AZ-500 Secure compute, storage, and databases Practice Test 8 — 15 Questions

Question 1

Which TWO of the following are benefits of using managed identities for Azure resources to access Azure Storage? (Choose two.)

Accepted Answer

Eliminates the need to store credentials in code or configuration files. Managed identities for Azure resources provide an automatically managed identity in Azure AD, allowing applications to authenticate to Azure Storage without storing credentials in code or configuration files. This eliminates the security risk of hardcoded secrets and simplifies credential management by relying on Azure's automatic rotation of the identity's service principal credentials.

Answer

Replicates storage data across regions for disaster recovery

Answer

Enables federated identity with external identity providers

Answer

Provides granular auditing of all storage access

Question 2

You receive the above ARM template snippet for an Azure Storage account. After deployment, a developer reports that they cannot access the storage account from a permitted virtual network. What is the most likely cause?

Accepted Answer

No virtual network rules are defined, so all traffic is denied by default.. The ARM template snippet shows a storage account with network rules configured, but no virtual network rules are defined. By default, when network rules are set to 'DenyAll', all traffic is blocked unless explicitly allowed via a virtual network rule or an IP rule. Since no virtual network rules are present, the storage account denies all traffic, including from permitted virtual networks, unless the network rules are set to 'AllowAll' or specific rules are added.

Answer

The encryption services for blob and file are not enabled correctly.

Answer

The key version is pinned to an older version, causing encryption failures.

Answer

The Key Vault firewall is blocking access to the encryption key.

Question 3

You run the above PowerShell script to change the access tier of all block blobs in the 'data' container from Cool to Hot. However, you receive an error that the operation is not allowed. What is the most likely reason?

Accepted Answer

The storage account's firewall is blocking the request from the current IP address.. The error 'operation is not allowed' typically occurs when the storage account's firewall rules block the request. Even if the SAS token is valid and the script is correct, Azure Storage firewalls deny access from IP addresses not explicitly allowed, resulting in a 403 Forbidden error. The script itself appears to correctly target BlockBlobs and change the tier, so the most likely cause is a network-level restriction.

Answer

The script incorrectly filters for BlockBlob instead of PageBlob.

Answer

The storage account is using a shared access signature (SAS) token that has expired.

Answer

The access tier cannot be changed from Cool to Hot after 30 days of creation.

Question 4

You run the above Kusto query in Azure Monitor Logs for an Azure Storage account. The query returns results showing multiple failed attempts to access PDF blobs with 403 errors from various IP addresses. What is the most likely cause of these failures?

Accepted Answer

The storage account firewall is blocking requests from these IP addresses.. A 403 (Forbidden) error indicates that the request reached the storage account but was denied authorization. When a storage account firewall is configured to deny traffic from specific IP ranges, all requests from those IPs—including legitimate ones—are blocked with a 403 response. This aligns with the query showing multiple failed attempts from various IP addresses, as the firewall rules apply globally to all requests, regardless of the blob's public access setting or SAS validity.

Answer

Anonymous public access is enabled, but the blobs are not marked as public.

Answer

The PDF blobs have been deleted or moved to a different container.

Answer

The shared access signatures (SAS) used to access the blobs have expired.

Question 5

Your company uses Azure Storage to store sensitive customer data. You need to ensure that only authorized applications running on Azure VMs can access the storage account without using shared keys or SAS tokens. What should you configure?

Accepted Answer

Enable Azure Storage firewall, deny access from all networks, and add a private endpoint. Then assign a managed identity to the VMs and grant it the necessary RBAC role.. Azure Storage firewall with service endpoints or private endpoints, combined with managed identity, allows secure access without shared keys or SAS tokens. Option A (storage account key) is a shared key. Option C (SAS token) is a shared access signature. Option D (access keys) are shared keys.

Answer

Use Azure AD authentication with storage account access keys.

Answer

Configure a storage account key and distribute it to the applications.

Answer

Generate a SAS token with IP restrictions and embed it in the application code.

Question 6

You are configuring security for an Azure App Service web app that connects to an Azure SQL Database. You need to ensure that the database connection string does not contain credentials in plaintext. What should you use?

