AZ-500 Secure compute, storage, and databases Practice Test 5 — 15 Questions

Question 1

A company uses Azure SQL Database for a critical application. Security policy requires that all client connections to the database use at least TLS 1.2 encryption. What configuration change must be made to enforce this requirement?

Accepted Answer

Configure the minimum TLS version in the SQL server's settings.. To enforce that all client connections to Azure SQL Database use at least TLS 1.2, you must configure the minimum TLS version at the SQL server level. This setting overrides the default behavior, which allows older, less secure TLS versions, and ensures that any connection attempt using TLS 1.0 or 1.1 is rejected. The configuration is made in the Azure portal under the SQL server's 'Connectivity' settings or via the 'Minimal TLS Version' property in ARM templates or PowerShell.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Update the server firewall rules to allow only specific IP addresses.

Answer

Implement Always Encrypted for all sensitive columns.

Question 2

A storage account contains legal evidence that must not be modified or deleted for seven years. Which feature should be configured?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) is the correct choice because it enforces a strict seven-year retention period during which blobs cannot be modified or deleted, even by account administrators. This is achieved through a policy that locks the data at the storage level, ensuring compliance with legal hold requirements for evidence preservation.

Answer

Soft delete only

Answer

Lifecycle management to archive tier

Answer

Customer-managed keys

Question 3

An Azure SQL Database contains salary data. Support analysts need to query employee records but must not see full salary values. Which feature is most appropriate when the application cannot be changed immediately?

Accepted Answer

Dynamic data masking. Dynamic data masking (DDM) is the correct choice because it obfuscates sensitive data in query results without modifying the underlying database or requiring application changes. The support analysts can still query employee records, but the salary column is masked according to a defined masking rule (e.g., showing only the last four digits or replacing with zeros). This meets the requirement of preventing full salary exposure while the application remains unchanged.

Answer

Transparent Data Encryption

Answer

Geo-replication

Answer

Accelerated database recovery

Question 4

A Kubernetes workload in AKS needs to pull images from Azure Container Registry without using admin credentials. Which configuration should be used?

Accepted Answer

Grant the AKS kubelet identity AcrPull on the registry. The AKS cluster uses a kubelet identity (managed identity) to authenticate with ACR. By granting the AcrPull role to this identity, the kubelet can pull container images without requiring admin credentials, as Azure RBAC handles the authentication via Azure AD tokens. This is the recommended secure method for image pull operations.

Answer

Enable anonymous pull access on the registry

Answer

Store the ACR admin password in a ConfigMap

Answer

Expose the registry through a public load balancer

Question 5

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Accepted Answer

Configure Key Vault networking with private endpoint or selected networks. Option A is correct because configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.

Answer

Disable soft delete permanently

Answer

Store secrets as plain text tags

Question 6

A storage account contains regulated records. Which two features help protect against accidental or malicious deletion?

Accepted Answer

Blob soft delete and versioning. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period, allowing recovery. Versioning preserves previous versions of blobs, enabling restoration to an earlier state if malicious overwrites or deletions occur. Together, they provide a layered defense against both accidental and intentional data loss.

Answer

Disabling all encryption

Answer

Public container access

Question 7

An AKS cluster must reduce risk from untrusted container images. Which two controls are most appropriate?

Accepted Answer

Scan container images for vulnerabilities before deployment. Option B is correct because scanning container images for vulnerabilities before deployment ensures that known security issues are identified and remediated before the images run in the cluster. This is a critical preventive control that directly reduces the risk of exploiting vulnerabilities in untrusted images. Azure Security Center and Azure Defender for container registries can automatically scan images in ACR and provide actionable findings.

Answer

Enable anonymous image pulls

Answer

Store Kubernetes secrets in plain text ConfigMaps

Question 8

A SQL workload needs to protect sensitive column values from database administrators who should not see plaintext. Which two features may be relevant depending on the query requirement?

Accepted Answer

Always Encrypted. Always Encrypted (Option A) is correct because it ensures that sensitive column data is encrypted at the client side and never exposed in plaintext to the database engine, preventing database administrators from viewing the actual values. This feature protects data at rest and in transit between the client and server, making it ideal for scenarios where DBAs should not see plaintext column values.

Answer

Transparent Data Encryption only

Answer

Basic server firewall rule

Question 9

You are designing a secure storage strategy for an Azure Storage account that will host sensitive financial data. The solution must protect data at rest, in transit, and during processing. Which three of the following security controls should you implement? (Choose three.)

Accepted Answer

Enable Azure Storage encryption using customer-managed keys (CMK) stored in Azure Key Vault.. Customer-managed keys (CMK) in Azure Key Vault provide an additional layer of protection for data at rest by allowing you to control the encryption keys used by Azure Storage. Azure Defender for Storage detects anomalous access patterns and potential threats, protecting data during processing. Configuring firewalls and virtual network service endpoints restricts network access, securing data in transit by ensuring only trusted networks can communicate with the storage account.

