AZ-500 Secure compute, storage, and databases — 50 Questions

Question 1

A company stores sensitive files in Azure Files shares. They require that data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault, and that all client connections use SMB 3.0 encryption for end-to-end encryption in transit. They create a premium Azure Files share in a storage account and configure encryption at rest with a CMK. However, clients are unable to connect without SMB encryption. What additional configuration is necessary to enforce SMB encryption for all connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Secure transfer required' in the storage account's configuration to enforce SMB 3.0 encryption.. The stem is intended to describe a scenario where encryption is not yet enforced. Enabling 'Secure transfer required' on the storage account enforces that all client connections use SMB 3.0 with encryption, which is necessary for end-to-end encryption in transit. Even though encryption at rest is configured with a CMK, the storage account does not automatically require encrypted connections; this setting explicitly denies unencrypted SMB 2.1 or SMB 3.0 without encryption. As written, the question is invalid.

Answer

No additional configuration is needed; Azure Files uses SMB encryption by default and cannot be disabled.

Answer

Configure a network security group (NSG) rule to block SMB traffic on port 445 that does not use encryption.

Answer

Set the Azure Files share to use the 'Premium' performance tier; encryption is only available on premium shares.

Question 2

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key stored in Azure Key Vault. The Key Vault has a firewall enabled that blocks all public network access. The SQL server has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. Despite this, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required?

Accepted Answer

Configure the Key Vault firewall to allow trusted Microsoft services to bypass the firewall.. The Key Vault firewall blocks all public network access, so even though the SQL server has the correct managed identity and role assignment, the connection is denied by the firewall. By enabling the 'Allow trusted Microsoft services to bypass this firewall' setting, Azure SQL Database (a trusted Microsoft service) can connect to the Key Vault without exposing it to the public internet. This is the required additional configuration to resolve the TDE access failure.

Answer

Enable the Azure SQL Database server's firewall to allow Azure services to access the server.

Answer

Assign a user-assigned managed identity to the SQL server instead of a system-assigned identity.

Answer

Change the Key Vault firewall to allow all networks.

Question 3

A company uses Azure SQL Database. They want to ensure that all data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. They also require that the key is automatically rotated every 12 months. Which two actions must be configured to meet this requirement? (Select two.)

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key.. Transparent Data Encryption (TDE) with a customer-managed key (CMK) stored in Azure Key Vault is the mechanism that encrypts Azure SQL Database data at rest using a key you control. This meets the requirement for CMK-based encryption. Option B is correct because Azure Key Vault supports automatic key rotation on a schedule; by configuring a rotation policy (e.g., every 12 months), the key used for TDE is automatically replaced, satisfying the rotation requirement.

Answer

Configure Azure SQL Database auditing to log key usage.

Answer

Enable Azure Information Protection for the database.

Question 4

A company plans to enable Azure Disk Encryption (ADE) on a set of Windows virtual machines using a Key Encryption Key (KEK) stored in Azure Key Vault. They have enabled soft-delete and purge protection on the Key Vault. The encryption fails with an error indicating that the key vault does not have the required permissions. Which additional configuration is most likely required for ADE to use the KEK?

Accepted Answer

Configure the key vault access policy to grant the Azure Disk Encryption service (or the VM's managed identity) the 'Key Vault Crypto Service Encryption User' role.. Azure Disk Encryption (ADE) with a Key Encryption Key (KEK) requires the identity performing encryption (typically the VM's managed identity) to have cryptographic permissions on the Key Vault. This can be achieved either by creating an access policy that grants the 'wrapKey' and 'unwrapKey' permissions, or by assigning the built-in RBAC role 'Key Vault Crypto Service Encryption User' to the identity via IAM. Option A incorrectly mixes these two authorization models by saying 'configure the key vault access policy to grant the role.' The proper configuration is an RBAC role assignment, not an access policy.

Answer

Enable the key vault for deployment by setting the 'Enabled for deployment' access policy.

Answer

Enable the key vault for disk encryption by setting the 'Enabled for Azure Disk Encryption' access policy.

Answer

Add the 'Storage Account Contributor' role for the VMs to access the key vault.