Accepted Answer

Store the connection string in Azure Key Vault and use a Key Vault reference in the App Service application settings.. Azure Key Vault provides a secure, centralized store for secrets like database connection strings. By using a Key Vault reference in the App Service application settings (e.g., @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/)), the connection string is never exposed in plaintext in configuration files or environment variables, and access is controlled via managed identities or service principals.

Answer

Store the connection string in the web.config file with encryption.

Answer

Store the connection string in Azure App Configuration with encryption.

Answer

Store the connection string in an App Service application setting without encryption.

Question 7

Your company uses Azure File shares for departmental file storage. You need to restrict access to only specific VMs in the same virtual network using Azure AD authentication. What should you configure?

Accepted Answer

Enable Azure AD DS authentication for Azure Files, configure private endpoints, and assign RBAC roles to the VMs' managed identities.. Azure Files supports identity-based authentication over SMB using Azure AD DS (or on-prem AD DS). To restrict access to specific VMs in the same VNet, you need to enable Azure AD DS authentication for Azure Files, configure private endpoints to ensure traffic stays within the VNet, and assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to the VMs' managed identities. This ensures only those VMs can access the share using their identity, without relying on shared keys or SAS tokens. Option B (storage account key) grants full access and cannot enforce per-VM restrictions. Option C (VNet firewall with Azure AD) lacks identity enforcement because firewall rules alone do not control which identities can connect. Option D (SAS with IP) is not suitable for SMB shares and does not support Azure AD authentication.

Answer

Use the storage account key and restrict access to the VNet via firewall.

Answer

Configure the storage firewall to allow only the VNet, and use Azure AD authentication.

Answer

Configure a SAS token with IP address restrictions.

Question 8

You are deploying a containerized application on Azure Kubernetes Service (AKS). The application needs to pull images from a private Azure Container Registry (ACR) and access secrets from Azure Key Vault. You want to minimize credential exposure. What should you configure?

Accepted Answer

Enable managed identity on the AKS cluster, grant the identity acrpull role on ACR, and use Azure Key Vault Provider for Secrets Store CSI Driver.. It uses AKS-managed identity (a form of Azure AD Pod Identity) to authenticate to ACR without storing any credentials in the cluster, and the Azure Key Vault Provider for Secrets Store CSI Driver mounts secrets directly into pods as volumes, eliminating the need for Kubernetes secrets. This approach minimizes credential exposure by relying on Azure AD authentication and managed identities, which are rotated automatically by Azure.

Answer

Use a service principal with certificate authentication, and rotate the certificate annually.

Answer

Create a service principal with a secret, assign it acrpull role, and store the secret in a Kubernetes secret for imagePullSecrets.

Answer

Enable the admin account on ACR and use the admin credentials in Kubernetes secrets.

Question 9

You need to ensure that an Azure Storage account's blob data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. What should you do first?

Accepted Answer

Create an Azure Key Vault with soft-delete and purge protection enabled.. To use a customer-managed key (CMK) for encrypting Azure Storage blob data, the key must be stored in an Azure Key Vault that supports the required lifecycle operations. Azure Key Vault must have both soft-delete and purge protection enabled to prevent permanent key deletion, which is a prerequisite for using CMK with Azure Storage. Without these features, the storage account cannot be configured to use the key, as Azure Storage requires the key to be recoverable.

Answer

Generate a random 256-bit key and store it in the storage account.

Answer

Create a system-assigned managed identity for the storage account.

Answer

Enable Azure Information Protection for the storage account.

Question 10

Your company uses Azure Database for PostgreSQL flexible server. You need to enable auditing of all database-level events and ensure audit logs are retained for compliance purposes for 5 years. What should you configure?

Accepted Answer

Enable server parameters for pgAudit, set audit log destination to Azure Monitor, and configure diagnostic settings to stream logs to a Log Analytics workspace with 5-year retention.. Azure Database for PostgreSQL flexible server supports the pgAudit extension for database-level auditing. To meet the 5-year retention requirement, audit logs must be sent to Azure Monitor via diagnostic settings, which allows you to configure a Log Analytics workspace with a retention period of up to 5 years. Writing logs to a database table (Option B) would not provide the required long-term retention and could impact performance.

