AZ-500 Secure compute, storage, and databases Practice Test 2 — 15 Questions

Question 1

A company stores sensitive data in Azure Blob Storage. They use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. The security policy requires that the encryption keys be automatically rotated every 90 days. Which configuration should they implement to meet this requirement without manual intervention?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable key auto-rotation in Key Vault by setting a rotation policy on the key.. Azure Key Vault supports automatic key rotation by configuring a rotation policy on the key. When you enable auto-rotation, Key Vault automatically creates a new key version at the specified interval (e.g., every 90 days) without any manual intervention. This directly satisfies the requirement for automatic rotation of customer-managed keys used for Azure Storage encryption at rest.

Answer

Use a custom Azure Automation runbook to rotate the key.

Answer

Set a key expiration date of 90 days and manually renew.

Answer

Enable versioning on the storage account and manually create a new key version.

Question 2

A company stores highly sensitive data in Azure Blob Storage. They require encryption at rest using a customer-managed key. Additionally, they want to ensure that the key can only be used from the same Azure region as the storage account. Which configuration must they implement?

Accepted Answer

Use an Azure Key Vault in the same region as the storage account (keys are region-bound by default).. Azure Key Vault keys are inherently region-bound; when you create a key vault in a specific Azure region, the key material and its cryptographic operations are confined to that region. By placing the key vault in the same region as the storage account, you ensure that the customer-managed key used for Azure Storage Service Encryption (SSE) can only be accessed and used within that region, satisfying the requirement for region-restricted key usage.

Answer

Store the key in a key vault in each region and use a managed identity to access the key vault.

Answer

Use a key stored in an Azure Key Vault with the 'Soft Delete' enabled.

Answer

Use an Azure Key Vault with 'Purge Protection' enabled.

Question 3

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections use at least TLS 1.2 encryption and that connections not meeting this requirement are rejected. Which configuration should they implement on the Azure SQL Server?

Accepted Answer

Set the 'Minimum TLS version' on the SQL server. Azure SQL Server allows you to enforce a minimum TLS version for all client connections. By setting the 'Minimum TLS version' to 1.2, the server will reject any connection attempt using TLS 1.0 or 1.1, ensuring compliance with the security policy that requires at least TLS 1.2 encryption.

Answer

Configure firewall rules to allow only trusted IP addresses

Answer

Enable Transparent Data Encryption (TDE)

Answer

Enable Advanced Threat Protection (ATP)

Question 4

A company stores confidential data in Azure Blob Storage. They need to ensure that all data at rest is encrypted and they must be able to quickly rotate the encryption key on demand in case of a security breach. They also want to minimize administrative overhead. Which encryption option should they use?

Accepted Answer

Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault. Server-side encryption with customer-managed keys (CMK) stored in Azure Key Vault allows the organization to control and rotate the encryption key on demand, meeting the security breach response requirement. This option encrypts data at rest in Azure Blob Storage while minimizing administrative overhead because Azure manages the encryption process, and the customer only manages the key lifecycle in Key Vault.

Answer

Server-side encryption with Microsoft-managed keys

Answer

Client-side encryption

Answer

Azure Disk Encryption

Question 5

A company uses Azure SQL Database and wants to periodically scan the database for vulnerabilities such as misconfigurations, excessive permissions, and missing patches. The scans should generate actionable reports that the security team can use to remediate issues. Which built-in Azure feature should they enable?

Accepted Answer

SQL Vulnerability Assessment. SQL Vulnerability Assessment is the correct choice because it is a built-in Azure SQL Database feature specifically designed to discover, track, and remediate potential database vulnerabilities such as misconfigurations, excessive permissions, and missing patches. It runs periodic scans and generates actionable reports with remediation steps, directly matching the requirement.

Answer

Azure Defender for SQL

Answer

SQL Auditing

Answer

Azure SQL Insights

Question 6

A company stores highly sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a key stored in Azure Key Vault, but they also want to prevent Microsoft Azure from having any access to the encryption key. Which encryption approach should they use?

Accepted Answer

Client-side encryption with a customer-managed key stored in Azure Key Vault. Client-side encryption with a customer-managed key stored in Azure Key Vault is the correct approach because the encryption and decryption operations occur entirely within the client application, using a key that is never exposed to Azure services. This ensures that Microsoft Azure has no access to the encryption key, meeting the requirement to prevent any Azure-side access. In contrast, server-side encryption options like Storage Service Encryption (SSE) with CMK still involve Azure managing the encryption process and having potential access to the key material.

Answer

Azure Storage Service Encryption with customer-managed keys (CMK)

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Question 7

A company generates shared access signature (SAS) tokens to grant time-limited access to blobs in an Azure Storage container. A security administrator needs the ability to immediately revoke all active SAS tokens for that container if a token is compromised. What should they use?

