AZ-500 Secure compute, storage, and databases Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing the ARM template snippet for a managed disk. You need to ensure the disk uses a customer-managed key (CMK) from Azure Key Vault. However, you notice the deployment fails because the key version is specified. What is the likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The keyversion should be omitted to allow automatic rotation.. When using a customer-managed key (CMK) for Azure managed disks, the key version must be omitted from the ARM template to enable automatic key rotation. If a specific key version is provided, Azure Disk Encryption will pin to that version and fail to rotate the key automatically, causing deployment errors when the key is rotated or expires. The correct approach is to specify only the key URL without the version, allowing the disk to always use the latest version of the key.

Answer

The keySource should be 'Microsoft.Storage' instead.

Answer

The keyvaulturi is incorrect.

Answer

The keyname is incorrect.

Question 2

Refer to the exhibit. You run the Azure CLI command to create a storage account. After creation, you need to ensure that the storage account can only be accessed using TLS 1.2. Does the command achieve this?

Accepted Answer

Yes, because --min-tls-version 1.2 sets the minimum TLS version to 1.2.. The command explicitly includes `--min-tls-version 1.2`, which sets the minimum TLS version required for requests to the storage account to 1.2. This ensures that only clients using TLS 1.2 or higher can access the account, effectively blocking older, less secure TLS versions. The `--https-only true` parameter further enforces that all traffic must use HTTPS, but it is the `--min-tls-version` parameter that directly controls the allowed TLS protocol version.

Answer

No, because the command does not include any TLS version parameter.

Answer

Yes, because the default minimum TLS version is 1.2.

Answer

No, because --https-only true only enforces HTTPS without specifying TLS version.

Question 3

Your company hosts a web application on Azure Virtual Machines. You need to ensure that all disks attached to the VMs are encrypted. You plan to use Azure Disk Encryption. What should you configure first?

Accepted Answer

Create an Azure Key Vault and configure a key encryption key. Azure Disk Encryption requires a key vault to store and manage the disk encryption keys and secrets, so the first step is to create an Azure Key Vault and configure a key encryption key (KEK) to protect the disk encryption key. The KEK adds an extra layer of security by wrapping the secret used for BitLocker/DM-Crypt encryption. A system-assigned managed identity (option A) is useful for key vault access but is not the prerequisite resource itself, and it is configured after the key vault exists. A network security group (option B) is unrelated because ADE does not require special inbound encryption traffic rules, and Azure Backup (option D) is a separate data protection service that does not enable disk encryption.

Answer

Assign a system-assigned managed identity to the VMs

Answer

Configure a network security group to allow encryption traffic

Answer

Enable Azure Backup on the VMs

Question 4

Your organization uses Azure Storage blobs to store sensitive documents. You need to enforce that all blob access must be via HTTPS and that storage account keys are rotated every 90 days. Which two actions should you take? (Each correct answer presents part of the solution.)

Accepted Answer

Use a PowerShell script to regenerate storage account keys every 90 days. Storage account keys must be regenerated periodically to reduce the risk of compromised keys. Using a PowerShell script (e.g., `New-AzStorageAccountKey`) scheduled via Azure Automation or a runbook allows you to enforce a 90-day rotation policy. Option E is correct because enabling 'Secure transfer required' on the storage account enforces HTTPS for all API requests to the blob service, rejecting any HTTP traffic at the platform level.

Answer

Configure an Azure Policy to require HTTPS

Answer

Generate a shared access signature (SAS) with HTTPS only

Answer

Store storage account keys in Azure Key Vault and enable automatic rotation

Question 5

You are designing a secure backup strategy for Azure Virtual Machines. The backup data must be encrypted at rest and in transit. Which combination should you use?

Accepted Answer

Azure Backup automatically encrypts data at rest using Azure Storage Service Encryption and in transit using HTTPS. Azure Backup automatically encrypts data at rest using Azure Storage Service Encryption (SSE) with platform-managed keys, and encrypts data in transit using HTTPS. This ensures that backup data is protected both at rest and during transfer without requiring additional configuration, making option A the correct choice.

