AZ-500 Secure compute, storage, and databases Practice Test 10 — 15 Questions

Question 1

You are responsible for securing Azure Storage accounts that contain confidential documents. You need to implement a solution that prevents accidental deletion of storage accounts and ensures that deleted blobs can be recovered within 30 days. Which two actions should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Enabling blob soft delete with a retention period of 30 days ensures that deleted blobs are retained and recoverable within that timeframe, directly addressing the recovery requirement. Option D is correct because applying a CanNotDelete resource lock to the storage account prevents accidental deletion of the entire account, even by users with Owner permissions, as the lock overrides delete operations.

Answer

Configure an immutability policy

Answer

Enable container soft delete

Answer

Configure network rules to block all public access

Question 2

You are securing an Azure Kubernetes Service (AKS) cluster that runs a microservices application. You need to ensure that pods can only communicate with other pods in the same namespace, and that all egress traffic from the cluster is inspected for malicious content. Which three components should you include in the solution?

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies (option B) are the native Kubernetes resource that controls pod-to-pod communication at the IP address or port level using ingress and egress rules. By defining a NetworkPolicy that restricts traffic to pods within the same namespace, you enforce the required isolation without additional network appliances.

Answer

Azure Application Gateway

Answer

Azure DDoS Protection

Question 3

You are reviewing the above Azure Policy definition. What does this policy do?

Accepted Answer

Denies storage accounts that have the default network action set to Deny. This policy denies the creation or update of storage accounts where the default network action is set to 'Deny'. The default network action determines whether traffic is allowed when no network rule matches; setting it to 'Deny' means that only explicitly allowed traffic is permitted, effectively locking down the storage account. The policy enforces a security baseline by preventing storage accounts from being configured with a restrictive default action that could block legitimate access if not properly managed.

Answer

Denies storage accounts that do not have encryption enabled

Answer

Denies storage accounts that have firewall rules configured

Answer

Denies storage accounts that allow all network traffic

Question 4

You are deploying an Azure Disk Encryption set with the above ARM template snippet. What is the result of this configuration?

Accepted Answer

The disk uses double encryption with both platform-managed and customer-managed keys. The ARM template snippet configures Azure Disk Encryption with both a diskEncryptionSet (customer-managed key) and the encryptionType set to 'EncryptionAtRestWithPlatformAndCustomerKeys'. This enables double encryption, where data is encrypted at rest using both platform-managed keys and customer-managed keys, providing an additional layer of security. The configuration is valid and will succeed because the keyVersion is optional when using a disk encryption set; Azure automatically uses the latest key version if not specified.

Answer

The disk uses only customer-managed key encryption

Answer

The disk encryption will fail because keyversion is empty

Answer

The disk uses only platform-managed key encryption

Question 5

You run the above PowerShell script. What is the effect on the storage account?

Accepted Answer

Block blobs with the prefix 'logs' are deleted after 30 days. The PowerShell script uses `Add-AzStorageAccountManagementPolicyAction` with `-Action Delete` and `-DaysAfterCreationGreaterThan 30` on a filter that targets block blobs with the prefix 'logs'. This creates a lifecycle management policy rule that automatically deletes those blobs 30 days after their creation. The correct answer is A because the rule specifically applies to block blobs (not all blobs) with the 'logs' prefix and sets a deletion action after 30 days.

Answer

Block blobs with the prefix 'logs' are deleted after 90 days

Answer

All block blobs are deleted after 30 days

Answer

Block blobs with the prefix 'logs' are moved to cool tier after 30 days

Question 6

Your organization uses Microsoft Defender for Cloud to manage security posture. You have an Azure SQL Database that stores PII. You need to ensure that all sensitive columns are automatically discovered and classified. Additionally, you want to audit access to these columns. What should you configure?

Accepted Answer

Microsoft Defender for Cloud's data discovery and classification and Azure SQL Database auditing. Microsoft Defender for Cloud's data discovery and classification provides built-in capabilities to automatically discover, classify, and label sensitive columns (such as those containing PII) in Azure SQL Database. Azure SQL Database auditing then logs all access to these classified columns, enabling audit trails for compliance. Together, they meet the requirements for automatic discovery and audit of sensitive data.

Answer

Azure SQL Database Advanced Threat Protection and Azure SQL Database auditing

Answer

Azure Purview Data Map and Azure SQL Database auditing

Answer

Azure SQL Database Vulnerability Assessment and Azure SQL Database auditing

Question 7

You need to securely store connection strings and secrets for an Azure function app. The solution must automatically rotate the secrets every 90 days and provide audit logs for access. What should you use?

Accepted Answer

Azure Key Vault with key rotation policy and diagnostic logging. Azure Key Vault is the correct service for securely storing connection strings and secrets because it provides centralized secret management with access policies and audit logging via diagnostic logs. The key rotation policy can be configured to automatically rotate secrets every 90 days, meeting the requirement. Diagnostic logging captures all access attempts, satisfying the audit log requirement.

Answer

Azure SQL Database with Always Encrypted

Answer

Azure Cosmos DB with encryption at rest

Answer

Azure App Service application settings with slot-sticky settings

Question 8

You are designing a backup strategy for Azure virtual machines. You need to ensure that backups are encrypted at rest and can be restored in a different Azure region in case of a regional disaster. Which two configurations should you use?

Accepted Answer

Enable encryption at rest for the Recovery Services vault using platform-managed keys. Enabling encryption at rest for the Recovery Services vault using platform-managed keys ensures that backup data is encrypted when stored in Azure's storage layer. This is a default encryption mechanism that protects data at rest without requiring additional key management overhead. Option C is correct because Cross-Region Restore (CRR) allows you to restore backup data to a paired Azure region, providing disaster recovery capability if the primary region fails.

