AZ-500 Secure compute, storage, and databases Practice Test 5 — 15 Questions

Question 1

You are designing a backup strategy for Azure VMs running critical workloads. The VMs have Azure Disk Encryption enabled with Azure Key Vault. You need to ensure that backups can be restored securely. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Azure Backup with the same Key Vault that holds the encryption keys and allow Backup service access to Key Vault.. Azure Backup can restore encrypted VMs only if it has access to the encryption keys stored in Azure Key Vault. By configuring the backup vault to use the same Key Vault that holds the disk encryption keys and enabling the 'Allow Backup service to access Key Vault' permission, Azure Backup can read the keys during restore operations to decrypt the disks and re-encrypt them on the target VM. This ensures the backup and restore process maintains the encryption state without manual key management.

Answer

Create a separate Key Vault for backup vault and copy the keys there.

Answer

Disable encryption before backup and re-enable after restore.

Answer

Export the encryption keys to a secure location and import them during restore.

Question 2

You need to ensure that only users with a valid Azure AD token can invoke an Azure Function app. No other authentication methods should be allowed. What should you configure?

Accepted Answer

Enable App Service Authentication with Azure AD as the provider and set 'Action to take when request is not authenticated' to 'Log in with Azure AD'.. Enabling App Service Authentication with Microsoft Entra ID as the provider and setting 'Action to take when request is not authenticated' to 'Log in with Microsoft Entra ID' ensures that only requests with a valid Microsoft Entra ID token are allowed. This configuration rejects anonymous requests and redirects unauthenticated users to Microsoft Entra ID for token acquisition, enforcing token-based authentication exclusively.

Answer

Enable App Service Authentication and set the action to 'Log in with Azure AD' but allow anonymous requests.

Answer

Configure function-level authorization and require function keys.

Answer

Configure IP restrictions to allow only known IP ranges.

Question 3

You are configuring secure access to Azure Blob Storage for a third-party partner application that runs outside Azure. The partner needs to upload files to a specific container. You want to grant least-privilege access without storing static credentials in the partner's code. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Configure the storage firewall to allow access only from the partner's public IP address.. Option B is correct because restricting the storage account firewall to the partner's public IP address limits network access to only the trusted source, which is a valid least-privilege network control for an external application. Option C is correct because a user-delegation SAS token is secured with Microsoft Entra ID credentials, can be scoped to a specific container with only Write permission, and can be set to expire, avoiding static credentials in the partner's code. Option A is not appropriate because the storage account key grants full control over the entire storage account and is a static credential. Option D is not appropriate because managed identities are only available to resources running in Azure, not to an application outside Azure. Option E is not appropriate because assigning an RBAC role to an Microsoft Entra ID application still requires the external application to authenticate with Microsoft Entra ID and does not by itself provide the scoped, time-limited access needed here.

Answer

Provide the storage account key to the partner and instruct them to use it in their application.

Answer

Create a managed identity for the partner's application and grant it the Storage Blob Data Contributor role.

Answer

Assign the Storage Blob Data Contributor RBAC role to the partner's Azure AD application.

Question 4

You need to ensure that Azure Disk Encryption (ADE) is enabled on all Azure VMs in a subscription. Which THREE actions are required to implement ADE? (Choose THREE.)

Accepted Answer

Run the Set-AzVMDiskEncryptionExtension cmdlet on each VM.. Option A is correct because Set-AzVMDiskEncryptionExtension is the actual cmdlet that enables Azure Disk Encryption on a running Azure VM, applying the encryption extension to the OS and data disks. Option B is correct because ADE requires an Azure Key Vault to store the BitLocker encryption keys (Windows) or DM-Crypt passphrase (Linux), and the vault must have soft-delete and purge protection enabled so keys are recoverable and cannot be permanently deleted prematurely. Option E is correct because the ADE extension runs under the Microsoft.Azure.Security service principal (or the VM's managed identity in newer models), and it must be granted Key Vault Contributor (or equivalent key permissions such as wrapKey/unwrapKey/get) so it can write and read the secrets/keys used for encryption. Option C is not required because ADE can be enabled on a running VM; a restart may occur but powering off is not mandatory. Option D is not required because Azure Backup is a separate data-protection service and is not a prerequisite for enabling ADE.

Answer

Turn off the VMs before enabling encryption.

Answer

Configure Azure Backup for the VMs.

Question 5

You have an Azure virtual machine that runs a line-of-business application. You need to ensure that the disks attached to the VM are encrypted at rest using platform-managed keys. What should you do?

Accepted Answer

Enable Azure Disk Encryption on the VM. Azure Disk Encryption (ADE) uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt the OS and data disks of Azure VMs at rest. By default, ADE uses platform-managed keys unless you specify a customer-managed key in a disk encryption set. Therefore, enabling ADE on the VM meets the requirement for encryption at rest with platform-managed keys.

