AZ-500 Secure compute, storage, and databases Practice Test 2 — 15 Questions

Question 1

A company stores highly sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a key stored in Azure Key Vault, but they also want to prevent Microsoft Azure from having any access to the encryption key. Which encryption approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Client-side encryption with a customer-managed key stored in Azure Key Vault. Client-side encryption with a customer-managed key stored in Azure Key Vault is the correct approach because the encryption and decryption operations occur entirely within the client application, using a key that is never exposed to Azure services. This ensures that Microsoft Azure has no access to the encryption key, meeting the requirement to prevent any Azure-side access. In contrast, server-side encryption options like Storage Service Encryption (SSE) with CMK still involve Azure managing the encryption process and having potential access to the key material.

Answer

Azure Storage Service Encryption with customer-managed keys (CMK)

Answer

Azure Disk Encryption

Answer

Azure Information Protection

Question 2

A storage account contains regulated records. Which two features help protect against accidental or malicious deletion?

Accepted Answer

Blob soft delete and versioning. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period, allowing recovery. Versioning preserves previous versions of blobs, enabling restoration to an earlier state if malicious overwrites or deletions occur. Together, they provide a layered defense against both accidental and intentional data loss.

Answer

Disabling all encryption

Answer

Public container access

Question 3

An AKS cluster must reduce risk from untrusted container images. Which two controls are most appropriate?

Accepted Answer

Scan container images for vulnerabilities before deployment. Scanning container images for vulnerabilities before deployment ensures that known security issues are identified and remediated before the images run in the cluster. This is a critical preventive control that directly reduces the risk of exploiting vulnerabilities in untrusted images. Azure Security Center and Azure Defender for container registries can automatically scan images in ACR and provide actionable findings.

Answer

Enable anonymous image pulls

Answer

Store Kubernetes secrets in plain text ConfigMaps

Question 4

A SQL workload needs to protect sensitive column values from database administrators who should not see plaintext. Which two features may be relevant depending on the query requirement?

Accepted Answer

Always Encrypted. Always Encrypted (Option A) is correct because it ensures that sensitive column data is encrypted at the client side and never exposed in plaintext to the database engine, preventing database administrators from viewing the actual values. This feature protects data at rest and in transit between the client and server, making it ideal for scenarios where DBAs should not see plaintext column values.

Answer

Transparent Data Encryption only

Answer

Basic server firewall rule

Question 5

You are designing a secure storage strategy for an Azure Storage account that will host sensitive financial data. The solution must protect data at rest, in transit, and during processing. Which three of the following security controls should you implement? (Choose three.)

Accepted Answer

Configure Azure Storage firewalls and virtual network service endpoints to restrict network access.. Customer-managed keys (CMK) in Azure Key Vault provide an additional layer of protection for data at rest by allowing you to control the encryption keys used by Azure Storage. Azure Defender for Storage detects anomalous access patterns and potential threats, protecting data during processing. Configuring firewalls and virtual network service endpoints restricts network access, securing data in transit by ensuring only trusted networks can communicate with the storage account.

Answer

Enable Azure Storage analytics logging with retention set to 90 days.

Answer

Configure a shared access signature (SAS) token with full account-level permissions for each user.

Answer

Use Azure Traffic Manager to distribute storage requests across multiple regions.

Question 6

Your company plans to deploy a set of Azure virtual machines (VMs) running a critical application. The security team requires that all operating system disks and temporary disks be encrypted, and that encryption keys are never stored in Azure but are managed in an on-premises HSM. Which three of the following actions should you take? (Choose three.)

Accepted Answer

Create a Key Vault access policy that grants the Azure Disk Encryption service principal the 'Wrap Key' and 'Unwrap Key' permissions.. The requirement that encryption keys never be stored in Azure and be managed in an on-premises HSM cannot be fully met with Azure Disk Encryption (ADE) alone, as ADE relies on Azure Key Vault for key storage. However, among the given options, the only actions that avoid storing keys in Azure are: using a passphrase-only approach (which stores the passphrase locally on the VM, not in Azure), enabling encryption at host (which uses platform-managed keys stored in Azure, but the question's requirement is about customer-managed keys; this option avoids using Azure Key Vault for customer keys), and setting the Key Vault firewall to allow only trusted Microsoft services (which prevents external access but does not store keys). These three actions, when combined, minimize key exposure to Azure and align with the intent of keeping keys off Azure, though they do not satisfy the on-premises HSM requirement directly.

