AZ-500 Secure compute, storage, and databases Practice Test 6 — 15 Questions

Question 1

Which TWO actions are required to enable Azure Defender for SQL on an Azure SQL Database?

Accepted Answer

Enable Advanced Data Security on the server.. Enabling Azure Defender for SQL on an Azure SQL Database requires two actions at the server level. First, you must enable Advanced Data Security (ADS) on the logical server, which is the foundational security package that includes vulnerability assessment, threat detection, and data discovery. Second, you must enable the Microsoft Defender for Cloud plan for SQL servers, which activates the Defender for SQL (formerly Azure Defender for SQL) features, including threat detection and advanced threat protection. These two steps together activate the full Azure Defender for SQL capabilities for all databases on that server.

Answer

Configure SQL Vulnerability Assessment.

Answer

Enable threat detection policies at the database level.

Answer

Enable SQL Auditing.

Question 2

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. Azure Storage Service Encryption (SSE) with customer-managed keys integrates with Azure Key Vault, which can be configured to log key operations such as encrypt, decrypt, wrap, and unwrap. These logs are sent to Azure Monitor or a storage account, enabling auditing of key usage for compliance and security monitoring.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.

Question 3

Which TWO features of Azure Database for PostgreSQL ensure data security at rest?

Accepted Answer

Infrastructure double encryption. Infrastructure double encryption (Option B) is a valid feature for Azure Database for PostgreSQL that provides data encryption at rest using two independent encryption layers: server-side encryption with service-managed keys and an additional hardware-based encryption at the storage infrastructure layer. Transparent Data Encryption (TDE) (Option C) is also a correct feature, as it encrypts the database files (data and logs) at rest using a symmetric key, ensuring data is encrypted when written to disk and decrypted when read by the application. Both options meet the requirement for data security at rest.

Answer

Firewall rules

Answer

Advanced Threat Protection

Answer

Auto-tuning

Question 4

You are reviewing the ARM template for an Azure Disk Encryption Set. The template includes the JSON snippet shown. You notice that the key version is empty. What is the consequence?

Accepted Answer

The encryption set will automatically use the latest version of the key.. When the key version is omitted in an Azure Disk Encryption Set ARM template, the encryption set automatically uses the latest version of the key from the specified Azure Key Vault. This behavior allows the encryption set to stay updated with key rotations without requiring manual template updates, as Azure Disk Encryption Sets support automatic key version updates when no version is specified.

Answer

The encryption set will use a platform-managed key.

Answer

The encryption set will use the key name without any version, causing it to fail.

Answer

The deployment will fail because a key version is required.

Question 5

You are deploying an Azure Storage account using the ARM template snippet shown. After deployment, you need to allow access from a specific public IP address. What should you do?

Accepted Answer

Add an IP rule to the ipRules array with the public IP address.. The ARM template snippet includes a `networkAcls` section with `defaultAction` set to `Deny`, which blocks all traffic by default. To allow access from a specific public IP address, you must add an IP rule to the `ipRules` array, specifying the public IP address in CIDR notation (e.g., "20.10.10.10"). This overrides the default deny for that specific IP, enabling access while keeping the storage account locked down from other public traffic.

Answer

Create a private endpoint and assign it to the storage account.

Answer

Configure a service endpoint for the storage account.

Answer

Update the defaultAction to Allow and set ipRules to deny the IP.

Question 6

You run the PowerShell cmdlet shown in the exhibit for an Azure SQL Database. What is the security implication?

Accepted Answer

The database is not protected against anomalous activities.. The cmdlet shown is `Set-AzSqlDatabaseVulnerabilityAssessmentSettings`, which enables Vulnerability Assessment (VA) but does not enable Advanced Threat Protection (ATP). Without ATP, the database lacks anomaly detection capabilities such as SQL injection detection, brute-force attack alerts, and unusual access pattern monitoring. Therefore, the database is not protected against anomalous activities, making option B correct.

Answer

Auditing of database queries is not configured.

Answer

The database firewall allows all public IP addresses.

Answer

Transparent data encryption is not enabled.

Question 7

You are deploying a new application on Azure VMs. The application must be encrypted at rest and during transmission. Which combination of features should you implement?

Accepted Answer

Azure Disk Encryption and HTTPS. Azure Disk Encryption (ADE) provides at-rest encryption for Azure VM disks using BitLocker (Windows) or DM-Crypt (Linux), while HTTPS ensures encryption in transit between the client and the application. Together, they satisfy the requirement for encryption both at rest and during transmission.

Answer

Azure Firewall and Azure Disk Encryption

Answer

Azure Storage Service Encryption and SSL

Answer

Azure Disk Encryption and SSL

Question 8

Your company uses Azure SQL Database. You need to ensure that all queries from a specific application use Always Encrypted to protect sensitive columns. The application is developed in C#. What must you configure in the application and database?

Accepted Answer

Define column master key and column encryption key in the database, and update the connection string to include 'Column Encryption Setting=enabled'.. Always Encrypted requires a column master key and column encryption key to be defined in the database to encrypt sensitive columns, and the client application must enable the feature in its connection string by adding 'Column Encryption Setting=enabled'. This ensures that encryption and decryption occur on the client side, protecting data in transit and at rest from the database engine.

