AZ-500 Secure compute, storage, and databases Practice Test 12 — 15 Questions

Question 1

You need to ensure that Azure Disk Encryption (ADE) is enabled on all Azure VMs in a subscription. Which THREE actions are required to implement ADE? (Choose THREE.)

Accepted Answer

Run the Set-AzVMDiskEncryptionExtension cmdlet on each VM.. Option A (Key Vault with soft-delete and purge protection), Option C (assign Key Vault Contributor role to Azure Disk Encryption service), and Option D (enable encryption on each VM using Set-AzVMDiskEncryptionExtension) are required. Option B (Backup) is not required for encryption. Option E (turning off VM) is not needed; encryption can be done online.

Answer

Turn off the VMs before enabling encryption.

Answer

Configure Azure Backup for the VMs.

Question 2

Your organization uses Azure Storage accounts with blob containers. You need to ensure that only authorized applications can access the storage account, without using shared keys or shared access signatures. What should you configure?

Accepted Answer

Use Azure AD authentication with managed identities. Option A is correct because Azure Storage supports managed identities for Azure resources, allowing applications to authenticate without storing keys. Option B is wrong because firewall rules control network access, not application identity. Option C is wrong because private endpoints provide network isolation, not application authentication. Option D is wrong because SAS tokens still require managing secrets.

Answer

Use a stored access policy with a shared access signature

Answer

Configure a firewall on the storage account to allow only the application's IP address

Answer

Enable a private endpoint for the storage account

Question 3

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

Accepted Answer

Implement Always Encrypted and store the column encryption key in Azure Key Vault. Option D is correct because Always Encrypted ensures data is encrypted at rest and in transit, and only client applications with the column encryption key can decrypt it; server administrators cannot access plaintext. Option A is wrong because TDE protects at rest but server administrators can still access plaintext. Option B is wrong because Dynamic Data Masking masks data but does not encrypt it. Option C is wrong because Transparent Data Encryption alone does not prevent server administrators from reading data.

Answer

Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault

Answer

Use Dynamic Data Masking to mask the credit card column for non-privileged users

Answer

Implement Azure SQL Database's Always Encrypted with enclaves

Question 4

You are configuring an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can securely access Azure Container Registry (ACR) without storing image pull secrets in the pod specification. What should you do?

Accepted Answer

Enable managed identity on AKS and assign the AcrPull role to the kubelet identity. Option B is correct because AKS can use managed identities to authenticate to ACR, and the kubelet can be assigned a managed identity with AcrPull role. Option A is wrong because admin credential is not recommended and requires managing secrets. Option C is wrong because a service principal requires managing a secret. Option D is wrong because using the default storage account credential is not for container registry authentication.

Answer

Create a service principal and store the secret in a Kubernetes secret, then reference it in the pod spec

Answer

Enable admin account on ACR and use the admin username and password in the pod spec

Answer

Use the storage account key of the attached Azure storage account

Question 5

Refer to the exhibit. You are deploying an Azure Storage account with the ARM template snippet shown. The deployment fails with an error about the encryption configuration. What is the most likely cause?

Accepted Answer

The storage account does not have the required permissions on the key vault. Option C is correct because the encryption key source requires the storage account's managed identity to have get, wrapKey, and unwrapKey permissions on the key vault. Option A is wrong because the key vault URI format is correct. Option B is wrong because the key name and version are provided. Option D is wrong because the key vault is in the same region.

Answer

The key vault URI is incorrect

Answer

The key name or version is missing

Answer

The key vault is in a different region than the storage account

Question 6

You have an Azure virtual machine that runs a line-of-business application. You need to ensure that the disks attached to the VM are encrypted at rest using platform-managed keys. What should you do?

Accepted Answer

Enable Azure Disk Encryption on the VM. Option B is correct because Azure Disk Encryption uses DM-Crypt (Linux) or BitLocker (Windows) to encrypt disks with platform-managed keys by default. Option A is wrong because enabling encryption at host requires additional configuration. Option C is wrong because SSE with PMK is for storage accounts, not VM disks. Option D is wrong because Azure Disk Encryption with KEK requires a key encryption key from Key Vault, which is customer-managed.

Answer

Configure a disk encryption set with a customer-managed key

Answer

Enable encryption at host on the VM

Answer

Enable Storage Service Encryption (SSE) on the storage account

Question 7

Your company stores sensitive documents in Azure Blob Storage. You need to implement a solution that automatically scans uploaded blobs for malware and quarantines any infected files. The solution must minimize administrative overhead and integrate with Azure Security Center. What should you use?

Accepted Answer

Enable Microsoft Defender for Storage and configure malware scanning. Option C is correct because Microsoft Defender for Storage provides built-in malware scanning for blobs, with automatic quarantine and integration with Security Center. Option A is wrong because Azure Firewall is for network traffic filtering, not content scanning. Option B is wrong because Microsoft Sentinel is a SIEM, not a malware scanner. Option D is wrong because Azure Policy can enforce rules but does not scan for malware.

Answer

Deploy Microsoft Sentinel and create an analytics rule to detect malware from storage logs

Answer

Create an Azure Policy to deny storage accounts without encryption

Answer

Enable Azure Firewall and configure application rules to inspect HTTPS traffic

Question 8

Refer to the exhibit. You are configuring network access for an Azure Storage account. After applying this configuration, users report that they cannot access the storage account from their on-premises network (public IP: 198.51.100.50). What is the most likely reason?