Answer

Configure Azure SQL Database auditing and point it to the PostgreSQL server.

Answer

Enable the pgAudit extension and write audit logs to a database table.

Answer

Enable diagnostic settings on the subscription and select the PostgreSQL server.

Question 11

You are designing a backup strategy for Azure VMs running critical workloads. The VMs have Azure Disk Encryption enabled with Azure Key Vault. You need to ensure that backups can be restored securely. What should you configure?

Accepted Answer

Configure Azure Backup with the same Key Vault that holds the encryption keys and allow Backup service access to Key Vault.. Azure Backup can restore encrypted VMs only if it has access to the encryption keys stored in Azure Key Vault. By configuring the backup vault to use the same Key Vault that holds the disk encryption keys and enabling the 'Allow Backup service to access Key Vault' permission, Azure Backup can read the keys during restore operations to decrypt the disks and re-encrypt them on the target VM. This ensures the backup and restore process maintains the encryption state without manual key management.

Answer

Create a separate Key Vault for backup vault and copy the keys there.

Answer

Disable encryption before backup and re-enable after restore.

Answer

Export the encryption keys to a secure location and import them during restore.

Question 12

You need to ensure that only users with a valid Azure AD token can invoke an Azure Function app. No other authentication methods should be allowed. What should you configure?

Accepted Answer

Enable App Service Authentication with Azure AD as the provider and set 'Action to take when request is not authenticated' to 'Log in with Azure AD'.. Enabling App Service Authentication with Azure AD as the provider and setting 'Action to take when request is not authenticated' to 'Log in with Azure AD' ensures that only requests with a valid Azure AD token are allowed. This configuration rejects anonymous requests and redirects unauthenticated users to Azure AD for token acquisition, enforcing token-based authentication exclusively.

Answer

Enable App Service Authentication and set the action to 'Log in with Azure AD' but allow anonymous requests.

Answer

Configure function-level authorization and require function keys.

Answer

Configure IP restrictions to allow only known IP ranges.

Question 13

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement? (Choose TWO.)

Accepted Answer

Deploy Azure Web Application Firewall (WAF) in front of the application.. Azure Web Application Firewall (WAF) can inspect incoming HTTP/S traffic and block malicious patterns such as SQL injection payloads before they reach the application. By filtering requests at the edge, WAF provides a critical layer of defense against SQL injection attacks targeting Azure SQL Database.

Answer

Use Always Encrypted for sensitive columns.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable SQL Server auditing.

Question 14

You are configuring secure access to Azure Blob Storage for a third-party partner application that runs outside Azure. The partner needs to upload files to a specific container. You want to grant least-privilege access without storing static credentials in the partner's code. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Configure the storage firewall to allow access only from the partner's public IP address.. Configuring the storage firewall to allow access only from the partner's public IP address restricts network-level access without requiring any credentials in the partner's code. Option C is correct because a user-delegation SAS token, signed with Azure AD credentials, provides time-limited, least-privilege write access to the container and avoids storing static keys or secrets in the partner's application.

Answer

Provide the storage account key to the partner and instruct them to use it in their application.

Answer

Create a managed identity for the partner's application and grant it the Storage Blob Data Contributor role.

Answer

Assign the Storage Blob Data Contributor RBAC role to the partner's Azure AD application.

Question 15

You need to ensure that Azure Disk Encryption (ADE) is enabled on all Azure VMs in a subscription. Which THREE actions are required to implement ADE? (Choose THREE.)

Accepted Answer

Run the Set-AzVMDiskEncryptionExtension cmdlet on each VM.. The Set-AzVMDiskEncryptionExtension cmdlet is the PowerShell command used to enable Azure Disk Encryption on a VM. It applies the BitLocker (Windows) or DM-Crypt (Linux) encryption to the OS and data disks, leveraging Azure Key Vault to store encryption keys and secrets. This is the direct action to enable encryption on each VM.

Answer

Turn off the VMs before enabling encryption.

Answer

Configure Azure Backup for the VMs.