Answer

Enable Transparent Data Encryption (TDE) on the database and use integrated security.

Answer

Configure Dynamic Data Masking and use ODBC driver.

Answer

Use Azure Information Protection labels and configure the application to enforce protection.

Question 9

You need to restrict access to an Azure Storage account so that only traffic from a specific virtual network (VNet) subnet is allowed. Which Azure Storage firewall setting should you configure?

Accepted Answer

Add a virtual network rule that references the VNet and subnet.. Azure Storage firewalls support virtual network rules that allow traffic only from a specific VNet and subnet. When you add a virtual network rule, you reference the VNet's resource ID and the subnet's name, and the storage account will only accept requests originating from that subnet. This is the precise mechanism for restricting access to a subnet without exposing public IP addresses.

Answer

Create a private endpoint for the storage account.

Answer

Enable service endpoints on the subnet and add an IP rule.

Answer

Add a firewall rule with the subnet's public IP address range.

Question 10

You have an Azure Cosmos DB account with multiple containers. You need to ensure that data is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which steps should you take?

Accepted Answer

Configure the Cosmos DB account to use a customer-managed key from Key Vault and assign the appropriate RBAC role.. Azure Cosmos DB supports encryption at rest using customer-managed keys (CMK) stored in Azure Key Vault. To enable this, you must configure the Cosmos DB account to use a CMK from Key Vault and assign the appropriate RBAC role (e.g., 'Key Vault Crypto Service Encryption User') to the Cosmos DB system-assigned managed identity, allowing it to access the key for encryption and decryption operations.

Answer

Use Azure Disk Encryption on the VMs hosting Cosmos DB.

Answer

Enable Transparent Data Encryption (TDE) and bring your own key (BYOK) from Key Vault.

Answer

Enable Always Encrypted on the Cosmos DB account and reference the key from Key Vault.

Question 11

You need to backup Azure SQL Managed Instance databases to a separate region for disaster recovery. Which Azure service should you use?

Accepted Answer

Azure Backup with geo-redundant storage. Azure Backup with geo-redundant storage (GRS) is the correct service because it provides a managed backup solution for Azure SQL Managed Instance that supports cross-region disaster recovery. By configuring the Backup Vault with GRS, backups are automatically replicated to a paired secondary region, ensuring data durability and recoverability during a regional outage. This aligns with the requirement to back up databases to a separate region without needing to manage replication or failover logic.

Answer

Active geo-replication

Answer

Geo-redundant storage (GRS) for Azure Storage

Answer

Azure Site Recovery

Question 12

Your company uses Azure Blob Storage to store sensitive documents. You need to prevent data exfiltration by ensuring that all access to the storage account is through Microsoft's private network. What should you configure?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. Creating a private endpoint for the storage account assigns it a private IP from your virtual network, and disabling public network access ensures that all traffic to the storage account is routed through Microsoft's backbone network, preventing data exfiltration over the public internet. This configuration effectively isolates the storage account to your private network, meeting the requirement to block all public access.

Answer

Apply a network security group (NSG) to the subnet with a deny rule for internet traffic.

Answer

Set the firewall to deny all and add a rule to allow only your VNet's public IP.

Answer

Enable service endpoints and configure a service endpoint policy.

Question 13

You have an Azure SQL Database that stores credit card numbers. You need to encrypt the column containing the credit card numbers so that only authorized applications can decrypt the data. The database administrator should not be able to view the plaintext data. Which feature should you use?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves (Option D) is correct because it ensures that credit card numbers are encrypted at rest and in memory, and only client applications with the column encryption key can decrypt the data. The database administrator (DBA) cannot access the plaintext because the encryption keys are never revealed to SQL Server or Azure SQL Database, and secure enclaves allow rich computations (e.g., equality, pattern matching) on encrypted data without exposing the plaintext to the database engine.

Answer

Transparent Data Encryption (TDE)

Answer

Column-level encryption using SQL Server built-in functions

Answer

Dynamic Data Masking

Question 14

You need to ensure that all new blobs uploaded to an Azure Storage account are automatically encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Enable Azure Storage Service Encryption (SSE) on the storage account.. Azure Storage Service Encryption (SSE) automatically encrypts data at rest for all storage accounts using 256-bit AES encryption, and it is enabled by default for new storage accounts. This ensures that any new blobs uploaded are encrypted without requiring any application changes or additional configuration, making it the simplest solution.

Answer

Use Azure Disk Encryption on any VMs writing to storage.

Answer

Implement client-side encryption in the application.

Answer

Configure a customer-managed key in Azure Key Vault.

Question 15

Which TWO actions should you take to ensure that an Azure Storage account is only accessible over HTTPS and that data in transit is encrypted?

Accepted Answer

Set 'Secure transfer required' to Enabled.. Enabling 'Secure transfer required' on an Azure Storage account rejects any HTTP requests and enforces HTTPS for all data in transit. Option D is correct because setting the minimum TLS version to 1.2 ensures that only clients using TLS 1.2 or higher can connect, which prevents downgrade attacks and enforces strong encryption for data in transit.

Answer

Configure a custom domain with HTTPS enabled.

Answer

Deploy Azure Firewall in front of the storage account.

Answer

Use Azure Private Link to connect to the storage account.