AZ-500 Secure compute, storage, and databases Practice Test 15 — 15 Questions

Question 1

Refer to the exhibit. You are querying the sys.column_master_keys view in an Azure SQL Database. What is the purpose of this query?

Accepted Answer

To retrieve the column master key configuration for Always Encrypted.. The sys.column_master_keys view in Azure SQL Database specifically returns metadata about column master keys (CMKs) used by Always Encrypted. These keys protect the column encryption keys (CEKs) that encrypt sensitive data columns. Therefore, querying this view retrieves the column master key configuration for Always Encrypted, making option B correct.

Answer

To check the Dynamic Data Masking policies.

Answer

To verify the configuration of Transparent Data Encryption (TDE).

Answer

To list the encryption keys used for column-level encryption.

Question 2

Refer to the exhibit. You are reviewing an ARM template for an Azure Storage account. Which of the following is true about the deployment?

Accepted Answer

The storage account will enforce HTTPS traffic and replicate data to a paired region.. The ARM template configures the storage account with the 'supportsHttpsTrafficOnly' property set to true, which enforces HTTPS for all requests. Additionally, the 'sku.name' is set to 'Standard_GRS', which replicates data to a paired region for geo-redundancy. Therefore, option D correctly identifies both HTTPS enforcement and geo-replication to a paired region.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

The storage account will use locally redundant storage (LRS).

Answer

The storage account will have a firewall rule to restrict access to specific IPs.

Question 3

Your organization uses Azure Storage for sensitive financial data. You need to restrict access to storage accounts based on the client's IP address. Which Azure Storage service feature should you configure?

Accepted Answer

Firewalls and virtual networks. Firewalls and virtual networks allow you to restrict access to Azure Storage accounts based on source IP address ranges, including specific client IPs. This is the correct feature because it provides network-level access control that can block or allow traffic from defined IP addresses, which directly meets the requirement to restrict access based on the client's IP address.

Answer

Shared access signatures (SAS)

Answer

Azure Private Link

Answer

Azure AD role-based access control

Question 4

A company plans to migrate on-premises SQL Server databases to Azure SQL Managed Instance. The security team requires that all data at rest be encrypted using customer-managed keys stored in Azure Key Vault. Which feature should be enabled?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault is the correct choice because it encrypts the entire database at rest using a symmetric key, and the option to use customer-managed keys (CMK) in Azure Key Vault satisfies the security team's requirement for full control over encryption keys. TDE performs real-time I/O encryption and decryption of data and log files, and when combined with Azure Key Vault, it supports bring-your-own-key (BYOK) scenarios, ensuring compliance with regulatory mandates for customer-managed key storage.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Answer

Always Encrypted with secure enclaves

Question 5

You are designing a secure compute solution for a critical application that must comply with PCI DSS. The application runs on Azure Virtual Machines with sensitive data. You need to ensure that ephemeral disks are encrypted at the host level. Which Azure Disk Encryption option should you use?

Accepted Answer

Encryption at host. Encryption at host encrypts data at the VM host level, including ephemeral disks, before it is transmitted to Azure Storage. This meets the PCI DSS requirement for encrypting ephemeral disks at rest without relying on the guest OS or key management. It uses server-side encryption with platform-managed or customer-managed keys directly on the host node.

Answer

Server-side encryption (SSE) with platform-managed keys

Answer

Azure Disk Encryption (ADE) with Key Vault

Answer

Double encryption (SSE with CMK and ADE)

Question 6

Your security team wants to automatically detect and remediate misconfigurations in Azure Storage accounts, such as enabling public access. The solution should use Azure Policy and be centrally managed for multiple subscriptions. What should you configure?

Accepted Answer

Azure Policy with a custom initiative for storage security. Azure Policy with a custom initiative allows you to define a set of policies (e.g., 'Audit storage accounts with unrestricted public access') that can be assigned at a management group scope, covering multiple subscriptions. This enables automatic detection and remediation of misconfigurations like enabling public access, using built-in effects such as 'Deny' or 'DeployIfNotExists' to enforce compliance centrally.

Answer

Azure Blueprints

Answer

Azure Resource Graph

Answer

Microsoft Defender for Cloud (formerly Azure Security Center)

Question 7

You need to ensure that Azure SQL Database connections are encrypted and the server's identity is verified. Which connection string parameter should be required?

Accepted Answer

Encrypt=True; TrustServerCertificate=False. Setting `Encrypt=True` forces TLS encryption for all data in transit between the client and Azure SQL Database, while `TrustServerCertificate=False` ensures that the server's TLS certificate is validated against a trusted certificate authority (CA). This combination provides both encryption and server identity verification, which is required for secure connections to Azure SQL Database.

Answer

Encrypt=Optional

Answer

TrustServerCertificate=True

Answer

Encrypt=False

Question 8

Which TWO of the following are valid ways to encrypt data at rest in Azure SQL Database? (Choose two.)

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) [B] is correct because it performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest using a symmetric database encryption key (DEK) protected by a certificate stored in Azure Key Vault or the service-managed key store, directly satisfying the data-at-rest requirement. Always Encrypted [D] is also correct because it encrypts sensitive columns at rest and in memory, with keys held outside the database (in Windows Certificate Store or Azure Key Vault), so the data stored on disk is ciphertext and never exposed to the SQL Database engine. Dynamic Data Masking [A] is not encryption — it merely obfuscates column values in query results for non-privileged users while the underlying data remains plaintext. Row-Level Security [C] restricts which rows a user can access via predicates but does not encrypt stored data. Azure Disk Encryption (ADE) [E] is not applicable to Azure SQL Database because it targets IaaS virtual machine OS and data disks (BitLocker/DM-Crypt), not the PaaS SQL Database service.

