running containerized workloads. The security policy mandates that container images be scanned for vulnerabilities, secrets never be stored in image layers, and network traffic between containers be encrypted. Which three of the following should you implement? (Choose three.)

Accepted Answer

Use Azure Key Vault with the AKS Secrets Store CSI Driver to mount secrets as volumes or environment variables.. Integrating ACR with Microsoft Defender for Containers enables vulnerability scanning of container images at rest and on push, ensuring images are free from known vulnerabilities before deployment. This directly addresses the mandate to scan images for vulnerabilities.

Answer

Deploy ACI containers with a public IP address and rely on network security groups for encryption.

Answer

Enable Azure Policy for AKS to enforce that containers run with privileged access.

Answer

Store all secrets as Kubernetes Secrets and reference them in the container image definition.

Question 6

A company enables Azure Disk Encryption (ADE) on Windows virtual machines using a key encryption key (KEK) stored in Azure Key Vault. They want the KEK to be automatically rotated every 30 days to meet compliance requirements. Which Azure Key Vault feature should they enable?

Accepted Answer

Key rotation policy. A key rotation policy in Azure Key Vault allows you to define automatic rotation rules for keys, including a rotation interval (e.g., every 30 days) and a rotation time window. This feature ensures that the KEK is automatically replaced with a new key version at the specified interval without manual intervention, meeting compliance requirements for periodic key rotation.

Answer

Key expiration date

Answer

Soft-delete

Answer

Purge protection

Question 7

A company uses Azure SQL Database to store customer data, including credit card numbers. The security policy requires that database administrators (DBAs) must not be able to view the credit card numbers in plaintext. The column containing the credit card numbers must be encrypted at rest and in transit, and only a specific application (using a dedicated client library) should be able to decrypt the data. Which technology should they implement?

Accepted Answer

Always Encrypted with a client-side encryption key stored in Azure Key Vault.. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted on the client side before being sent to Azure SQL Database, and the encryption keys are never revealed to the database engine. This prevents DBAs or any server-side administrators from viewing the plaintext data, as decryption can only occur using the client-side encryption key stored in Azure Key Vault and accessed by the dedicated application library.

Answer

Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.

Answer

Dynamic Data Masking (DDM) for the credit card column.

Answer

Row-Level Security (RLS) to restrict DBA access to the credit card column.

Question 8

A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?

Accepted Answer

Blob Storage change feed.. The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.

Answer

Azure Blob Storage soft delete.

Answer

Azure Blob Storage versioning.

Answer

Azure Storage analytics logs.

Question 9

A company is enabling Azure Disk Encryption (ADE) on Windows virtual machines. They have enabled soft-delete on Azure Key Vault and configured a Key Encryption Key (KEK). However, the disk encryption fails with an error indicating that the key vault does not have the required permissions. What is the most likely missing configuration?

Accepted Answer

The Key Vault access policy does not grant the Azure Disk Encryption service principal the 'unwrap key' and 'wrap key' permissions.. Azure Disk Encryption (ADE) requires the Azure Disk Encryption service principal (also known as the Azure Disk Encryption service) to have 'unwrap key' and 'wrap key' permissions on the Key Vault. These permissions allow the service to encrypt and decrypt the disk encryption keys using the Key Encryption Key (KEK). Without these specific cryptographic permissions, the encryption operation fails, even if soft-delete and a KEK are correctly configured.

Answer

The Key Vault firewall is blocking the Azure platform.

Answer

The VM does not have a managed identity assigned.

Answer

The KEK is in a different Azure region than the VM.

Question 10

A Kubernetes workload in AKS needs to pull images from Azure Container Registry without using admin credentials. Which configuration should be used?

Accepted Answer

Grant the AKS kubelet identity AcrPull on the registry. The AKS cluster uses a kubelet identity (managed identity) to authenticate with ACR. By granting the AcrPull role to this identity, the kubelet can pull container images without requiring admin credentials, as Azure RBAC handles the authentication via Azure AD tokens. This is the recommended secure method for image pull operations.

Answer

Enable anonymous pull access on the registry

Answer

Store the ACR admin password in a ConfigMap

Answer

Expose the registry through a public load balancer

Question 11

A company uses Azure SQL Database with Azure Active Directory authentication. To meet compliance requirements, they need to audit all failed login attempts and store the audit logs in a storage account located in a different Azure region for disaster recovery. What should they configure?

