AZ-500 Secure compute, storage, and databases Practice Test 13 — 15 Questions

Question 1

Your company uses Azure Managed Disks for VMs running a production database. The disks are encrypted with Azure Disk Encryption (ADE) using Azure Key Vault. Security policy requires that all encryption keys be rotated every 90 days. You have automated key rotation in Key Vault. However, after rotating the key, you find that the disks are still using the old key. You need to ensure that the disks use the new key after rotation. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable encryption on the VM, then re-enable ADE specifying the new key version.. Azure Disk Encryption (ADE) does not automatically re-encrypt disks when the key is rotated in Key Vault. To force the disk to use the new key version, you must disable encryption on the VM and then re-enable ADE, specifying the new key version. This triggers a re-encryption process that applies the updated key to the managed disks.

Answer

Delete the old key version from Key Vault to force the disk to use the new key.

Answer

No action is needed; ADE automatically re-encrypts disks with the new key after rotation.

Answer

Update the disk encryption set to reference the new key version; the disk will automatically use it.

Question 2

Your organization uses Azure Storage to host sensitive financial data. You need to ensure that all access to the storage account is encrypted in transit and that access keys are rotated automatically every 90 days. You also need to prevent access from public IP addresses. Which combination of configurations should you implement?

Accepted Answer

Enable 'Secure transfer required', configure key rotation policy, and set 'Public network access' to 'Disabled'. Enabling 'Secure transfer required' enforces HTTPS for all access, configuring key rotation policy enables automatic rotation of access keys every 90 days, and setting 'Public network access' to 'Disabled' prevents access from any public IP address, meeting all requirements. Option A is incorrect because rotating keys manually does not satisfy the automatic rotation requirement. Option B is incorrect because enabling 'Allow trusted Microsoft services' does not block public IP addresses, and disabling storage account key access would break legitimate access. Option C is incorrect because disabling blob public access only prevents anonymous public access to blobs, but does not block all public IPs.

Answer

Configure a network firewall rule to block all traffic, enable 'Secure transfer required', and rotate keys manually every 90 days

Answer

Enable 'Allow trusted Microsoft services', configure key rotation policy, and disable 'Allow storage account key access'

Answer

Enable 'Secure transfer required', configure key rotation policy, and disable 'Allow Blob public access'

Question 3

Your company has a large number of Azure SQL databases that contain personally identifiable information (PII). You need to classify and protect sensitive columns across all databases. The solution must automatically discover and label sensitive data, and enable auditing of access to that data. What should you implement?

Accepted Answer

Data Discovery & Classification. Azure SQL Database's Data Discovery & Classification automatically discovers sensitive columns, allows labeling, and integrates with auditing and vulnerability assessment. Option A is wrong because Dynamic Data Masking only masks data, it does not classify. Option B is wrong because Always Encrypted encrypts data at rest, but does not classify or audit. Option C is wrong because Microsoft Defender for SQL provides security alerts and vulnerability assessment, but not classification.

Answer

Always Encrypted with secure enclaves

Answer

Microsoft Defender for SQL

Answer

Dynamic Data Masking

Question 4

You need to secure a Linux virtual machine running a web application in Azure. The solution must ensure that only traffic on port 443 (HTTPS) is allowed from the internet, and that SSH access is restricted to a management subnet. What should you configure?

Accepted Answer

Network Security Group (NSG) on the VM NIC with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound. An NSG applied to the VM NIC allows granular control: inbound rules can allow HTTPS (port 443) from the Internet and SSH (port 22) only from the management subnet, while denying all other inbound traffic. This meets the requirements without affecting other resources. Option A is wrong because Azure Firewall is more complex and costly than necessary for this simple rule set. Option C is wrong because Application Security Groups do not filter traffic by themselves; they are logical groupings used in NSG rules. Option D is wrong because an NSG on the subnet would apply to all VMs in that subnet, which is broader than needed.

Answer

Azure Firewall with application rules to allow HTTPS and SNAT SSH traffic

Answer

Application Security Group with a network security group that allows HTTPS and SSH

Answer

Network Security Group on the subnet with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound

Question 5

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to ensure that only approved container images from a private Azure Container Registry (ACR) can run in the cluster. The solution must also enforce that pods run with least privilege. What should you configure?

Accepted Answer

Apply Azure Policy with built-in initiatives 'Kubernetes cluster containers should only use allowed images' and 'Kubernetes cluster pods should use specified service account'. Azure Policy for AKS includes built-in initiatives such as 'Kubernetes cluster containers should only use allowed images' to restrict container images to those from approved registries like ACR, and 'Kubernetes cluster pods should use specified service account' to enforce least privilege by requiring pods to use a specific service account with minimal permissions. Option A is incorrect because a NetworkPolicy controls network traffic but cannot enforce image source or privileges; Secrets are for storing sensitive data, not for policy enforcement. Option B is incorrect because ACR tasks scan images during build, but do not enforce runtime restrictions on which images are allowed to run in the cluster; pod security policies are deprecated. Option C is incorrect because Azure AD pod-managed identities authenticate pods to Azure resources but do not enforce image source restrictions or least privilege beyond authentication.

