AZ-500 Secure compute, storage, and databases Practice Test 5 — 15 Questions

Question 1

Your company uses Azure SQL Managed Instance. You need to ensure that all connections from clients use TLS 1.2 or higher. What should you configure?

Accepted Answer

Set the 'Minimal TLS version' property to 1.2 in the Managed Instance settings. Azure SQL Managed Instance exposes a 'Minimal TLS version' property in its settings that enforces the minimum TLS version for all client connections. Setting this to 1.2 ensures that any connection attempt using TLS 1.0 or 1.1 is rejected at the server level, providing a centralized, server-side enforcement mechanism without relying on client-side configurations.

Answer

Configure a firewall rule to block non-TLS 1.2 connections

Answer

Create an Azure Policy to require TLS 1.2 for all SQL Managed Instances

Answer

Enable the 'Force encryption' option on the client side

Question 2

You are designing a secure backup strategy for Azure Virtual Machines. The backup data must be encrypted at rest and in transit. Which combination should you use?

Accepted Answer

Azure Backup automatically encrypts data at rest using Azure Storage Service Encryption and in transit using HTTPS. Azure Backup automatically encrypts data at rest using Azure Storage Service Encryption (SSE) with platform-managed keys, and encrypts data in transit using HTTPS. This ensures that backup data is protected both at rest and during transfer without requiring additional configuration, making option A the correct choice.

Answer

Azure Storage Service Encryption and HTTPS

Answer

Azure Backup with customer-managed keys and enforce HTTPS

Answer

Azure Disk Encryption on the VMs and Azure Backup

Question 3

You need to restrict access to an Azure Storage account so that only requests from a specific Azure Virtual Network are allowed. What should you configure?

Accepted Answer

Configure the storage account firewall to allow access only from the VNet. The Azure Storage account firewall can be configured to restrict access to traffic originating from a specific Azure Virtual Network (VNet) by adding a firewall rule that allows access only from that VNet. This is achieved by enabling a service endpoint for Microsoft.Storage on the subnet, which ensures that traffic from the VNet to the storage account is routed through the Azure backbone network and is identified by the storage firewall as originating from the VNet. This configuration effectively blocks all other traffic, including internet-based requests, unless explicitly allowed.

Answer

Assign an RBAC role to the VNet's managed identity

Answer

Configure a service endpoint for the storage account

Answer

Configure an Azure Private Endpoint for the storage account

Question 4

Your organization uses Azure Files shares. You need to ensure that users authenticate using on-premises Active Directory credentials and that access is logged. What should you do?

Accepted Answer

Enable identity-based authentication for Azure Files and configure diagnostic logs. Azure Files supports identity-based authentication using on-premises Active Directory Domain Services (AD DS) via Kerberos. This allows users to authenticate with their on-premises AD credentials and access the file share seamlessly. Enabling diagnostic logs captures access events, meeting the logging requirement.

Answer

Configure a firewall rule to allow on-premises IPs and enable diagnostic logs

Answer

Use shared access signatures (SAS) for access and enable diagnostic logs

Answer

Configure Azure RBAC for the share and enable diagnostic logs

Question 5

You have an Azure SQL Database that stores Personally Identifiable Information (PII). You need to mask the PII columns for support staff but allow full access to managers. What should you implement?

Accepted Answer

Dynamic Data Masking with a masking policy and grant UNMASK permission to managers. Dynamic Data Masking (DDM) obfuscates sensitive data in query results based on a masking policy, without altering the underlying data. Granting the UNMASK permission to managers allows them to see the original values, while support staff see masked data. This directly meets the requirement to mask PII columns for support staff but allow full access to managers.

Answer

Always Encrypted with separate column encryption keys for managers

Answer

Azure Information Protection labels and encryption

Answer

Row-level security to restrict rows for support staff

Question 6

You are reviewing an Azure Resource Manager template for a storage account. The exhibit shows a snippet of the template. Which statement about the template is true?

Accepted Answer

The storage account will use Microsoft-managed keys for encryption.. The template snippet does not include any encryption-related properties, such as `encryption.keySource` or `encryption.services`, which means the storage account will use the default Microsoft-managed keys for encryption. By default, Azure Storage encrypts all data at rest using Microsoft-managed keys, and no explicit configuration is required. Option C correctly identifies this default behavior.

Answer

Encryption is disabled for the storage account.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

Encryption is enabled only for blob storage.

Question 7

You are deploying an Azure SQL Database with a security alert policy as shown in the exhibit. Which statement is true?

Accepted Answer

Alerts are enabled and notifications are sent to both account admins and admin@contoso.com.. The security alert policy in Azure SQL Database has 'state' set to 'Enabled' and 'emailAddresses' includes both 'admin@contoso.com' and the account admins (via 'emailAccountAdmins' set to true). This means alerts are active and notifications are sent to both the specified email and the account administrators, making option A correct.

Answer

Email notifications are sent only to admin@contoso.com.

Answer

Alerts are not retained because retentionDays is set to 30.

Answer

All alerts are disabled because disabledAlerts is empty.

Question 8

You need to ensure that an Azure Storage account only allows access from a specific virtual network. Which configuration should you use?

Accepted Answer

Configure a service endpoint for Azure Storage and add the virtual network subnet to the firewall rules.. Configuring a service endpoint for Azure Storage extends your virtual network identity to the service, allowing you to secure storage account access exclusively to specific subnets. By adding the virtual network subnet to the storage account's firewall rules, you restrict all traffic to only those subnets, blocking public internet access while allowing private traffic from the designated virtual network.

Answer

Enable Azure Private Link and assign a private endpoint.

