AZ-500 Secure compute, storage, and databases Practice Test 17 — 15 Questions

Question 1

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed key. Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Storage accounts. By default, it uses Microsoft-managed keys, but you can configure it to use customer-managed keys (CMK) stored in Azure Key Vault. This ensures that you control the encryption keys and can manage their lifecycle, rotation, and access policies, meeting the requirement for customer-managed key encryption.

Answer

Azure Disk Encryption

Answer

Azure Storage Service Encryption (SSE) with platform-managed key

Answer

Azure Information Protection

Question 2

A company has an Azure SQL Database that contains sensitive financial data. They want to audit all successful and failed login attempts for the database. What should they configure?

Accepted Answer

Azure SQL Database auditing. Azure SQL Database auditing is the correct configuration because it captures both successful and failed login attempts (authentication events) at the database level. Auditing writes these events to an audit log destination (such as Azure Storage, Log Analytics, or Event Hubs), enabling detailed forensic analysis of access patterns. This directly meets the requirement to audit all login attempts for the sensitive financial database.

Answer

SQL Vulnerability Assessment

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 3

Your organization uses Azure Files shares for user home directories. You need to enforce that users access these shares only from trusted locations (corporate IP ranges) and that all access is logged. Which combination of actions should you take?

Accepted Answer

Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.. Azure Files supports network security via storage account firewalls, which can restrict access to specific IP ranges. Enabling diagnostic settings allows sending logs (e.g., to a Log Analytics workspace) for auditing. Option C correctly combines both requirements. Option A is incorrect because Private Endpoints and service endpoints provide network isolation but do not filter by IP source. Option B is incorrect because while a SAS token can include an IP restriction, it is not designed for persistent user access to home directories and complicates management. Option D is incorrect because Microsoft Entra Domain Services and conditional access control authentication but do not enforce network-level IP restrictions.

Answer

Use a Private Endpoint for the storage account and configure a service endpoint on the virtual network.

Answer

Generate a shared access signature (SAS) token that is valid only from corporate IPs and attach it to the file share.

Answer

Assign Azure AD DS to the storage account and enable Azure AD authentication for Azure Files, then configure conditional access policies.

Question 4

You need to ensure that Azure SQL Database automatically detects and alerts on potential SQL injection attacks. Which Microsoft Defender for Cloud plan should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL includes advanced SQL security features such as Vulnerability Assessment, Advanced Threat Protection, and Data Discovery & Classification. Specifically, its Advanced Threat Protection capability uses machine learning models to detect anomalous database activities, including SQL injection attempts, and can trigger alerts or automated responses. Enabling this plan on your Azure SQL Database ensures that potential SQL injection attacks are automatically detected and alerted.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud (free tier)

Answer

Microsoft Defender for App Service

Question 5

You are the security engineer for a healthcare company that uses Azure to store electronic health records (EHR) in Azure Blob Storage. Compliance requires that all data be encrypted at rest with customer-managed keys stored in a hardware security module (HSM), that the storage account be accessible only from a specific virtual network, and that all access to the storage account be logged and sent to a central security information and event management (SIEM) system. Additionally, you must ensure that any blobs containing protected health information (PHI) are automatically labeled with a sensitivity label that prevents them from being shared externally. You have decided to use Azure Key Vault Managed HSM for key storage, Azure Private Endpoint for network access, and Azure Monitor for logging. However, you are unsure how to automatically apply sensitivity labels to blobs based on content inspection. Which service should you use to achieve automatic labeling of PHI data in Azure Blob Storage?

Accepted Answer

Microsoft Purview Information Protection with auto-labeling policies for Azure Blob Storage. Microsoft Purview Information Protection with auto-labeling policies for Azure Blob Storage (option C) is the correct choice because it is the service designed to scan and classify data in Azure Blob Storage using sensitive information types and then automatically apply sensitivity labels that enforce protection such as preventing external sharing. It integrates with the same Microsoft Purview compliance stack that provides sensitivity labels, so labels applied to blobs can carry encryption and sharing restrictions. The other options do not provide native automatic sensitivity labeling: Defender for Storage (A) offers threat detection and can integrate with Purview labeling but does not itself perform content-based auto-labeling, Azure Policy (B) can audit or tag resources but cannot inspect blob content or apply sensitivity labels, and Microsoft Sentinel (D) is a SIEM/SOAR tool for detection and automation, not a data classification and labeling engine.

Answer

Microsoft Defender for Storage with sensitivity labeling integration

Answer

Azure Policy with custom policies to tag blobs containing PHI

Answer

Microsoft Sentinel with analytics rules to detect PHI and apply labels via automation

Question 6

You are designing security for an Azure SQL Database that will store personally identifiable information (PII). The database will be accessed by multiple applications, some of which are legacy and cannot use Azure AD authentication. Your requirements include: encrypting data at rest, encrypting data in transit, and dynamically masking PII columns for non-privileged users. Which THREE features should you implement?

