AZ-500 Secure compute, storage, and databases Practice Test 13 — 15 Questions

Question 1

Your company has an Azure SQL Managed Instance that stores sensitive customer data. You need to implement a solution that automatically classifies and protects the sensitive data in the database, with minimal manual intervention. The solution should integrate with Microsoft Purview. What should you use?

Accepted Answer

Microsoft Defender for SQL (Data Discovery & Classification). Option B is correct because Microsoft Defender for SQL includes data discovery and classification, which can be integrated with Purview. Option A is wrong because Azure Policy is for compliance enforcement, not classification. Option C is wrong because Dynamic Data Masking masks data but does not classify it. Option D is wrong because SQL Server Audit logs access but does not classify data.

Answer

SQL Server Audit

Answer

Azure Policy with built-in SQL classification policy

Answer

Dynamic Data Masking

Question 2

Your company stores sensitive customer data in Azure Blob Storage. You need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. The key must be automatically rotated every 90 days. Which Azure policy should you configure to enforce this requirement?

Accepted Answer

Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault with automatic key rotation. Option B is correct because 'Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault with automatic key rotation' enforces CMK and automatic rotation. Options A and C do not include rotation. Option D is for Azure SQL Database, not Blob Storage.

Answer

Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault

Answer

Configure Transparent Data Encryption for Azure SQL Database with customer-managed key

Answer

Deploy encryption of Azure Blob Storage using Azure Disk Encryption

Question 3

You are deploying a virtual machine that will host a legacy application. The application writes temporary files to the local disk. You must ensure that any data written to the temporary disk is encrypted at rest with a platform-managed key. What should you do?

Accepted Answer

Enable encryption at host on the VM. Option A is correct because Azure Disk Encryption encrypts OS and data disks, but the temporary disk (D: drive) is not encrypted by default. EncryptingHostVmWithCustomerManagedKey is a VM feature that encrypts the temporary disk with a customer-managed key. However, the question specifies a platform-managed key. Actually, the correct answer is to use a VM with encryption at host enabled, which uses platform-managed keys by default. Option A (Azure Disk Encryption) does not encrypt temporary disk. Option B (encryption at host) encrypts temporary disk with PMK. Option C is for storage account. Option D is for SQL.

Answer

Enable Azure Disk Encryption on the VM

Answer

Configure storage service encryption on the managed disk

Answer

Use Always Encrypted with secure enclaves

Question 4

You are designing a secure Azure SQL Database deployment. The database must support real-time analytics and reporting without impacting the performance of the transactional workload. You need to ensure that the reporting queries have an isolated copy of the data that is automatically kept up to date. The solution must also encrypt the data at rest using a customer-managed key. What should you include in the design?

Accepted Answer

Hyperscale service tier with named replicas. Option C is correct because Azure SQL Database Hyperscale service tier with named replicas provides a scalable read-only replica for reporting, and it supports TDE with CMK. Geo-replication (A) is for disaster recovery, not reporting. Failover groups (B) are for high availability. Serverless (D) is for compute scaling, not read replicas.

Answer

Active geo-replication with a readable secondary

Answer

Serverless compute tier with auto-pause

Answer

Failover groups with automatic failover

Question 5

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Accepted Answer

Configure a private endpoint. Option B is correct because setting the minimum TLS version to 1.2 enforces encryption in transit. Option D is correct because using private endpoints ensures traffic stays within the Azure backbone and the same region. Option A (firewall with IP rules) allows traffic from specified IPs but not necessarily from Azure services. Option C (public network access disabled) is a prerequisite for private endpoints but not sufficient alone. Option E (service endpoint) does not enforce regional restriction.

Answer

Enable service endpoints for the Cosmos DB account

Answer

Disable public network access

Answer

Configure firewall rules to allow only Azure services

Question 6

You are responsible for securing Azure Storage accounts that contain confidential documents. You need to implement a solution that prevents accidental deletion of storage accounts and ensures that deleted blobs can be recovered within 30 days. Which two actions should you take?

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Option A is correct because a resource lock prevents deletion of the storage account. Option D is correct because soft delete for blobs allows recovery within the specified retention period. Option B (containers) is for versioning for blobs, not deletion prevention. Option C (immutability policy) is for legal hold, not recovery. Option E (firewall) is for access control.

Answer

Configure an immutability policy

Answer

Enable container soft delete

Answer

Configure network rules to block all public access

Question 7

You are securing an Azure Kubernetes Service (AKS) cluster that runs a microservices application. You need to ensure that pods can only communicate with other pods in the same namespace, and that all egress traffic from the cluster is inspected for malicious content. Which three components should you include in the solution?

Accepted Answer

Kubernetes Network Policies. Option A is correct because Network Policies in AKS control pod-to-pod communication. Option C is correct because Azure Firewall can inspect egress traffic. Option D is correct because the egress traffic must be routed through the firewall. Option B (Azure DDoS Protection) is for DDoS attacks, not content inspection. Option E (Application Gateway) is for inbound traffic, not egress inspection.

Answer

Azure Application Gateway

Answer

Azure DDoS Protection

Question 8

You are reviewing the above Azure Policy definition. What does this policy do?

Accepted Answer

Denies storage accounts that have the default network action set to Deny. Option D is correct: the policy denies (via `"effect": "deny"`) any storage account that has `networkAcls.defaultAction` set to `Deny`. This means storage accounts that deny all traffic by default are blocked, which effectively requires that storage accounts allow traffic by default (i.e., `defaultAction` must not be `Deny`). Actually, the policy denies a storage account if its defaultAction equals Deny. So it prevents storage accounts from having a deny default action. Option A is opposite. Option B is about encryption, not network. Option C is about firewall rules, not the default action.

