AZ-500 Secure compute, storage, and databases Practice Test 14 — 15 Questions

Question 1

You have an Azure SQL Managed Instance that hosts a line-of-business application. The application requires that all connections use Windows Authentication. You need to ensure that the authentication is secure and that the managed instance can integrate with on-premises Active Directory. What should you configure?

Accepted Answer

Configure Azure AD Kerberos authentication and set up a trust with on-premises Active Directory. Option C is correct: Azure SQL Managed Instance supports Windows Authentication via Kerberos, and Azure AD Kerberos authentication allows on-premises AD integration. Option A (Azure AD passwordless) is for Azure AD, not on-premises AD. Option B (Always Encrypted) is for column encryption. Option D (VNet integration) is for networking.

Answer

Enable Always Encrypted with secure enclaves

Answer

Enable Azure AD authentication and configure passwordless sign-in

Answer

Configure VNet integration with a site-to-site VPN

Question 2

You manage Azure Storage accounts for a healthcare organization. To comply with HIPAA, you need to ensure that all data at rest is encrypted and that access keys are rotated automatically every 90 days. What should you implement?

Accepted Answer

Use customer-managed keys (CMK) in Azure Key Vault with automatic key rotation.. Customer-managed keys (CMK) with Azure Key Vault allow automatic key rotation. Option A is wrong because Azure RBAC doesn't handle encryption keys. Option B is wrong because infrastructure encryption is for double encryption, not key rotation. Option D is wrong because shared access keys are not rotated automatically.

Answer

Configure Azure RBAC roles for storage accounts.

Answer

Enable infrastructure encryption for storage accounts.

Answer

Generate new storage account access keys manually every 90 days.

Question 3

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to restrict a user to only view data from the 'Sales' schema, without granting permissions to other schemas. What should you do?

Accepted Answer

Create a user mapped to the Entra ID user and grant SELECT on the Sales schema only.. Creating a user in the database mapped to the Entra ID user and granting SELECT only on the Sales schema meets the requirement. Option A is wrong because roles at the server level grant broader permissions. Option B is wrong because denying permissions is less secure and can be overridden. Option D is wrong because contained database users do not use Entra ID.

Answer

Add the user to the db_datareader role in the database.

Answer

Use a DENY statement on all other schemas for the user.

Answer

Create a contained database user with password and assign to db_datareader.

Question 4

You need to protect Azure VMs from ransomware by ensuring that encrypted file systems cannot be read by attackers. Which solution should you implement?

Accepted Answer

Enable Azure Disk Encryption on the VMs.. Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt the OS and data disks, protecting against offline attacks. Option B is wrong because Defender for Cloud is for threat detection, not encryption. Option C is wrong because Azure Backup provides recovery, not encryption. Option D is wrong because NSGs control network traffic, not disk encryption.

Answer

Apply network security groups (NSGs) to block unauthorized access.

Answer

Configure Azure Backup for the VMs.

Answer

Enable Microsoft Defender for Cloud on the subscription.

Question 5

Your company has a policy to disable TLS versions older than 1.2 for Azure Storage accounts. You configure the minimum TLS version setting to 1.2. After a week, an audit reveals that some clients are still connecting with TLS 1.0. What is the most likely reason?

Accepted Answer

Some clients have established persistent connections before the change.. The minimum TLS version setting may not be enforced immediately for existing connections; clients with persistent connections may continue using older TLS. Option A is wrong because the setting applies to all storage services. Option B is wrong because the setting is not related to IP rules. Option D is wrong because TLS 1.0 is not required by default.

Answer

Clients are accessing the storage account through a private endpoint with IP rules.

Answer

The storage account is configured to allow TLS 1.0 by default.

Answer

The setting does not apply to Azure Files.

Question 6

You are designing a secure data solution for a financial services company. Data must be encrypted at rest and in transit. Additionally, you need to prevent administrators from accessing the encryption keys. What should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys and a key vault access policy that denies key operations for the admin group.. Azure Storage encryption with customer-managed keys stored in a key vault with vault access policy set to deny all key operations for administrators meets the requirement. Option A is wrong because infrastructure encryption does not prevent admin access. Option B is wrong because Microsoft-managed keys do not meet the requirement. Option D is wrong because encryption in transit alone does not address at-rest encryption.

Answer

Azure Storage encryption with service-side encryption and HTTPS enforced.

Answer

Azure Storage encryption with Microsoft-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Question 7

You have an Azure SQL Database that contains sensitive customer data. You need to ensure that database administrators (DBAs) cannot view the data in the 'CreditCard' column. What should you implement?

Accepted Answer

Use Always Encrypted with column encryption key stored in Azure Key Vault.. Dynamic Data Masking (DDM) obfuscates sensitive data to non-privileged users, while DBAs with elevated permissions can still see the unmasked data unless excluded. Option B is wrong because Always Encrypted protects data from DBAs. Option C is wrong because TDE encrypts at rest, not at query time. Option D is wrong because auditing tracks access but does not prevent viewing.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Answer

Implement Azure SQL Auditing for the database.

