AZ-500 Secure compute, storage, and databases Practice Test 6 — 15 Questions

Question 1

You are securing an Azure Kubernetes Service (AKS) cluster that runs a microservices application. You need to ensure that pods can only communicate with other pods in the same namespace, and that all egress traffic from the cluster is inspected for malicious content. Which three components should you include in the solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kubernetes Network Policies. Kubernetes Network Policies (B) are the native mechanism in AKS to enforce pod-level segmentation, allowing you to define ingress rules that restrict pods to communicating only with pods in the same namespace. Azure Firewall (E) provides the Layer 3–7 inspection capability required to examine egress traffic for malicious content, including FQDN filtering, threat intelligence-based filtering, and IDPS. A user-defined route (D) is needed to force-tunnel egress traffic from the AKS cluster's subnet to Azure Firewall, ensuring all outbound traffic is routed through the firewall for inspection rather than bypassing it via the default internet path. Azure Application Gateway (A) is a Layer 7 HTTP(S) load balancer and WAF for ingress traffic, not a mechanism for pod-to-pod namespace isolation or egress inspection. Azure DDoS Protection (C) mitigates volumetric network attacks against public endpoints but does not provide pod-level segmentation or egress content inspection.

Answer

Azure Application Gateway

Answer

Azure DDoS Protection

Question 2

You are reviewing the above Azure Policy definition. What does this policy do?

Accepted Answer

Denies storage accounts that have the default network action set to Deny. This policy denies the creation or update of storage accounts where the default network action is set to 'Deny'. The default network action determines whether traffic is allowed when no network rule matches; setting it to 'Deny' means that only explicitly allowed traffic is permitted, effectively locking down the storage account. The policy enforces a security baseline by preventing storage accounts from being configured with a restrictive default action that could block legitimate access if not properly managed.

Answer

Denies storage accounts that do not have encryption enabled

Answer

Denies storage accounts that have firewall rules configured

Answer

Denies storage accounts that allow all network traffic

Question 3

You are deploying an Azure Disk Encryption set with the above ARM template snippet. What is the result of this configuration?

Accepted Answer

The disk uses double encryption with both platform-managed and customer-managed keys. The ARM template snippet configures Azure Disk Encryption with both a diskEncryptionSet (customer-managed key) and the encryptionType set to 'EncryptionAtRestWithPlatformAndCustomerKeys'. This enables double encryption, where data is encrypted at rest using both platform-managed keys and customer-managed keys, providing an additional layer of security. The configuration is valid and will succeed because the keyVersion is optional when using a disk encryption set; Azure automatically uses the latest key version if not specified.

Answer

The disk uses only customer-managed key encryption

Answer

The disk encryption will fail because keyversion is empty

Answer

The disk uses only platform-managed key encryption

Question 4

Your organization uses Microsoft Defender for Cloud to manage security posture. You have an Azure SQL Database that stores PII. You need to ensure that all sensitive columns are automatically discovered and classified. Additionally, you want to audit access to these columns. What should you configure?

Accepted Answer

Microsoft Defender for Cloud's data discovery and classification and Azure SQL Database auditing. Microsoft Defender for Cloud's data discovery and classification provides built-in capabilities to automatically discover, classify, and label sensitive columns (such as those containing PII) in Azure SQL Database. Azure SQL Database auditing then logs all access to these classified columns, enabling audit trails for compliance. Together, they meet the requirements for automatic discovery and audit of sensitive data.

Answer

Azure SQL Database Advanced Threat Protection and Azure SQL Database auditing

Answer

Azure Purview Data Map and Azure SQL Database auditing

Answer

Azure SQL Database Vulnerability Assessment and Azure SQL Database auditing

Question 5

You need to securely store connection strings and secrets for an Azure function app. The solution must automatically rotate the secrets every 90 days and provide audit logs for access. What should you use?

Accepted Answer

Azure Key Vault with key rotation policy and diagnostic logging. Azure Key Vault is the correct service for securely storing connection strings and secrets because it provides centralized secret management with access policies and audit logging via diagnostic logs. The key rotation policy can be configured to automatically rotate secrets every 90 days, meeting the requirement. Diagnostic logging captures all access attempts, satisfying the audit log requirement.