Question 5

An Azure Storage account is configured with server-side encryption (SSE) using a customer-managed key stored in Azure Key Vault. The security team requires that the storage account's identity be used to authenticate to the key vault for key access. Additionally, they want the identity to be automatically deleted when the storage account is deleted. Which type of identity should they assign to the storage account?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied to the lifecycle of the Azure resource (the storage account) and is automatically deleted when the resource is deleted. This identity can be used to authenticate to Azure Key Vault for accessing the customer-managed key used in server-side encryption (SSE), satisfying the security team's requirement for automatic deletion upon storage account deletion.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Azure AD user account

Question 6

A healthcare company stores sensitive patient data in Azure SQL Database. They want to encrypt specific columns containing Personally Identifiable Information (PII) so that even database administrators cannot view the data. The security team also needs to perform equality searches (e.g., WHERE SSN = '123-45-6789') on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted with deterministic encryption.. Always Encrypted with deterministic encryption is the correct choice because it encrypts sensitive columns at the client side, ensuring database administrators never see plaintext, and it supports equality searches through deterministic ciphertext generation. Secure enclaves can also do this, but they are overkill for equality-only queries and add complexity.

Answer

Always Encrypted with randomized encryption.

Answer

Always Encrypted with secure enclaves.

Answer

Transparent Data Encryption (TDE).

Question 7

A company has an Azure SQL Database server. They want to allow an Azure Function with a system-assigned managed identity to access the database by using Azure Active Directory (Azure AD) authentication. Which two configurations are required to grant this access? (Choose two.)

Accepted Answer

Assign the managed identity the 'db_datareader' role in the database.. Assigning the managed identity the 'db_datareader' role in the database grants it read permissions on all tables and views, which is a common requirement for an Azure Function accessing data. Option B is correct because a contained database user must be created for the managed identity in the SQL database, mapping the Azure AD identity to a database principal that can be granted permissions. Without this contained user, the managed identity cannot authenticate to the database via Azure AD.

Answer

Add the managed identity as an Azure AD admin for the SQL server.

Answer

Enable Azure AD-only authentication on the SQL server.

Question 8

An AKS cluster needs to pull container images from a private Azure Container Registry (ACR). The security policy requires that the AKS cluster identity should not have direct access to the ACR; instead, a service principal with the AcrPull role should be used, with credentials stored as a Kubernetes secret. Which authentication method should be configured on the AKS cluster?

Accepted Answer

Kubernetes pull secret using a service principal. The scenario explicitly requires that the AKS cluster identity not have direct access to ACR, and instead mandates using a service principal with AcrPull role whose credentials are stored as a Kubernetes secret. A Kubernetes pull secret of type 'docker-registry' stores the service principal's client ID and client secret, which kubelet uses to authenticate to ACR when pulling images. This method decouples the AKS cluster's managed identity from ACR access, satisfying the security policy.

Answer

AKS managed identity

Answer

ACR admin account

Answer

Azure AD pod identity

Question 9

A company wants to enable Azure Disk Encryption (ADE) on their Windows virtual machines using a Key Encryption Key (KEK) stored in Azure Key Vault. They have created the Key Vault with soft-delete enabled and a key. However, the encryption fails. What is the most likely missing configuration that prevents ADE from using the KEK?

Accepted Answer

The Key Vault does not have the 'Azure Disk Encryption for Azure VMs' access policy.. Azure Disk Encryption (ADE) requires the Key Vault to have an explicit access policy granting the 'Azure Disk Encryption for Azure VMs' service principal (or the equivalent Azure RBAC role) permission to wrap and unwrap keys. Without this policy, the ADE extension cannot use the KEK to protect the encryption keys, even if the Key Vault itself is correctly configured with soft-delete and a key.

Answer

The Key Vault does not allow access from the Azure platform.

Answer

The Key Vault firewall is enabled and blocking access from Azure services.

Answer

The Key Vault does not have the system-assigned managed identity of the VM enabled.

Question 10

A company uses Azure Key Vault to store secrets for their applications. They want to ensure that an application hosted on an Azure virtual machine can access secrets from only a specific Key Vault, and that all traffic between the VM and Key Vault remains within the Azure network and does not traverse the public internet. Which configuration should they implement?

