AZ-500 Secure compute, storage, and databases Practice Test 2 — 15 Questions

Question 1

A company has an Azure SQL Database server. They want to allow an Azure Function with a system-assigned managed identity to access the database by using Azure Active Directory (Azure AD) authentication. Which two configurations are required to grant this access? (Choose two.)

Accepted Answer

Assign the managed identity the 'db_datareader' role in the database.. Option A is correct because assigning the managed identity the 'db_datareader' role in the database grants it read permissions on all tables and views, which is a common requirement for an Azure Function accessing data. Option B is correct because a contained database user must be created for the managed identity in the SQL database, mapping the Azure AD identity to a database principal that can be granted permissions. Without this contained user, the managed identity cannot authenticate to the database via Azure AD.

Answer

Add the managed identity as an Azure AD admin for the SQL server.

Answer

Enable Azure AD-only authentication on the SQL server.

Question 2

An AKS cluster needs to pull container images from a private Azure Container Registry (ACR). The security policy requires that the AKS cluster identity should not have direct access to the ACR; instead, a service principal with the AcrPull role should be used, with credentials stored as a Kubernetes secret. Which authentication method should be configured on the AKS cluster?

Accepted Answer

Kubernetes pull secret using a service principal. The correct answer is C because the scenario explicitly requires that the AKS cluster identity not have direct access to ACR, and instead mandates using a service principal with AcrPull role whose credentials are stored as a Kubernetes secret. A Kubernetes pull secret of type 'docker-registry' stores the service principal's client ID and client secret, which kubelet uses to authenticate to ACR when pulling images. This method decouples the AKS cluster's managed identity from ACR access, satisfying the security policy.

Answer

AKS managed identity

Answer

ACR admin account

Answer

Azure AD pod identity

Question 3

A healthcare organization stores sensitive patient data in Azure SQL Database. They need to encrypt specific columns containing medical history so that even database administrators with highly privileged roles, such as 'sysadmin', cannot view the plaintext data. Additionally, they need to support complex queries on the encrypted data, including pattern matching and range comparisons. Which encryption technology should they implement?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves is correct because it encrypts specific columns at the client side, ensuring that even database administrators with sysadmin privileges cannot view the plaintext data. The secure enclave feature allows computations (such as pattern matching and range comparisons) to be performed on the encrypted data inside a trusted execution environment, which is required by the question's need for complex queries on encrypted columns.

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Answer

Row-Level Security

Question 4

A company wants to enable Azure Disk Encryption (ADE) on their Windows virtual machines using a Key Encryption Key (KEK) stored in Azure Key Vault. They have created the Key Vault with soft-delete enabled and a key. However, the encryption fails. What is the most likely missing configuration that prevents ADE from using the KEK?

Accepted Answer

The Key Vault does not have the 'Azure Disk Encryption for Azure VMs' access policy.. Azure Disk Encryption (ADE) requires the Key Vault to have an explicit access policy granting the 'Azure Disk Encryption for Azure VMs' service principal (or the equivalent Azure RBAC role) permission to wrap and unwrap keys. Without this policy, the ADE extension cannot use the KEK to protect the encryption keys, even if the Key Vault itself is correctly configured with soft-delete and a key.

Answer

The Key Vault does not allow access from the Azure platform.

Answer

The Key Vault firewall is enabled and blocking access from Azure services.

Answer

The Key Vault does not have the system-assigned managed identity of the VM enabled.

Question 5

A company uses Azure Key Vault to store secrets for their applications. They want to ensure that an application hosted on an Azure virtual machine can access secrets from only a specific Key Vault, and that all traffic between the VM and Key Vault remains within the Azure network and does not traverse the public internet. Which configuration should they implement?

Accepted Answer

Create a private endpoint for Key Vault in the same VNet as the VM and disable public network access on the Key Vault.. Option A is correct because it combines a private endpoint for Azure Key Vault with disabling public network access. A private endpoint assigns a private IP address from the VM's VNet to the Key Vault, ensuring all traffic stays within the Microsoft Azure backbone network and never traverses the public internet. Disabling public network access on the Key Vault firewall then blocks any attempts to access the vault via its public endpoint, enforcing that only traffic through the private endpoint is allowed.

Answer

Enable the Key Vault firewall and add the VM's public IP address to the allowed list.

Answer

Use a service endpoint for Key Vault on the VM's subnet, and assign a managed identity to the VM.

Answer

Assign a system-assigned managed identity to the VM and grant it access to the Key Vault.

Question 6

A company is enabling Azure Disk Encryption (ADE) on Windows virtual machines. They have enabled soft-delete on Azure Key Vault and configured a Key Encryption Key (KEK). However, the disk encryption fails with an error indicating that the key vault does not have the required permissions. What is the most likely missing configuration?

Accepted Answer

The Key Vault access policy does not grant the Azure Disk Encryption service principal the 'unwrap key' and 'wrap key' permissions.. Azure Disk Encryption (ADE) requires the Azure Disk Encryption service principal (also known as the Azure Disk Encryption service) to have 'unwrap key' and 'wrap key' permissions on the Key Vault. These permissions allow the service to encrypt and decrypt the disk encryption keys using the Key Encryption Key (KEK). Without these specific cryptographic permissions, the encryption operation fails, even if soft-delete and a KEK are correctly configured.

Answer

The Key Vault firewall is blocking the Azure platform.

Answer

The VM does not have a managed identity assigned.