Answer

Configure firewall rules to allow only the virtual network's public IP range.

Answer

Generate new storage account access keys and share them only with the virtual network.

Question 9

Your company uses Azure SQL Database. You need to ensure that all queries are audited for compliance. Which feature should you enable?

Accepted Answer

Enable SQL Auditing on the server and configure the audit log destination.. To audit all queries against Azure SQL Database for compliance, you must enable SQL Auditing at the server level and configure an audit log destination (such as Azure Storage, Log Analytics, or Event Hubs). This captures database events, including all queries, and writes them to the chosen destination for review and retention. Option B directly fulfills the requirement to track and log query activity.

Answer

Enable SQL Vulnerability Assessment.

Answer

Configure Dynamic Data Masking.

Answer

Enable Advanced Threat Protection.

Question 10

You are designing a solution to store sensitive documents in Azure Blob Storage. The documents must be encrypted at rest using a customer-managed key that is automatically rotated every 90 days. Microsoft Entra ID must be used to control access to the key. What should you use?

Accepted Answer

Azure Storage Service Encryption (SSE) with a customer-managed key stored in Azure Key Vault and configure key rotation.. Azure Storage Service Encryption (SSE) with a customer-managed key (CMK) stored in Azure Key Vault allows you to control the encryption key used for data at rest in Blob Storage. By storing the key in Key Vault, you can configure automatic key rotation every 90 days, and you can use Microsoft Entra ID (formerly Azure AD) to control access to the key via RBAC roles such as Key Vault Crypto Officer. This meets all requirements: encryption at rest, customer-managed key, automatic rotation, and Entra ID-based access control.

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Answer

Client-side encryption (CSE) using Azure Key Vault.

Question 11

You need to prevent data from being exfiltrated from an Azure SQL Database by unauthorized users. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct feature because it is specifically designed to detect and prevent the unauthorized exfiltration of sensitive data. For Azure SQL Database, DLP policies can be configured to monitor and block risky operations such as SELECT queries that return large volumes of sensitive columns, or unauthorized exports, by integrating with the SQL auditing and threat detection capabilities. This directly addresses the requirement to prevent data exfiltration by unauthorized users.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Question 12

Your company has an Azure Cosmos DB account that stores customer profiles. You need to ensure that only authenticated and authorized users can access the data. Which access control method should you use?

Accepted Answer

Use Azure RBAC with Microsoft Entra ID authentication.. Azure RBAC with Microsoft Entra ID authentication provides fine-grained, identity-based access control for Azure Cosmos DB. This method allows you to assign specific roles (e.g., Cosmos DB Built-in Data Reader) to users or service principals, ensuring that only authenticated and authorized identities can access the data plane operations, such as reading or writing documents. It eliminates the need to share or manage keys, aligning with the principle of least privilege.

Answer

Configure an IP firewall rule to allow only corporate IP ranges.

Answer

Use primary read-write keys with connection strings.

Answer

Use resource tokens generated from a master key.

Question 13

You are deploying a critical application on Azure Virtual Machines that must remain highly available. You need to implement a security solution that ensures the application can recover from a ransomware attack that encrypts all data disks. What is the most cost-effective approach?

Accepted Answer

Configure Azure Backup with immutable vault and soft delete.. Azure Backup with immutable vault and soft delete protects against ransomware by preventing deletion and allowing recovery. This approach is cost-effective because it uses Azure Backup, which is optimized for backup and recovery, and the immutable vault ensures backups cannot be modified or deleted by ransomware. Option B is incorrect because Azure Files share backup is not applicable to VM disks. Option C, Azure Site Recovery, is primarily for disaster recovery, not ransomware recovery. Option D, storing snapshots in the same storage account, does not protect against ransomware because the snapshots can also be encrypted or deleted.

Answer

Use Azure Files share with snapshots for the application data.

Answer

Enable Azure Site Recovery for the virtual machines.

Answer

Take daily snapshots of the disks and store them in the same storage account.

Question 14

You need to enable transparent data encryption (TDE) for an Azure SQL Managed Instance. What is the prerequisite?

Accepted Answer

No additional configuration is needed; TDE is enabled by default.. Transparent Data Encryption (TDE) is enabled by default for Azure SQL Managed Instance. When you create a new managed instance, TDE is automatically turned on using a service-managed key, so no additional configuration is required. This default behavior ensures data at rest is encrypted without any prerequisite steps from the user.

Answer

Configure a backup policy for the managed instance.

Answer

Enable a service endpoint for Azure SQL.

Answer

Create an Azure Key Vault and configure a customer-managed key.

Question 15

You are deploying a multi-tier application on Azure Kubernetes Service (AKS). The application uses Azure Disks for persistent storage. You need to ensure that the disks are encrypted at rest using a customer-managed key stored in a Key Vault in a different region. What should you do?

Accepted Answer

Configure disk encryption set (DES) with a customer-managed key from a Key Vault in the same region as the disks.. Azure Disk Encryption at rest with customer-managed keys requires a Disk Encryption Set (DES) that references a Key Vault in the same Azure region as the managed disks. The Key Vault must be in the same region as the disks because Azure Disk Encryption uses server-side encryption (SSE) with the DES, and the encryption key must be accessible within the same regional boundary to comply with Azure's regional key management constraints. Cross-region Key Vault references are not supported for managed disk encryption.

Answer

Enable Azure Disk Encryption (ADE) using Azure Key Vault in the same region as AKS.

Answer

Use server-side encryption (SSE) with platform-managed keys.

Answer

Use Azure Storage Service Encryption (SSE) with customer-managed keys from the remote Key Vault.