AZ-500 Secure compute, storage, and databases Practice Test 16 — 15 Questions

Question 1

Your company uses Azure SQL Database for a line-of-business application. The security team requires that all queries executed against the database be audited, including the actual query text, and that the audit logs be retained for one year. You configure auditing to store logs in an Azure Storage account with a retention policy of 365 days. However, after some time, you notice that the audit logs are being deleted after only 30 days. You verify that the storage account's retention policy is set to 365 days and that the audit configuration is correct. What is the most likely cause of the logs being deleted prematurely?

Accepted Answer

The audit log retention period in Azure SQL Database auditing settings is set to 30 days.. Audit logs for Azure SQL Database can be stored in a storage account, but the retention policy for audit logs is configured within the Azure SQL auditing settings, not the storage account's default retention policy. If the retention period in the audit log settings is set to 30 days, logs will be deleted after that period even if the storage account has a longer retention. Option C is correct. Option A is incorrect because lifecycle management policies are not enabled by default. Option B is incorrect because the storage account retention policy does not apply to blob storage for audit logs unless specifically configured. Option D is incorrect because soft delete does not delete logs; it protects them.

Answer

The storage account has soft delete enabled, which deletes logs after 30 days.

Answer

A lifecycle management policy is deleting blobs after 30 days.

Answer

The storage account's immutable storage policy is overriding the retention setting.

Question 2

You need to restrict access to a storage account containing sensitive financial data. The storage account is used by multiple Azure VMs and Azure App Service web apps. Only authorized applications and users should be able to access the storage account. Which TWO options should you implement?

Accepted Answer

Use managed identities for Azure resources to authenticate from App Service and VMs to the storage account.. Option A: Storage service endpoints restrict access to the storage account from specific VNets. Option C: Managed identities allow App Service to authenticate to storage without storing credentials. Option B (shared access keys) is broad and not recommended for fine-grained control. Option D (storage account keys) is even broader. Option E (Azure AD user delegation) is for user-level access, not service access.

Answer

Grant Azure AD user delegation permissions for each user accessing the storage account.

Answer

Configure shared access signature (SAS) tokens with a long expiration time for all applications.

Answer

Distribute storage account access keys to all application developers.

Question 3

Your company is deploying a new application on Azure Kubernetes Service (AKS). The application needs to read and write data to an Azure Storage account. Security requirements mandate that no storage account keys or connection strings be stored in the application code or configuration files. Which TWO actions should you take?

Accepted Answer

Configure the storage account firewall to allow access only from the AKS cluster's virtual network and subnet.. Option A: Using a managed identity for the pod (via AAD Pod Identity or Workload Identity) allows the pod to authenticate without secrets. Option D: Setting the storage account firewall to allow access only from the AKS cluster's VNet provides network-level security. Option B (service principal with client secret) still requires a secret. Option C (SAS token) also requires a secret. Option E (RBAC with storage account key) is not possible; RBAC does not use keys.

Answer

Generate a shared access signature (SAS) token and embed it in the application code.

Answer

Assign the 'Storage Account Key Operator Service Role' RBAC role to the AKS cluster.

Answer

Create a service principal with a client secret and use that secret in the application configuration.

Question 4

You are designing security for an Azure SQL Database that will store personally identifiable information (PII). The database will be accessed by multiple applications, some of which are legacy and cannot use Azure AD authentication. Your requirements include: encrypting data at rest, encrypting data in transit, and dynamically masking PII columns for non-privileged users. Which THREE features should you implement?

Accepted Answer

Configure Dynamic Data Masking (DDM) for the PII columns.. Option A: Transparent Data Encryption (TDE) encrypts data at rest. Option C: Dynamic Data Masking (DDM) masks PII columns for non-privileged users. Option D: Enforce minimal TLS version 1.2 ensures data in transit is encrypted. Option B (Always Encrypted) is client-side encryption but not required if TDE is used and the client does not support it. Option E (Azure Information Protection) is not for database-level encryption.

Answer

Implement Always Encrypted for the PII columns.

Answer

Apply Azure Information Protection labels to the database.

