AZ-500 Secure compute, storage, and databases Practice Test 11 — 15 Questions

Question 1

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is a Microsoft service. How can the SQL server be granted access to the key vault to perform TDE operations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault. Azure Key Vault's firewall includes a setting to 'Allow trusted Microsoft services to bypass this firewall.' Azure SQL Database is a trusted Microsoft service, so enabling this setting allows the SQL server to authenticate to Key Vault using its system-assigned managed identity to retrieve the customer-managed key for TDE operations, without needing to disable the firewall or create a private endpoint.

Answer

Create a private endpoint on the Key Vault for the SQL server

Answer

Disable the Key Vault firewall

Answer

Assign the SQL server a system-assigned managed identity and grant it access to the key vault

Question 2

A company stores sensitive data in Azure Blob Storage. They want to encrypt the data at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want the key to be automatically rotated every 90 days without manual intervention. Which configuration should they implement?

Accepted Answer

Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.. Azure Key Vault supports automatic key rotation through a rotation policy, which can be configured to rotate a customer-managed key (CMK) every 90 days without manual intervention. When Azure Storage encryption uses a CMK stored in Key Vault, the storage account references the key version, and enabling a rotation policy in Key Vault automatically creates new key versions, which Azure Storage then uses for encryption. This satisfies the requirement for automated 90-day rotation without manual steps.

Answer

Enable Azure Storage encryption with a CMK and configure a rotation policy on the storage account.

Answer

Enable Azure Storage encryption with a CMK and manually rotate the key every 90 days.

Answer

Use Azure Storage service-side encryption with platform-managed keys and enforce rotation via Azure Policy.

Question 3

A company uses Azure Managed Disks for their virtual machines. They want to ensure that all managed disks are encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also want to automatically revoke access to the disks if the key is disabled or deleted. Which feature should they configure?

Accepted Answer

Server-side encryption with customer-managed keys (SSE-CMK). Server-side encryption with customer-managed keys (SSE-CMK) encrypts Azure Managed Disks at rest using a key stored in Azure Key Vault. When the key is disabled or deleted, Azure automatically revokes access to the disk by failing any I/O operations that require that key, ensuring the disk becomes inaccessible. This directly meets the requirement for both CMK-based encryption and automatic access revocation upon key loss.

Answer

Azure Disk Encryption (ADE) with a Key Encryption Key (KEK)

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys

Answer

Azure Key Vault soft-delete and purge protection

Question 4

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections use at least TLS 1.2 encryption and that connections not meeting this requirement are rejected. Which configuration should they implement on the Azure SQL Server?

Accepted Answer

Set the 'Minimum TLS version' on the SQL server. Azure SQL Server allows you to enforce a minimum TLS version for all client connections. By setting the 'Minimum TLS version' to 1.2, the server will reject any connection attempt using TLS 1.0 or 1.1, ensuring compliance with the security policy that requires at least TLS 1.2 encryption.

Answer

Configure firewall rules to allow only trusted IP addresses

Answer

Enable Transparent Data Encryption (TDE)

Answer

Enable Advanced Threat Protection (ATP)

Question 5

A company plans to enable Azure Disk Encryption (ADE) on a fleet of Windows virtual machines. They want to use a key stored in Azure Key Vault to encrypt the disks. Which additional access configuration must be made in the Key Vault to allow ADE to succeed?

Accepted Answer

Grant the Azure Disk Encryption service principal (Microsoft.Azure.Security) appropriate key permissions in the Key Vault access policy.. Azure Disk Encryption (ADE) uses the Azure platform's built-in service principal (Microsoft.Azure.Security) to access the Key Vault and retrieve the disk encryption key. Without granting this service principal the necessary 'Get', 'WrapKey', and 'UnwrapKey' key permissions in the Key Vault access policy, ADE cannot authenticate and perform the encryption operations. This is a mandatory configuration step for ADE to succeed.

Answer

Assign a managed identity to each VM and grant that identity key permissions in the Key Vault.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Assign the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal.

Question 6

A company stores highly sensitive data in Azure Blob Storage. The security policy requires that all data is encrypted at rest using a key that is stored in Azure Key Vault, and that the storage account uses its system-assigned managed identity to access the key. Which encryption configuration should they use?

Accepted Answer

Server-side encryption with customer-managed keys (CMK). Server-side encryption with customer-managed keys (CMK) is required because the security policy mandates that the encryption key be stored in Azure Key Vault and that the storage account uses its system-assigned managed identity to access that key. CMK allows you to bring your own key (BYOK) into Key Vault and grants the storage account access via a managed identity, ensuring the key is under your control and not managed by Azure. Service-managed keys (option A) use Microsoft-managed keys, which do not satisfy the requirement for customer-controlled key storage.

Answer

Server-side encryption with service-managed keys

Answer

Client-side encryption

Answer

Azure Disk Encryption

Question 7

A company uses Azure Key Vault to store secrets. They want to grant developers the ability to read secrets, but only for specific secret names (e.g., 'App--ConnectionString'). They also want to use Azure RBAC instead of the Key Vault access policy model. Which RBAC role should they assign, and at which scope?

