AZ-500 Secure compute, storage, and databases Practice Test 15 — 15 Questions

Question 1

You work for a financial institution that uses Azure Cosmos DB with API for NoSQL to store transaction data. The security requirements mandate: (1) All data at rest must be encrypted using customer-managed keys (CMK) stored in Azure Key Vault. (2) The encryption keys must be automatically rotated every 60 days. (3) Network access to the Cosmos DB account must be restricted to only specific virtual networks. (4) Access to the keys must be logged and monitored. (5) The Cosmos DB account must be configured to use private endpoints. You have configured the Cosmos DB account with CMK and private endpoints. However, after setting up automatic key rotation in Key Vault, the Cosmos DB account starts returning 403 (Forbidden) errors for some requests. What is the most likely cause?

Accepted Answer

The key vault access policy does not grant the Cosmos DB account necessary permissions on the new key version.. Option D is correct because when using CMK with automatic key rotation, the Cosmos DB account must have access to the new key version. If the account does not have the correct permissions (e.g., get, wrap, unwrap) on the new key version, it will fail. Option A is wrong because private endpoints do not cause 403 errors. Option B is wrong because firewall rules are separate from CMK. Option C is wrong because Cosmos DB does not have a 'key version' property to update manually.

Answer

The private endpoint connection is not approved.

Answer

The Cosmos DB account's key version property is outdated and must be updated manually.

Answer

The firewall rules are blocking the Cosmos DB account from accessing Key Vault.

Question 2

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed key. Azure Storage Service Encryption with customer-managed keys allows you to use your own key stored in Azure Key Vault. Option B is correct because it uses CMK. Option A is incorrect because SSE with PMK uses Microsoft-managed keys. Option C is incorrect because Azure Disk Encryption is for VMs. Option D is incorrect because Azure Information Protection is for classification and labeling.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption (SSE) with platform-managed key

Answer

Azure Information Protection

Question 3

A company has an Azure SQL Database that contains sensitive financial data. They want to audit all successful and failed login attempts for the database. What should they configure?

Accepted Answer

Azure SQL Database auditing. Azure SQL Database auditing tracks database events, including successful and failed logins, to an audit log in Azure Storage, Log Analytics, or Event Hubs. Option C is correct. Option A is incorrect because Azure AD audit logs track identity events, not SQL login attempts. Option B is incorrect because SQL Vulnerability Assessment checks for security misconfigurations. Option D is incorrect because Microsoft Defender for Cloud alerts on threats but does not provide detailed login audit trails.

Answer

SQL Vulnerability Assessment

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 4

Your organization uses Azure Files shares for user home directories. You need to enforce that users access these shares only from trusted locations (corporate IP ranges) and that all access is logged. Which combination of actions should you take?

Accepted Answer

Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.. Azure Files supports network security using service endpoints and firewalls to restrict access to specific IP ranges. Diagnostic settings can send logs to Log Analytics. Option A is correct. Option B is incorrect because Private Endpoint does not filter by IP. Option C is incorrect because SAS tokens are for delegated access, not IP restriction. Option D is incorrect because Azure AD DS does not filter by source IP.

Answer

Use a Private Endpoint for the storage account and configure a service endpoint on the virtual network.

Answer

Generate a shared access signature (SAS) token that is valid only from corporate IPs and attach it to the file share.

Answer

Assign Azure AD DS to the storage account and enable Azure AD authentication for Azure Files, then configure conditional access policies.

Question 5

You are designing a backup strategy for Azure Virtual Machines that host a critical database. Compliance requires that backups be stored in a separate Azure region and be immutable for 90 days. What should you use?

Accepted Answer

Azure Backup with Geo-Redundant Storage (GRS) and enable soft delete. Azure Backup with geo-redundant storage (GRS) stores backups in a paired region. Immutable storage for Azure Backup is achieved by enabling soft delete and using backup policies with retention that prevents deletion. Option B is correct. Option A is incorrect because LRS does not provide cross-region storage. Option C is incorrect because Azure Site Recovery is for disaster recovery, not long-term backup. Option D is incorrect because Azure Disk Encryption encrypts disks but does not provide geo-redundancy or immutability.

Answer

Azure Backup with Locally Redundant Storage (LRS) and a retention policy of 90 days

Answer

Azure Disk Encryption with a backup policy stored in a different region

Answer

Azure Site Recovery with a recovery plan and retention of 90 days

Question 6

A company uses Azure Cosmos DB with SQL API to store user profiles. They need to ensure that only authorized applications can access the data, and that the data is encrypted in transit and at rest. Currently, the application uses a master key to connect. What should they implement to improve security?