Answer

Create a Kubernetes NetworkPolicy to restrict pod-to-pod communication and use Secrets for image pull

Answer

Configure ACR tasks to scan images for vulnerabilities and use AKS pod security policies

Answer

Use Azure AD pod-managed identities to authenticate to ACR and assign RBAC roles

Question 6

Your company plans to use Azure SQL Managed Instance to store customer data. You need to comply with regulatory requirements for data encryption at rest and in transit, and you must ensure that only authorized applications can access the database. Which TWO actions should you take? (Choose two.)

Accepted Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys. To comply with encryption at rest and in transit, you need Transparent Data Encryption (TDE) for at-rest encryption and enforce encryption in transit via the connection string. Option A is correct because TDE with customer-managed keys encrypts the entire database at rest, meeting regulatory requirements. Option C is correct because 'Encrypt=True' and 'TrustServerCertificate=False' ensure that data is encrypted during transit and that the server certificate is validated, providing secure connections. Option B is incorrect because a virtual network rule controls network access, not encryption. Option D is incorrect because Always Encrypted protects specific columns, not the entire database at rest. Option E is incorrect because Azure AD authentication manages identity, not encryption.

Answer

Configure a virtual network rule to allow only specific subnets

Answer

Enable Always Encrypted for sensitive columns

Answer

Configure Azure AD authentication for the managed instance

Question 7

You are reviewing an Azure Policy definition. You need to determine the effect of this policy when a user attempts to create a new storage account with 'Secure transfer required' set to 'Disabled'. What happens?

Accepted Answer

The creation request is denied.. The policy has an effect of 'Deny' when the condition evaluates to true—in this case, when 'supportsHttpsTrafficOnly' is false. Therefore, the creation request is denied, making option B correct. Option A is incorrect because the policy does not modify settings; it denies the operation. Option C is incorrect because the policy effect is 'Deny', not 'Audit'. Option D is incorrect because the policy actively denies the operation.

Answer

The storage account is created but 'Secure transfer required' is automatically enabled.

Answer

The creation is allowed but an audit event is generated.

Answer

The creation is allowed and no action is taken.

Question 8

You are the Azure Security Engineer for a financial services company. The company has a multi-tier application deployed on Azure Virtual Machines (VMs) in a hub-spoke network topology. The application consists of web servers, application servers, and database servers. The database servers run SQL Server on Windows Server 2022 and store sensitive financial data. Compliance requires that all data at rest be encrypted using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, all network traffic between tiers must be encrypted, and the database must be accessible only from the application servers. You have the following resources: a Key Vault with an HSM-backed key (key1) for disk encryption, and a Key Vault with a software-protected key (key2) for SQL Server TDE. Current configuration: The web servers are in subnet A, application servers in subnet B, and database servers in subnet C. Network Security Groups (NSGs) allow traffic from subnet B to subnet C on TCP 1433. The database servers are not using TDE. You need to implement the required security controls. What should you do first?

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server instance using a service-managed key, then rotate to use key2 from Key Vault. To use customer-managed keys for SQL Server TDE, you must first enable TDE with a service-managed key, then switch to the customer-managed key (key2) stored in Azure Key Vault. This is required because you cannot directly enable TDE with a customer-managed key; you must first use a service-managed key and then rotate. Option B (Azure Disk Encryption) encrypts the OS and data disks but not the SQL Server data files, so it does not meet the compliance requirement for data at rest encryption of the database. Option C (SQL authentication) does not provide encryption. Option D (Always Encrypted) encrypts specific columns, not the entire database, and it also requires TDE for full database encryption.

Answer

Enable Azure Disk Encryption on the database VMs using key1 from the HSM-backed Key Vault

Answer

Configure SQL Server to use SQL authentication and create a login for the application servers

Answer

Implement Always Encrypted for the sensitive columns using key2 from Key Vault

Question 9

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.. When Azure Key Vault has a firewall that denies all public network access, the 'Allow trusted Microsoft services to bypass this firewall' setting is required for Azure SQL Database (a trusted Microsoft service) to authenticate using its system-assigned managed identity and access the customer-managed key for TDE. This setting allows the SQL server to reach the Key Vault over the Microsoft backbone network without requiring a private endpoint or VNet integration, as the service is explicitly trusted by Azure.

Answer

Configure a private endpoint for the SQL server to the Key Vault.

