AZ-500 Secure compute, storage, and databases Practice Test 3 — 15 Questions

Question 1

A company enabled Azure Disk Encryption on Windows virtual machines using Azure Key Vault to store encryption keys. They have enabled soft-delete and purge protection on the Key Vault. After a user accidentally deletes a key, the company tries to recover it but the recovery operation fails. What is the most likely reason for the recovery failure?

Accepted Answer

The key vault firewall is blocking access from the VM's virtual network.. The key recovery operation fails because the Key Vault firewall is blocking the recovery request from the VM's virtual network. Even though soft-delete and purge protection are enabled, the firewall rules prevent the VM from communicating with the Key Vault to perform the recovery. The recovery operation requires network access to the Key Vault endpoint, and if the firewall is configured to deny traffic from the VM's subnet, the operation will fail.

Answer

The key vault is in a different Azure region than the VM.

Answer

The key was not created with soft-delete enabled.

Answer

The VM's managed identity does not have 'Key Vault Crypto Service Encryption User' permission.

Question 2

A company has an Azure Storage account with infrastructure encryption enabled. They configure the storage account to use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. Despite this configuration, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

The storage account's encryption type is set to Microsoft-managed keys. Option C is correct because the storage account's encryption type must be explicitly set to 'Customer-managed keys' to use CMK from Azure Key Vault. If the encryption type remains at the default 'Microsoft-managed keys', newly uploaded blobs will continue to be encrypted with Microsoft-managed keys regardless of the CMK configuration in Key Vault. Infrastructure encryption is a separate feature that encrypts data at the hardware level and does not affect the key management type.

Answer

The storage account was created before infrastructure encryption was generally available

Answer

The customer-managed key in Key Vault is disabled or expired

Answer

The blob container has a policy that overrides the encryption setting

Question 3

A company is migrating a sensitive database to Azure SQL Managed Instance. The security team requires that the managed instance is not accessible from the public internet and that only specific Azure services, such as Azure Data Factory, can connect. Which configuration should the team implement to meet these requirements?

Accepted Answer

Configure a private endpoint for the Azure SQL Managed Instance.. Option A is correct because configuring a private endpoint for Azure SQL Managed Instance places the instance within a virtual network, making it inaccessible from the public internet. Private endpoints use a private IP address from the VNet, and by combining this with disabling public network access, only traffic from within the VNet or from peered networks can reach the instance. To allow specific Azure services like Azure Data Factory to connect, you can use a managed private endpoint in Data Factory that targets the SQL Managed Instance's private endpoint, ensuring secure, private connectivity without exposing the instance to the internet.

Answer

Use a virtual network service endpoint and disable public network access.

Answer

Configure firewall rules to allow only the IP ranges of Azure Data Factory and deny all other traffic.

Answer

Apply a service tag for Azure SQL Managed Instance in the virtual network NSG.

Question 4

A company deploys a public-facing web application behind Azure Application Gateway. They want to enable the Web Application Firewall (WAF) to protect against SQL injection and cross-site scripting attacks. During the initial testing phase, they want to identify malicious requests without blocking them, to tune the WAF rules before enabling full protection. Which WAF mode should they configure?

Accepted Answer

Detection mode. Detection mode logs WAF alerts and records the full request details without blocking any traffic. This allows the security team to analyze malicious requests, tune rule exclusions, and validate that legitimate traffic is not falsely flagged before switching to Prevention mode. It is the correct choice for the initial testing phase described.

Answer

Prevention mode

Answer

Logging mode

Answer

Off

Question 5

A company stores sensitive healthcare data in Azure SQL Database. They need to encrypt specific columns containing patient diagnosis codes so that even database administrators with the 'sysadmin' role cannot view the plaintext. The application must be able to perform equality searches (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

Accepted Answer

Always Encrypted (deterministic encryption). Always Encrypted with deterministic encryption ensures that sensitive columns are encrypted at the client side, so the encryption keys are never revealed to the database engine, including sysadmin roles. Deterministic encryption generates the same ciphertext for the same plaintext, enabling equality searches (WHERE clauses) on encrypted columns without exposing plaintext data to the server.

Answer

Transparent Data Encryption (TDE)

Answer

Row-Level Security (RLS)

Answer

Dynamic Data Masking (DDM)

Question 6

A company stores sensitive data in Azure Blob Storage. They use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. The security policy requires that the encryption keys be automatically rotated every 90 days. Which configuration should they implement to meet this requirement without manual intervention?

Accepted Answer

Enable key auto-rotation in Key Vault by setting a rotation policy on the key.. Azure Key Vault supports automatic key rotation by configuring a rotation policy on the key. When you enable auto-rotation, Key Vault automatically creates a new key version at the specified interval (e.g., every 90 days) without any manual intervention. This directly satisfies the requirement for automatic rotation of customer-managed keys used for Azure Storage encryption at rest.

