AZ-500 Secure compute, storage, and databases Practice Test 16 — 15 Questions

Question 1

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Accepted Answer

Configure Key Vault networking with private endpoint or selected networks. Configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.

Answer

Disable soft delete permanently

Answer

Store secrets as plain text tags

Question 2

Drag and drop the steps to configure Azure Defender for SQL on an Azure SQL Database into the correct order.

Accepted Answer

1. Enable Azure Defender for SQL on the database. 2. Configure a storage account for vulnerability assessment scans. 3. Set up email notifications for security alerts.. Defender for SQL is enabled per database under security settings, requiring storage for scans.

Answer

1. Configure a storage account for vulnerability assessment scans. 2. Enable Azure Defender for SQL on the database. 3. Set up email notifications for security alerts.

Answer

1. Enable Azure Defender for SQL on the database. 2. Set up email notifications for security alerts. 3. Configure a storage account for vulnerability assessment scans.

Answer

1. Set up email notifications for security alerts. 2. Enable Azure Defender for SQL on the database. 3. Configure a storage account for vulnerability assessment scans.

Question 3

Drag and drop the steps to enable Azure Security Center's enhanced security features for a subscription into the correct order.

Accepted Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Choose the subscription, Step 4: Set pricing tier to Standard. To enable Azure Security Center's enhanced security features for a subscription, you must first navigate to Security Center, then access 'Security policy' under Management. Within that blade, select the target subscription and set its pricing tier to Standard. This activates advanced threat detection and vulnerability assessment capabilities. Common mistakes include confusing the order of subscription selection and tier setting, or mixing up the security policy with auto-provisioning settings.

Answer

Step 1: Navigate to Azure Security Center, Step 2: Choose the subscription, Step 3: Set pricing tier to Standard, Step 4: Select 'Security policy' under Management

Answer

Step 1: Navigate to Azure Security Center, Step 2: Select 'Security policy' under Management, Step 3: Set pricing tier to Standard, Step 4: Choose the subscription

Answer

Step 1: Navigate to Azure Security Center, Step 2: Go to 'Auto provisioning' settings, Step 3: Enable Log Analytics agent, Step 4: Set pricing tier to Standard

Question 4

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.

Accepted Answer

1. Navigate to Azure AD Security
2. Configure user risk policy
3. Configure sign-in risk policy
4. Review risk detections. Identity Protection policies are configured under Security, with user risk policy settings.

Answer

1. Configure sign-in risk policy
2. Configure user risk policy
3. Navigate to Azure AD Security
4. Review risk detections

Answer

1. Review risk detections
2. Navigate to Azure AD Security
3. Configure user risk policy
4. Configure sign-in risk policy

Answer

1. Configure user risk policy
2. Navigate to Azure AD Security
3. Configure sign-in risk policy
4. Review risk detections

Question 5

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Accepted Answer

Implement Azure Web Application Firewall (WAF). Azure Web Application Firewall (WAF) can inspect incoming HTTP/HTTPS traffic and block malicious payloads, including SQL injection attempts, before they reach the application or database. It provides a perimeter defense that filters out common attack patterns, reducing the attack surface for SQL injection.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure Azure SQL Database firewall rules

Answer

Enable Always Encrypted for sensitive columns

Question 6

Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?

Accepted Answer

Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.. Identity-based authentication for Azure Files using Microsoft Entra ID allows you to assign share-level permissions (e.g., Storage File Data SMB Share Contributor) to specific users or groups, ensuring only explicitly authorized identities can access the share. This meets the requirement of restricting access to users with explicit permissions, as opposed to relying on network rules or shared keys.

Answer

Configure a firewall rule to allow only corporate IP ranges.

Answer

Use storage account access keys to mount the file share.

Answer

Generate a shared access signature (SAS) with read permissions.

Question 7

Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?

Accepted Answer

Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Azure AD using Azure AD Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.

Answer

Enable Azure AD Domain Services authentication and join the storage account to the managed domain.

Answer

Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.

Answer

Use storage account keys to mount the share and rely on Windows ACLs.

Question 8

Which THREE components are part of Azure Disk Encryption for Windows VMs?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption is the correct component because Azure Disk Encryption for Windows VMs leverages BitLocker to provide volume-level encryption for the OS and data disks. BitLocker is the native Windows technology that encrypts the entire volume, ensuring data at rest is protected within Azure managed disks.

Answer

DM-Crypt

Answer

Microsoft Entra ID (Azure AD)

Question 9

You are designing a secure database solution for a financial application using Azure SQL Database. The database contains highly sensitive columns (e.g., credit card numbers). Which combination of features should you implement to protect data at rest, in transit, and in use, while minimizing performance impact?