Answer

Change the Key Vault firewall to allow all Azure services.

Answer

Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.

Question 10

A company stores sensitive files in Azure Files shares. They require encryption at rest using customer-managed keys (CMK) and encryption in transit using SMB 3.0 encryption. They have created a premium Azure Files share in a storage account and configured encryption at rest with a CMK. However, clients are able to connect without enforcing SMB encryption. What additional configuration is necessary to ensure that all connections to the file share are encrypted in transit?

Accepted Answer

Enable the 'Secure transfer required' property on the storage account.. Enabling the 'Secure transfer required' property on the storage account enforces encryption in transit for all client connections, including SMB 3.0 encryption for Azure Files. Without this setting, clients can connect using unencrypted SMB 2.1 or SMB 3.0 without encryption, even if the file share itself supports encryption. This property is a storage account-level flag that rejects any request not using HTTPS or SMB 3.0 with encryption.

Answer

Configure a network security group (NSG) to allow only encrypted traffic.

Answer

Set the minimum SMB protocol version to 3.0 on the file share.

Answer

Create a service endpoint for the storage account.

Question 11

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.. Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.

Answer

Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.

Answer

Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.

Answer

Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.

Question 12

A company uses Azure Disk Encryption (ADE) on Windows virtual machines. They use a key encryption key (KEK) stored in Azure Key Vault to wrap the disk encryption key. The security policy requires that the KEK be automatically rotated every 90 days. They need to ensure that after rotation, the OS and data disks of running VMs automatically get re-wrapped with the new KEK version. Which configuration should they implement?

Accepted Answer

Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).. Azure Key Vault supports automatic key rotation with a configurable rotation period, and when a disk encryption set (DES) is configured with an empty string as the key version, it automatically uses the latest version of the KEK. This ensures that after the KEK is rotated every 90 days, the running VMs' OS and data disks are re-wrapped with the new KEK version without manual intervention or VM restart.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Create a new KEK every 90 days and modify the disk encryption set to point to the new key version.

Answer

Use Azure Policy to enforce automatic key rotation.

Question 13

A company uses Azure SQL Database with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server has a system-assigned managed identity assigned the 'Key Vault Crypto Service Encryption User' role. However, TDE operations are failing because the SQL server cannot access the Key Vault. What additional configuration is needed?

Accepted Answer

Enable the Key Vault firewall to allow trusted Microsoft services. When Azure Key Vault has its firewall enabled to deny all public network access, it blocks all traffic, including requests from Azure SQL Database. By enabling the 'Allow trusted Microsoft services' exception, Azure Key Vault permits specific Azure platform services (like Azure SQL Database) to bypass the firewall, provided the service authenticates using a managed identity with appropriate permissions. This setting is essential for TDE with CMK because the SQL server's system-assigned managed identity must reach the Key Vault to unwrap the encryption key, even when public access is disabled.

Answer

Create a private endpoint for the SQL server to access the Key Vault

Answer

Enable public network access on the Key Vault

Answer

Assign the SQL server's managed identity the 'Reader' role on the Key Vault

Question 14

A company uses Azure SQL Database to store customer data, including credit card numbers. The security policy requires that database administrators (DBAs) must not be able to view the credit card numbers in plaintext. The column containing the credit card numbers must be encrypted at rest and in transit, and only a specific application (using a dedicated client library) should be able to decrypt the data. Which technology should they implement?

Accepted Answer

Always Encrypted with a client-side encryption key stored in Azure Key Vault.. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted on the client side before being sent to Azure SQL Database, and the encryption keys are never revealed to the database engine. This prevents DBAs or any server-side administrators from viewing the plaintext data, as decryption can only occur using the client-side encryption key stored in Azure Key Vault and accessed by the dedicated application library.

Answer

Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.

Answer

Dynamic Data Masking (DDM) for the credit card column.

Answer

Row-Level Security (RLS) to restrict DBA access to the credit card column.

Question 15

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall that blocks all public access. The SQL server is a managed service that needs to access the key to perform TDE operations. The Key Vault is in the same Azure region as the SQL server. Which additional configuration is needed?

Accepted Answer

Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings. When Azure Key Vault has a firewall that blocks all public access, Azure services like SQL Database that need to access the key for TDE operations must be explicitly allowed. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits the SQL server's managed service identity to authenticate and retrieve the CMK from Key Vault, even when public network access is denied. This setting is required because the SQL server, as a platform-as-a-service (PaaS) resource, does not reside in a virtual network by default and cannot use a private endpoint or service endpoint without additional networking configuration.

Answer

Configure a service endpoint for Microsoft.KeyVault on the SQL server's subnet

Answer

Assign the SQL server's server identity the 'Contributor' role on the Key Vault

Answer

Create a private endpoint for the Key Vault in the SQL server's virtual network