Accepted Answer

Enable SQL Auditing and set the destination to an Azure Storage account in a different region.. Option C is correct because Azure SQL Database auditing can be configured to write audit logs directly to an Azure Storage account. Storing the logs in a storage account located in a different Azure region meets the disaster recovery requirement by ensuring logs survive a regional outage. The audit logs capture all database events, including failed login attempts, which satisfies the compliance need.

Answer

Enable SQL Auditing and set the destination to a Log Analytics workspace in a different region.

Answer

Enable SQL Auditing and set the destination to an Event Hub namespace in the same region.

Answer

Enable Advanced Threat Protection for Azure SQL Database and configure email notifications.

Question 12

A company stores highly sensitive data in Azure Blob Storage. The security policy requires that all data is encrypted at rest using a key that is stored in Azure Key Vault, and that the storage account uses its system-assigned managed identity to access the key. Which encryption configuration should they use?

Accepted Answer

Server-side encryption with customer-managed keys (CMK). Server-side encryption with customer-managed keys (CMK) is required because the security policy mandates that the encryption key be stored in Azure Key Vault and that the storage account uses its system-assigned managed identity to access that key. CMK allows you to bring your own key (BYOK) into Key Vault and grants the storage account access via a managed identity, ensuring the key is under your control and not managed by Azure. Service-managed keys (option A) use Microsoft-managed keys, which do not satisfy the requirement for customer-controlled key storage.

Answer

Server-side encryption with service-managed keys

Answer

Client-side encryption

Answer

Azure Disk Encryption

Question 13

A company uses Azure SQL Database. They want to ensure that all data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. They also require that the key is automatically rotated every 12 months. Which two actions must be configured to meet this requirement? (Select two.)

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key.. Option A is correct because Transparent Data Encryption (TDE) with a customer-managed key (CMK) stored in Azure Key Vault is the mechanism that encrypts Azure SQL Database data at rest using a key you control. This meets the requirement for CMK-based encryption. Option B is correct because Azure Key Vault supports automatic key rotation on a schedule; by configuring a rotation policy (e.g., every 12 months), the key used for TDE is automatically replaced, satisfying the rotation requirement.

Answer

Configure Azure SQL Database auditing to log key usage.

Answer

Enable Azure Information Protection for the database.

Question 14

A healthcare company stores sensitive patient data in Azure SQL Database. They want to encrypt specific columns containing Personally Identifiable Information (PII) so that even database administrators cannot view the data. The security team also needs to perform equality searches (e.g., WHERE SSN = '123-45-6789') on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted with secure enclaves.. Always Encrypted with secure enclaves is the correct choice because it supports rich computations (including equality searches) on encrypted columns while ensuring that the data remains encrypted even from database administrators. The secure enclave technology allows operations like equality comparisons to be performed inside a trusted execution environment, preventing the database engine from seeing the plaintext data.

Answer

Always Encrypted with randomized encryption.

Answer

Always Encrypted with deterministic encryption.

Answer

Transparent Data Encryption (TDE).

Question 15

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key stored in Azure Key Vault. The Key Vault has a firewall enabled that blocks all public network access. The SQL server has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. Despite this, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required?

Accepted Answer

Configure the Key Vault firewall to allow trusted Microsoft services to bypass the firewall.. The Key Vault firewall blocks all public network access, so even though the SQL server has the correct managed identity and role assignment, the connection is denied by the firewall. By enabling the 'Allow trusted Microsoft services to bypass this firewall' setting, Azure SQL Database (a trusted Microsoft service) can connect to the Key Vault without exposing it to the public internet. This is the required additional configuration to resolve the TDE access failure.

Answer

Enable the Azure SQL Database server's firewall to allow Azure services to access the server.

Answer

Assign a user-assigned managed identity to the SQL server instead of a system-assigned identity.

Answer

Change the Key Vault firewall to allow all networks.

Question 16

A company plans to enable Azure Disk Encryption (ADE) on a set of Windows virtual machines using a Key Encryption Key (KEK) stored in Azure Key Vault. They have enabled soft-delete and purge protection on the Key Vault. The encryption fails with an error indicating that the key vault does not have the required permissions. Which additional configuration is most likely required for ADE to use the KEK?