Accepted Answer

Create a private endpoint for Key Vault in the same VNet as the VM and disable public network access on the Key Vault.. It combines a private endpoint for Azure Key Vault with disabling public network access. A private endpoint assigns a private IP address from the VM's VNet to the Key Vault, ensuring all traffic stays within the Microsoft Azure backbone network and never traverses the public internet. Disabling public network access on the Key Vault firewall then blocks any attempts to access the vault via its public endpoint, enforcing that only traffic through the private endpoint is allowed.

Answer

Enable the Key Vault firewall and add the VM's public IP address to the allowed list.

Answer

Use a service endpoint for Key Vault on the VM's subnet, and assign a managed identity to the VM.

Answer

Assign a system-assigned managed identity to the VM and grant it access to the Key Vault.

Question 11

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall and virtual network service endpoints. The storage account used for TDE logs is in the same Azure region. What additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for TDE operations?

Accepted Answer

Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings.. Azure SQL Database uses TDE with a customer-managed key stored in Key Vault. When the Key Vault has a firewall enabled, Azure SQL Database must be able to bypass that firewall to access the key. Enabling 'Allow trusted Microsoft services to bypass this firewall' is required because Azure SQL Database is a trusted Microsoft service that needs to reach the Key Vault endpoint for TDE operations, even when the firewall blocks public network access.

Answer

Disable public network access on the Key Vault.

Answer

Add the SQL Database server's system-assigned managed identity to the Key Vault access policy.

Answer

Enable soft-delete on the Key Vault.

Question 12

A company uses Azure Blob Storage to store archival data that is rarely accessed. The security policy requires that the data must be encrypted at rest using a unique Microsoft-managed key per storage account, and the data must be stored cost-effectively while allowing retrieval within 15 minutes. Which storage account type and encryption configuration should they choose?

Accepted Answer

General-purpose v2 account with Cool access tier and default encryption. A General-purpose v2 (GPv2) storage account supports the Cool access tier, which is cost-effective for rarely accessed data, and uses default Microsoft-managed encryption keys (SSE) that are unique per storage account. The Cool tier allows data retrieval within minutes (typically under 15 minutes for blob rehydration), meeting the recovery time objective.

Answer

BlockBlobStorage account with infrastructure encryption

Answer

BlobStorage account with Hot access tier and default encryption

Answer

General-purpose v1 account with Archive access tier and default encryption

Question 13

A company enabled Azure Disk Encryption on Windows virtual machines using Azure Key Vault to store encryption keys. They have enabled soft-delete and purge protection on the Key Vault. After a user accidentally deletes a key, the company tries to recover it but the recovery operation fails. What is the most likely reason for the recovery failure?

Accepted Answer

The key vault firewall is blocking access from the VM's virtual network.. The key recovery operation fails because the Key Vault firewall is blocking the network from which the recovery request originates. Even though soft-delete and purge protection are enabled, the firewall rules prevent the client (e.g., an administrator's machine or a management VM) from communicating with the Key Vault to perform the recovery. Recovery requires network access to the Key Vault data plane endpoint, and if the firewall denies traffic from that source, the operation will fail.

Answer

The key vault is in a different Azure region than the VM.

Answer

The key was not created with soft-delete enabled.

Answer

The VM's managed identity does not have 'Key Vault Crypto Service Encryption User' permission.

Question 14

A company is migrating a sensitive database to Azure SQL Managed Instance. The security team requires that the managed instance is not accessible from the public internet and that only specific Azure services, such as Azure Data Factory, can connect. Which configuration should the team implement to meet these requirements?

Accepted Answer

Configure a private endpoint for the Azure SQL Managed Instance.. Azure SQL Managed Instance is deployed inside a virtual network and has a public endpoint that can be disabled. To ensure it is not accessible from the public internet, disable the public endpoint. To allow specific Azure services like Azure Data Factory to connect privately, you can use a private endpoint for the SQL Managed Instance (or a managed private endpoint in Data Factory targeting the instance). A private endpoint assigns a private IP address in your virtual network and, combined with disabling public network access, ensures only private connectivity is possible.

Answer

Use a virtual network service endpoint and disable public network access.

Answer

Configure firewall rules to allow only the IP ranges of Azure Data Factory and deny all other traffic.

Answer

Apply a service tag for Azure SQL Managed Instance in the virtual network NSG.