Answer

The KEK is in a different Azure region than the VM.

Question 7

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall that denies all public access. The SQL server must be able to access the key for TDE operations. Which additional configuration is necessary in the Key Vault to allow this?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.. Option C is correct because when Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

Answer

Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.

Answer

Enable soft-delete on the Key Vault.

Answer

Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.

Question 8

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall and virtual network service endpoints. The storage account used for TDE logs is in the same Azure region. What additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for TDE operations?

Accepted Answer

Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings.. Azure SQL Database uses TDE with a customer-managed key stored in Key Vault. When the Key Vault has a firewall enabled, Azure SQL Database must be able to bypass that firewall to access the key. Enabling 'Allow trusted Microsoft services to bypass this firewall' is required because Azure SQL Database is a trusted Microsoft service that needs to reach the Key Vault endpoint for TDE operations, even when the firewall blocks public network access.

Answer

Disable public network access on the Key Vault.

Answer

Add the SQL Database server's system-assigned managed identity to the Key Vault access policy.

Answer

Enable soft-delete on the Key Vault.

Question 9

A company uses Azure Blob Storage to store archival data that is rarely accessed. The security policy requires that the data must be encrypted at rest using a unique Microsoft-managed key per storage account, and the data must be stored cost-effectively while allowing retrieval within 15 minutes. Which storage account type and encryption configuration should they choose?

Accepted Answer

General-purpose v2 account with Cool access tier and default encryption. Option C is correct because a General-purpose v2 (GPv2) storage account supports the Cool access tier, which is cost-effective for rarely accessed data, and uses default Microsoft-managed encryption keys (SSE) that are unique per storage account. The Cool tier allows data retrieval within minutes (typically under 15 minutes for blob rehydration), meeting the recovery time objective.

Answer

BlockBlobStorage account with infrastructure encryption

Answer

BlobStorage account with Hot access tier and default encryption

Answer

General-purpose v1 account with Archive access tier and default encryption

Question 10

A company stores sensitive financial records in Azure Blob Storage. They want to ensure that if a blob is deleted or overwritten, it can be recovered within 30 days. They also want to protect against accidental deletion of the storage account itself. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Blob soft delete (Option A) protects individual blobs by retaining deleted or overwritten blobs for a specified retention period, allowing recovery within that window. Storage account soft delete (Option B) protects the entire storage account from accidental deletion by retaining the deleted account for a configurable period. Together, they address both the blob-level and account-level recovery requirements for the 30-day window.

Answer

Enable container soft delete with a retention period of 30 days

Answer

Enable blob versioning

Question 11

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

Accepted Answer

No, Azure does not support CMK from a different region than the storage account.. Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.

Answer

Yes, but the storage account must use a different key vault per region; no other implications.

Answer

Yes, but you must enable cross-region replication for the key vault and pay additional costs.

Answer

Yes, but you must use a managed identity from the storage account's region to access the key vault.

Question 12

A company stores business records in Azure Blob Storage. Due to a legal investigation, they must prevent any modification or deletion of the blobs for an indefinite period until the legal hold is released. They also need to ensure that even storage account owners cannot alter the data during the hold. Which blob storage feature should they enable?

Accepted Answer

Legal hold. Legal hold (option B) is the correct choice because it is designed to protect blobs from any modification or deletion for an indefinite period, even by storage account owners. Unlike time-based retention policies, a legal hold has no expiration and cannot be removed until explicitly cleared by an authorized user, making it ideal for indefinite legal investigations.

Answer

Time-based retention policy

Answer

Soft delete

Answer

Blob versioning

Question 13

A company uses Azure Blob Storage to store sensitive documents. The security policy requires that the storage account can only be accessed from a specific Azure virtual network (VNet) and that all access must use Azure Active Directory (Azure AD) authentication. They want to block any access that uses storage account keys or shared access signatures (SAS). Which configuration should they implement?

Accepted Answer

Configure the storage account firewall to allow access from the specific VNet, and disable 'Allow storage account key access'.. Option A is correct because it combines two essential controls: the storage account firewall restricts access to only the specified VNet, and disabling 'Allow storage account key access' enforces Azure AD authentication by blocking all requests that use account keys or SAS tokens. This ensures that only authenticated Azure AD identities from the allowed VNet can access the storage account, meeting the security policy requirements.

Answer

Configure a private endpoint for the storage account and disable 'Allow storage account key access'.

Answer

Configure the storage account firewall to deny all networks, and set 'Allow storage account key access' to 'Disabled'.

Answer

Configure the storage account firewall to allow access from the specific VNet, and enable 'Require secure transfer' (HTTPS only).

Question 14

A company has an Azure SQL Database that stores personally identifiable information (PII) in columns. They need to encrypt those columns so that only authorized applications can decrypt the data, and even database administrators cannot view the plaintext. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they use?

Accepted Answer

Always Encrypted with deterministic encryption. Always Encrypted with deterministic encryption is the correct choice because it encrypts PII columns at the client side, ensuring that even database administrators cannot view plaintext data. Deterministic encryption generates the same ciphertext for the same plaintext, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting the requirement for query support.

Answer

Always Encrypted with randomized encryption

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 15

A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?

Accepted Answer

Enable Azure Storage encryption with customer-managed keys (CMK). Option A is correct because enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.

Answer

Use service-managed keys (SSE) with platform-managed keys

Answer

Enable Azure Disk Encryption on VMs that access the storage account

Answer

Configure Azure Information Protection for the storage account