AZ-500 Secure compute, storage, and databases Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing the JSON output of an Azure Storage account encryption configuration. What can you conclude about the encryption settings?

Accepted Answer

The storage account uses a customer-managed key from Azure Key Vault.. The JSON output shows that the storage account's encryption configuration includes a `keyvaulturi` and a `keyname`, which are the required properties for a customer-managed key (CMK) from Azure Key Vault. The presence of `keyvaulturi` and `keyname` indicates that the encryption key is not managed by the platform but by the customer, making option A correct.

Answer

The encryption configuration is incomplete because keyVersion is '1'.

Answer

Only blob storage is encrypted; file storage is not.

Answer

The storage account uses platform-managed keys (SSE).

Question 2

Your company uses Azure SQL Database for a multitenant SaaS application. You need to ensure that one tenant cannot access another tenant's data, even if the application code has a bug. Which Azure SQL Database feature should you implement?

Accepted Answer

Always Encrypted. Always Encrypted ensures that sensitive data is encrypted at the client side and the encryption keys are never revealed to Azure SQL Database. This means that even if the application code has a bug that attempts to read another tenant's data, the database engine cannot decrypt it without the correct column encryption key, providing tenant isolation at the data level.

Answer

Dynamic Data Masking (DDM)

Answer

Azure SQL Database Auditing

Answer

Row-Level Security (RLS)

Question 3

A developer needs to securely connect to an Azure Storage account from a private virtual network without exposing the storage account to the public internet. Which Azure service should be used?

Accepted Answer

Azure Private Link. Azure Private Link enables private connectivity to Azure Storage from a virtual network by mapping the storage account to a private endpoint using a private IP address from the VNet. This ensures traffic never traverses the public internet, even though the storage account remains accessible via its public endpoint for other clients. It is the correct choice because it provides secure, private access without exposing the storage account to the public internet.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Service Endpoints

Question 4

A company is deploying Azure Virtual Machines for a batch processing workload. The VMs process highly sensitive data and must ensure that the data on the OS and data disks is encrypted using a customer-managed key stored in Azure Key Vault. Which encryption option meets the requirement?

Accepted Answer

Azure Disk Encryption (ADE). Azure Disk Encryption (ADE) uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt both OS and data disks at the volume level, ensuring data at rest is protected with customer-managed keys stored in Azure Key Vault. This meets the requirement for encrypting VM disks with a customer-managed key, as ADE directly integrates with Azure Key Vault for key management.

Answer

Encryption at host

Answer

Azure Storage Service Encryption

Answer

Server-side encryption (SSE) with customer-managed keys

Question 5

A critical application uses Azure Functions with an Azure Storage account for input and output. The security team requires that all data in transit between the function app and storage be encrypted using a customer-managed key. Which configuration should you implement?

Accepted Answer

Configure a site-to-site VPN between the function app and storage account. A site-to-site VPN between the function app and storage account allows the use of customer-managed IPsec keys for encrypting data in transit. Azure Functions can be integrated into a virtual network, and a VPN gateway can establish a site-to-site VPN to the storage account's VNet, ensuring all traffic is encrypted with customer-managed keys. Option A is incorrect because SMB 3.0+ encryption uses Azure-managed keys, not customer-managed keys. Option C only ensures HTTPS for client-to-function traffic, not function-to-storage transit. Option D uses managed certificates for domain validation, not for encrypting storage traffic.

Answer

Enable 'HTTPS Only' on the function app and use Azure Files for the function code with encryption in transit (SMB 3.0+)

Answer

Enable 'HTTPS Only' and use Key Vault references for storage connection strings

Answer

Use App Service managed certificates for the function app

Question 6

Which TWO actions should you take to secure an Azure Storage account that contains sensitive data? (Choose two.)

Accepted Answer

Disable public network access. Option A is correct because disabling public network access on the storage account blocks all anonymous and internet-based access, forcing traffic through private endpoints or authorized virtual networks, which is essential for protecting sensitive data. Option B is correct because enabling soft delete for blobs retains deleted blob data for a configurable retention period, allowing recovery from accidental or malicious deletion and thus protecting data integrity. Option C is not a security control; GRS is a durability/redundancy feature that replicates data to a secondary region but does not restrict access. Option D, while a valid security practice, is not one of the two marked correct answers here and does not by itself secure the account against public exposure. Option E is incorrect because a SAS token with full permissions grants broad access and, if leaked, increases risk rather than securing the account.

