AZ-500 Secure compute, storage, and databases Practice Test 10 — 15 Questions

Question 1

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No, Azure does not support CMK from a different region than the storage account.. Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.

Answer

Yes, but the storage account must use a different key vault per region; no other implications.

Answer

Yes, but you must enable cross-region replication for the key vault and pay additional costs.

Answer

Yes, but you must use a managed identity from the storage account's region to access the key vault.

Question 2

A company stores business records in Azure Blob Storage. Due to a legal investigation, they must prevent any modification or deletion of the blobs for an indefinite period until the legal hold is released. They also need to ensure that even storage account owners cannot alter the data during the hold. Which blob storage feature should they enable?

Accepted Answer

Legal hold. Legal hold (option B) is the correct choice because it is designed to protect blobs from any modification or deletion for an indefinite period, even by storage account owners. Unlike time-based retention policies, a legal hold has no expiration and cannot be removed until explicitly cleared by an authorized user, making it ideal for indefinite legal investigations.

Answer

Time-based retention policy

Answer

Soft delete

Answer

Blob versioning

Question 3

A company uses Azure Blob Storage to store sensitive documents. The security policy requires that the storage account can only be accessed from a specific Azure virtual network (VNet) and that all access must use Azure Active Directory (Azure AD) authentication. They want to block any access that uses storage account keys or shared access signatures (SAS). Which configuration should they implement?

Accepted Answer

Configure the storage account firewall to allow access from the specific VNet, and disable 'Allow storage account key access'.. It combines two essential controls: the storage account firewall restricts access to only the specified VNet, and disabling 'Allow storage account key access' enforces Microsoft Entra ID authentication by blocking all requests that use account keys or SAS tokens. This ensures that only authenticated Microsoft Entra ID identities from the allowed VNet can access the storage account, meeting the security policy requirements.

Answer

Configure a private endpoint for the storage account and disable 'Allow storage account key access'.

Answer

Configure the storage account firewall to deny all networks, and set 'Allow storage account key access' to 'Disabled'.

Answer

Configure the storage account firewall to allow access from the specific VNet, and enable 'Require secure transfer' (HTTPS only).

Question 4

A company has an Azure SQL Database that stores personally identifiable information (PII) in columns. They need to encrypt those columns so that only authorized applications can decrypt the data, and even database administrators cannot view the plaintext. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they use?

Accepted Answer

Always Encrypted with deterministic encryption. Always Encrypted with deterministic encryption is the correct choice because it encrypts PII columns at the client side, ensuring that even database administrators cannot view plaintext data. Deterministic encryption generates the same ciphertext for the same plaintext, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting the requirement for query support.

Answer

Always Encrypted with randomized encryption

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 5

A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?

Accepted Answer

Enable Azure Storage encryption with customer-managed keys (CMK). Enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.

Answer

Use service-managed keys (SSE) with platform-managed keys

Answer

Enable Azure Disk Encryption on VMs that access the storage account

Answer

Configure Azure Information Protection for the storage account

Question 6

A company has an Azure Storage account with infrastructure encryption enabled. They configure the storage account to use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. Despite this configuration, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

The storage account's encryption type is set to Microsoft-managed keys. The storage account's encryption type must be explicitly set to 'Customer-managed keys' to use CMK from Azure Key Vault. If the encryption type remains at the default 'Microsoft-managed keys', newly uploaded blobs will continue to be encrypted with Microsoft-managed keys regardless of the CMK configuration in Key Vault. Infrastructure encryption is a separate feature that encrypts data at the hardware level and does not affect the key management type.

Answer

The storage account was created before infrastructure encryption was generally available

Answer

The customer-managed key in Key Vault is disabled or expired

Answer

The blob container has a policy that overrides the encryption setting

Question 7

A company deploys a public-facing web application behind Azure Application Gateway. They want to enable the Web Application Firewall (WAF) to protect against SQL injection and cross-site scripting attacks. During the initial testing phase, they want to identify malicious requests without blocking them, to tune the WAF rules before enabling full protection. Which WAF mode should they configure?