Answer

Configure Dynamic Data Masking for the 'CreditCard' column.

Question 8

You need to ensure that only approved applications can access your Azure storage account. What should you configure?

Accepted Answer

Configure firewall rules to allow only specific virtual networks and IP addresses.. Firewall and virtual network settings with service endpoints allow you to restrict access to specific VNets and IP ranges. Option B is wrong because shared access keys do not restrict by application. Option C is wrong because Azure RBAC controls user permissions, not application access. Option D is wrong because private endpoints provide private IP connectivity but still require additional controls to restrict by application.

Answer

Use shared access keys for all storage account access.

Answer

Assign Azure RBAC roles to the storage account.

Answer

Use private endpoints and disable public network access.

Question 9

Your organization uses Azure Cosmos DB with API for MongoDB. You need to encrypt data at rest using a customer-managed key stored in Azure Key Vault, and you must ensure that the key is automatically rotated every year. What should you do?

Accepted Answer

Configure a customer-managed key in Key Vault and set the key rotation policy to auto-rotate annually.. Cosmos DB supports customer-managed keys with automatic rotation in Key Vault. Option A is wrong because Cosmos DB does not have infrastructure encryption. Option B is wrong because CMK with manual rotation does not meet automatic requirement. Option D is wrong because Microsoft-managed keys do not allow customer control.

Answer

Enable server-side encryption with Microsoft-managed keys.

Answer

Use a customer-managed key and manually rotate it every year.

Answer

Enable infrastructure encryption on the Cosmos DB account.

Question 10

You need to protect Azure VM disks from unauthorized snapshot creation. Which configuration should you implement?

Accepted Answer

Apply a 'CanNotDelete' resource lock on the disk resource.. Azure Resource Locks prevent deletion or modification of resources, including snapshot creation. Option B is wrong because Azure Backup does not prevent snapshots. Option C is wrong because RBAC can allow snapshot creation if permissions are granted. Option D is wrong because Azure Policy can audit but not prevent.

Answer

Assign the 'Reader' role to all users on the disk.

Answer

Configure Azure Backup for the VM.

Answer

Use Azure Policy to audit snapshot creation.

Question 11

Which two actions should you take to secure Azure Storage accounts against data exfiltration?

Accepted Answer

Use Azure Private Endpoints for storage accounts.. Correct: A and C. Firewall and virtual network service endpoints restrict network access, and private endpoints provide secure connectivity. Option B (shared access keys) does not prevent exfiltration. Option D (soft delete) helps recovery but not prevention. Option E (CORS) controls cross-origin requests, not exfiltration.

Answer

Enable shared access key authentication.

Answer

Enable soft delete for blobs.

Answer

Configure CORS rules to allow all origins.

Question 12

Which three security configurations should you apply to an Azure SQL Database to meet a requirement for data protection at rest and in transit?

Accepted Answer

Use Always Encrypted for sensitive columns.. Correct: A, B, D. TDE encrypts at rest, firewall rules protect network access, and Always Encrypted protects sensitive columns in transit. Option C (auditing) is for monitoring, not encryption. Option E (threat detection) is for detection, not protection.

Answer

Enable Microsoft Defender for Azure SQL.

Answer

Enable Azure SQL Auditing.

Question 13

Which two options are valid methods to authenticate to Azure Storage from on-premises servers?

Accepted Answer

Microsoft Entra ID authentication.. Correct: B and D. Shared access keys and Entra ID authentication are both supported. Option A (X.509 certificates) is not supported for storage. Option C (SAS tokens) is a form of shared access, but not a primary authentication method. Option E (Azure CLI) is a command-line tool, not an authentication method per se.

Answer

X.509 certificate authentication.

Answer

SAS tokens generated from the storage account.

Answer

Azure CLI login.

Question 14

Refer to the exhibit. You have an Azure Storage account with the encryption configuration shown. Users report that they cannot upload files to the storage account. What is the most likely cause?

Accepted Answer

The key version is pinned; if the key was rotated, the old version may be disabled.. The key version is pinned to a specific version. If the key is rotated, the old version may be disabled or deleted, causing access failures. Option A is wrong because the key source is Key Vault, not Microsoft-managed. Option B is wrong because the key vault URI is valid. Option D is wrong because key permissions are not directly indicated.

Answer

The storage account does not have permissions to access the key vault.

Answer

The key vault URI is incorrect.

Answer

The encryption key source is set to Microsoft.Keyvault but should be Microsoft.Storage.

Question 15

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

Accepted Answer

Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Key Vault meets all requirements: encryption at rest, automatic rotation with Key Vault's key rotation policy, and access by Azure SQL Database without application direct access. Option A is wrong because Always Encrypted encrypts columns but requires the application to handle encryption keys. Option B is wrong because Azure Disk Encryption encrypts VM disks, not SQL database. Option D is wrong because server-side encryption with service-managed keys does not use customer-managed keys.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.

Answer

Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.