Answer

Enable geo-redundant storage (GRS)

Answer

Enable Azure AD authentication for blob and queue data

Answer

Generate a shared access signature (SAS) token with full permissions

Question 7

Which TWO of the following are benefits of using managed identities for Azure resources to access Azure Storage? (Choose two.)

Accepted Answer

Eliminates the need to store credentials in code or configuration files. Option B is correct because managed identities let an Azure resource (such as a VM, App Service, or Function) obtain an OAuth 2.0 access token from Microsoft Entra ID via the Instance Metadata Service (IMDS) endpoint, so no connection strings, account keys, or SAS tokens need to be embedded in code or configuration files. Option D is correct because the underlying credential (the service principal's certificate/secret) is managed and rotated automatically by the Azure platform, removing the manual key-rotation burden from the developer. Option A is not a benefit of managed identities; cross-region replication is a storage redundancy feature (LRS/ZRS/GRS/RA-GRS), unrelated to authentication. Option C is not correct because managed identities are tied to Microsoft Entra ID and do not provide federated identity with external identity providers. Option E is not correct because granular auditing of storage access comes from Azure Storage logging, diagnostic settings, and Microsoft Defender for Storage, not from using a managed identity.

Answer

Replicates storage data across regions for disaster recovery

Answer

Enables federated identity with external identity providers

Answer

Provides granular auditing of all storage access

Question 8

You receive the above ARM template snippet for an Azure Storage account. After deployment, a developer reports that they cannot access the storage account from a permitted virtual network. What is the most likely cause?

Accepted Answer

No virtual network rules are defined, so all traffic is denied by default.. The ARM template snippet shows a storage account with network rules configured, but no virtual network rules are defined. By default, when network rules are set to 'DenyAll', all traffic is blocked unless explicitly allowed via a virtual network rule or an IP rule. Since no virtual network rules are present, the storage account denies all traffic, including from permitted virtual networks, unless the network rules are set to 'AllowAll' or specific rules are added.

Answer

The encryption services for blob and file are not enabled correctly.

Answer

The key version is pinned to an older version, causing encryption failures.

Answer

The Key Vault firewall is blocking access to the encryption key.

Question 9

You run the above PowerShell script to change the access tier of all block blobs in the 'data' container from Cool to Hot. However, you receive an error that the operation is not allowed. What is the most likely reason?

Accepted Answer

The storage account's firewall is blocking the request from the current IP address.. The error 'operation is not allowed' typically occurs when the storage account's firewall rules block the request. Even if the SAS token is valid and the script is correct, Azure Storage firewalls deny access from IP addresses not explicitly allowed, resulting in a 403 Forbidden error. The script itself appears to correctly target BlockBlobs and change the tier, so the most likely cause is a network-level restriction.

Answer

The script incorrectly filters for BlockBlob instead of PageBlob.

Answer

The storage account is using a shared access signature (SAS) token that has expired.

Answer

The access tier cannot be changed from Cool to Hot after 30 days of creation.

Question 10

You run the above Kusto query in Azure Monitor Logs for an Azure Storage account. The query returns results showing multiple failed attempts to access PDF blobs with 403 errors from various IP addresses. What is the most likely cause of these failures?

Accepted Answer

The storage account firewall is blocking requests from these IP addresses.. A 403 (Forbidden) error indicates that the request reached the storage account but was denied authorization. When a storage account firewall is configured to deny traffic from specific IP ranges, all requests from those IPs—including legitimate ones—are blocked with a 403 response. This aligns with the query showing multiple failed attempts from various IP addresses, as the firewall rules apply globally to all requests, regardless of the blob's public access setting or SAS validity.

Answer

Anonymous public access is enabled, but the blobs are not marked as public.

Answer

The PDF blobs have been deleted or moved to a different container.

Answer

The shared access signatures (SAS) used to access the blobs have expired.

Question 11

You are designing a secure database solution for a financial application using Azure SQL Database. The database contains highly sensitive columns (e.g., credit card numbers). Which combination of features should you implement to protect data at rest, in transit, and in use, while minimizing performance impact?

Accepted Answer

Always Encrypted (with deterministic encryption for equality searches), TDE, and enforce TLS 1.2.. It combines Always Encrypted with deterministic encryption (which supports equality searches while protecting data in use), Transparent Data Encryption (TDE) for data at rest, and enforced TLS 1.2 for data in transit. This provides comprehensive protection across all three states while minimizing performance impact, as deterministic encryption allows efficient querying without decrypting on the server side.