Answer

Configure a disk encryption set with a customer-managed key

Answer

Enable encryption at host on the VM

Answer

Enable Storage Service Encryption (SSE) on the storage account

Question 6

Your company stores sensitive documents in Azure Blob Storage. You need to implement a solution that automatically scans uploaded blobs for malware and quarantines any infected files. The solution must minimize administrative overhead and integrate with Azure Security Center. What should you use?

Accepted Answer

Enable Microsoft Defender for Storage and configure malware scanning. Microsoft Defender for Storage includes built-in malware scanning that automatically scans blobs upon upload and quarantines infected files by moving them to a separate container or applying a deny tag. This integrates natively with Azure Security Center (now part of Microsoft Defender for Cloud) and requires no custom infrastructure or manual intervention, minimizing administrative overhead.

Answer

Deploy Microsoft Sentinel and create an analytics rule to detect malware from storage logs

Answer

Create an Azure Policy to deny storage accounts without encryption

Answer

Enable Azure Firewall and configure application rules to inspect HTTPS traffic

Question 7

Your organization uses Azure Files shares with Azure AD DS authentication. You need to ensure that users can access the file share from on-premises Windows clients using their on-premises AD credentials, without exposing the storage account to the internet. The on-premises network is connected to Azure via a site-to-site VPN. What should you configure?

Accepted Answer

Enable AD DS authentication and configure a private endpoint for the storage account. It combines Microsoft Entra Domain Services authentication (which allows on-premises AD credentials to be used for Azure Files access) with a private endpoint, which places the storage account on the Azure virtual network and eliminates public internet exposure. The site-to-site VPN extends the on-premises network into Azure, so clients can reach the private endpoint directly without traversing the internet.

Answer

Enable AD DS authentication and configure a virtual network service endpoint

Answer

Enable AD DS authentication and configure a firewall rule to allow the on-premises VPN gateway public IP

Answer

Enable Azure AD DS authentication and configure a service endpoint

Question 8

Which TWO actions should you take to secure an Azure Cosmos DB account? (Choose two.)

Accepted Answer

Configure IP firewall rules to restrict access to trusted IP ranges. Option A is correct because configuring IP firewall rules on a Cosmos DB account restricts access to a defined set of trusted public IP addresses or ranges, blocking requests from any other network source at the service level. Option B is correct because using Microsoft Entra ID (Microsoft Entra ID) with managed identities lets applications authenticate to Cosmos DB without storing account keys or connection strings, eliminating a major credential-theft vector and enabling RBAC-based data-plane authorization. Option C is not among the marked correct answers, and while private endpoints are a valid network-isolation feature, disabling key-based authentication is a separate, optional hardening step rather than a required paired action here. Option D does not belong because the default consistency level (Strong, Bounded Staleness, Session, Consistent Prefix, Eventual) is a data-consistency and latency/throughput trade-off setting, not a security control. Option E does not belong because enabling public network access from all networks widens the attack surface and is the opposite of a security-hardening action.

Answer

Use a private endpoint and disable key-based authentication

Answer

Set the default consistency level to Strong

Answer

Enable public network access from all networks

Question 9

Which TWO security features can be enabled on an Azure SQL Database to protect sensitive data from unauthorized access by database administrators? (Choose two.)

Accepted Answer

Always Encrypted. Always Encrypted (B) is correct because it encrypts sensitive columns client-side so that the data encryption keys never reach the Azure SQL Database engine, meaning even database administrators with full server access cannot read the plaintext data. Row-Level Security (C) is correct because it enforces row-level access predicates inside the database, so a DBA querying the table only sees the rows permitted by the security policy, restricting unauthorized access to sensitive rows. Transparent Data Encryption (A) is not correct here because it only protects data at rest and decrypts transparently for anyone with database access, including administrators. Azure SQL Database firewall rules (D) control network-level access by IP range but do not restrict what an authorized administrator can view. Auditing (E) records activity for compliance and forensics but does not prevent an administrator from accessing sensitive data.

Answer

Transparent Data Encryption (TDE)

Answer

Azure SQL Database firewall rules

Answer

Auditing

Question 10

Your company has an Azure SQL Managed Instance that stores sensitive customer data. You need to implement a solution that automatically classifies and protects the sensitive data in the database, with minimal manual intervention. The solution should integrate with Microsoft Purview. What should you use?