Answer

Azure Storage Service Encryption and HTTPS

Answer

Azure Backup with customer-managed keys and enforce HTTPS

Answer

Azure Disk Encryption on the VMs and Azure Backup

Question 6

You need to restrict access to an Azure Storage account so that only requests from a specific Azure Virtual Network are allowed. What should you configure?

Accepted Answer

Configure the storage account firewall to allow access only from the VNet. The Azure Storage account firewall can be configured to restrict access to traffic originating from a specific Azure Virtual Network (VNet) by adding a firewall rule that allows access only from that VNet. This is achieved by enabling a service endpoint for Microsoft.Storage on the subnet, which ensures that traffic from the VNet to the storage account is routed through the Azure backbone network and is identified by the storage firewall as originating from the VNet. This configuration effectively blocks all other traffic, including internet-based requests, unless explicitly allowed.

Answer

Assign an RBAC role to the VNet's managed identity

Answer

Configure a service endpoint for the storage account

Answer

Configure an Azure Private Endpoint for the storage account

Question 7

You need to ensure that an Azure Storage account only allows access from a specific virtual network. Which configuration should you use?

Accepted Answer

Configure a service endpoint for Azure Storage and add the virtual network subnet to the firewall rules.. Configuring a service endpoint for Azure Storage extends your virtual network identity to the service, allowing you to secure storage account access exclusively to specific subnets. By adding the virtual network subnet to the storage account's firewall rules, you restrict all traffic to only those subnets, blocking public internet access while allowing private traffic from the designated virtual network.

Answer

Enable Azure Private Link and assign a private endpoint.

Answer

Configure firewall rules to allow only the virtual network's public IP range.

Answer

Generate new storage account access keys and share them only with the virtual network.

Question 8

You need to prevent data from being exfiltrated from an Azure SQL Database by unauthorized users. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct feature because it is specifically designed to detect and prevent the unauthorized exfiltration of sensitive data. For Azure SQL Database, DLP policies can be configured to monitor and block risky operations such as SELECT queries that return large volumes of sensitive columns, or unauthorized exports, by integrating with the SQL auditing and threat detection capabilities. This directly addresses the requirement to prevent data exfiltration by unauthorized users.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Question 9

You are deploying a multi-tier application on Azure Kubernetes Service (AKS). The application uses Azure Disks for persistent storage. You need to ensure that the disks are encrypted at rest using a customer-managed key stored in a Key Vault in a different region. What should you do?

Accepted Answer

Configure disk encryption set (DES) with a customer-managed key from a Key Vault in the same region as the disks.. Azure Disk Encryption at rest with customer-managed keys requires a Disk Encryption Set (DES) that references a Key Vault in the same Azure region as the managed disks. The Key Vault must be in the same region as the disks because Azure Disk Encryption uses server-side encryption (SSE) with the DES, and the encryption key must be accessible within the same regional boundary to comply with Azure's regional key management constraints. Cross-region Key Vault references are not supported for managed disk encryption.

Answer

Enable Azure Disk Encryption (ADE) using Azure Key Vault in the same region as AKS.

Answer

Use server-side encryption (SSE) with platform-managed keys.

Answer

Use Azure Storage Service Encryption (SSE) with customer-managed keys from the remote Key Vault.

Question 10

Which TWO actions are required to enable Azure Defender for SQL on an Azure SQL Database?

Accepted Answer

Enable Advanced Data Security on the server.. Option A is correct because Azure Defender for SQL (formerly Advanced Threat Protection) is activated by turning on Advanced Data Security at the logical SQL server level, which enables both vulnerability assessment and advanced threat protection for all databases on that server. Option D is correct because Microsoft Defender for Cloud's 'SQL servers' plan (Defender for SQL) must be enabled in the subscription to provide the underlying threat detection and alerting capability for Azure SQL Database. Option B is incorrect because SQL Vulnerability Assessment is a scanning feature that is included with Advanced Data Security but is not itself the action that enables Defender for SQL. Option C is incorrect because threat detection policies are configured as part of Advanced Data Security at the server level, not independently at the database level as a required enabling step. Option E is incorrect because SQL Auditing is a separate logging and compliance feature and does not enable Azure Defender for SQL.