Question 5

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. A recent assessment shows that a standard-tier storage account (storageaccount1) used for backup data has the following findings: 1) 'Storage account should use a private endpoint' is unhealthy; 2) 'Storage account should use customer-managed keys (CMK) for encryption' is healthy; 3) 'Storage account should restrict network access' is unhealthy; 4) 'Storage account should enable soft delete for blobs' is healthy. Management requires that all storage accounts used for backup be protected against accidental deletion and have network access restricted to a specific virtual network (vnet-backup). Currently, the storage account is accessible from all networks. You need to remediate the unhealthy findings while maintaining the healthy status of the other controls. Which combination of actions should you take?

Accepted Answer

Create a private endpoint in the vnet-backup subnet for the storage account and set the public network access to 'Disabled'.. Option C is correct: Enabling a private endpoint and disabling public network access will remediate both the private endpoint and network access findings. Soft delete is already enabled, and CMK is already in place. Option A: Enabling a service endpoint does not remediate the private endpoint finding and may not satisfy the recommendation. Option B: Configuring firewall rules allows public IPs, which does not meet the private endpoint recommendation. Option D: Enabling a service endpoint and firewall rules does not address the private endpoint requirement.

Answer

Enable a service endpoint for Microsoft.Storage on vnet-backup and configure the firewall to allow only that subnet, then create a private endpoint as well.

Answer

Enable a service endpoint for Microsoft.Storage on the vnet-backup subnet and update the storage account firewall to allow access only from that subnet.

Answer

Configure the storage account firewall to allow access only from the vnet-backup subnet's public IP range.

Question 6

Your company is migrating a legacy on-premises application to Azure VMs. The application writes log files to a local folder. You need to collect these logs centrally for security analysis using Microsoft Sentinel. The application runs on Windows Server 2022 and is expected to generate about 50 GB of logs per day. The security team requires that logs be encrypted at rest and in transit, and that log collection has minimal latency. You set up Azure Monitor Agent (AMA) on the VM and configure a Data Collection Rule (DCR) to stream custom logs to a Log Analytics workspace. However, after 24 hours, no custom logs appear in the workspace. The AMA is reporting as healthy. You need to troubleshoot and resolve the issue. What is the most likely cause?

Accepted Answer

The DCR does not include the correct table name for the custom log, or the table does not exist in the Log Analytics workspace.. Option B is correct: The DCR must reference the custom log table created in the Log Analytics workspace; if the table name does not match, logs will not be ingested. Option A: AMA can collect custom logs from a file path; the path does not need to be a network share. Option C: The agent does not require local admin privileges for custom log collection. Option D: The log file format is not limited to JSON; AMA can collect plain text logs with a defined pattern.

Answer

The custom log file path specified in the DCR is a local path, but AMA requires a network share for custom log collection.

Answer

The log file format is not JSON, but AMA only supports custom logs in JSON format.

Answer

The VM does not have local administrator privileges required for the AMA to read the log files.

Question 7

You are the security administrator for a company that uses Azure Blob Storage to store sensitive documents. You need to ensure that all blob data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. You have enabled encryption with CMK on the storage account. However, after a key rotation in Key Vault, you notice that newly uploaded blobs are encrypted with the new key, but existing blobs are still encrypted with the old key. You need to ensure that all blobs are re-encrypted with the new key. What should you do?

Accepted Answer

Re-upload the existing blobs using the new key version by calling the Put Blob operation with the new encryption key.. Option C is correct: Re-uploading blobs using the new key triggers re-encryption with the latest key version. Option A: Azure Storage automatically rewrites blobs on read/write only if the blob is accessed; re-uploading ensures all blobs are re-encrypted. Option B: Key rotation does not automatically re-encrypt existing blobs; you must explicitly re-encrypt by rewriting. Option D: The storage account encryption setting applies to new blobs only; existing blobs retain the old key until rewritten.

Answer

Update the storage account's encryption scope to use the new key version and then call the 'Rewrite' operation on each blob.

Answer

Set the storage account encryption to use a different key, then revert to the original key to force re-encryption.

Answer

No action is needed; Azure Storage automatically re-encrypts existing blobs with the new key after rotation.