Accepted Answer

Enable managed identity for the application and grant it access to Cosmos DB via Azure RBAC. Using managed identities for Azure resources eliminates the need for master keys by allowing the application to authenticate to Azure Cosmos DB via Azure AD. Option D is correct. Option A is incorrect because firewall restricts network access but does not address key management. Option B is incorrect because private endpoints improve network security but still require authentication. Option C is incorrect because resource tokens are for granular user-level access, not application authentication.

Answer

Use resource tokens with permissions for each user

Answer

Enable private endpoint for Cosmos DB

Answer

Configure IP firewall rules on the Cosmos DB account

Question 7

Your organization stores sensitive documents in Azure Blob Storage. You need to prevent data exfiltration by ensuring that authorized users can only access blobs from within the corporate network, and that any attempt to download blobs from outside the network is blocked. What should you configure?

Accepted Answer

Configure a storage account firewall to allow only the corporate IP range and deny all other traffic. Storage account firewalls and virtual network service endpoints allow you to restrict access to specific IP ranges or virtual networks. Option A is correct. Option B is incorrect because SAS tokens can be used from anywhere if not restricted. Option C is incorrect because Azure RBAC controls permissions but does not enforce network location. Option D is incorrect because Azure Information Protection labels classify but do not block access based on network.

Answer

Apply Azure Information Protection sensitivity labels to the blobs

Answer

Generate SAS tokens with a short expiration and distribute them to users

Answer

Assign Azure RBAC roles to users and require multi-factor authentication

Question 8

You need to ensure that Azure SQL Database automatically detects and alerts on potential SQL injection attacks. Which Microsoft Defender for Cloud plan should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL includes advanced threat protection that detects SQL injection and other anomalous activities. Option B is correct. Option A is incorrect because Defender for Cloud (free) only provides basic security assessments. Option C is incorrect because Defender for Storage protects storage accounts. Option D is incorrect because Defender for App Service protects web apps.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud (free tier)

Answer

Microsoft Defender for App Service

Question 9

Which TWO actions should you take to secure managed database backups in Azure SQL Managed Instance?

Accepted Answer

Configure geo-redundant backup storage (RA-GRS). Option B (geo-redundant storage) ensures backups are replicated to another region for disaster recovery. Option D (soft delete) protects backups from accidental or malicious deletion. Option A is incorrect because TDE encrypts data at rest, but backups are automatically encrypted if TDE is enabled. Option C is incorrect because retention policies do not provide cross-region redundancy. Option E is incorrect because auditing does not protect backups directly.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure auditing for the managed instance

Answer

Set a long-term retention policy for backups

Question 10

Which THREE measures should you implement to secure a Linux virtual machine running a web application on Azure?

Accepted Answer

Enable Azure Disk Encryption for OS and data disks. Option A (just-in-time VM access) reduces exposure by opening ports only when needed. Option C (Azure Disk Encryption) encrypts OS and data disks at rest. Option E (Microsoft Defender for Servers) provides threat detection and vulnerability management. Option B is incorrect because NSGs filter traffic but do not encrypt data. Option D is incorrect because Azure Backup protects against data loss but does not encrypt disks themselves; backup encryption is separate.

Answer

Configure network security groups to allow only HTTP and HTTPS

Answer

Configure Azure Backup for the VM

Question 11

Which TWO configurations are required to ensure that an Azure Storage account is accessible only via HTTPS and that access keys are not used?

Accepted Answer

Set the 'Secure transfer required' property to Enabled. Option A (secure transfer required) enforces HTTPS. Option D (disable shared key access) prevents use of access keys. Option B is incorrect because enabling firewall does not disable access keys. Option C is incorrect because enabling logging does not enforce HTTPS or disable keys. Option E is incorrect because enabling versioning does not affect encryption or key usage.

Answer

Enable blob versioning

Answer

Enable diagnostic settings for the storage account

Answer

Configure the storage account firewall to allow only selected virtual networks

Question 12

Refer to the exhibit. You have an Azure Disk Encryption policy assignment. An administrator reports that encryption of a new VM fails. What is the most likely cause?