Answer

Deploy the VMs with Azure Premium SSD managed disks and enable encryption at host.

Answer

Set the Key Vault firewall to allow only trusted Microsoft services to access the vault.

Answer

Configure the VMs to use Azure Disk Encryption with a passphrase-only approach (no KEK).

Question 7

You are securing an Azure SQL Database that contains personally identifiable information (PII). The solution must prevent unauthorized access to sensitive columns by privileged users (e.g., DBAs) and ensure that data is encrypted on the wire. Which three of the following should you implement? (Choose three.)

Accepted Answer

Enforce the use of TLS 1.2 or higher for all client connections to the database.. Option B (Enable Always Encrypted with column-level encryption for the sensitive PII columns) is correct because Always Encrypted keeps encryption keys outside the database engine, so even privileged users such as DBAs cannot decrypt the protected PII columns; the client driver performs encryption/decryption, which directly satisfies the requirement to prevent privileged users from accessing sensitive data. Option C (Configure the Azure SQL Database firewall to block all public endpoints and allow only specific virtual network subnets) is correct because restricting access to private VNet subnets via service endpoints or private link removes exposure to the public internet and limits which network sources can reach the database, reducing unauthorized access paths. Option E (Enforce the use of TLS 1.2 or higher for all client connections to the database) is correct because Azure SQL Database encrypts data in transit using TLS, and enforcing a minimum of TLS 1.2 ensures data is encrypted on the wire as required. Option A (TDE with customer-managed keys) is not correct here because TDE encrypts data at rest and does not prevent privileged DBAs from reading decrypted column values, so it does not meet the privileged-user access requirement. Option D (Auditing with 90-day retention) is not correct because auditing only records activity and does not prevent access or encrypt data on the wire. Option F (a role with SELECT on all tables granted to the DBA group) is not correct because it explicitly grants broad read access to the DBA group, which is the opposite of the stated requirement.

Answer

Create a database role with SELECT permissions on all tables and grant it to the DBA group.

Answer

Enable Azure SQL Database Auditing and set a retention policy of at least 90 days.

Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.

Question 8

Your organization is planning to use Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) for running containerized workloads. The security policy mandates that container images be scanned for vulnerabilities, secrets never be stored in image layers, and network traffic between containers be encrypted. Which three of the following should you implement? (Choose three.)

Accepted Answer

Integrate Azure Container Registry (ACR) with Microsoft Defender for Containers to scan images on push.. Integrating ACR with Microsoft Defender for Containers enables vulnerability scanning of container images at rest and on push, ensuring images are free from known vulnerabilities before deployment. This directly addresses the mandate to scan images for vulnerabilities.

Answer

Store all secrets as Kubernetes Secrets and reference them in the container image definition.

Answer

Enable Azure Policy for AKS to enforce that containers run with privileged access.

Answer

Deploy ACI containers with a public IP address and rely on network security groups for encryption.

Question 9

You are a Security Engineer for a company that is migrating critical workloads to Azure. You need to ensure the security of compute, storage, and databases. Which of the following actions should you take? (Choose four.)

Accepted Answer

Enable Azure Defender for Storage to detect anomalies and potential threats to your blob storage, Azure Files, and Data Lake Storage.. Option A is correct because configuring a storage account firewall to allow only specific virtual networks and trusted Azure services enforces network-level least-privilege access to storage, blocking public/anonymous access paths. Option C is correct because Azure Defender for SQL (Microsoft Defender for SQL) provides advanced threat protection, security alerts, and vulnerability assessment for Azure SQL databases, directly securing the database tier. Option D is correct because Azure Disk Encryption encrypts managed disks at rest using BitLocker for Windows and DM-Crypt for Linux, protecting compute data even if the underlying media is compromised. Option E is correct because Azure Defender for Storage detects anomalous access and potential threats across Blob Storage, Azure Files, and Data Lake Storage, adding detection to the storage tier. Option B is not appropriate because Azure Front Door WAF protects HTTP/HTTPS applications at the edge, not virtual machines directly, and does not secure VM operating systems. Option F is incorrect because disabling soft delete removes a critical recovery control; backups should retain soft delete to protect against accidental or malicious deletion.

Answer

Use Azure Backup for virtual machines without enabling soft delete to ensure immediate permanent deletion of backup data.

Answer

Implement Azure Front Door WAF policies to protect against SQL injection and cross-site scripting attacks on virtual machines.