Answer

Denies storage accounts that do not have encryption enabled

Answer

Denies storage accounts that have firewall rules configured

Answer

Denies storage accounts that allow all network traffic

Question 9

You are deploying an Azure Disk Encryption set with the above ARM template snippet. What is the result of this configuration?

Accepted Answer

The disk uses double encryption with both platform-managed and customer-managed keys. Option A is correct: The `keySource` is `Microsoft.Keyvault`, indicating a customer-managed key. `infrastructureEncryption` is `Enabled`, meaning double encryption (platform-managed + customer-managed). Option B is wrong because `infrastructureEncryption` is enabled. Option C is wrong because keySource is Keyvault. Option D is wrong because infrastructure encryption is enabled.

Answer

The disk uses only customer-managed key encryption

Answer

The disk encryption will fail because keyversion is empty

Answer

The disk uses only platform-managed key encryption

Question 10

You run the above PowerShell script. What is the effect on the storage account?

Accepted Answer

Block blobs with the prefix 'logs' are deleted after 30 days. Option B is correct: the script creates a management policy rule that deletes block blobs with prefix 'logs' after 30 days since last modification. Option A is wrong because it deletes after 30 days, not 90. Option C is wrong because the action is delete, not tier. Option D is wrong because it applies only to block blobs with prefix 'logs'.

Answer

Block blobs with the prefix 'logs' are deleted after 90 days

Answer

All block blobs are deleted after 30 days

Answer

Block blobs with the prefix 'logs' are moved to cool tier after 30 days

Question 11

Your organization uses Microsoft Defender for Cloud to manage security posture. You have an Azure SQL Database that stores PII. You need to ensure that all sensitive columns are automatically discovered and classified. Additionally, you want to audit access to these columns. What should you configure?

Accepted Answer

Microsoft Defender for Cloud's data discovery and classification and Azure SQL Database auditing. Option B is correct: Microsoft Defender for Cloud includes data discovery and classification for Azure SQL Database, and auditing can be enabled to track access. Option A (Azure Purview) is for broader data governance but not directly for SQL Database auditing. Option C (Azure SQL Database Vulnerability Assessment) checks for vulnerabilities, not classification. Option D (Azure SQL Database Advanced Threat Protection) detects threats, not classification.

Answer

Azure SQL Database Advanced Threat Protection and Azure SQL Database auditing

Answer

Azure Purview Data Map and Azure SQL Database auditing

Answer

Azure SQL Database Vulnerability Assessment and Azure SQL Database auditing

Question 12

You need to securely store connection strings and secrets for an Azure function app. The solution must automatically rotate the secrets every 90 days and provide audit logs for access. What should you use?

Accepted Answer

Azure Key Vault with key rotation policy and diagnostic logging. Option A is correct: Azure Key Vault with automatic rotation and audit logging. Option B (App Service application settings) stores secrets in plaintext. Option C (Azure Cosmos DB) is not for secrets. Option D (Azure SQL Database) is not appropriate.

Answer

Azure SQL Database with Always Encrypted

Answer

Azure Cosmos DB with encryption at rest

Answer

Azure App Service application settings with slot-sticky settings

Question 13

You are designing a backup strategy for Azure virtual machines. You need to ensure that backups are encrypted at rest and can be restored in a different Azure region in case of a regional disaster. Which two configurations should you use?

Accepted Answer

Enable encryption at rest for the Recovery Services vault using platform-managed keys. Option A is correct: Azure Backup uses encryption at rest by default. Option C is correct: Cross-region restore (CRR) allows restoring in a different region. Option B (geo-redundant storage) is used by Recovery Services vault but is not a restore option. Option D (Azure Site Recovery) is for disaster recovery, not backup. Option E (Azure Disk Encryption) is for VM disks, not backup.

Answer

Configure Azure Site Recovery for the VMs

Answer

Enable Azure Disk Encryption on the VMs

Answer

Use geo-redundant storage (GRS) for the Recovery Services vault

Question 14

You are configuring security for an Azure Functions app that processes credit card numbers. You need to ensure that the function can securely access a storage account without storing any credentials in code or configuration, and that all data in the storage account is encrypted with a customer-managed key. Which three actions should you take?

Accepted Answer

Assign the 'Storage Blob Data Contributor' role to the function app's managed identity. Option A is correct: managed identity allows the function to authenticate without credentials. Option C is correct: RBAC assignment allows the function to access the storage account. Option E is correct: CMK encryption at rest. Option B (connection string) is not secure. Option D (Key Vault reference) still requires a secret, but managed identity is better.

Answer

Store the storage account connection string in an application setting

Answer

Use a Key Vault reference in the function app configuration to retrieve the storage account key

Question 15

You are deploying a web application that stores user-uploaded files in Azure Blob Storage. You need to ensure that only authenticated users can upload files, and that uploaded files are automatically scanned for malware. What should you use?

Accepted Answer

Enable Azure AD authentication for the storage account and enable Microsoft Defender for Storage. Option D is correct: Azure AD authentication for the storage account ensures only authenticated users can access, and Microsoft Defender for Storage provides malware scanning. Option A (SAS tokens) are shared access signatures, not user-specific. Option B (Event Grid) is for event handling, not authentication. Option C (Azure Firewall) is network-level, not application-level.

Answer

Use Azure Event Grid to trigger a function for malware scanning

Answer

Configure Azure Firewall to allow only the web app's IP address

Answer

Use shared access signatures (SAS) with stored access policies