Accepted Answer

Detection mode. Detection mode logs WAF alerts and records the full request details without blocking any traffic. This allows the security team to analyze malicious requests, tune rule exclusions, and validate that legitimate traffic is not falsely flagged before switching to Prevention mode. It is the correct choice for the initial testing phase described.

Answer

Prevention mode

Answer

Logging mode

Answer

Off

Question 8

A company stores sensitive healthcare data in Azure SQL Database. They need to encrypt specific columns containing patient diagnosis codes so that even database administrators with the 'sysadmin' role cannot view the plaintext. The application must be able to perform equality searches (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted (deterministic encryption). Always Encrypted with deterministic encryption ensures that sensitive columns are encrypted at the client side, so the encryption keys are never revealed to the database engine, including sysadmin roles. Deterministic encryption generates the same ciphertext for the same plaintext, enabling equality searches (WHERE clauses) on encrypted columns without exposing plaintext data to the server.

Answer

Transparent Data Encryption (TDE)

Answer

Row-Level Security (RLS)

Answer

Dynamic Data Masking (DDM)

Question 9

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable key auto-rotation in Key Vault by setting a rotation policy on the key.. Azure Key Vault supports automatic key rotation by configuring a rotation policy on the key. When you enable auto-rotation, Key Vault automatically creates a new key version at the specified interval (e.g., every 90 days) without any manual intervention. This directly satisfies the requirement for automatic rotation of customer-managed keys used for Azure Storage encryption at rest.

Answer

Use a custom Azure Automation runbook to rotate the key.

Answer

Set a key expiration date of 90 days and manually renew.

Answer

Enable versioning on the storage account and manually create a new key version.

Question 10

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 11

A company enables Azure SQL Database auditing to log database events to a storage account. The security policy requires that the audit logs be protected from tampering and deletion after they are written. Which storage account feature should the company enable to ensure that audit log files cannot be modified or deleted by anyone for a specified retention period?

Accepted Answer

Immutable storage. Immutable storage for Azure Blob Storage provides a WORM (Write Once, Read Many) policy that prevents audit log files from being modified or deleted by any user, including administrators, for a specified retention period. This directly meets the security requirement to protect audit logs from tampering and deletion after they are written.

Answer

Soft delete

Answer

Hierarchical namespace

Answer

Firewall and virtual networks

Question 12

A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?

Accepted Answer

Blob Storage change feed.. The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.

Answer

Azure Blob Storage soft delete.

Answer

Azure Blob Storage versioning.

Answer

Azure Storage analytics logs.

Question 13

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key stored in Azure Key Vault. The Key Vault is configured with a firewall that denies all public access. The SQL server must be able to access the key. What additional configuration is necessary?

Accepted Answer

Enable trusted Microsoft services on the Key Vault firewall. When Azure Key Vault's firewall denies all public access, enabling 'Allow trusted Microsoft services' is necessary because Azure SQL Database's TDE key retrieval is considered a trusted service operation. This setting bypasses the firewall for specific Azure services like SQL Database that are authenticated and authorized to access the vault, without requiring a private endpoint or service endpoint.

Answer

Create a private endpoint for Key Vault

Answer

Assign the SQL server's managed identity to the Key Vault

Answer

Configure a service endpoint on the SQL server

Question 14

A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?

Accepted Answer

Set the key vault's 'enabledForDiskEncryption' property to true.. Azure Disk Encryption requires the key vault's 'enabledForDiskEncryption' property to be set to true. This property explicitly authorizes the Azure platform (specifically the Azure Disk Encryption service) to access the Key Encryption Key (KEK) stored in the vault for encrypting VM disks. Without this flag, the platform cannot retrieve the KEK, even if other permissions exist.

Answer

Grant the Azure Disk Encryption service principal 'Reader' role on the key vault.

Answer

Grant the virtual machine's managed identity 'Contributor' role on the key vault.

Answer

Configure soft-delete and purge protection on the key vault.

Question 15

A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

A default encryption scope is configured on the blob container that uses a Microsoft-managed key.. When a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.

Answer

The Key Vault is in a different Azure region than the storage account.

Answer

The storage account does not have a system-assigned managed identity enabled.

Answer

The customer-managed key in Key Vault is disabled or expired.