Answer

Enable Azure Storage analytics logging with retention set to 90 days.

Answer

Configure a shared access signature (SAS) token with full account-level permissions for each user.

Answer

Use Azure Traffic Manager to distribute storage requests across multiple regions.

Question 10

Your company plans to deploy a set of Azure virtual machines (VMs) running a critical application. The security team requires that all operating system disks and temporary disks be encrypted, and that encryption keys are never stored in Azure but are managed in an on-premises HSM. Which three of the following actions should you take? (Choose three.)

Accepted Answer

Create a Key Vault access policy that grants the Azure Disk Encryption service principal the 'Wrap Key' and 'Unwrap Key' permissions.. Azure Disk Encryption (ADE) uses Azure Key Vault to protect encryption keys. To meet the requirement that keys are never stored in Azure but managed in an on-premises HSM, you must use Azure Dedicated HSM, which is a physical HSM appliance that you control and that can be integrated with on-premises key management. Additionally, you must configure a Key Vault access policy granting the Azure Disk Encryption service principal the 'Wrap Key' and 'Unwrap Key' permissions so that ADE can use the key encryption key (KEK) stored in the HSM. Enabling ADE with a KEK ensures that the disk encryption keys are wrapped (encrypted) by the KEK, and the KEK itself is stored and managed in the on-premises HSM via Azure Dedicated HSM.

Answer

Deploy the VMs with Azure Premium SSD managed disks and enable encryption at host.

Answer

Set the Key Vault firewall to allow only trusted Microsoft services to access the vault.

Answer

Configure the VMs to use Azure Disk Encryption with a passphrase-only approach (no KEK).

Question 11

You are securing an Azure SQL Database that contains personally identifiable information (PII). The solution must prevent unauthorized access to sensitive columns by privileged users (e.g., DBAs) and ensure that data is encrypted on the wire. Which three of the following should you implement? (Choose three.)

Accepted Answer

Enforce the use of TLS 1.2 or higher for all client connections to the database.. Always Encrypted with column-level encryption is correct because it ensures that sensitive PII columns are encrypted at the client side and the encryption keys are never revealed to the database engine, preventing privileged users like DBAs from reading the plaintext data. Configuring the Azure SQL Database firewall to block public endpoints and allow only specific virtual network subnets is correct because it restricts network access to trusted sources, reducing the attack surface. Enforcing TLS 1.2 or higher for all client connections is correct because it ensures data is encrypted in transit, protecting against man-in-the-middle attacks and meeting the requirement for encryption on the wire.

Answer

Create a database role with SELECT permissions on all tables and grant it to the DBA group.

Answer

Enable Azure SQL Database Auditing and set a retention policy of at least 90 days.

Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.

Question 12

Your organization is planning to use Azure Container Instances (ACI) and Azure Kubernetes Service (AKS) for running containerized workloads. The security policy mandates that container images be scanned for vulnerabilities, secrets never be stored in image layers, and network traffic between containers be encrypted. Which three of the following should you implement? (Choose three.)

Accepted Answer

Integrate Azure Container Registry (ACR) with Microsoft Defender for Containers to scan images on push.. Integrating ACR with Microsoft Defender for Containers enables vulnerability scanning of container images at rest and on push, ensuring images are free from known vulnerabilities before deployment. This directly addresses the mandate to scan images for vulnerabilities.

Answer

Enable Azure Policy for AKS to enforce that containers run with privileged access.

Answer

Store all secrets as Kubernetes Secrets and reference them in the container image definition.

Answer

Deploy ACI containers with a public IP address and rely on network security groups for encryption.

Question 13

You are a Security Engineer for a company that is migrating critical workloads to Azure. You need to ensure the security of compute, storage, and databases. Which of the following actions should you take? (Choose four.)

Accepted Answer

Enable Azure Defender for SQL to receive security alerts and vulnerability assessments for Azure SQL databases.. Enabling Azure Defender for SQL provides security alerts and vulnerability assessments for Azure SQL databases, which is essential for securing database workloads. This action directly addresses the requirement to ensure the security of databases by detecting threats and identifying misconfigurations.

Answer

Implement Azure Front Door WAF policies to protect against SQL injection and cross-site scripting attacks on virtual machines.

Answer

Use Azure Backup for virtual machines without enabling soft delete to ensure immediate permanent deletion of backup data.

Question 14

Drag and drop the steps to configure Azure Defender for SQL on an Azure SQL Database into the correct order.

Question 15

Drag and drop the steps to enable Azure Security Center's enhanced security features for a subscription into the correct order.