Answer

Always Encrypted with secure enclaves, TDE, and enforce TLS 1.2.

Answer

Dynamic Data Masking, TDE, and enforce TLS 1.2.

Answer

Column-level encryption using Azure Key Vault, TDE, and enforce TLS 1.2.

Question 12

Your company uses Azure File shares for departmental file storage. You need to restrict access to only specific VMs in the same virtual network using Azure AD authentication. What should you configure?

Accepted Answer

Enable Azure AD DS authentication for Azure Files, configure private endpoints, and assign RBAC roles to the VMs' managed identities.. Azure Files supports Microsoft Entra Domain Services (or Microsoft Entra Domain Services) authentication, which allows identity-based access over SMB, and combining it with private endpoints keeps traffic on the VNet while RBAC roles assigned to the VMs' managed identities grant only those specific VMs access. This matches the requirement to restrict access to specific VMs in the same virtual network using Microsoft Entra ID authentication. Option B relies on the storage account key, which is shared-secret authentication rather than Microsoft Entra ID, and a VNet firewall alone cannot identify individual VMs. Option C allows the whole VNet via the storage firewall and does not scope access to specific VMs or use managed identities. Option D uses a SAS token with IP restrictions, which is not Microsoft Entra ID authentication and cannot target specific VM identities.

Answer

Use the storage account key and restrict access to the VNet via firewall.

Answer

Configure the storage firewall to allow only the VNet, and use Azure AD authentication.

Answer

Configure a SAS token with IP address restrictions.

Question 13

You are deploying a containerized application on Azure Kubernetes Service (AKS). The application needs to pull images from a private Azure Container Registry (ACR) and access secrets from Azure Key Vault. You want to minimize credential exposure. What should you configure?

Accepted Answer

Enable managed identity on the AKS cluster, grant the identity acrpull role on ACR, and use Azure Key Vault Provider for Secrets Store CSI Driver.. It uses AKS-managed identity (a form of Microsoft Entra ID Pod Identity) to authenticate to ACR without storing any credentials in the cluster, and the Azure Key Vault Provider for Secrets Store CSI Driver mounts secrets directly into pods as volumes, eliminating the need for Kubernetes secrets. This approach minimizes credential exposure by relying on Microsoft Entra ID authentication and managed identities, which are rotated automatically by Azure.

Answer

Use a service principal with certificate authentication, and rotate the certificate annually.

Answer

Create a service principal with a secret, assign it acrpull role, and store the secret in a Kubernetes secret for imagePullSecrets.

Answer

Enable the admin account on ACR and use the admin credentials in Kubernetes secrets.

Question 14

You need to ensure that an Azure Storage account's blob data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. What should you do first?

Accepted Answer

Create an Azure Key Vault with soft-delete and purge protection enabled.. To use a customer-managed key (CMK) for encrypting Azure Storage blob data, the key must be stored in an Azure Key Vault that supports the required lifecycle operations. Azure Key Vault must have both soft-delete and purge protection enabled to prevent permanent key deletion, which is a prerequisite for using CMK with Azure Storage. Without these features, the storage account cannot be configured to use the key, as Azure Storage requires the key to be recoverable.

Answer

Generate a random 256-bit key and store it in the storage account.

Answer

Create a system-assigned managed identity for the storage account.

Answer

Enable Azure Information Protection for the storage account.

Question 15

Your company uses Azure Database for PostgreSQL flexible server. You need to enable auditing of all database-level events and ensure audit logs are retained for compliance purposes for 5 years. What should you configure?

Accepted Answer

Enable server parameters for pgAudit, set audit log destination to Azure Monitor, and configure diagnostic settings to stream logs to a Log Analytics workspace with 5-year retention.. Azure Database for PostgreSQL flexible server supports the pgAudit extension for database-level auditing. To meet the 5-year retention requirement, audit logs must be sent to Azure Monitor via diagnostic settings, which allows you to configure a Log Analytics workspace with a retention period of up to 5 years. Writing logs to a database table (Option B) would not provide the required long-term retention and could impact performance.

Answer

Configure Azure SQL Database auditing and point it to the PostgreSQL server.

Answer

Enable the pgAudit extension and write audit logs to a database table.

Answer

Enable diagnostic settings on the subscription and select the PostgreSQL server.