Question 10

Match each Azure RBAC role to its typical permission scope.

Accepted Answer

Owner: Full access to all resources including the ability to assign roles.. The correct matches are: Owner with full access and role assignment, Contributor with full management but no access control, Reader with read-only view, and User Access Administrator with user access management. Common confusions include swapping Owner and Contributor definitions.

Answer

Owner: Can create and manage all types of Azure resources but cannot grant access.

Answer

Contributor: Full access to all resources including the ability to assign roles.

Question 11

Match each Azure Key Vault feature to its purpose.

Accepted Answer

Soft-delete: Allows recovery of deleted vaults and objects for a configurable retention period.. Key Vault features: Soft-delete allows recovery, Purge protection prevents permanent deletion, and Key rotation automates key renewal. Common confusions include swapping Soft-delete and Purge protection, or confusing Key rotation with access control.

Answer

Soft-delete: Prevents permanent deletion of vaults and objects even after the soft-delete period.

Answer

Purge protection: Allows recovery of deleted vaults and objects for a configurable retention period.

Answer

Key rotation: Controls access to keys using Azure RBAC.

Question 12

Match each Azure encryption concept to its description.

Accepted Answer

Azure Storage Service Encryption: Encrypts data at rest in Azure Blob and File storage.. Correct matches: Azure Storage Service Encryption (data at rest in storage), Azure Disk Encryption (VM disks via BitLocker/DM-Crypt), Azure Key Vault (key & secret management), Azure SQL TDE (database at rest). Common confusions: Key Vault vs. ADE roles, and SSE scope (at rest vs. in transit).

Answer

Azure Key Vault: Encrypts virtual machine disks.

Answer

Azure Storage Service Encryption: Encrypts data in transit for Azure Storage.

Question 13

Your company runs a critical application on Azure Virtual Machines. You need to ensure that the OS disks and data disks are encrypted to meet compliance requirements. The solution must use Azure Key Vault to store encryption keys and support automated backup. What should you implement?

Accepted Answer

Azure Disk Encryption (ADE). Azure Disk Encryption (ADE) uses BitLocker (Windows) or DM-Crypt (Linux) to provide volume-level encryption for OS and data disks. It integrates with Azure Key Vault to store and control encryption keys and secrets, and it supports automated backup because encrypted disks can be backed up using Azure Backup without additional configuration. This directly meets the compliance requirement for encrypting both OS and data disks with key management in Key Vault.

Answer

Azure Backup with encryption using platform-managed keys

Answer

Azure Confidential Computing

Answer

Azure Storage Service Encryption (SSE)

Question 14

You need to ensure that an Azure Storage account is accessible only from a specific virtual network (VNet) and only over HTTPS. You also want to deny access from any public IP. What should you configure?

Accepted Answer

Configure storage firewall rules to deny all public IPs, add the VNet as a service endpoint, and enable 'Secure transfer required' (HTTPS).. It combines three essential controls: storage firewall rules explicitly deny all public IP traffic, a service endpoint for the specific VNet allows only traffic from that virtual network, and enabling 'Secure transfer required' enforces HTTPS for all requests. This configuration ensures the storage account is accessible exclusively from the designated VNet over HTTPS, blocking any public internet access.

Answer

Generate a SAS token and require HTTPS.

Answer

Configure a Network Security Group (NSG) on the subnet to deny all inbound traffic.

Answer

Configure a private endpoint for the storage account and disable public network access.

Question 15

You are designing a backup strategy for Azure Virtual Machines. Which THREE features should you enable to ensure recoverability and security?

Accepted Answer

Soft delete for backup data. Azure Backup (B) is the foundational Azure service that provides VM backup and restore capabilities, so it must be enabled to make any recoverability strategy functional. Soft delete for backup data (A) is correct because it retains deleted or expired recovery points for an additional 14 days by default, protecting against accidental or malicious deletion of backups (ransomware scenarios). Encryption at rest using Azure Disk Encryption (E) is correct because it secures VM OS and data disks with BitLocker (Windows) or DM-Crypt (Linux) backed by Azure Key Vault, satisfying the security requirement. Geo-redundant storage (C) is not a feature you enable per se for VM backup recoverability in this context, and Azure Site Recovery (D) is a disaster-recovery replication/orchestration service rather than a backup feature, so neither belongs among the three required selections.

Answer

Geo-redundant storage (GRS)

Answer

Azure Site Recovery