AZ-500 Secure compute, storage, and databases Practice Test 12 — 15 Questions

Question 1

An Azure SQL Database contains salary data. Support analysts need to query employee records but must not see full salary values. Which feature is most appropriate when the application cannot be changed immediately?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dynamic data masking. Dynamic data masking (DDM) is the correct choice because it obfuscates sensitive data in query results without modifying the underlying database or requiring application changes. The support analysts can still query employee records, but the salary column is masked according to a defined masking rule (e.g., showing only the last four digits or replacing with zeros). This meets the requirement of preventing full salary exposure while the application remains unchanged.

Answer

Transparent Data Encryption

Answer

Geo-replication

Answer

Accelerated database recovery

Question 2

A Kubernetes workload in AKS needs to pull images from Azure Container Registry without using admin credentials. Which configuration should be used?

Accepted Answer

Grant the AKS kubelet identity AcrPull on the registry. The AKS cluster uses a kubelet identity (managed identity) to authenticate with ACR. By granting the AcrPull role to this identity, the kubelet can pull container images without requiring admin credentials, as Azure RBAC handles the authentication via Microsoft Entra ID tokens. This is the recommended secure method for image pull operations.

Answer

Enable anonymous pull access on the registry

Answer

Store the ACR admin password in a ConfigMap

Answer

Expose the registry through a public load balancer

Question 3

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Accepted Answer

Configure Key Vault networking with private endpoint or selected networks. Option A is correct because configuring Key Vault networking with a private endpoint or selected networks restricts access to the vault from approved private IP ranges within your virtual networks, blocking public internet access. Option C is correct because Key Vault's firewall and virtual network restrictions let you allow traffic only from specified VNets/subnets and trusted Azure services, directly enforcing the 'selected private networks and approved Azure services' requirement. Option B is incorrect because soft delete is a data-protection feature that retains deleted vaults/objects for recovery; disabling it does not control network accessibility and would weaken security. Option D is incorrect because storing secrets as plain text tags is insecure and unrelated to network access restrictions; tags are metadata and should never hold secret values.

Answer

Disable soft delete permanently

Answer

Store secrets as plain text tags

Question 4

Drag and drop the steps to configure Azure Defender for SQL on an Azure SQL Database into the correct order.

Accepted Answer

1. Enable Azure Defender for SQL on the database. 2. Configure a storage account for vulnerability assessment scans. 3. Set up email notifications for security alerts.. Defender for SQL is enabled per database under security settings, requiring storage for scans.

Answer

1. Configure a storage account for vulnerability assessment scans. 2. Enable Azure Defender for SQL on the database. 3. Set up email notifications for security alerts.

Answer

1. Enable Azure Defender for SQL on the database. 2. Set up email notifications for security alerts. 3. Configure a storage account for vulnerability assessment scans.

Answer

1. Set up email notifications for security alerts. 2. Enable Azure Defender for SQL on the database. 3. Configure a storage account for vulnerability assessment scans.

Question 5

Drag and drop the steps to enable Azure Security Center's enhanced security features for a subscription into the correct order.

Accepted Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Choose the subscription, Step 4: Set pricing tier to Standard. To enable Azure Security Center's enhanced security features for a subscription, you must first navigate to Security Center, then access 'Security policy' under Management. Within that blade, select the target subscription and set its pricing tier to Standard. This activates advanced threat detection and vulnerability assessment capabilities. Common mistakes include confusing the order of subscription selection and tier setting, or mixing up the security policy with auto-provisioning settings.

Answer

Step 1: Navigate to Azure Security Center, Step 2: Choose the subscription, Step 3: Set pricing tier to Standard, Step 4: Select 'Security policy' under Management

Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Set pricing tier to Standard, Step 4: Choose the subscription

Answer

Step 1: Navigate to Azure Security Center, Step 2: Go to 'Auto provisioning' settings, Step 3: Enable Log Analytics agent, Step 4: Set pricing tier to Standard

Question 6

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.

Accepted Answer

1. Navigate to Azure AD Security
2. Configure user risk policy
3. Configure sign-in risk policy
4. Review risk detections. Identity Protection policies are configured under Security, with user risk policy settings.

Answer

1. Configure sign-in risk policy
2. Configure user risk policy
3. Navigate to Azure AD Security
4. Review risk detections

Answer

1. Review risk detections
2. Navigate to Azure AD Security
3. Configure user risk policy
4. Configure sign-in risk policy

Answer

1. Configure user risk policy
2. Navigate to Azure AD Security
3. Configure sign-in risk policy
4. Review risk detections

Question 7

Your organization uses Azure Storage for sensitive customer data. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, you want to automatically rotate the key every 90 days. What should you configure?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key and configure a key rotation policy in Azure Key Vault.. Azure Storage encryption with a customer-managed key (CMK) allows you to use your own key stored in Azure Key Vault to encrypt data at rest. By configuring a key rotation policy in Azure Key Vault, you can automatically rotate the key every 90 days, meeting both the CMK and rotation requirements without custom code.

Answer

Enable Azure Disk Encryption on the storage account and store the key in Key Vault with rotation policy.

Answer

Enable server-side encryption with a platform-managed key and use Azure Policy to enforce rotation.

Answer

Use client-side encryption with .NET client library and implement custom rotation logic.

Question 8

You have an Azure SQL Database that stores financial data. You need to prevent unauthorized access by encrypting specific columns containing credit card numbers. The solution must allow authorized applications to query the data transparently. What should you implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it encrypts specific columns (e.g., credit card numbers) at the client-side, ensuring that the data remains encrypted both at rest and in transit, and only authorized applications with the column encryption key can decrypt and query the data transparently. This meets the requirement of preventing unauthorized access (including database administrators) while allowing transparent querying for authorized applications.