Accepted Answer

Assign the 'Key Vault Secrets User' role at the secret scope. The 'Key Vault Secrets User' role, when assigned at the individual secret scope (e.g., /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vault}/secrets/{secretName}), grants read-only access to that specific secret. This satisfies the requirement to use Azure RBAC (instead of the legacy access policy model) and to limit developers to reading only secrets with a specific name, such as 'App--ConnectionString'.

Answer

Assign the 'Key Vault Secrets User' role at the vault scope

Answer

Assign the 'Key Vault Reader' role at the secret scope

Answer

Assign the 'Key Vault Secrets Officer' role at the secret scope

Question 8

A company stores confidential data in Azure Blob Storage. They need to ensure that all data at rest is encrypted and they must be able to quickly rotate the encryption key on demand in case of a security breach. They also want to minimize administrative overhead. Which encryption option should they use?

Accepted Answer

Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault. Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault allows the organization to control and rotate the encryption key on demand, meeting the security breach response requirement. This option encrypts data at rest in Azure Blob Storage while minimizing administrative overhead because Azure manages the encryption process, and the customer only manages the key lifecycle in Key Vault.

Answer

Server-side encryption with Microsoft-managed keys

Answer

Client-side encryption

Answer

Azure Disk Encryption

Question 9

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Question 10

A company uses Azure SQL Database with Azure Active Directory authentication. To meet compliance requirements, they need to audit all failed login attempts and store the audit logs in a storage account located in a different Azure region for disaster recovery. What should they configure?

Accepted Answer

Enable SQL Auditing and set the destination to an Azure Storage account in a different region.. Azure SQL Database auditing can be configured to write audit logs directly to an Azure Storage account. Storing the logs in a storage account located in a different Azure region meets the disaster recovery requirement by ensuring logs survive a regional outage. The audit logs capture all database events, including failed login attempts, which satisfies the compliance need.

Answer

Enable SQL Auditing and set the destination to a Log Analytics workspace in a different region.

Answer

Enable SQL Auditing and set the destination to an Event Hub namespace in the same region.

Answer

Enable Advanced Threat Protection for Azure SQL Database and configure email notifications.

Question 11

A company generates shared access signature (SAS) tokens to grant time-limited access to blobs in an Azure Storage container. A security administrator needs the ability to immediately revoke all active SAS tokens for that container if a token is compromised. What should they use?

Accepted Answer

Use a stored access policy on the container and reference it in the SAS token.. A stored access policy on the container provides a centralized way to manage permissions for shared access signatures (SAS). By associating the SAS token with the policy, you can immediately revoke all tokens that reference that policy by simply deleting or modifying the policy's permissions or expiry time. This is the only method that allows instant revocation of multiple SAS tokens without waiting for their individual expiry.

Answer

Use a user delegation key to create the SAS token.

Answer

Use an account-level SAS token.

Answer

Use a service-level SAS token with IP address restrictions.

Question 12

A company stores sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they need the ability to immediately make the data inaccessible in case of a security breach. Which configuration on the storage account enables this?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key (CMK). Enabling Azure Storage encryption with a customer-managed key (CMK) stored in Azure Key Vault allows the customer to control the encryption key used for data at rest. In the event of a security breach, the customer can immediately revoke access to the CMK in Key Vault (e.g., by disabling the key or deleting the key vault), which renders the encrypted Blob Storage data inaccessible because Azure Storage cannot decrypt it without the key. This satisfies both the encryption-at-rest requirement and the ability to make data inaccessible on demand.

Answer

Enable infrastructure encryption

Answer

Enable soft delete for the storage account

Answer

Enable Azure AD authentication for Blob Storage

Question 13

A company enables Azure Disk Encryption (ADE) on Windows virtual machines using a key encryption key (KEK) stored in Azure Key Vault. They want the KEK to be automatically rotated every 30 days to meet compliance requirements. Which Azure Key Vault feature should they enable?

Accepted Answer

Key rotation policy. A key rotation policy in Azure Key Vault allows you to define automatic rotation rules for keys, including a rotation interval (e.g., every 30 days) and a rotation time window. This feature ensures that the KEK is automatically replaced with a new key version at the specified interval without manual intervention, meeting compliance requirements for periodic key rotation.

Answer

Key expiration date

Answer

Soft-delete

Answer

Purge protection

Question 14

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections to the database use at least TLS 1.2 encryption. What configuration change must be made to enforce this requirement?

Accepted Answer

Configure the minimum TLS version in the SQL server's settings.. To enforce that all client connections to Azure SQL Database use at least TLS 1.2, you must configure the minimum TLS version at the SQL server level. This setting overrides the default behavior, which allows older, less secure TLS versions, and ensures that any connection attempt using TLS 1.0 or 1.1 is rejected. The configuration is made in the Azure portal under the SQL server's 'Connectivity' settings or via the 'Minimal TLS Version' property in ARM templates or PowerShell.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Update the server firewall rules to allow only specific IP addresses.

Answer

Implement Always Encrypted for all sensitive columns.

Question 15

A storage account contains legal evidence that must not be modified or deleted for seven years. Which feature should be configured?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) is the correct choice because it enforces a strict seven-year retention period during which blobs cannot be modified or deleted, even by account administrators. This is achieved through a policy that locks the data at the storage level, ensuring compliance with legal hold requirements for evidence preservation.

Answer

Soft delete only

Answer

Lifecycle management to archive tier

Answer

Customer-managed keys