Accepted Answer

Configure Dynamic Data Masking (DDM) for the PII columns.. (Dynamic Data Masking) masks PII columns for non-privileged users. Option C (Minimum TLS Version 1.2) ensures data in transit is encrypted. Option D (Transparent Data Encryption) encrypts data at rest. Option B (Always Encrypted) is client-side and requires client support, not suitable for legacy apps. Option E (Azure Information Protection) is not a database security feature for this scenario.

Answer

Implement Always Encrypted for the PII columns.

Answer

Apply Azure Information Protection labels to the database.

Question 7

Your company is migrating a legacy on-premises application to Azure VMs. The application writes log files to a local folder. You need to collect these logs centrally for security analysis using Microsoft Sentinel. The application runs on Windows Server 2022 and is expected to generate about 50 GB of logs per day. The security team requires that logs be encrypted at rest and in transit, and that log collection has minimal latency. You set up Azure Monitor Agent (AMA) on the VM and configure a Data Collection Rule (DCR) to stream custom logs to a Log Analytics workspace. However, after 24 hours, no custom logs appear in the workspace. The AMA is reporting as healthy. You need to troubleshoot and resolve the issue. What is the most likely cause?

Accepted Answer

The DCR does not include the correct table name for the custom log, or the table does not exist in the Log Analytics workspace.. The DCR must reference the custom log table created in the Log Analytics workspace; if the table name does not match or the table does not exist, logs will not be ingested. Option B: AMA can collect custom logs from a local file path; the path does not need to be a network share. Option C: The log file format is not limited to JSON; AMA can collect plain text logs with a defined pattern. Option D: The agent does not require local admin privileges for custom log collection; it runs as Local System.

Answer

The custom log file path specified in the DCR is a local path, but AMA requires a network share for custom log collection.

Answer

The log file format is not JSON, but AMA only supports custom logs in JSON format.

Answer

The VM does not have local administrator privileges required for the AMA to read the log files.

Question 8

You are the security administrator for a company that uses Azure Blob Storage to store sensitive documents. You need to ensure that all blob data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. You have enabled encryption with CMK on the storage account. However, after a key rotation in Key Vault, you notice that newly uploaded blobs are encrypted with the new key, but existing blobs are still encrypted with the old key. You need to ensure that all blobs are re-encrypted with the new key. What should you do?

Accepted Answer

Re-upload the existing blobs using the new key version by calling the Put Blob operation with the new encryption key.. To ensure all blobs are re-encrypted with the new key, you must trigger a rewrite of the blob data. Re-uploading the existing blobs using the Put Blob operation with the new encryption key forces the storage account to re-encrypt the data using the latest key version from Key Vault. Option A is incorrect because the 'Rewrite' operation does not exist in Azure Blob Storage; you must overwrite the blob to trigger re-encryption. Option B is incorrect because changing the encryption key setting does not retroactively re-encrypt existing blobs; it only applies to new blobs. Option C is incorrect because Azure Storage does not automatically re-encrypt existing blobs when the key is rotated; only new blobs use the new key version.

Answer

Update the storage account's encryption scope to use the new key version and then call the 'Rewrite' operation on each blob.

Answer

Set the storage account encryption to use a different key, then revert to the original key to force re-encryption.

Answer

No action is needed; Azure Storage automatically re-encrypts existing blobs with the new key after rotation.

Question 9

Your organization uses Azure Storage to host sensitive financial data. You need to ensure that all access to the storage account is encrypted in transit and that access keys are rotated automatically every 90 days. You also need to prevent access from public IP addresses. Which combination of configurations should you implement?

Accepted Answer

Enable 'Secure transfer required', configure key rotation policy, and set 'Public network access' to 'Disabled'. It directly satisfies all three requirements: enabling 'Secure transfer required' enforces HTTPS/TLS encryption in transit, configuring a key rotation policy automatically rotates the storage account access keys on a 90-day schedule, and setting 'Public network access' to 'Disabled' blocks access from public IP addresses (forcing private endpoint/private link access). The other options fall short: A relies on manual key rotation and a blanket firewall block rather than automatic rotation, B disables storage account key access (which conflicts with rotating access keys) and does not disable public network access, and C disables only anonymous blob public access, which does not prevent access from public IP addresses.

Answer

Configure a network firewall rule to block all traffic, enable 'Secure transfer required', and rotate keys manually every 90 days

Answer

Enable 'Allow trusted Microsoft services', configure key rotation policy, and disable 'Allow storage account key access'

Answer

Enable 'Secure transfer required', configure key rotation policy, and disable 'Allow Blob public access'

Question 10

You are reviewing an Azure Policy definition. You need to determine the effect of this policy when a user attempts to create a new storage account with 'Secure transfer required' set to 'Disabled'. What happens?

Accepted Answer

The creation request is denied.. The correct answer is B: the creation request is denied. This policy uses a Deny effect, which blocks any request that violates the policy rule—here, creating a storage account with 'Secure transfer required' set to Disabled—so the deployment fails before the resource is provisioned. Option A is wrong because Deny does not remediate or modify the request; auto-enabling would require a Modify or DeployIfNotExists effect. Option C is wrong because generating an audit event corresponds to the Audit effect, which only logs non-compliance without blocking. Option D is wrong because Deny actively prevents the non-compliant creation rather than allowing it silently.