Answer

Azure Storage service encryption

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 9

You need to securely store secrets, such as connection strings and API keys, for use by an Azure Functions app. The solution must automatically rotate the secrets and audit access. What should you use?

Accepted Answer

Azure Key Vault. Azure Key Vault is the correct choice because it provides a centralized, secure store for secrets like connection strings and API keys, with built-in support for automatic rotation via integration with Azure Key Vault references in Azure Functions and access auditing through diagnostic logs and Azure Monitor. This meets the requirements of secure storage, automated secret rotation, and audit trail generation.

Answer

Azure Blob Storage with encryption

Answer

Managed Identity

Answer

Application settings in the function app configuration

Question 10

You are designing a security solution for Azure Cosmos DB that stores Personally Identifiable Information (PII). You need to encrypt data at rest and in transit. You also need to implement row-level security to restrict access based on user role. What should you configure?

Accepted Answer

Encryption at rest is automatically enabled; enforce TLS for transit; implement row-level security via application code.. Azure Cosmos DB automatically encrypts data at rest using AES-256 encryption, and data in transit is secured by enforcing TLS (Transport Layer Security). Row-level security is not natively supported in Cosmos DB; instead, it must be implemented at the application layer by filtering queries based on user roles, typically using a partition key or a custom property in the document.

Answer

Enable Azure Disk Encryption on the Cosmos DB account.

Answer

Enable Always Encrypted and configure column encryption.

Answer

Use Dynamic Data Masking to restrict sensitive data.

Question 11

You have an Azure Storage account that contains sensitive documents. You need to generate a time-limited, secure URL that allows a specific user to download a file without requiring storage account keys. What should you use?

Accepted Answer

Shared Access Signature (SAS). A Shared Access Signature (SAS) is the correct choice because it provides delegated, time-limited access to a specific storage resource (e.g., a blob) without exposing the storage account keys. You can scope the SAS to a specific user by using a stored access policy or by generating a service SAS with fine-grained permissions, and you can enforce expiration and allowed IP ranges. This meets the requirement of a secure, time-bound URL for a single file download.

Answer

Azure Front Door custom domain

Answer

Storage account access key

Answer

Azure RBAC role assignment

Question 12

Your organization is using Azure Database for MySQL. You need to ensure that only traffic from Azure services and specific client IP addresses can connect to the database. What should you configure?

Accepted Answer

Firewall rules with 'Allow access to Azure services' enabled and specific IP rules. Azure Database for MySQL uses firewall rules to control access at the server level. Enabling 'Allow access to Azure services' permits connections from Azure internal IP ranges, while adding specific client IP rules restricts access to only those addresses. This dual configuration meets the requirement to allow traffic from Azure services and specific client IPs while blocking all other traffic.

Answer

Azure Active Directory authentication

Answer

Virtual Network service endpoints

Answer

Network Security Group (NSG) rules on the subnet

Question 13

You are deploying a three-tier application on Azure VMs. The web tier must be accessible from the internet, but the application and database tiers must only accept traffic from the web tier. You need to implement network segmentation using Azure networking components. What is the most secure and manageable solution?

Accepted Answer

Use separate subnets for each tier in the same VNet and configure NSGs to allow traffic only from the previous tier.. Placing each tier in its own subnet within the same VNet allows you to apply Network Security Groups (NSGs) at the subnet level with inbound rules that restrict traffic to only the previous tier's subnet IP range. This follows the principle of least privilege and provides a clear, manageable boundary between tiers without introducing unnecessary complexity or performance overhead.

Answer

Use a single subnet and configure NSGs on VM NICs to restrict traffic.

Answer

Use VNet peering to connect separate VNets for each tier and use NSGs.

Answer

Use a single VNet with one subnet and use Azure Firewall to filter traffic between tiers.

Question 14

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Accepted Answer

Implement Azure Web Application Firewall (WAF). Option B (Azure Web Application Firewall) is correct because WAF, especially when deployed with Azure Application Gateway or Front Door, includes managed rule sets that detect and block common SQL injection patterns in HTTP requests before they reach the database. Option D (parameterized queries) is correct because parameterization separates SQL code from user-supplied data, so injected input is treated as a literal value rather than executable SQL, which is the most fundamental defense against SQL injection at the application layer. Option A (TDE) is not correct because it only encrypts data at rest and does nothing to prevent injection attacks. Option C (Azure SQL Database firewall rules) is not correct because it restricts access by IP address or Azure service, not by inspecting query content. Option E (Always Encrypted) is not correct because it protects sensitive column data from unauthorized viewing, not from SQL injection logic.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure Azure SQL Database firewall rules

Answer

Enable Always Encrypted for sensitive columns

Question 15

You need to secure an Azure Storage account that will host sensitive data. Which TWO configurations should you implement?

Accepted Answer

Enable 'Secure transfer required'. Option B is correct because enabling 'Secure transfer required' on the storage account enforces HTTPS/TLS for all requests to the storage endpoints, rejecting any HTTP traffic so sensitive data is never transmitted in cleartext. Option E is correct because configuring a private endpoint assigns the storage account a private IP address inside your virtual network via Azure Private Link, removing exposure to the public internet and letting access flow only over the Microsoft backbone network. Option A is not correct here because a SAS is a delegated, time-limited access token for granting scoped permissions to clients, not a baseline network or transport security configuration for the account. Option C is not correct because allowing public network access from all networks does the opposite of securing the account, exposing it to the internet. Option D is not correct because enabling Azure Files simply turns on the SMB/NFS file share service and does not itself harden or restrict access to the storage account.

Answer

Generate a shared access signature (SAS)

Answer

Allow public network access from all networks

Answer

Enable Azure Files