Accepted Answer

Configure the key vault access policy to grant the Azure Disk Encryption service (or the VM's managed identity) the 'Key Vault Crypto Service Encryption User' role.. Azure Disk Encryption (ADE) requires the Key Vault to have an access policy that grants the Azure Disk Encryption service (or the VM's managed identity) the 'Key Vault Crypto Service Encryption User' role. This role provides the necessary cryptographic permissions (e.g., 'wrapKey' and 'unwrapKey') to use the Key Encryption Key (KEK) for encrypting and decrypting the Disk Encryption Key (DEK). Without this specific role assignment, the encryption operation fails with a permissions error, even if soft-delete and purge protection are enabled.

Answer

Enable the key vault for deployment by setting the 'Enabled for deployment' access policy.

Answer

Enable the key vault for disk encryption by setting the 'Enabled for Azure Disk Encryption' access policy.

Answer

Add the 'Storage Account Contributor' role for the VMs to access the key vault.

Question 17

A company wants to enable Azure Disk Encryption (ADE) on their Windows virtual machines using a Key Encryption Key (KEK) stored in Azure Key Vault. They have created the Key Vault with soft-delete enabled and a key. However, the encryption fails. What is the most likely missing configuration that prevents ADE from using the KEK?

Accepted Answer

The Key Vault does not have the 'Azure Disk Encryption for Azure VMs' access policy.. Azure Disk Encryption (ADE) requires the Key Vault to have an explicit access policy granting the 'Azure Disk Encryption for Azure VMs' service principal (or the equivalent Azure RBAC role) permission to wrap and unwrap keys. Without this policy, the ADE extension cannot use the KEK to protect the encryption keys, even if the Key Vault itself is correctly configured with soft-delete and a key.

Answer

The Key Vault does not allow access from the Azure platform.

Answer

The Key Vault firewall is enabled and blocking access from Azure services.

Answer

The Key Vault does not have the system-assigned managed identity of the VM enabled.

Question 18

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.. Option B is correct because when Azure Key Vault has a firewall that denies all public network access, the 'Allow trusted Microsoft services to bypass this firewall' setting is required for Azure SQL Database (a trusted Microsoft service) to authenticate using its system-assigned managed identity and access the customer-managed key for TDE. This setting allows the SQL server to reach the Key Vault over the Microsoft backbone network without requiring a private endpoint or VNet integration, as the service is explicitly trusted by Azure.

Answer

Configure a private endpoint for the SQL server to the Key Vault.

Answer

Change the Key Vault firewall to allow all Azure services.

Answer

Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.

Question 19

A company generates shared access signature (SAS) tokens to grant time-limited access to blobs in an Azure Storage container. A security administrator needs the ability to immediately revoke all active SAS tokens for that container if a token is compromised. What should they use?

Accepted Answer

Use a stored access policy on the container and reference it in the SAS token.. A stored access policy on the container provides a centralized way to manage permissions for shared access signatures (SAS). By associating the SAS token with the policy, you can immediately revoke all tokens that reference that policy by simply deleting or modifying the policy's permissions or expiry time. This is the only method that allows instant revocation of multiple SAS tokens without waiting for their individual expiry.

Answer

Use a user delegation key to create the SAS token.

Answer

Use an account-level SAS token.

Answer

Use a service-level SAS token with IP address restrictions.

Question 20

A company has an Azure SQL Database server. They want to allow an Azure Function with a system-assigned managed identity to access the database by using Azure Active Directory (Azure AD) authentication. Which two configurations are required to grant this access? (Choose two.)

Accepted Answer

Assign the managed identity the 'db_datareader' role in the database.. Option A is correct because assigning the managed identity the 'db_datareader' role in the database grants it read permissions on all tables and views, which is a common requirement for an Azure Function accessing data. Option B is correct because a contained database user must be created for the managed identity in the SQL database, mapping the Azure AD identity to a database principal that can be granted permissions. Without this contained user, the managed identity cannot authenticate to the database via Azure AD.

Answer

Add the managed identity as an Azure AD admin for the SQL server.

Answer

Enable Azure AD-only authentication on the SQL server.

AZ-500 Practice Exam 57 — 20 Questions

Exhibit

AZ-500 Practice Exam 57 — 20 Questions

Exhibit