Answer

Azure SQL Database with Always Encrypted

Answer

Azure Cosmos DB with encryption at rest

Answer

Azure App Service application settings with slot-sticky settings

Question 6

You have an Azure SQL Managed Instance that hosts a line-of-business application. The application requires that all connections use Windows Authentication. You need to ensure that the authentication is secure and that the managed instance can integrate with on-premises Active Directory. What should you configure?

Accepted Answer

Configure Azure AD Kerberos authentication and set up a trust with on-premises Active Directory. Azure SQL Managed Instance requires Windows Authentication to integrate with on-premises Active Directory. Configuring Microsoft Entra ID Kerberos authentication with a trust to on-premises AD enables Kerberos ticket-based authentication, allowing the managed instance to accept Windows Authentication from on-premises clients without exposing credentials over the network.

Answer

Enable Always Encrypted with secure enclaves

Answer

Enable Azure AD authentication and configure passwordless sign-in

Answer

Configure VNet integration with a site-to-site VPN

Question 7

Your company has a policy to disable TLS versions older than 1.2 for Azure Storage accounts. You configure the minimum TLS version setting to 1.2. After a week, an audit reveals that some clients are still connecting with TLS 1.0. What is the most likely reason?

Accepted Answer

Some clients have established persistent connections before the change.. The most likely reason is that some clients established persistent connections (e.g., using HTTP keep-alive or long-lived TCP sessions) before the minimum TLS version was changed to 1.2. These connections continue to use the TLS version negotiated at the time of connection establishment, which could be TLS 1.0, and are not terminated by the configuration change. Only new connections are forced to use TLS 1.2 or higher.

Answer

Clients are accessing the storage account through a private endpoint with IP rules.

Answer

The storage account is configured to allow TLS 1.0 by default.

Answer

The setting does not apply to Azure Files.

Question 8

You are designing a secure data solution for a financial services company. Data must be encrypted at rest and in transit. Additionally, you need to prevent administrators from accessing the encryption keys. What should you use?

Accepted Answer

Azure Storage encryption with customer-managed keys and a key vault access policy that denies key operations for the admin group.. It combines Azure Storage service-side encryption (SSE) with customer-managed keys (CMK) stored in Azure Key Vault, and restricts key operations for administrators via a Key Vault access policy. This ensures data is encrypted at rest (SSE) and in transit (HTTPS enforced), while preventing admins from accessing the encryption keys by denying them cryptographic operations like 'unwrap key' or 'decrypt'.

Answer

Azure Storage encryption with service-side encryption and HTTPS enforced.

Answer

Azure Storage encryption with Microsoft-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Question 9

You need to ensure that only approved applications can access your Azure storage account. What should you configure?

Accepted Answer

Configure firewall rules to allow only specific virtual networks and IP addresses.. Configuring firewall rules to allow only specific virtual networks and IP addresses restricts access to your Azure storage account to traffic from approved sources. This ensures that only applications running in those trusted networks or with those IP addresses can access the storage, effectively blocking unauthorized applications. It is a network-level access control that works in conjunction with other security measures.

Answer

Use shared access keys for all storage account access.

Answer

Assign Azure RBAC roles to the storage account.

Answer

Use private endpoints and disable public network access.

Question 10

Your organization uses Azure Cosmos DB with API for MongoDB. You need to encrypt data at rest using a customer-managed key stored in Azure Key Vault, and you must ensure that the key is automatically rotated every year. What should you do?

Accepted Answer

Configure a customer-managed key in Key Vault and set the key rotation policy to auto-rotate annually.. Azure Cosmos DB supports customer-managed keys (CMK) via Azure Key Vault for data at rest encryption. By setting the key rotation policy in Key Vault to auto-rotate annually, you meet the requirement for automatic yearly rotation without manual intervention. This ensures compliance with security policies while maintaining control over the encryption key.

Answer

Enable server-side encryption with Microsoft-managed keys.

Answer

Use a customer-managed key and manually rotate it every year.

Answer

Enable infrastructure encryption on the Cosmos DB account.

Question 11

You need to protect Azure VM disks from unauthorized snapshot creation. Which configuration should you implement?

Accepted Answer

Assign the 'Reader' role to all users on the disk.. To prevent unauthorized snapshot creation, you must restrict the permission to create snapshots (Microsoft.Compute/snapshots/write) via RBAC or use an Azure Policy with Deny effect. Resource locks do not block snapshots, and auditing alone does not prevent them. None of the provided options correctly implements the required protection.