Answer

Configure SQL Vulnerability Assessment.

Answer

Enable threat detection policies at the database level.

Answer

Enable SQL Auditing.

Question 11

Which TWO features of Azure Database for PostgreSQL ensure data security at rest?

Accepted Answer

Infrastructure double encryption. Infrastructure double encryption (B) is correct because Azure Database for PostgreSQL applies two layers of AES-256 encryption at the infrastructure level — one at the service layer and one at the hardware layer — protecting data stored on disk even if one layer is compromised. Transparent Data Encryption (TDE) (C) is correct because it encrypts data and log files at rest on the server, using a key managed by the service, so stored data cannot be read without the encryption key. Firewall rules (A) control network access to the server, not data at rest, so they address perimeter security rather than storage encryption. Advanced Threat Protection (D) detects anomalous access patterns and potential attacks, which is threat detection rather than at-rest encryption. Auto-tuning (E) optimizes query performance and configuration, and has no bearing on encrypting stored data.

Answer

Firewall rules

Answer

Advanced Threat Protection

Answer

Auto-tuning

Question 12

You need to restrict access to an Azure Storage account so that only traffic from a specific virtual network (VNet) subnet is allowed. Which Azure Storage firewall setting should you configure?

Accepted Answer

Add a virtual network rule that references the VNet and subnet.. Azure Storage firewalls support virtual network rules that allow traffic only from a specific VNet and subnet. When you add a virtual network rule, you reference the VNet's resource ID and the subnet's name, and the storage account will only accept requests originating from that subnet. This is the precise mechanism for restricting access to a subnet without exposing public IP addresses.

Answer

Create a private endpoint for the storage account.

Answer

Enable service endpoints on the subnet and add an IP rule.

Answer

Add a firewall rule with the subnet's public IP address range.

Question 13

Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?

Accepted Answer

Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Microsoft Entra ID using Microsoft Entra Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.

Answer

Enable Azure AD Domain Services authentication and join the storage account to the managed domain.

Answer

Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.

Answer

Use storage account keys to mount the share and rely on Windows ACLs.

Question 14

You need to backup Azure SQL Managed Instance databases to a separate region for disaster recovery. Which Azure service should you use?

Accepted Answer

Azure Backup with geo-redundant storage. Azure Backup with geo-redundant storage (GRS) is the correct service because it provides a managed backup solution for Azure SQL Managed Instance that supports cross-region disaster recovery. By configuring the Backup Vault with GRS, backups are automatically replicated to a paired secondary region, ensuring data durability and recoverability during a regional outage. This aligns with the requirement to back up databases to a separate region without needing to manage replication or failover logic.

Answer

Active geo-replication

Answer

Geo-redundant storage (GRS) for Azure Storage

Answer

Azure Site Recovery

Question 15

Which THREE components are part of Azure Disk Encryption for Windows VMs?

Accepted Answer

BitLocker Drive Encryption. Azure Disk Encryption for Windows VMs relies on BitLocker Drive Encryption (option C) as the actual volume-encryption technology inside the guest OS, which is why C is correct. It also integrates with Azure Key Vault to store and manage the encryption secrets, specifically using a Key Encryption Key (KEK) to wrap the BitLocker secrets (option D), and it stores the Volume Encryption Key (VEK), which is the actual BitLocker key material used to encrypt the OS and data volumes, in Key Vault (option E). Together, BitLocker plus Key Vault with KEK and VEK form the core components of the Windows ADE implementation. DM-Crypt (option A) is the Linux disk-encryption subsystem used by Azure Disk Encryption for Linux VMs, not for Windows, so it does not belong here. Microsoft Entra ID (option B) is not a component of the disk-encryption mechanism itself; it may be used for identity and access to the subscription or Key Vault, but it is not one of the three required ADE-for-Windows components.

Answer

DM-Crypt

Answer

Microsoft Entra ID (Azure AD)