Answer

Configure Azure Site Recovery for the VMs

Answer

Enable Azure Disk Encryption on the VMs

Answer

Use geo-redundant storage (GRS) for the Recovery Services vault

Question 9

You are configuring security for an Azure Functions app that processes credit card numbers. You need to ensure that the function can securely access a storage account without storing any credentials in code or configuration, and that all data in the storage account is encrypted with a customer-managed key. Which three actions should you take?

Accepted Answer

Assign the 'Storage Blob Data Contributor' role to the function app's managed identity. Assigning the 'Storage Blob Data Contributor' role to the function app's managed identity authorizes the function to read and write blobs in the storage account using Azure RBAC, without requiring any credentials in code or configuration. This aligns with the requirement to avoid storing credentials, as the managed identity provides a secure identity for the function app to authenticate to Azure services.

Answer

Store the storage account connection string in an application setting

Answer

Use a Key Vault reference in the function app configuration to retrieve the storage account key

Question 10

You are deploying a web application that stores user-uploaded files in Azure Blob Storage. You need to ensure that only authenticated users can upload files, and that uploaded files are automatically scanned for malware. What should you use?

Accepted Answer

Enable Azure AD authentication for the storage account and enable Microsoft Defender for Storage. Enabling Azure AD authentication for the storage account ensures that only authenticated users (via Azure AD) can upload files, while Microsoft Defender for Storage provides built-in malware scanning for uploaded blobs. This combination directly addresses both requirements without additional infrastructure.

Answer

Use Azure Event Grid to trigger a function for malware scanning

Answer

Configure Azure Firewall to allow only the web app's IP address

Answer

Use shared access signatures (SAS) with stored access policies

Question 11

You have an Azure SQL Managed Instance that hosts a line-of-business application. The application requires that all connections use Windows Authentication. You need to ensure that the authentication is secure and that the managed instance can integrate with on-premises Active Directory. What should you configure?

Accepted Answer

Configure Azure AD Kerberos authentication and set up a trust with on-premises Active Directory. Azure SQL Managed Instance requires Windows Authentication to integrate with on-premises Active Directory. Configuring Azure AD Kerberos authentication with a trust to on-premises AD enables Kerberos ticket-based authentication, allowing the managed instance to accept Windows Authentication from on-premises clients without exposing credentials over the network.

Answer

Enable Always Encrypted with secure enclaves

Answer

Enable Azure AD authentication and configure passwordless sign-in

Answer

Configure VNet integration with a site-to-site VPN

Question 12

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to restrict a user to only view data from the 'Sales' schema, without granting permissions to other schemas. What should you do?

Accepted Answer

Create a user mapped to the Entra ID user and grant SELECT on the Sales schema only.. It directly implements the principle of least privilege by creating a database user mapped to the Microsoft Entra ID user and granting SELECT only on the Sales schema. This ensures the user can view data exclusively within that schema, with no implicit permissions on other schemas. Azure SQL Database supports schema-level permissions, making this a precise and secure approach.

Answer

Add the user to the db_datareader role in the database.

Answer

Use a DENY statement on all other schemas for the user.

Answer

Create a contained database user with password and assign to db_datareader.

Question 13

You need to protect Azure VMs from ransomware by ensuring that encrypted file systems cannot be read by attackers. Which solution should you implement?

Accepted Answer

Enable Azure Disk Encryption on the VMs.. Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt the OS and data disks of Azure VMs at rest. This ensures that even if an attacker gains access to the underlying storage or exports the VHD files, the encrypted file system cannot be read without the encryption keys, which are protected by Azure Key Vault. This directly addresses the requirement to prevent attackers from reading encrypted file systems.

Answer

Apply network security groups (NSGs) to block unauthorized access.

Answer

Configure Azure Backup for the VMs.

Answer

Enable Microsoft Defender for Cloud on the subscription.

Question 14

Your company has a policy to disable TLS versions older than 1.2 for Azure Storage accounts. You configure the minimum TLS version setting to 1.2. After a week, an audit reveals that some clients are still connecting with TLS 1.0. What is the most likely reason?

Accepted Answer

Some clients have established persistent connections before the change.. The most likely reason is that some clients established persistent connections (e.g., using HTTP keep-alive or long-lived TCP sessions) before the minimum TLS version was changed to 1.2. These connections continue to use the TLS version negotiated at the time of connection establishment, which could be TLS 1.0, and are not terminated by the configuration change. Only new connections are forced to use TLS 1.2 or higher.

Answer

Clients are accessing the storage account through a private endpoint with IP rules.

Answer

The storage account is configured to allow TLS 1.0 by default.

Answer

The setting does not apply to Azure Files.

Question 15

You are designing a secure data solution for a financial services company. Data must be encrypted at rest and in transit. Additionally, you need to prevent administrators from accessing the encryption keys. What should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys and a key vault access policy that denies key operations for the admin group.. It combines Azure Storage service-side encryption (SSE) with customer-managed keys (CMK) stored in Azure Key Vault, and restricts key operations for administrators via a Key Vault access policy. This ensures data is encrypted at rest (SSE) and in transit (HTTPS enforced), while preventing admins from accessing the encryption keys by denying them cryptographic operations like 'unwrap key' or 'decrypt'.

Answer

Azure Storage encryption with service-side encryption and HTTPS enforced.

Answer

Azure Storage encryption with Microsoft-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.