AZ-500 Secure compute, storage, and databases Practice Test 14 — 15 Questions

Question 1

You are deploying a critical application on Azure Virtual Machines that must remain highly available. You need to implement a security solution that ensures the application can recover from a ransomware attack that encrypts all data disks. What is the most cost-effective approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Azure Backup with immutable vault and soft delete.. Azure Backup with an immutable vault and soft delete (option A) is the most cost-effective solution because it provides ransomware-resistant, tamper-proof recovery points for the VM data disks at a lower cost than full VM replication, and immutability plus soft delete prevents attackers from deleting or altering backups during an attack. Azure Site Recovery (option C) is designed for disaster recovery and VM replication, which is more expensive and not specifically aimed at protecting backup data from ransomware. Azure Files snapshots (option B) only apply to Azure Files shares, not VM data disks, so they cannot protect the application's disk data. Daily disk snapshots stored in the same storage account (option D) are not immutable and can be deleted or encrypted along with the source data, making them a weak ransomware defense.

Answer

Use Azure Files share with snapshots for the application data.

Answer

Enable Azure Site Recovery for the virtual machines.

Answer

Take daily snapshots of the disks and store them in the same storage account.

Question 2

You need to enable transparent data encryption (TDE) for an Azure SQL Managed Instance. What is the prerequisite?

Accepted Answer

No additional configuration is needed; TDE is enabled by default.. Transparent Data Encryption (TDE) is enabled by default for Azure SQL Managed Instance. When you create a new managed instance, TDE is automatically turned on using a service-managed key, so no additional configuration is required. This default behavior ensures data at rest is encrypted without any prerequisite steps from the user.

Answer

Configure a backup policy for the managed instance.

Answer

Enable a service endpoint for Azure SQL.

Answer

Create an Azure Key Vault and configure a customer-managed key.

Question 3

Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?

Accepted Answer

Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.. Identity-based authentication for Azure Files using Microsoft Entra ID allows you to assign share-level permissions (e.g., Storage File Data SMB Share Contributor) to specific users or groups, ensuring only explicitly authorized identities can access the share. This meets the requirement of restricting access to users with explicit permissions, as opposed to relying on network rules or shared keys.

Answer

Configure a firewall rule to allow only corporate IP ranges.

Answer

Use storage account access keys to mount the file share.

Answer

Generate a shared access signature (SAS) with read permissions.

Question 4

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. Azure Storage Service Encryption (SSE) with customer-managed keys integrates with Azure Key Vault, which can be configured to log key operations such as encrypt, decrypt, wrap, and unwrap. These logs are sent to Azure Monitor or a storage account, enabling auditing of key usage for compliance and security monitoring.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.

Question 5

You are reviewing the ARM template for an Azure Disk Encryption Set. The template includes the JSON snippet shown. You notice that the key version is empty. What is the consequence?

Accepted Answer

The encryption set will automatically use the latest version of the key.. When the key version is omitted in an Azure Disk Encryption Set ARM template, the encryption set automatically uses the latest version of the key from the specified Azure Key Vault. This behavior allows the encryption set to stay updated with key rotations without requiring manual template updates, as Azure Disk Encryption Sets support automatic key version updates when no version is specified.

Answer

The encryption set will use a platform-managed key.

Answer

The encryption set will use the key name without any version, causing it to fail.

Answer

The deployment will fail because a key version is required.

Question 6

You are deploying an Azure Storage account using an ARM template that includes a networkAcls section with defaultAction set to Deny. After deployment, you need to allow access from a specific public IP address. What should you do?

Accepted Answer

Add an IP rule to the ipRules array with the public IP address.. The ARM template includes a `networkAcls` section with `defaultAction` set to `Deny`, which blocks all traffic by default. To allow access from a specific public IP address, you must add an IP rule to the `ipRules` array, specifying the public IP address in CIDR notation (e.g., "20.10.10.10/32"). This overrides the default deny for that specific IP, enabling access while keeping the storage account locked down from other public traffic.

Answer

Create a private endpoint and assign it to the storage account.

Answer

Configure a service endpoint for the storage account.

Answer

Update the defaultAction to Allow and set ipRules to deny the IP.

Question 7

You run the PowerShell cmdlet shown in the exhibit for an Azure SQL Database. What is the security implication?

Accepted Answer

The database is not protected against anomalous activities.. The cmdlet shown is `Set-AzSqlDatabaseVulnerabilityAssessmentSettings`, which enables Vulnerability Assessment (VA) but does not enable Advanced Threat Protection (ATP). Without ATP, the database lacks anomaly detection capabilities such as SQL injection detection, brute-force attack alerts, and unusual access pattern monitoring. Therefore, the database is not protected against anomalous activities, making option B correct.

Answer

Auditing of database queries is not configured.

Answer

The database firewall allows all public IP addresses.

Answer

Transparent data encryption is not enabled.

Question 8

You are deploying a new application on Azure VMs. The application must be encrypted at rest and during transmission. Which combination of features should you implement?

Accepted Answer

Azure Disk Encryption and HTTPS. Azure Disk Encryption (ADE) provides at-rest encryption for Azure VM disks using BitLocker (Windows) or DM-Crypt (Linux), while HTTPS ensures encryption in transit between the client and the application. Together, they satisfy the requirement for encryption both at rest and during transmission.