Answer

The storage account is created but 'Secure transfer required' is automatically enabled.

Answer

The creation is allowed but an audit event is generated.

Answer

The creation is allowed and no action is taken.

Question 11

You are a security administrator for a company that stores sensitive data in Azure Blob Storage. You need to ensure that data cannot be accessed from outside the corporate network, even if someone obtains a valid SAS token. The company uses a site-to-site VPN to connect to Azure. What should you configure?

Accepted Answer

Configure storage firewall to allow access only from selected virtual networks and IP ranges.. To restrict blob access to the corporate network, you must configure the storage account firewall to allow only specific virtual networks or IP ranges. This ensures that requests from outside the allowed networks are denied, even if they present a valid SAS token.

Answer

Enable soft delete for blobs.

Answer

Use customer-managed keys (CMK) for encryption at rest.

Answer

Enable Azure Defender for Storage.

Question 12

You are a security administrator for a company that stores sensitive data in Azure Blob Storage. The data must be encrypted at rest with a customer-managed key (CMK) stored in Azure Key Vault, and the key must be automatically rotated every 90 days. You need to configure the storage account to meet these requirements. What should you do?

Accepted Answer

Configure the storage account to use a customer-managed key from Key Vault and set the key rotation policy in Key Vault to 90 days.. To use a customer-managed key for Azure Storage encryption, you must configure the storage account to reference a key in Key Vault. Key Vault's rotation policy can automatically rotate the key on a schedule, and the storage account will use the latest version if configured to do so. This provides automatic key rotation without manual intervention, satisfying the 90-day requirement.

Answer

Use a customer-provided key (CPK) on each blob upload and configure an Azure Automation runbook to rotate the key every 90 days.

Answer

Enable infrastructure encryption on the storage account and set the key rotation policy in Key Vault to 90 days.

Answer

Create a new customer-managed key in Key Vault every 90 days and manually update the storage account to use the new key.

Question 13

You are the Azure Security Engineer for a healthcare company that stores patient imaging data in an Azure Storage account. The compliance team requires that all data written to the account be encrypted with a customer-managed key stored in Azure Key Vault, and that this key be automatically rotated every 12 months. You configure a customer-managed key for the storage account. Which additional configuration must you apply to meet the automatic rotation requirement?

Accepted Answer

In Azure Key Vault, configure a key rotation policy on the customer-managed key that rotates the key every 12 months.. Customer-managed keys for Azure Storage encryption are stored in Azure Key Vault. To automatically rotate the key, you configure a rotation policy on the key itself in Key Vault. The storage account should reference the key without a specific version so that it always uses the latest key version. This native integration ensures seamless rotation without manual intervention or custom scripting.

Answer

Create an Azure Automation runbook that updates the storage account encryption key version every 12 months.

Answer

Enable Azure Defender for Storage and set the key rotation period in the Defender for Cloud security policy.

Answer

In the storage account's encryption settings, set the key rotation interval to 12 months and enable auto-rotation.

Question 14

You are the Azure Security Engineer for a company that uses Azure SQL Database. A recent security audit requires that all connections to the database be encrypted and that the database reject any unencrypted connections. You need to enforce this requirement with the least administrative effort. What should you do?

Accepted Answer

Enable the 'Enforce SSL connection' setting on the Azure SQL Database server.. The 'Enforce SSL connection' setting on the Azure SQL Database server forces all connections to use TLS encryption. When enabled, any attempt to connect without encryption is rejected. This directly satisfies the requirement to encrypt all connections and reject unencrypted ones, and it requires only a single configuration change.

Answer

Configure a firewall rule on the Azure SQL Database server to allow only connections from specific IP addresses.

Answer

Implement Always Encrypted on all sensitive columns in the database.

Answer

Enable Transparent Data Encryption (TDE) on the Azure SQL Database.

Question 15

You are a security engineer for a healthcare company that stores patient records in an Azure Storage account. A compliance requirement mandates that all data in the storage account be encrypted at rest using a key that the company controls and can revoke at any time. The storage account is currently configured with Microsoft-managed keys for encryption. You need to change the encryption key management to meet the compliance requirement. What should you do first?

Accepted Answer

Create an Azure Key Vault and generate a customer-managed key, then configure the storage account to use that key for encryption.. To meet the requirement of encrypting data at rest with a customer-managed key, you must create an Azure Key Vault, generate a key, and configure the storage account to use that key for encryption. This ensures the organization controls the key lifecycle, including revocation. Other options either address different encryption aspects (in-transit) or use Microsoft-managed keys, which do not provide the required control.

Answer

Enable Azure Disk Encryption on the storage account to use customer-managed keys.

Answer

Enable Secure transfer required on the storage account to enforce encryption in transit.

Answer

Configure the storage account to use infrastructure encryption with Microsoft-managed keys.