Answer

Apply a 'CanNotDelete' resource lock on the disk resource.

Answer

Configure Azure Backup for the VM.

Answer

Use Azure Policy to audit snapshot creation.

Question 12

Which three options are valid methods to authenticate to Azure Storage from on-premises servers?

Accepted Answer

Microsoft Entra ID authentication.. Microsoft Entra ID authentication (A) is valid because on-premises servers can authenticate to Azure Storage using Entra ID credentials via OAuth 2.0 tokens obtained through service principals, managed identities (where supported), or workload identity federation, and this is the recommended approach for Azure Files and Blob Storage. Storage account access keys (B) are valid because the storage account's two 512-bit shared keys grant full administrative access to the account and can be used directly by on-premises applications to sign requests via Shared Key authorization. SAS tokens generated from the storage account (D) are valid because a service, account, or user delegation SAS is a signed URL credential that grants scoped, time-limited access to storage resources and can be issued to and used by on-premises servers without exposing the account keys. X.509 certificate authentication (C) is not a native Azure Storage authentication method; certificates are used for things like service principals in Entra ID or TLS, not as a direct storage credential. Azure CLI login (E) is not itself an authentication method for storage access; it is a tool that obtains Entra ID tokens, so the underlying authentication is Entra ID (A), not the CLI login action.

Answer

X.509 certificate authentication.

Answer

Azure CLI login.

Question 13

Refer to the exhibit. You have an Azure Storage account with the encryption configuration shown. Users report that they cannot upload files to the storage account. What is the most likely cause?

Accepted Answer

The key version is pinned; if the key was rotated, the old version may be disabled.. When the encryption key version is pinned in the storage account's encryption settings, Azure Storage will attempt to use that specific version of the key from Azure Key Vault. If the key is rotated (a new version is created) and the old version is disabled or deleted, the storage account loses access to the encryption key, causing upload operations to fail. This is a common misconfiguration where the key version is explicitly set instead of leaving it blank to allow automatic use of the latest version.

Answer

The storage account does not have permissions to access the key vault.

Answer

The key vault URI is incorrect.

Answer

The encryption key source is set to Microsoft.Keyvault but should be Microsoft.Storage.

Question 14

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

Accepted Answer

Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.. Azure SQL Database TDE with customer-managed keys (CMK) in Key Vault is the only option that encrypts the database at rest using keys the customer controls, supports automatic key rotation via Key Vault rotation policies, and keeps the application from directly accessing the vault because TDE decryption happens transparently at the storage engine layer. Key Vault auditing (via diagnostic logs) satisfies the audit requirement, and the SQL service accesses the key through its managed identity on behalf of the app.

Answer

Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.

Answer

Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.

Answer

Implement Always Encrypted with column encryption keys stored in Azure Key Vault.

Question 15

You work for a financial institution that uses Azure Cosmos DB with API for NoSQL to store transaction data. The security requirements mandate: (1) All data at rest must be encrypted using customer-managed keys (CMK) stored in Azure Key Vault. (2) The encryption keys must be automatically rotated every 60 days. (3) Network access to the Cosmos DB account must be restricted to only specific virtual networks. (4) Access to the keys must be logged and monitored. (5) The Cosmos DB account must be configured to use private endpoints. You have configured the Cosmos DB account with CMK and private endpoints. However, after setting up automatic key rotation in Key Vault, the Cosmos DB account starts returning 403 (Forbidden) errors for some requests. What is the most likely cause?

Accepted Answer

The Cosmos DB account's key version property is outdated and must be updated manually.. When using CMK with Cosmos DB, if the account was configured with a specific key version (rather than a versionless key URI), automatic key rotation in Key Vault creates a new key version, but Cosmos DB continues to reference the old version. Once the old version is disabled or otherwise inaccessible, requests fail with 403 (Forbidden). The fix is to update the key version in the Cosmos DB account or configure the account to use the latest key version. Access policies are scoped to the key itself, not individual versions, so if the policy is correct it will apply to new versions as well. Therefore, option C is the most likely cause.

Answer

The private endpoint connection is not approved.

Answer

The key vault access policy does not grant the Cosmos DB account necessary permissions on the new key version.

Answer

The firewall rules are blocking the Cosmos DB account from accessing Key Vault.