Question 8

Your organization has an Azure SQL Database that stores credit card numbers. The compliance team requires that credit card numbers be encrypted at rest and that only authorized applications can decrypt the data. The applications access the database using different service principals. You decide to implement Always Encrypted with secure enclaves. You create a column master key (CMK) in Azure Key Vault and a column encryption key (CEK) for the credit card column. You configure the column with deterministic encryption. However, after deployment, the applications report that they cannot insert or query the encrypted column. The error indicates that the column cannot be decrypted. You verify that the applications have the necessary permissions to access the CMK in Key Vault. What is the most likely cause of the issue?

Accepted Answer

The applications are using an older version of the SQL client driver that does not support Always Encrypted with secure enclaves.. Option D is correct: Applications must use a client driver that supports Always Encrypted with secure enclaves, such as the latest Microsoft.Data.SqlClient or .NET Framework with the enclave type configured. Option A: The CMK does not need to be in the same region. Option B: Both deterministic and randomized encryption can be used with secure enclaves. Option C: Even with permissions, the driver must support the enclave protocol.

Answer

The service principals do not have the 'Get' and 'Decrypt' permissions on the CMK in Key Vault.

Answer

Deterministic encryption is not supported with secure enclaves; you must use randomized encryption.

Answer

The CMK is stored in a Key Vault in a different region than the SQL Database.

Question 9

Your company uses Azure Files shares for user home directories. Security policy requires that all data be encrypted at rest and in transit. You have enabled encryption at rest using Azure Storage Service Encryption (SSE). For encryption in transit, you require SMB clients to use SMB 3.0 or later with encryption. You configure the storage account to require secure transfer. A user reports that they cannot mount the file share from a Windows 10 machine that is not domain-joined. The user can mount other file shares without issues. What is the most likely reason for the failure?

Accepted Answer

The client machine does not support SMB 3.0 encryption, which is required when secure transfer is enabled.. Option B is correct: When secure transfer is required, SMB 3.0 with encryption is mandatory. If the client does not support SMB encryption (e.g., due to older OS or misconfiguration), the mount will fail. Option A: Azure Files supports SMB mount from non-domain-joined machines. Option C: Azure Files supports both SMB protocols. Option D: DNS resolution is not the issue if they can mount other shares.

Answer

The storage account firewall is blocking the client's public IP address.

Answer

The user's machine is not domain-joined, so it cannot authenticate to Azure Files.

Answer

Azure Files only supports SMB 2.1, and the client is trying to use SMB 3.0.

Question 10

Your organization has an Azure Cosmos DB account that stores IoT telemetry data. The data is ingested from multiple devices and is time-sensitive. Security requirements mandate that all data be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. You configure CMK for the Cosmos DB account. After a security incident, you need to revoke access to the data immediately by disabling the CMK in Key Vault. However, you find that data can still be read from Cosmos DB. You need to ensure that disabling the key renders the data inaccessible. What should you do?

Accepted Answer

Change the Cosmos DB account's default identity to a user-assigned managed identity and remove that identity's access to the Key Vault.. Option C is correct: Changing the default identity to a user-assigned managed identity and revoking its access to the Key Vault will disable the CMK and make the data inaccessible. Option A: Disabling the key version does not immediately revoke access; Cosmos DB caches the key. Option B: Deleting the key may be irreversible and does not guarantee immediate revocation. Option D: Rotating the key does not revoke the old key; data encrypted with the old key remains accessible.

Answer

Rotate the CMK to a new key version and update the Cosmos DB account to use the new key.

Answer

Delete the CMK from Key Vault.

Answer

Disable the specific key version used by Cosmos DB in Key Vault.

Question 11

Your company uses Azure Managed Disks for VMs running a production database. The disks are encrypted with Azure Disk Encryption (ADE) using Azure Key Vault. Security policy requires that all encryption keys be rotated every 90 days. You have automated key rotation in Key Vault. However, after rotating the key, you find that the disks are still using the old key. You need to ensure that the disks use the new key after rotation. What should you do?

Accepted Answer

Disable encryption on the VM, then re-enable ADE specifying the new key version.. Option B is correct: ADE does not automatically re-encrypt disks after key rotation. You must disable encryption on the VM and then re-enable it with the new key version to force re-encryption. Option A: ADE does not support automatic re-encryption. Option C: Deleting the old key would break the VM. Option D: Updating the disk encryption set only affects new disks, not existing ones.