Accepted Answer

Always Encrypted (with deterministic encryption for equality searches), TDE, and enforce TLS 1.2.. It combines Always Encrypted with deterministic encryption (which supports equality searches while protecting data in use), Transparent Data Encryption (TDE) for data at rest, and enforced TLS 1.2 for data in transit. This provides comprehensive protection across all three states while minimizing performance impact, as deterministic encryption allows efficient querying without decrypting on the server side.

Answer

Always Encrypted with secure enclaves, TDE, and enforce TLS 1.2.

Answer

Dynamic Data Masking, TDE, and enforce TLS 1.2.

Answer

Column-level encryption using Azure Key Vault, TDE, and enforce TLS 1.2.

Question 10

Your organization uses Azure Storage accounts with blob containers. You need to ensure that only authorized applications can access the storage account, without using shared keys or shared access signatures. What should you configure?

Accepted Answer

Use Azure AD authentication with managed identities. Azure AD authentication with managed identities allows applications to authenticate to Azure Storage without using shared keys or SAS tokens. Managed identities provide an automatically managed identity in Azure AD, enabling applications to use OAuth 2.0 tokens for secure access to storage accounts. This approach eliminates the need for any shared secrets or keys, meeting the requirement exactly.

Answer

Use a stored access policy with a shared access signature

Answer

Configure a firewall on the storage account to allow only the application's IP address

Answer

Enable a private endpoint for the storage account

Question 11

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

Accepted Answer

Implement Always Encrypted and store the column encryption key in Azure Key Vault. Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted at rest and remains encrypted throughout its lifecycle, including during query processing. By storing the column encryption key in Azure Key Vault, you separate key management from the database, preventing even database administrators from accessing plaintext data. Only authorized applications with access to the key can decrypt the data at the application layer, meeting all stated requirements.

Answer

Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault

Answer

Use Dynamic Data Masking to mask the credit card column for non-privileged users

Answer

Implement Azure SQL Database's Always Encrypted with enclaves

Question 12

You need to securely connect to an Azure SQL Database from an on-premises application without exposing the database to the public internet. Which solution should you use?

Accepted Answer

Use Azure Private Link to connect via a private endpoint. Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address from your on-premises network via ExpressRoute or VPN. This ensures traffic never traverses the public internet, meeting the requirement for secure, non-public connectivity.

Answer

Configure a firewall rule to allow the on-premises public IP address

Answer

Enable Always Encrypted on the database

Answer

Use a virtual network service endpoint for Azure SQL Database

Question 13

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Accepted Answer

Configure a private endpoint. Configuring a private endpoint ensures that traffic between the client and Cosmos DB traverses the Microsoft backbone network, enforcing that only Azure services within the same region can access via private IPs. Option C is correct because setting the minimum TLS version to 1.2 enforces encryption in transit for all connections. Option A (service endpoints) does not enforce encryption or regional restriction. Option D (disable public network access) is a prerequisite for private endpoints but alone does not enforce encryption. Option E (firewall rules to allow only Azure services) does not enforce TLS version.

Answer

Enable service endpoints for the Cosmos DB account

Answer

Disable public network access

Answer

Configure firewall rules to allow only Azure services

Question 14

You manage Azure Storage accounts for a healthcare organization. To comply with HIPAA, you need to ensure that all data at rest is encrypted and that encryption keys are rotated automatically every 90 days. What should you implement?

Accepted Answer

Use customer-managed keys (CMK) in Azure Key Vault with automatic key rotation.. Customer-managed keys (CMK) stored in Azure Key Vault with automatic key rotation fulfill the requirement for encrypted data at rest and automatic rotation of encryption keys. This ensures that HIPAA compliance is met by maintaining control over encryption keys and enforcing their periodic rotation. The other options do not provide automatic key rotation: RBAC controls access but does not rotate keys; infrastructure encryption adds another layer but does not include key rotation; manually rotating storage account access keys addresses authentication keys, not encryption keys, and is not automatic.

Answer

Configure Azure RBAC roles for storage accounts.

Answer

Enable infrastructure encryption for storage accounts.

Answer

Generate new storage account access keys manually every 90 days.

Question 15

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

Accepted Answer

Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.. Azure Storage Service Encryption with Microsoft-managed keys only applies to Azure Storage accounts, not to Azure SQL Database. It does not use customer-managed keys or support automatic rotation. Option B is wrong because Azure Disk Encryption encrypts VM disks, not the Azure SQL Database. It does not meet the requirement for encrypting the database at rest. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access. Option D is wrong because Always Encrypted encrypts specific columns but requires the client application to handle the column encryption keys, violating the requirement that the application not have direct access to the key vault.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.

Answer

Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.