Accepted Answer

Use a stored access policy on the container and reference it in the SAS token.. A stored access policy on the container provides a centralized way to manage permissions for shared access signatures (SAS). By associating the SAS token with the policy, you can immediately revoke all tokens that reference that policy by simply deleting or modifying the policy's permissions or expiry time. This is the only method that allows instant revocation of multiple SAS tokens without waiting for their individual expiry.

Answer

Use a user delegation key to create the SAS token.

Answer

Use an account-level SAS token.

Answer

Use a service-level SAS token with IP address restrictions.

Question 8

A company enables Azure Disk Encryption (ADE) on Windows virtual machines using a key encryption key (KEK) stored in Azure Key Vault. They want the KEK to be automatically rotated every 30 days to meet compliance requirements. Which Azure Key Vault feature should they enable?

Accepted Answer

Key rotation policy. A key rotation policy in Azure Key Vault allows you to define automatic rotation rules for keys, including a rotation interval (e.g., every 30 days) and a rotation time window. This feature ensures that the KEK is automatically replaced with a new key version at the specified interval without manual intervention, meeting compliance requirements for periodic key rotation.

Answer

Key expiration date

Answer

Soft-delete

Answer

Purge protection

Question 9

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections to the database use at least TLS 1.2 encryption. What configuration change must be made to enforce this requirement?

Accepted Answer

Configure the minimum TLS version in the SQL server's settings.. To enforce that all client connections to Azure SQL Database use at least TLS 1.2, you must configure the minimum TLS version at the SQL server level. This setting overrides the default behavior, which allows older, less secure TLS versions, and ensures that any connection attempt using TLS 1.0 or 1.1 is rejected. The configuration is made in the Azure portal under the SQL server's 'Connectivity' settings or via the 'Minimal TLS Version' property in ARM templates or PowerShell.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Update the server firewall rules to allow only specific IP addresses.

Answer

Implement Always Encrypted for all sensitive columns.

Question 10

A storage account contains legal evidence that must not be modified or deleted for seven years. Which feature should be configured?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) is the correct choice because it enforces a strict seven-year retention period during which blobs cannot be modified or deleted, even by account administrators. This is achieved through a policy that locks the data at the storage level, ensuring compliance with legal hold requirements for evidence preservation.

Answer

Soft delete only

Answer

Lifecycle management to archive tier

Answer

Customer-managed keys

Question 11

An Azure SQL Database contains salary data. Support analysts need to query employee records but must not see full salary values. Which feature is most appropriate when the application cannot be changed immediately?

Accepted Answer

Dynamic data masking. Dynamic data masking (DDM) is the correct choice because it obfuscates sensitive data in query results without modifying the underlying database or requiring application changes. The support analysts can still query employee records, but the salary column is masked according to a defined masking rule (e.g., showing only the last four digits or replacing with zeros). This meets the requirement of preventing full salary exposure while the application remains unchanged.

Answer

Transparent Data Encryption

Answer

Geo-replication

Answer

Accelerated database recovery

Question 12

A Kubernetes workload in AKS needs to pull images from Azure Container Registry without using admin credentials. Which configuration should be used?

Accepted Answer

Grant the AKS kubelet identity AcrPull on the registry. The AKS cluster uses a kubelet identity (managed identity) to authenticate with ACR. By granting the AcrPull role to this identity, the kubelet can pull container images without requiring admin credentials, as Azure RBAC handles the authentication via Azure AD tokens. This is the recommended secure method for image pull operations.

Answer

Enable anonymous pull access on the registry

Answer

Store the ACR admin password in a ConfigMap

Answer

Expose the registry through a public load balancer

Question 13

A storage account contains regulated records. Which two features help protect against accidental or malicious deletion?

Accepted Answer

Blob soft delete and versioning. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period, allowing recovery. Versioning preserves previous versions of blobs, enabling restoration to an earlier state if malicious overwrites or deletions occur. Together, they provide a layered defense against both accidental and intentional data loss.

Answer

Disabling all encryption

Answer

Public container access

Question 14

An AKS cluster must reduce risk from untrusted container images. Which two controls are most appropriate?

Accepted Answer

Scan container images for vulnerabilities before deployment. Scanning container images for vulnerabilities before deployment ensures that known security issues are identified and remediated before the images run in the cluster. This is a critical preventive control that directly reduces the risk of exploiting vulnerabilities in untrusted images. Azure Security Center and Azure Defender for container registries can automatically scan images in ACR and provide actionable findings.

Answer

Enable anonymous image pulls

Answer

Store Kubernetes secrets in plain text ConfigMaps

Question 15

A SQL workload needs to protect sensitive column values from database administrators who should not see plaintext. Which two features may be relevant depending on the query requirement?

Accepted Answer

Always Encrypted. Always Encrypted (Option A) is correct because it ensures that sensitive column data is encrypted at the client side and never exposed in plaintext to the database engine, preventing database administrators from viewing the actual values. This feature protects data at rest and in transit between the client and server, making it ideal for scenarios where DBAs should not see plaintext column values.

Answer

Transparent Data Encryption only

Answer

Basic server firewall rule