AZ-500 Secure compute, storage, and databases Practice Test 6 — 15 Questions

Question 1

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.

Question 2

Match each Azure RBAC role to its typical permission scope.

Question 3

Match each Azure Key Vault feature to its purpose.

Question 4

Match each Azure encryption concept to its description.

Question 5

Your organization uses Azure Storage for sensitive customer data. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, you want to automatically rotate the key every 90 days. What should you configure?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key and configure a key rotation policy in Azure Key Vault.. Option A is correct because Azure Storage encryption with CMK supports automatic key rotation via Key Vault key rotation policy. Option B is wrong because SSE with platform-managed key cannot use CMK. Option C is wrong because Azure Disk Encryption is for VMs, not storage accounts. Option D is wrong because client-side encryption shifts responsibility to the client and does not leverage Azure Key Vault automatic rotation.

Answer

Enable Azure Disk Encryption on the storage account and store the key in Key Vault with rotation policy.

Answer

Enable server-side encryption with a platform-managed key and use Azure Policy to enforce rotation.

Answer

Use client-side encryption with .NET client library and implement custom rotation logic.

Question 6

You have an Azure SQL Database that stores financial data. You need to prevent unauthorized access by encrypting specific columns containing credit card numbers. The solution must allow authorized applications to query the data transparently. What should you implement?

Accepted Answer

Always Encrypted. Option D is correct because Always Encrypted encrypts sensitive columns and allows authorized applications to decrypt transparently using the client driver. Option A is wrong because TDE encrypts the entire database at rest but does not provide column-level granularity or transparent querying for applications. Option B is wrong because Dynamic Data Masking only masks data but does not encrypt it. Option C is wrong because Azure Storage encryption applies to Azure Storage, not SQL Database.

Answer

Azure Storage service encryption

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 7

You need to securely store secrets, such as connection strings and API keys, for use by an Azure Functions app. The solution must automatically rotate the secrets and audit access. What should you use?

Accepted Answer

Azure Key Vault. Option B is correct because Azure Key Vault is designed to store secrets securely, supports automatic rotation, and provides auditing. Option A is wrong because App Settings are not encrypted at rest by default and do not support rotation or auditing. Option C is wrong because Azure Storage is not optimized for secrets management. Option D is wrong because Managed Identities provide identity, not secret storage.

Answer

Azure Blob Storage with encryption

Answer

Managed Identity

Answer

Application settings in the function app configuration

Question 8

Your company runs a critical application on Azure Virtual Machines. You need to ensure that the OS disks and data disks are encrypted to meet compliance requirements. The solution must use Azure Key Vault to store encryption keys and support automated backup. What should you implement?

Accepted Answer

Azure Disk Encryption (ADE). Option C is correct because Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt disks and integrates with Azure Key Vault. Option A is wrong because Azure Storage Service Encryption encrypts data at rest in storage accounts, not VM disks. Option B is wrong because Azure Backup does not provide encryption itself. Option D is wrong because Azure Confidential Computing is a different technology for protecting data in use.

Answer

Azure Backup with encryption using platform-managed keys

Answer

Azure Confidential Computing

Answer

Azure Storage Service Encryption (SSE)

Question 9

You are designing a security solution for Azure Cosmos DB that stores Personally Identifiable Information (PII). You need to encrypt data at rest and in transit. You also need to implement row-level security to restrict access based on user role. What should you configure?

Accepted Answer

Encryption at rest is automatically enabled; enforce TLS for transit; implement row-level security via application code.. Option D is correct because Cosmos DB encryption at rest is enabled by default and enforced through the service, transport encryption uses TLS, and row-level security is implemented using user-defined functions or stored procedures in the application layer. Option A is wrong because Always Encrypted is for SQL Server. Option B is wrong because Azure Disk Encryption is for VMs. Option C is wrong because Dynamic Data Masking is for SQL Server.

Answer

Enable Azure Disk Encryption on the Cosmos DB account.

Answer

Enable Always Encrypted and configure column encryption.

Answer

Use Dynamic Data Masking to restrict sensitive data.

Question 10

You have an Azure Storage account that contains sensitive documents. You need to generate a time-limited, secure URL that allows a specific user to download a file without requiring storage account keys. What should you use?

