AZ-500 Secure compute, storage, and databases Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. You are analyzing the Always Encrypted configuration for an Azure SQL Database. The SSN column uses randomized encryption, and the CreditCard column uses deterministic encryption. Which statement is true regarding querying these columns?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Only the CreditCard column supports equality searches.. Deterministic encryption always generates the same ciphertext for a given plaintext, enabling equality comparisons and point lookups. Randomized encryption produces different ciphertexts each time, preventing any equality or pattern-matching operations. Therefore, only the CreditCard column (deterministic) supports equality searches.

Answer

Both columns support equality searches.

Answer

Both columns support pattern matching with LIKE.

Answer

Only the SSN column supports point lookups.

Question 2

You need to encrypt an Azure Storage account at rest using a customer-managed key stored in Azure Key Vault. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys. Azure Storage Service Encryption (SSE) encrypts data at rest automatically. By enabling customer-managed keys (CMK) in Azure Key Vault, you can control the encryption key used for SSE, meeting the requirement to encrypt the storage account with a key you manage.

Answer

Azure Information Protection

Answer

Azure Confidential Computing

Answer

Azure Disk Encryption

Question 3

You are designing a secure data solution for a financial application. The data must be encrypted at rest, in transit, and in use. You choose Azure SQL Database. Which combination of features should you implement?

Accepted Answer

Transparent Data Encryption, enforce TLS, and Always Encrypted. It addresses all three encryption states required by the scenario: Transparent Data Encryption (TDE) encrypts data at rest, enforcing TLS secures data in transit, and Always Encrypted protects data in use by keeping encryption keys client-side, ensuring plaintext data never appears in the database engine.

Answer

Azure Information Protection, Dynamic Data Masking, and column-level security

Answer

Always Encrypted, Azure Active Directory authentication, and Azure Information Protection

Answer

Transparent Data Encryption, Dynamic Data Masking, and Azure Active Directory authentication

Question 4

You need to prevent data exfiltration from Azure Storage accounts by controlling which networks can access them. Which Azure feature should you use?

Accepted Answer

Azure Storage firewalls and virtual network rules. Azure Storage firewalls and virtual network rules (Option D) are the correct choice because they allow you to restrict access to your storage account based on specific IP addresses, IP ranges, or virtual networks, effectively preventing data exfiltration by blocking unauthorized network traffic. This feature works at the network layer, enabling you to create a perimeter around your storage account that only allows trusted sources to connect, which directly addresses the requirement to control network-level access.

Answer

Azure Storage shared access signatures (SAS)

Answer

Azure Firewall

Answer

Azure Private Link

Question 5

Your company uses Azure SQL Database to store customer data. You need to ensure that database administrators cannot access sensitive columns (e.g., credit card numbers) even during maintenance. What should you implement?

Accepted Answer

Always Encrypted. Always Encrypted ensures that sensitive columns like credit card numbers are encrypted at all times — both at rest and in transit — and that the encryption keys are never revealed to the database engine. This means database administrators (DBAs) cannot decrypt the data even during maintenance, because the decryption happens only on the client side. This directly meets the requirement to prevent DBA access to sensitive columns.

Answer

Transparent Data Encryption

Answer

Dynamic Data Masking

Answer

Row-level security

Question 6

You have an Azure Cosmos DB account with multiple containers. You need to ensure that only specific Azure AD identities can access the data and that all access is logged. What should you use?

Accepted Answer

Use Azure AD authentication and RBAC roles, and enable diagnostic logs. Microsoft Entra ID authentication with RBAC roles allows you to restrict data access to specific Microsoft Entra ID identities, and enabling diagnostic logs captures all data plane operations for auditing. This combination meets the requirements of identity-based access control and comprehensive logging, unlike primary keys which are shared secrets and do not support identity-level auditing.

Answer

Use primary keys for authentication and enable audit logging

Answer

Configure managed identities for Azure resources and enable diagnostic logs

Answer

Configure an Azure Cosmos DB firewall and enable diagnostic logs

Question 7

You need to ensure that an Azure Key Vault is accessible only from a specific virtual network and that all operations are logged. What should you configure?

Accepted Answer

Key Vault firewall and virtual network service endpoints, and diagnostic settings. To restrict Key Vault access to a specific virtual network, you must configure the Key Vault firewall and virtual network service endpoints, which allow you to deny all traffic except that originating from the specified VNet/subnet. To log all operations, you must configure diagnostic settings to send audit events (e.g., AuditEvent logs) to a Log Analytics workspace, Storage account, or Event Hub. Option A is correct because it combines both network access control and logging requirements.

Answer

Azure RBAC roles and diagnostic settings

Answer

Soft-delete and purge protection, and diagnostic settings

Answer

Azure Policy and diagnostic settings

Question 8

Your company uses Azure SQL Managed Instance. You need to ensure that all connections from clients use TLS 1.2 or higher. What should you configure?

Accepted Answer

Set the 'Minimal TLS version' property to 1.2 in the Managed Instance settings. Azure SQL Managed Instance exposes a 'Minimal TLS version' property in its settings that enforces the minimum TLS version for all client connections. Setting this to 1.2 ensures that any connection attempt using TLS 1.0 or 1.1 is rejected at the server level, providing a centralized, server-side enforcement mechanism without relying on client-side configurations.