Accepted Answer

The key version referenced in the policy is no longer valid because the key was rotated.. The exhibit shows encryption configuration with keySource as Microsoft.Keyvault and a specific key version. If the key version is specified, Azure Disk Encryption will attempt to use that exact version. If the key is rotated or archived, the specified version becomes invalid. Option A is correct. Option B is incorrect because the key vault URI is present. Option C is incorrect because the key exists. Option D is incorrect because key rotation is not inherently a problem if the version is updated in the policy.

Answer

The disk encryption set does not have purge protection enabled.

Answer

The key does not exist in the key vault.

Answer

The key vault URI is incorrect or inaccessible.

Question 13

Refer to the exhibit. You are implementing an Azure Policy to enforce encryption on managed disks. A user reports that they cannot create a VM even though they specified a disk encryption set. What is the most likely reason?

Accepted Answer

The user specified the disk encryption set in the VM properties but not on the disk resource.. The policy checks that the property 'diskEncryptionSet.id' exists on the OS disk. If the user specifies the encryption set at the VM level rather than the disk level, the property may not be present on the disk resource itself. Option B is correct. Option A is incorrect because the policy allows creation if the property exists. Option C is incorrect because the policy does not check for key validity. Option D is incorrect because the policy applies to all regions.

Answer

The user did not have permission to assign a disk encryption set.

Answer

The disk encryption set is in a different region than the VM.

Answer

The disk encryption set is not enabled for encryption.

Question 14

You are the security engineer for a healthcare company that uses Azure to store electronic health records (EHR) in Azure Blob Storage. Compliance requires that all data be encrypted at rest with customer-managed keys stored in a hardware security module (HSM), that the storage account be accessible only from a specific virtual network, and that all access to the storage account be logged and sent to a central security information and event management (SIEM) system. Additionally, you must ensure that any blobs containing protected health information (PHI) are automatically labeled with a sensitivity label that prevents them from being shared externally. You have decided to use Azure Key Vault Managed HSM for key storage, Azure Private Endpoint for network access, and Azure Monitor for logging. However, you are unsure how to automatically apply sensitivity labels to blobs based on content inspection. Which service should you use to achieve automatic labeling of PHI data in Azure Blob Storage?

Accepted Answer

Microsoft Purview Information Protection with auto-labeling policies for Azure Blob Storage. Microsoft Purview Information Protection can automatically classify and label sensitive data in Azure Blob Storage using content scanning and machine learning. Option C is correct. Option A is incorrect because Azure Policy enforces rules but does not inspect content for labeling. Option B is incorrect because Microsoft Sentinel is a SIEM, not a labeling service. Option D is incorrect because Microsoft Defender for Storage provides threat detection but does not apply sensitivity labels.

Answer

Microsoft Defender for Storage with sensitivity labeling integration

Answer

Azure Policy with custom policies to tag blobs containing PHI

Answer

Microsoft Sentinel with analytics rules to detect PHI and apply labels via automation

Question 15

Your organization runs a critical application on Azure Virtual Machines (VMs) that processes credit card transactions. Compliance with PCI DSS requires that all cardholder data be encrypted at rest and that the encryption keys be stored in a FIPS 140-2 Level 3 validated hardware security module (HSM). You have chosen to use Azure Disk Encryption with customer-managed keys stored in Azure Key Vault Managed HSM. During a security review, you discover that the VMs are using unmanaged disks. You need to migrate them to managed disks without downtime and ensure that encryption is applied. You also need to maintain the existing encryption keys and ensure that the encryption set is in the same region as the VMs. What should you do?

Accepted Answer

Stop the VM, convert the unmanaged disks to managed disks using Azure CLI, then enable Azure Disk Encryption with the existing DES.. Azure Disk Encryption with managed disks requires a Disk Encryption Set (DES) that references the key in the HSM. You can convert unmanaged disks to managed disks by stopping the VM and using Azure CLI or PowerShell, then attaching the managed disk. To avoid downtime, you should perform the conversion during a maintenance window. Ensure the DES is in the same region as the VM. Option B is correct. Option A is incorrect because you cannot directly use Azure Disk Encryption on unmanaged disks with a DES; you must convert to managed disks first. Option C is incorrect because Azure Backup does not help with disk type conversion. Option D is incorrect because copying disks would create duplicates and require reconfiguration.

Answer

Copy the unmanaged disks to managed disks using AzCopy and then attach them to the VM while it is running.

Answer

Create a new VM with managed disks, attach the unmanaged disks as data disks, and enable Azure Disk Encryption with the existing DES.

Answer

Take a backup of the VMs using Azure Backup, restore them to managed disks, and enable encryption with a new DES.