Answer

Azure Firewall and Azure Disk Encryption

Answer

Azure Storage Service Encryption and SSL

Answer

Azure Disk Encryption and SSL

Question 9

Your company uses Azure SQL Database. You need to ensure that all queries from a specific application use Always Encrypted to protect sensitive columns. The application is developed in C#. What must you configure in the application and database?

Accepted Answer

Define column master key and column encryption key in the database, and update the connection string to include 'Column Encryption Setting=enabled'.. Always Encrypted requires a column master key and column encryption key to be defined in the database to encrypt sensitive columns, and the client application must enable the feature in its connection string by adding 'Column Encryption Setting=enabled'. This ensures that encryption and decryption occur on the client side, protecting data in transit and at rest from the database engine.

Answer

Enable Transparent Data Encryption (TDE) on the database and use integrated security.

Answer

Configure Dynamic Data Masking and use ODBC driver.

Answer

Use Azure Information Protection labels and configure the application to enforce protection.

Question 10

You have an Azure Cosmos DB account with multiple containers. You need to ensure that data is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which steps should you take?

Accepted Answer

Configure the Cosmos DB account to use a customer-managed key from Key Vault and assign the appropriate RBAC role.. Azure Cosmos DB supports encryption at rest using customer-managed keys (CMK) stored in Azure Key Vault. To enable this, you must configure the Cosmos DB account to use a CMK from Key Vault and assign the appropriate RBAC role (e.g., 'Key Vault Crypto Service Encryption User') to the Cosmos DB system-assigned managed identity, allowing it to access the key for encryption and decryption operations.

Answer

Use Azure Disk Encryption on the VMs hosting Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) and bring your own key (BYOK) from Key Vault.

Answer

Enable Always Encrypted on the Cosmos DB account and reference the key from Key Vault.

Question 11

Your company uses Azure Blob Storage to store sensitive documents. You need to prevent data exfiltration by ensuring that all access to the storage account is through Microsoft's private network. What should you configure?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. Creating a private endpoint for the storage account assigns it a private IP from your virtual network, and disabling public network access ensures that all traffic to the storage account is routed through Microsoft's backbone network, preventing data exfiltration over the public internet. This configuration effectively isolates the storage account to your private network, meeting the requirement to block all public access.

Answer

Apply a network security group (NSG) to the subnet with a deny rule for internet traffic.

Answer

Set the firewall to deny all and add a rule to allow only your VNet's public IP.

Answer

Enable service endpoints and configure a service endpoint policy.

Question 12

You have an Azure SQL Database that stores credit card numbers. You need to encrypt the column containing the credit card numbers so that only authorized applications can decrypt the data. The database administrator should not be able to view the plaintext data. Which feature should you use?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves (Option D) is correct because it ensures that credit card numbers are encrypted at rest and in memory, and only client applications with the column encryption key can decrypt the data. The database administrator (DBA) cannot access the plaintext because the encryption keys are never revealed to SQL Server or Azure SQL Database, and secure enclaves allow rich computations (e.g., equality, pattern matching) on encrypted data without exposing the plaintext to the database engine.

Answer

Transparent Data Encryption (TDE)

Answer

Column-level encryption using SQL Server built-in functions

Answer

Dynamic Data Masking

Question 13

You need to ensure that all new blobs uploaded to an Azure Storage account are automatically encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) on the storage account.. Azure Storage Service Encryption (SSE) automatically encrypts data at rest for all storage accounts using 256-bit AES encryption, and it is enabled by default for new storage accounts. This ensures that any new blobs uploaded are encrypted without requiring any application changes or additional configuration, making it the simplest solution.

Answer

Use Azure Disk Encryption on any VMs writing to storage.

Answer

Implement client-side encryption in the application.

Answer

Configure a customer-managed key in Azure Key Vault.

Question 14

Which TWO actions should you take to ensure that an Azure Storage account is only accessible over HTTPS and that data in transit is encrypted?

Accepted Answer

Set 'Secure transfer required' to Enabled.. Enabling 'Secure transfer required' on an Azure Storage account rejects any HTTP requests and enforces HTTPS for all data in transit. Option D is correct because setting the minimum TLS version to 1.2 ensures that only clients using TLS 1.2 or higher can connect, which prevents downgrade attacks and enforces strong encryption for data in transit.

Answer

Configure a custom domain with HTTPS enabled.

Answer

Deploy Azure Firewall in front of the storage account.

Answer

Use Azure Private Link to connect to the storage account.

Question 15

Which TWO database-level security features are available in Azure SQL Database to protect sensitive data?

Accepted Answer

Always Encrypted. Always Encrypted (B) is correct because it is a database-level feature in Azure SQL Database that encrypts sensitive columns at the client side, keeping data encrypted at rest, in transit, and in memory, with the encryption keys never revealed to the database engine. Dynamic Data Masking (C) is also correct because it is a database-level feature that limits exposure of sensitive data by masking it in query results for non-privileged users without altering the underlying data. Azure Information Protection (A) is a classification and labeling service for documents and emails, not a database-level SQL security feature. Microsoft Entra ID authentication (D) is an identity/authentication mechanism for connecting to Azure SQL Database, not a data-protection feature for sensitive columns. Azure Disk Encryption (E) encrypts the underlying OS and data disks of VMs, so it does not apply to Azure SQL Database's database-level security.

Answer

Azure Information Protection

Answer

Azure AD authentication

Answer

Azure Disk Encryption