Answer

Dynamic Data Masking

Answer

Row-Level Security

Answer

Azure Disk Encryption (ADE)

Question 9

Your company uses Azure Storage to store sensitive customer data. You need to ensure that only authorized applications running on Azure VMs can access the storage account without using shared keys or SAS tokens. What should you configure?

Accepted Answer

Enable Azure Storage firewall, deny access from all networks, and add a private endpoint. Then assign a managed identity to the VMs and grant it the necessary RBAC role.. Azure Storage firewall with service endpoints or private endpoints, combined with managed identity, allows secure access without shared keys or SAS tokens. Option A (storage account key) is a shared key. Option C (SAS token) is a shared access signature. Option D (access keys) are shared keys.

Answer

Use Azure AD authentication with storage account access keys.

Answer

Configure a storage account key and distribute it to the applications.

Answer

Generate a SAS token with IP restrictions and embed it in the application code.

Question 10

You are configuring security for an Azure App Service web app that connects to an Azure SQL Database. You need to ensure that the database connection string does not contain credentials in plaintext. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and use a Key Vault reference in the App Service application settings.. Azure Key Vault provides a secure, centralized store for secrets like database connection strings. By using a Key Vault reference in the App Service application settings (e.g., @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/)), the connection string is never exposed in plaintext in configuration files or environment variables, and access is controlled via managed identities or service principals.

Answer

Store the connection string in the web.config file with encryption.

Answer

Store the connection string in Azure App Configuration with encryption.

Answer

Store the connection string in an App Service application setting without encryption.

Question 11

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement? (Choose TWO.)

Accepted Answer

Deploy Azure Web Application Firewall (WAF) in front of the application.. Option B is correct because Azure Web Application Firewall (WAF), typically via Application Gateway or Front Door, inspects HTTP/HTTPS traffic and applies OWASP Core Rule Set rules that detect and block common SQL injection payloads before they reach the application or database. Option E is correct because parameterized queries (prepared statements) cause the database engine to treat user input strictly as data rather than executable SQL, which is the fundamental application-level defense against SQL injection. Option A is not correct here because Always Encrypted protects data confidentiality at rest and in memory by encrypting sensitive columns, but it does not detect or prevent SQL injection. Option C is not correct because Transparent Data Encryption (TDE) only encrypts data and log files at rest and has no bearing on injection attacks. Option D is not correct because SQL Server auditing records activity for compliance and forensic review after the fact; it is a detective control, not a preventive measure against SQL injection.

Answer

Use Always Encrypted for sensitive columns.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable SQL Server auditing.

Question 12

Your organization uses Azure Storage accounts with blob containers. You need to ensure that only authorized applications can access the storage account, without using shared keys or shared access signatures. What should you configure?

Accepted Answer

Use Azure AD authentication with managed identities. Microsoft Entra ID authentication with managed identities allows applications to authenticate to Azure Storage without using shared keys or SAS tokens. Managed identities provide an automatically managed identity in Microsoft Entra ID, enabling applications to use OAuth 2.0 tokens for secure access to storage accounts. This approach eliminates the need for any shared secrets or keys, meeting the requirement exactly.

Answer

Use a stored access policy with a shared access signature

Answer

Configure a firewall on the storage account to allow only the application's IP address

Answer

Enable a private endpoint for the storage account

Question 13

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

Accepted Answer

Implement Always Encrypted and store the column encryption key in Azure Key Vault. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted at rest and remains encrypted throughout its lifecycle, including during query processing. By storing the column encryption key in Azure Key Vault, you separate key management from the database, preventing even database administrators from accessing plaintext data. Only authorized applications with access to the key can decrypt the data at the application layer, meeting all stated requirements.

Answer

Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault

Answer

Use Dynamic Data Masking to mask the credit card column for non-privileged users

Answer

Implement Azure SQL Database's Always Encrypted with enclaves

Question 14

You are configuring an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can securely access Azure Container Registry (ACR) without storing image pull secrets in the pod specification. What should you do?

Accepted Answer

Enable managed identity on AKS and assign the AcrPull role to the kubelet identity. Enabling managed identity on AKS creates a kubelet identity that can be granted the AcrPull role via Azure RBAC. This allows AKS to authenticate to ACR automatically without storing any secrets in the pod specification, as the kubelet uses the managed identity to pull container images on behalf of the pods.

Answer

Create a service principal and store the secret in a Kubernetes secret, then reference it in the pod spec

Answer

Enable admin account on ACR and use the admin username and password in the pod spec

Answer

Use the storage account key of the attached Azure storage account

Question 15

Refer to the exhibit. You are deploying an Azure Storage account with the ARM template snippet shown. The deployment fails with an error about the encryption configuration. What is the most likely cause?

Accepted Answer

The storage account does not have the required permissions on the key vault. The storage account must be granted explicit permissions on the Azure Key Vault to access the encryption key. Even if the key vault URI, key name, and version are correct, the deployment will fail if the storage account's managed identity (or the user-assigned identity) does not have 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the key vault. This is a common oversight when configuring customer-managed keys for Azure Storage encryption.

Answer

The key vault URI is incorrect

Answer

The key name or version is missing

Answer

The key vault is in a different region than the storage account