Answer

Configure a firewall rule to block non-TLS 1.2 connections

Answer

Create an Azure Policy to require TLS 1.2 for all SQL Managed Instances

Answer

Enable the 'Force encryption' option on the client side

Question 9

Your organization uses Azure Files shares. You need to ensure that users authenticate using on-premises Active Directory credentials and that access is logged. What should you do?

Accepted Answer

Enable identity-based authentication for Azure Files and configure diagnostic logs. Azure Files supports identity-based authentication using on-premises Active Directory Domain Services (AD DS) via Kerberos. This allows users to authenticate with their on-premises AD credentials and access the file share seamlessly. Enabling diagnostic logs captures access events, meeting the logging requirement.

Answer

Configure a firewall rule to allow on-premises IPs and enable diagnostic logs

Answer

Use shared access signatures (SAS) for access and enable diagnostic logs

Answer

Configure Azure RBAC for the share and enable diagnostic logs

Question 10

You have an Azure SQL Database that stores Personally Identifiable Information (PII). You need to mask the PII columns for support staff but allow full access to managers. What should you implement?

Accepted Answer

Dynamic Data Masking with a masking policy and grant UNMASK permission to managers. Dynamic Data Masking (DDM) obfuscates sensitive data in query results based on a masking policy, without altering the underlying data. Granting the UNMASK permission to managers allows them to see the original values, while support staff see masked data. This directly meets the requirement to mask PII columns for support staff but allow full access to managers.

Answer

Always Encrypted with separate column encryption keys for managers

Answer

Azure Information Protection labels and encryption

Answer

Row-level security to restrict rows for support staff

Question 11

You are reviewing an Azure Resource Manager template for a storage account. The exhibit shows a snippet of the template. Which statement about the template is true?

Accepted Answer

The storage account will use Microsoft-managed keys for encryption.. The template snippet does not include any encryption-related properties, such as `encryption.keySource` or `encryption.services`, which means the storage account will use the default Microsoft-managed keys for encryption. By default, Azure Storage encrypts all data at rest using Microsoft-managed keys, and no explicit configuration is required. Option C correctly identifies this default behavior.

Answer

Encryption is disabled for the storage account.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

Encryption is enabled only for blob storage.

Question 12

You are deploying an Azure SQL Database with a security alert policy as shown in the exhibit. Which statement is true?

Accepted Answer

Alerts are enabled and notifications are sent to both account admins and admin@contoso.com.. The security alert policy in Azure SQL Database has 'state' set to 'Enabled' and 'emailAddresses' includes both 'admin@contoso.com' and the account admins (via 'emailAccountAdmins' set to true). This means alerts are active and notifications are sent to both the specified email and the account administrators, making option A correct.

Answer

Email notifications are sent only to admin@contoso.com.

Answer

Alerts are not retained because retentionDays is set to 30.

Answer

All alerts are disabled because disabledAlerts is empty.

Question 13

Your company uses Azure SQL Database. You need to ensure that all queries are audited for compliance. Which feature should you enable?

Accepted Answer

Enable SQL Auditing on the server and configure the audit log destination.. To audit all queries against Azure SQL Database for compliance, you must enable SQL Auditing at the server level and configure an audit log destination (such as Azure Storage, Log Analytics, or Event Hubs). This captures database events, including all queries, and writes them to the chosen destination for review and retention. Option B directly fulfills the requirement to track and log query activity.

Answer

Enable SQL Vulnerability Assessment.

Answer

Configure Dynamic Data Masking.

Answer

Enable Advanced Threat Protection.

Question 14

You are designing a solution to store sensitive documents in Azure Blob Storage. The documents must be encrypted at rest using a customer-managed key that is automatically rotated every 90 days. Microsoft Entra ID must be used to control access to the key. What should you use?

Accepted Answer

Azure Storage Service Encryption (SSE) with a customer-managed key stored in Azure Key Vault and configure key rotation.. Azure Storage Service Encryption (SSE) with a customer-managed key (CMK) stored in Azure Key Vault allows you to control the encryption key used for data at rest in Blob Storage. By storing the key in Key Vault, you can configure automatic key rotation every 90 days, and you can use Microsoft Entra ID (formerly Azure AD) to control access to the key via RBAC roles such as Key Vault Crypto Officer. This meets all requirements: encryption at rest, customer-managed key, automatic rotation, and Entra ID-based access control.

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Answer

Client-side encryption (CSE) using Azure Key Vault.

Question 15

Your company has an Azure Cosmos DB account that stores customer profiles. You need to ensure that only authenticated and authorized users can access the data. Which access control method should you use?

Accepted Answer

Use Azure RBAC with Microsoft Entra ID authentication.. Azure RBAC with Microsoft Entra ID authentication provides fine-grained, identity-based access control for Azure Cosmos DB. This method allows you to assign specific roles (e.g., Cosmos DB Built-in Data Reader) to users or service principals, ensuring that only authenticated and authorized identities can access the data plane operations, such as reading or writing documents. It eliminates the need to share or manage keys, aligning with the principle of least privilege.

Answer

Configure an IP firewall rule to allow only corporate IP ranges.

Answer

Use primary read-write keys with connection strings.

Answer

Use resource tokens generated from a master key.