AZ-500 Secure compute, storage, and databases Practice Test 7 — 15 Questions

Question 1

Which TWO database-level security features are available in Azure SQL Database to protect sensitive data?

Accepted Answer

Always Encrypted. Always Encrypted is a database-level feature in Azure SQL Database that protects sensitive data by encrypting it at the client side, ensuring the database engine never sees the plaintext values. This provides strong separation between data owners and data custodians, as encryption keys are stored outside the database.

Answer

Azure Information Protection

Answer

Azure AD authentication

Answer

Azure Disk Encryption

Question 2

Refer to the exhibit. You are reviewing the JSON output of an Azure Storage account encryption configuration. What can you conclude about the encryption settings?

Accepted Answer

The storage account uses a customer-managed key from Azure Key Vault.. The JSON output shows that the storage account's encryption configuration includes a `keyvaulturi` and a `keyname`, which are the required properties for a customer-managed key (CMK) from Azure Key Vault. The presence of `keyvaulturi` and `keyname` indicates that the encryption key is not managed by the platform but by the customer, making option A correct.

Answer

The encryption configuration is incomplete because keyVersion is '1'.

Answer

Only blob storage is encrypted; file storage is not.

Answer

The storage account uses platform-managed keys (SSE).

Question 3

Refer to the exhibit. You are querying the sys.column_master_keys view in an Azure SQL Database. What is the purpose of this query?

Accepted Answer

To retrieve the column master key configuration for Always Encrypted.. The sys.column_master_keys view in Azure SQL Database specifically returns metadata about column master keys (CMKs) used by Always Encrypted. These keys protect the column encryption keys (CEKs) that encrypt sensitive data columns. Therefore, querying this view retrieves the column master key configuration for Always Encrypted, making option B correct.

Answer

To check the Dynamic Data Masking policies.

Answer

To verify the configuration of Transparent Data Encryption (TDE).

Answer

To list the encryption keys used for column-level encryption.

Question 4

Refer to the exhibit. You are reviewing an ARM template for an Azure Storage account. Which of the following is true about the deployment?

Accepted Answer

The storage account will enforce HTTPS traffic and replicate data to a paired region.. The ARM template configures the storage account with the 'supportsHttpsTrafficOnly' property set to true, which enforces HTTPS for all requests. Additionally, the 'sku.name' is set to 'Standard_GRS', which replicates data to a paired region for geo-redundancy. Therefore, option D correctly identifies both HTTPS enforcement and geo-replication to a paired region.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

The storage account will use locally redundant storage (LRS).

Answer

The storage account will have a firewall rule to restrict access to specific IPs.

Question 5

Your organization uses Azure Storage for sensitive financial data. You need to restrict access to storage accounts based on the client's IP address. Which Azure Storage service feature should you configure?

Accepted Answer

Firewalls and virtual networks. Firewalls and virtual networks allow you to restrict access to Azure Storage accounts based on source IP address ranges, including specific client IPs. This is the correct feature because it provides network-level access control that can block or allow traffic from defined IP addresses, which directly meets the requirement to restrict access based on the client's IP address.

Answer

Shared access signatures (SAS)

Answer

Azure Private Link

Answer

Azure AD role-based access control

Question 6

A company plans to migrate on-premises SQL Server databases to Azure SQL Managed Instance. The security team requires that all data at rest be encrypted using customer-managed keys stored in Azure Key Vault. Which feature should be enabled?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault is the correct choice because it encrypts the entire database at rest using a symmetric key, and the option to use customer-managed keys (CMK) in Azure Key Vault satisfies the security team's requirement for full control over encryption keys. TDE performs real-time I/O encryption and decryption of data and log files, and when combined with Azure Key Vault, it supports bring-your-own-key (BYOK) scenarios, ensuring compliance with regulatory mandates for customer-managed key storage.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Answer

Always Encrypted with secure enclaves

Question 7

You are designing a secure compute solution for a critical application that must comply with PCI DSS. The application runs on Azure Virtual Machines with sensitive data. You need to ensure that ephemeral disks are encrypted at the host level. Which Azure Disk Encryption option should you use?

Accepted Answer

Encryption at host. Encryption at host encrypts data at the VM host level, including ephemeral disks, before it is transmitted to Azure Storage. This meets the PCI DSS requirement for encrypting ephemeral disks at rest without relying on the guest OS or key management. It uses server-side encryption with platform-managed or customer-managed keys directly on the host node.

Answer

Server-side encryption (SSE) with platform-managed keys

Answer

Azure Disk Encryption (ADE) with Key Vault

Answer

Double encryption (SSE with CMK and ADE)

Question 8

Your company uses Azure SQL Database for a multitenant SaaS application. You need to ensure that one tenant cannot access another tenant's data, even if the application code has a bug. Which Azure SQL Database feature should you implement?

Accepted Answer

Always Encrypted. Always Encrypted ensures that sensitive data is encrypted at the client side and the encryption keys are never revealed to Azure SQL Database. This means that even if the application code has a bug that attempts to read another tenant's data, the database engine cannot decrypt it without the correct column encryption key, providing tenant isolation at the data level.