Accepted Answer

Microsoft Defender for SQL (Data Discovery & Classification). Microsoft Defender for SQL includes the Data Discovery & Classification feature, which can automatically scan the Azure SQL Managed Instance for sensitive columns (e.g., credit card numbers, email addresses) and recommend or apply classification labels. This integrates natively with Microsoft Purview to centralize data governance and sensitivity tagging, requiring minimal manual intervention.

Answer

SQL Server Audit

Answer

Azure Policy with built-in SQL classification policy

Answer

Dynamic Data Masking

Question 11

Your company stores sensitive customer data in Azure Blob Storage. You need to ensure that data at rest is encrypted using a customer-managed key stored in Azure Key Vault. The key must be automatically rotated every 90 days. Which Azure policy should you configure to enforce this requirement?

Accepted Answer

Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault with automatic key rotation. It specifically targets Azure Blob Storage encryption with a customer-managed key stored in Azure Key Vault and includes the requirement for automatic key rotation every 90 days. This policy ensures that the encryption key is managed by the customer and rotated automatically to meet compliance requirements.

Answer

Configure encryption of Azure Blob Storage with customer-managed key stored in Azure Key Vault

Answer

Configure Transparent Data Encryption for Azure SQL Database with customer-managed key

Answer

Deploy encryption of Azure Blob Storage using Azure Disk Encryption

Question 12

You are deploying a virtual machine that will host a legacy application. The application writes temporary files to the local disk. You must ensure that any data written to the temporary disk is encrypted at rest with a platform-managed key. What should you do?

Accepted Answer

Enable encryption at host on the VM. Enabling encryption at host on the VM ensures that all data written to the temporary disk (as well as OS and data disks) is encrypted at rest using a platform-managed key. This feature encrypts data at the host level before it is written to the storage backend, covering the temp disk which is not a managed disk and thus not eligible for server-side encryption (SSE) alone. It meets the requirement of using a platform-managed key without requiring the VM to manage keys or perform OS-level encryption.

Answer

Enable Azure Disk Encryption on the VM

Answer

Configure storage service encryption on the managed disk

Answer

Use Always Encrypted with secure enclaves

Question 13

You are designing a secure Azure SQL Database deployment. The database must support real-time analytics and reporting without impacting the performance of the transactional workload. You need to ensure that the reporting queries have an isolated copy of the data that is automatically kept up to date. The solution must also encrypt the data at rest using a customer-managed key. What should you include in the design?

Accepted Answer

Hyperscale service tier with named replicas. Hyperscale service tier with named replicas provides a fully isolated, read-only copy of the database that is automatically kept up to date via log-based replication, ensuring real-time analytics do not impact the transactional workload. Additionally, Hyperscale supports Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault, meeting the encryption requirement.

Answer

Active geo-replication with a readable secondary

Answer

Serverless compute tier with auto-pause

Answer

Failover groups with automatic failover

Question 14

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Accepted Answer

Configure a private endpoint. Option C is correct because setting the minimum TLS version to 1.2 on the Cosmos DB account enforces that all client connections use TLS 1.2 or higher, directly satisfying the encryption-in-transit requirement. Option B is correct because a private endpoint assigns a private IP address from your virtual network to the Cosmos DB account, ensuring traffic stays on the Azure backbone and restricting access to only resources within that network/region rather than the public internet. Option A is incorrect because service endpoints only extend your VNet identity to the service over the Azure backbone but do not give Cosmos DB a private IP or fully eliminate public exposure the way a private endpoint does. Option D is incorrect because disabling public network access alone does not provide a private connectivity path and would block clients unless paired with a private endpoint. Option E is incorrect because firewall rules allowing 'Azure services' permit access from any Azure region, not only services within the same region.

Answer

Enable service endpoints for the Cosmos DB account

Answer

Disable public network access

Answer

Configure firewall rules to allow only Azure services

Question 15

You are responsible for securing Azure Storage accounts that contain confidential documents. You need to implement a solution that prevents accidental deletion of storage accounts and ensures that deleted blobs can be recovered within 30 days. Which two actions should you take?

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Option B is correct because enabling blob soft delete with a retention period of 30 days ensures that deleted blobs remain recoverable for exactly the required 30-day window, satisfying the recovery requirement. Option D is correct because a CanNotDelete resource lock on the storage account prevents accidental deletion of the storage account itself, which is the protection requirement. Option A is incorrect because an immutability policy (WORM) prevents modification or deletion of blob data for a retention interval but does not address accidental deletion of the storage account and is not the mechanism for 30-day blob recovery. Option C is incorrect because container soft delete only protects containers, not individual blobs, so it does not meet the requirement that deleted blobs be recoverable. Option E is incorrect because network rules blocking public access restrict connectivity and do not provide deletion protection or recovery capability.

Answer

Configure an immutability policy

Answer

Enable container soft delete

Answer

Configure network rules to block all public access