Accepted Answer

Shared Access Signature (SAS). Option A is correct because a shared access signature (SAS) token provides delegated access with time-limited permissions. Option B is wrong because a storage account key grants full access and cannot be time-limited. Option C is wrong because Azure RBAC does not generate URLs. Option D is wrong because Azure Front Door is a global load balancer, not a mechanism for generating secure URLs.

Answer

Azure Front Door custom domain

Answer

Storage account access key

Answer

Azure RBAC role assignment

Question 11

Your organization is using Azure Database for MySQL. You need to ensure that only traffic from Azure services and specific client IP addresses can connect to the database. What should you configure?

Accepted Answer

Firewall rules with 'Allow access to Azure services' enabled and specific IP rules. Option C is correct because Azure Database for MySQL uses firewall rules to allow specific IP ranges and an option to allow Azure services. Option A is wrong because NSGs are for virtual networks, not Azure PaaS databases directly. Option B is wrong because Azure AD authentication is for identity, not network access. Option D is wrong because VNet service endpoints are a more complex configuration, and the question doesn't specify a VNet.

Answer

Azure Active Directory authentication

Answer

Virtual Network service endpoints

Answer

Network Security Group (NSG) rules on the subnet

Question 12

You are deploying a three-tier application on Azure VMs. The web tier must be accessible from the internet, but the application and database tiers must only accept traffic from the web tier. You need to implement network segmentation using Azure networking components. What is the most secure and manageable solution?

Accepted Answer

Use separate subnets for each tier in the same VNet and configure NSGs to allow traffic only from the previous tier.. Option B is correct because placing each tier in separate subnets with NSGs restricting traffic to the previous tier provides network segmentation and is manageable. Option A is wrong because VNet peering connects separate VNets but doesn't provide fine-grained control within a single VNet. Option C is wrong because a single subnet with NSGs is less secure due to lack of isolation. Option D is wrong because Azure Firewall is more expensive and complex than NSGs for this scenario.

Answer

Use a single subnet and configure NSGs on VM NICs to restrict traffic.

Answer

Use VNet peering to connect separate VNets for each tier and use NSGs.

Answer

Use a single VNet with one subnet and use Azure Firewall to filter traffic between tiers.

Question 13

You need to ensure that an Azure Storage account is accessible only from a specific virtual network (VNet) and only over HTTPS. You also want to deny access from any public IP. What should you configure?

Accepted Answer

Configure storage firewall rules to deny all public IPs, add the VNet as a service endpoint, and enable 'Secure transfer required' (HTTPS).. Option D is correct because you can configure firewall rules to deny all public IPs, add the VNet as a service endpoint, and enable the 'Secure transfer required' property. Option A is wrong because NSG on the subnet is not sufficient to block public internet access to the storage account. Option B is wrong because private endpoint creates a private IP, but you also need to block public access. Option C is wrong because SAS token does not restrict network location.

Answer

Generate a SAS token and require HTTPS.

Answer

Configure a Network Security Group (NSG) on the subnet to deny all inbound traffic.

Answer

Configure a private endpoint for the storage account and disable public network access.

Question 14

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Accepted Answer

Implement Azure Web Application Firewall (WAF). Option B and Option C are correct. Using parameterized queries prevents SQL injection by separating data from code. Web Application Firewall (WAF) can filter malicious input before it reaches the database. Option A is wrong because TDE encrypts data at rest, not preventing injection. Option D is wrong because firewall rules control network access, not injection. Option E is wrong because Always Encrypted encrypts columns but does not prevent injection.

Answer

Enable Transparent Data Encryption (TDE)

Answer

Configure Azure SQL Database firewall rules

Answer

Enable Always Encrypted for sensitive columns

Question 15

You are designing a backup strategy for Azure Virtual Machines. Which THREE features should you enable to ensure recoverability and security?

Accepted Answer

Soft delete for backup data. Option A, Option B, and Option D are correct. Azure Backup provides automated backups. Soft delete prevents malicious deletion of backups. Encryption at rest secures backup data. Option C is wrong because geo-redundant storage (GRS) is a replication option, not a backup feature. Option E is wrong because Azure Site Recovery is for disaster recovery, not backup.

Answer

Geo-redundant storage (GRS)

Answer

Azure Site Recovery