Accepted Answer

The user's public IP address is not in the allowed IP rules. Option B is correct because the default action is Deny, and only the IP range 203.0.113.0/24 is allowed. The user's IP is 198.51.100.50, which is not in the allowed range. Option A is wrong because Azure Services bypass only affects trusted Azure services, not user IPs. Option C is wrong because there are no virtual network rules. Option D is wrong because the storage account is not a private endpoint configuration.

Answer

The storage account is configured with a private endpoint

Answer

The bypass for AzureServices is not configured correctly

Answer

The virtual network rules are missing

Question 9

You need to securely connect to an Azure SQL Database from an on-premises application without exposing the database to the public internet. Which solution should you use?

Accepted Answer

Use Azure Private Link to connect via a private endpoint. Option A is correct because Azure Private Link creates a private endpoint in a virtual network, allowing on-premises connectivity via VPN or ExpressRoute without public exposure. Option B is wrong because firewall rules with public IP still expose the database to the internet. Option C is wrong because always encrypted does not affect network access. Option D is wrong because service endpoints still use a public IP for the service, though traffic stays on the backbone.

Answer

Configure a firewall rule to allow the on-premises public IP address

Answer

Enable Always Encrypted on the database

Answer

Use a virtual network service endpoint for Azure SQL Database

Question 10

Your organization uses Azure Files shares with Azure AD DS authentication. You need to ensure that users can access the file share from on-premises Windows clients using their on-premises AD credentials, without exposing the storage account to the internet. The on-premises network is connected to Azure via a site-to-site VPN. What should you configure?

Accepted Answer

Enable AD DS authentication and configure a private endpoint for the storage account. Option D is correct because to use on-premises AD credentials, you need to enable AD DS authentication on the storage account, and use a private endpoint for connectivity. Option A is wrong because Azure AD DS uses cloud-only identities, not on-premises AD. Option B is wrong because firewall rules with IP expose the storage account to the internet. Option C is wrong because service endpoints still use a public endpoint.

Answer

Enable AD DS authentication and configure a virtual network service endpoint

Answer

Enable AD DS authentication and configure a firewall rule to allow the on-premises VPN gateway public IP

Answer

Enable Azure AD DS authentication and configure a service endpoint

Question 11

Which TWO actions should you take to secure an Azure Cosmos DB account? (Choose two.)

Accepted Answer

Configure IP firewall rules to restrict access to trusted IP ranges. Options A and D are correct. Option A: Using managed identities avoids storing keys in applications. Option D: IP firewall restricts network access. Option B is wrong because private endpoint does not replace key-based auth; you still need to disable key-based auth or use AAD. Option C is wrong because enabling public network access is not a security best practice. Option E is wrong because changing consistency level does not affect security.

Answer

Use a private endpoint and disable key-based authentication

Answer

Set the default consistency level to Strong

Answer

Enable public network access from all networks

Question 12

Which THREE components are required to enable Azure Disk Encryption for Windows VMs using Azure Key Vault? (Choose three.)

Accepted Answer

Azure Key Vault with an access policy granting permissions to the Azure Disk Encryption service. Options A, B, and D are correct. Option A: A Key Vault is required to store encryption keys. Option B: The VM must have a key encryption key (KEK) or be configured to use a BEK. Option D: The VM must have the AzureDiskEncryption extension installed. Option C is wrong because a recovery vault is for Azure Backup, not disk encryption. Option E is wrong because a storage account is not required; Azure Disk Encryption uses managed disks.

Answer

A Recovery Services vault

Answer

A storage account to store the encryption logs

Question 13

Which TWO security features can be enabled on an Azure SQL Database to protect sensitive data from unauthorized access by database administrators? (Choose two.)

Accepted Answer

Always Encrypted. Options A and D are correct. Option A: Always Encrypted ensures that database administrators cannot see plaintext data because the encryption keys are controlled by the client. Option D: Row-Level Security restricts access to rows based on user context, preventing admins from viewing data they shouldn't. Option B is wrong because TDE protects at rest but admins can still query data. Option C is wrong because firewall rules control network access, not data access. Option E is wrong because auditing logs access but does not prevent it.

Answer

Transparent Data Encryption (TDE)

Answer

Azure SQL Database firewall rules

Answer

Auditing

Question 14

Refer to the exhibit. You are deploying an Azure Disk Encryption Set using this ARM template. The deployment succeeds, but when you try to create a disk using this encryption set, the disk creation fails with an error about key vault permissions. What is the most likely cause?

Accepted Answer

The disk encryption set's system-assigned identity lacks Get, WrapKey, and UnwrapKey permissions on the key vault. Option D is correct because the key version is empty, which means the disk encryption set will use the latest version of the key. However, the system-assigned identity needs to have permission on the key vault. The error indicates that the key vault access policy is missing. Option A is wrong because the identity is correctly defined. Option B is wrong because the key vault URI is correct. Option C is wrong because the key source is correctly set to Key Vault.

Answer

The identity type should be UserAssigned

Answer

The key vault URI is malformed

Answer

The key source should be Microsoft.Storage

Question 15

You are designing a solution for Azure Blob Storage that must prevent data from being overwritten or deleted for a specified retention period. Which feature should you enable?

Accepted Answer

Immutable storage with time-based retention policy. Option A is correct because immutability policies (WORM) prevent data modification or deletion for a set period. Option B is wrong because soft delete recovers deleted data but does not prevent deletion. Option C is wrong because versioning keeps multiple versions but allows deletion. Option D is wrong because lifecycle management automates tiering, not protection.

Answer

Blob versioning

Answer

Lifecycle management policies

Answer

Soft delete for blobs