Question 15

A company deploys a public-facing web application behind Azure Application Gateway. They want to enable the Web Application Firewall (WAF) to protect against SQL injection and cross-site scripting attacks. During the initial testing phase, they want to identify malicious requests without blocking them, to tune the WAF rules before enabling full protection. Which WAF mode should they configure?

Accepted Answer

Detection mode. Detection mode logs WAF alerts and records the full request details without blocking any traffic. This allows the security team to analyze malicious requests, tune rule exclusions, and validate that legitimate traffic is not falsely flagged before switching to Prevention mode. It is the correct choice for the initial testing phase described.

Answer

Prevention mode

Answer

Logging mode

Answer

Off

Question 16

A company stores sensitive data in Azure Blob Storage. They use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. The security policy requires that the encryption keys be automatically rotated every 90 days. Which configuration should they implement to meet this requirement without manual intervention?

Accepted Answer

Enable key auto-rotation in Key Vault by setting a rotation policy on the key.. Azure Key Vault supports automatic key rotation by configuring a rotation policy on the key. When you enable auto-rotation, Key Vault automatically creates a new key version at the specified interval (e.g., every 90 days) without any manual intervention. This directly satisfies the requirement for automatic rotation of customer-managed keys used for Azure Storage encryption at rest.

Answer

Use a custom Azure Automation runbook to rotate the key.

Answer

Set a key expiration date of 90 days and manually renew.

Answer

Enable versioning on the storage account and manually create a new key version.

Question 17

A company stores highly sensitive data in Azure Blob Storage. They require encryption at rest using a customer-managed key. Additionally, they want to ensure that the key can only be used from the same Azure region as the storage account. Which configuration must they implement?

Accepted Answer

Use an Azure Key Vault in the same region as the storage account (keys are region-bound by default).. Azure Key Vault keys are inherently region-bound; when you create a key vault in a specific Azure region, the key material and its cryptographic operations are confined to that region. By placing the key vault in the same region as the storage account, you ensure that the customer-managed key used for Azure Storage Service Encryption (SSE) can only be accessed and used within that region, satisfying the requirement for region-restricted key usage.

Answer

Store the key in a key vault in each region and use a managed identity to access the key vault.

Answer

Use a key stored in an Azure Key Vault with the 'Soft Delete' enabled.

Answer

Use an Azure Key Vault with 'Purge Protection' enabled.

Question 18

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections use at least TLS 1.2 encryption and that connections not meeting this requirement are rejected. Which configuration should they implement on the Azure SQL Server?

Accepted Answer

Set the 'Minimum TLS version' on the SQL server. Azure SQL Server allows you to enforce a minimum TLS version for all client connections. By setting the 'Minimum TLS version' to 1.2, the server will reject any connection attempt using TLS 1.0 or 1.1, ensuring compliance with the security policy that requires at least TLS 1.2 encryption.

Answer

Configure firewall rules to allow only trusted IP addresses

Answer

Enable Transparent Data Encryption (TDE)

Answer

Enable Advanced Threat Protection (ATP)

Question 19

A company stores confidential data in Azure Blob Storage. They need to ensure that all data at rest is encrypted and they must be able to quickly rotate the encryption key on demand in case of a security breach. They also want to minimize administrative overhead. Which encryption option should they use?

Accepted Answer

Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault. Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault allows the organization to control and rotate the encryption key on demand, meeting the security breach response requirement. This option encrypts data at rest in Azure Blob Storage while minimizing administrative overhead because Azure manages the encryption process, and the customer only manages the key lifecycle in Key Vault.

Answer

Server-side encryption with Microsoft-managed keys

Answer

Client-side encryption

Answer

Azure Disk Encryption

Question 20

A company uses Azure SQL Database and wants to periodically scan the database for vulnerabilities such as misconfigurations, excessive permissions, and missing patches. The scans should generate actionable reports that the security team can use to remediate issues. Which built-in Azure feature should they enable?

Accepted Answer

SQL Vulnerability Assessment. SQL Vulnerability Assessment is the correct choice because it is a built-in Azure SQL Database feature specifically designed to discover, track, and remediate potential database vulnerabilities such as misconfigurations, excessive permissions, and missing patches. It runs periodic scans and generates actionable reports with remediation steps, directly matching the requirement.

Answer

Azure Defender for SQL

Answer

SQL Auditing

Answer

Azure SQL Insights