Answer

Delete the old key version from Key Vault to force the disk to use the new key.

Answer

No action is needed; ADE automatically re-encrypts disks with the new key after rotation.

Answer

Update the disk encryption set to reference the new key version; the disk will automatically use it.

Question 12

Your organization uses Azure Storage to host sensitive financial data. You need to ensure that all access to the storage account is encrypted in transit and that access keys are rotated automatically every 90 days. You also need to prevent access from public IP addresses. Which combination of configurations should you implement?

Accepted Answer

Enable 'Secure transfer required', configure key rotation policy, and set 'Public network access' to 'Disabled'. Option B is correct because enabling 'Secure transfer required' enforces HTTPS, automatic key rotation can be configured in the storage account settings, and the 'Selected networks' firewall with a deny-all default rule blocks public IPs. Option A is wrong because disabling public network access alone does not enforce HTTPS. Option C is wrong because firewall rules do not enforce HTTPS. Option D is wrong because disabling anonymous access does not enforce HTTPS.

Answer

Configure a network firewall rule to block all traffic, enable 'Secure transfer required', and rotate keys manually every 90 days

Answer

Enable 'Allow trusted Microsoft services', configure key rotation policy, and disable 'Allow storage account key access'

Answer

Enable 'Secure transfer required', configure key rotation policy, and disable 'Allow Blob public access'

Question 13

Your company has a large number of Azure SQL databases that contain personally identifiable information (PII). You need to classify and protect sensitive columns across all databases. The solution must automatically discover and label sensitive data, and enable auditing of access to that data. What should you implement?

Accepted Answer

Data Discovery & Classification. Option D is correct because Azure SQL Database's Data Discovery & Classification automatically discovers sensitive columns, allows labeling, and integrates with auditing and vulnerability assessment. Option A is wrong because Dynamic Data Masking only masks data, it does not classify. Option B is wrong because Always Encrypted encrypts data at rest, but does not classify or audit. Option C is wrong because Microsoft Defender for SQL provides security alerts and vulnerability assessment, but not classification.

Answer

Always Encrypted with secure enclaves

Answer

Microsoft Defender for SQL

Answer

Dynamic Data Masking

Question 14

You need to secure a Linux virtual machine running a web application in Azure. The solution must ensure that only traffic on port 443 (HTTPS) is allowed from the internet, and that SSH access is restricted to a management subnet. What should you configure?

Accepted Answer

Network Security Group (NSG) on the VM NIC with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound. Option A is correct because an NSG with inbound rules that allow HTTPS from any source and SSH only from the management subnet achieves the goal. Option B is wrong because Azure Firewall is more complex and costly than needed. Option C is wrong because a network security group attached to the subnet would affect all VMs. Option D is wrong because Application Security Groups are used for grouping VMs, not for filtering traffic.

Answer

Azure Firewall with application rules to allow HTTPS and SNAT SSH traffic

Answer

Application Security Group with a network security group that allows HTTPS and SSH

Answer

Network Security Group on the subnet with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound

Question 15

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to ensure that only approved container images from a private Azure Container Registry (ACR) can run in the cluster. The solution must also enforce that pods run with least privilege. What should you configure?

Accepted Answer

Apply Azure Policy with built-in initiatives 'Kubernetes cluster containers should only use allowed images' and 'Kubernetes cluster pods should use specified service account'. Option C is correct because Azure Policy for AKS can enforce image source from ACR and restrict pod security policies (via built-in initiatives). Option A is wrong because ACR tasks are for building images, not enforcement. Option B is wrong because Azure AD pod-managed identities are for authentication, not image enforcement. Option D is wrong because Kubernetes network policies control traffic, not image source or privileges.

Answer

Create a Kubernetes NetworkPolicy to restrict pod-to-pod communication and use Secrets for image pull

Answer

Configure ACR tasks to scan images for vulnerabilities and use AKS pod security policies

Answer

Use Azure AD pod-managed identities to authenticate to ACR and assign RBAC roles