Answer

Dynamic Data Masking (DDM)

Answer

Azure SQL Database Auditing

Answer

Row-Level Security (RLS)

Question 9

A developer needs to securely connect to an Azure Storage account from a private virtual network without exposing the storage account to the public internet. Which Azure service should be used?

Accepted Answer

Azure Private Link. Azure Private Link enables private connectivity to Azure Storage from a virtual network by mapping the storage account to a private endpoint using a private IP address from the VNet. This ensures traffic never traverses the public internet, even though the storage account remains accessible via its public endpoint for other clients. It is the correct choice because it provides secure, private access without exposing the storage account to the public internet.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Service Endpoints

Question 10

Your security team wants to automatically detect and remediate misconfigurations in Azure Storage accounts, such as enabling public access. The solution should use Azure Policy and be centrally managed for multiple subscriptions. What should you configure?

Accepted Answer

Azure Policy with a custom initiative for storage security. Azure Policy with a custom initiative allows you to define a set of policies (e.g., 'Audit storage accounts with unrestricted public access') that can be assigned at a management group scope, covering multiple subscriptions. This enables automatic detection and remediation of misconfigurations like enabling public access, using built-in effects such as 'Deny' or 'DeployIfNotExists' to enforce compliance centrally.

Answer

Azure Blueprints

Answer

Azure Resource Graph

Answer

Microsoft Defender for Cloud (formerly Azure Security Center)

Question 11

A company is deploying Azure Virtual Machines for a batch processing workload. The VMs process highly sensitive data and must ensure that the data on the OS and data disks is encrypted using a customer-managed key stored in Azure Key Vault. Which encryption option meets the requirement?

Accepted Answer

Azure Disk Encryption (ADE). Azure Disk Encryption (ADE) uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt both OS and data disks at the volume level, ensuring data at rest is protected with customer-managed keys stored in Azure Key Vault. This meets the requirement for encrypting VM disks with a customer-managed key, as ADE directly integrates with Azure Key Vault for key management.

Answer

Encryption at host

Answer

Azure Storage Service Encryption

Answer

Server-side encryption (SSE) with customer-managed keys

Question 12

You need to ensure that Azure SQL Database connections are encrypted and the server's identity is verified. Which connection string parameter should be required?

Accepted Answer

Encrypt=True; TrustServerCertificate=False. Setting `Encrypt=True` forces TLS encryption for all data in transit between the client and Azure SQL Database, while `TrustServerCertificate=False` ensures that the server's TLS certificate is validated against a trusted certificate authority (CA). This combination provides both encryption and server identity verification, which is required for secure connections to Azure SQL Database.

Answer

Encrypt=Optional

Answer

TrustServerCertificate=True

Answer

Encrypt=False

Question 13

A critical application uses Azure Functions with an Azure Storage account for input and output. The security team requires that all data in transit between the function app and storage be encrypted using a customer-managed key. Which configuration should you implement?

Accepted Answer

Configure a site-to-site VPN between the function app and storage account. A site-to-site VPN between the function app and storage account allows the use of customer-managed IPsec keys for encrypting data in transit. Azure Functions can be integrated into a virtual network, and a VPN gateway can establish a site-to-site VPN to the storage account's VNet, ensuring all traffic is encrypted with customer-managed keys. Option A is incorrect because SMB 3.0+ encryption uses Azure-managed keys, not customer-managed keys. Option C only ensures HTTPS for client-to-function traffic, not function-to-storage transit. Option D uses managed certificates for domain validation, not for encrypting storage traffic.

Answer

Enable 'HTTPS Only' on the function app and use Azure Files for the function code with encryption in transit (SMB 3.0+)

Answer

Enable 'HTTPS Only' and use Key Vault references for storage connection strings

Answer

Use App Service managed certificates for the function app

Question 14

Which TWO actions should you take to secure an Azure Storage account that contains sensitive data? (Choose two.)

Accepted Answer

Disable public network access. Disabling public network access (Option A) ensures the storage account is only accessible over private endpoints or from trusted Azure services, blocking all internet-based traffic. This is a critical security control for sensitive data, eliminating the risk of unauthorized access via public endpoints. Enabling soft delete for blobs (Option B) protects against accidental or malicious deletion by retaining deleted data for a specified period. This is also a key security measure for sensitive data, helping to prevent data loss and support recovery after a security incident.

Answer

Enable geo-redundant storage (GRS)

Answer

Enable Azure AD authentication for blob and queue data

Answer

Generate a shared access signature (SAS) token with full permissions

Question 15

Which TWO of the following are valid ways to encrypt data at rest in Azure SQL Database? (Choose two.)

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) and Always Encrypted are two distinct methods for encrypting data at rest in Azure SQL Database. TDE encrypts the entire database at the file level, protecting data and log files on disk. Always Encrypted protects sensitive data at the column level, ensuring the data remains encrypted even during query processing. Both provide encryption at rest. Dynamic Data Masking obfuscates data in query results but does not encrypt data. Row-Level Security restricts access at the row level but does not encrypt. Azure Disk Encryption (ADE) is designed for Azure IaaS virtual machines, not for PaaS services like Azure SQL Database.

Answer

Dynamic Data Masking

Answer

Row-Level Security

Answer

Azure Disk Encryption (ADE)