Answer

Use a custom Azure Automation runbook to rotate the key.

Answer

Set a key expiration date of 90 days and manually renew.

Answer

Enable versioning on the storage account and manually create a new key version.

Question 7

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

Accepted Answer

Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.. Option B is correct because deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Answer

Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.

Answer

Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.

Answer

Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.

Question 8

A company enables Azure SQL Database auditing to log database events to a storage account. The security policy requires that the audit logs be protected from tampering and deletion after they are written. Which storage account feature should the company enable to ensure that audit log files cannot be modified or deleted by anyone for a specified retention period?

Accepted Answer

Immutable storage. Immutable storage for Azure Blob Storage provides a WORM (Write Once, Read Many) policy that prevents audit log files from being modified or deleted by any user, including administrators, for a specified retention period. This directly meets the security requirement to protect audit logs from tampering and deletion after they are written.

Answer

Soft delete

Answer

Hierarchical namespace

Answer

Firewall and virtual networks

Question 9

A company stores critical business data in an Azure Storage account (Blob Storage). They want to ensure that all data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data quickly if a breach is suspected. Which feature should they enable on the storage account to enforce CMK?

Accepted Answer

Enable Azure Storage encryption with customer-managed keys. Option B is correct because enabling Azure Storage encryption with customer-managed keys (CMK) allows you to use your own key stored in Azure Key Vault to encrypt all data at rest in the storage account. This also provides the ability to revoke access to the data quickly by disabling, deleting, or rotating the key in Key Vault, which renders the data inaccessible until the key is restored.

Answer

Enable infrastructure encryption for the storage account

Answer

Enable soft delete for blobs

Answer

Enable versioning for blobs

Question 10

A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?

Accepted Answer

Blob Storage change feed.. The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.

Answer

Azure Blob Storage soft delete.

Answer

Azure Blob Storage versioning.

Answer

Azure Storage analytics logs.

Question 11

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key stored in Azure Key Vault. The Key Vault is configured with a firewall that denies all public access. The SQL server must be able to access the key. What additional configuration is necessary?

Accepted Answer

Enable trusted Microsoft services on the Key Vault firewall. When Azure Key Vault's firewall denies all public access, enabling 'Allow trusted Microsoft services' is necessary because Azure SQL Database's TDE key retrieval is considered a trusted service operation. This setting bypasses the firewall for specific Azure services like SQL Database that are authenticated and authorized to access the vault, without requiring a private endpoint or service endpoint.

Answer

Create a private endpoint for Key Vault

Answer

Assign the SQL server's managed identity to the Key Vault

Answer

Configure a service endpoint on the SQL server

Question 12

A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?

Accepted Answer

Set the key vault's 'enabledForDiskEncryption' property to true.. Option B is correct because Azure Disk Encryption requires the key vault's 'enabledForDiskEncryption' property to be set to true. This property explicitly authorizes the Azure platform (specifically the Azure Disk Encryption service) to access the Key Encryption Key (KEK) stored in the vault for encrypting VM disks. Without this flag, the platform cannot retrieve the KEK, even if other permissions exist.

Answer

Grant the Azure Disk Encryption service principal 'Reader' role on the key vault.

Answer

Grant the virtual machine's managed identity 'Contributor' role on the key vault.

Answer

Configure soft-delete and purge protection on the key vault.

Question 13

A company uses Azure Key Vault to store keys and secrets. They want to ensure that even if an administrator accidentally deletes a key, it can be recovered for up to 90 days. Additionally, they want to prevent anyone from permanently purging the key during that period. Which two features must be enabled?

Accepted Answer

Soft-delete and purge protection. Soft-delete must be enabled to retain a deleted key for a configurable retention period (default 90 days), allowing recovery. Purge protection must be enabled to prevent permanent deletion (purging) of the key during that retention period, even by administrators. Together, these two features ensure the key can be recovered and cannot be permanently deleted for up to 90 days.

Answer

Purge protection and access policies

Answer

Soft-delete and backup

Question 14

A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

A default encryption scope is configured on the blob container that uses a Microsoft-managed key.. Option C is correct because when a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.

Answer

The Key Vault is in a different Azure region than the storage account.

Answer

The storage account does not have a system-assigned managed identity enabled.

Answer

The customer-managed key in Key Vault is disabled or expired.

Question 15

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is a Microsoft service. How can the SQL server be granted access to the key vault to perform TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault. Option C is correct because Azure Key Vault's firewall includes a setting to 'Allow trusted Microsoft services to bypass this firewall.' Azure SQL Database is a trusted Microsoft service, so enabling this setting allows the SQL server to authenticate to Key Vault using its system-assigned managed identity to retrieve the customer-managed key for TDE operations, without needing to disable the firewall or create a private endpoint.

Answer

Create a private endpoint on the Key Vault for the SQL server

Answer

Disable the Key Vault firewall

Answer

Assign the SQL server a system-assigned managed identity and grant it access to the key vault