AZ-500 Secure compute, storage, and databases Practice Test 8 — 15 Questions

Question 1

Your organization uses Azure Files shares. You need to ensure that users authenticate using on-premises Active Directory credentials and that access is logged. What should you do?

Accepted Answer

Enable identity-based authentication for Azure Files and configure diagnostic logs. Azure Files supports identity-based authentication using on-premises AD or Azure AD DS. Enable logging via diagnostic settings. Option D is correct. Option A is wrong because firewall does not authenticate users. Option B is wrong because SAS tokens are not identity-based. Option C is wrong because RBAC controls permissions but does not authenticate on-premises AD users.

Answer

Configure a firewall rule to allow on-premises IPs and enable diagnostic logs

Answer

Use shared access signatures (SAS) for access and enable diagnostic logs

Answer

Configure Azure RBAC for the share and enable diagnostic logs

Question 2

You have an Azure SQL Database that stores Personally Identifiable Information (PII). You need to mask the PII columns for support staff but allow full access to managers. What should you implement?

Accepted Answer

Dynamic Data Masking with a masking policy and grant UNMASK permission to managers. Dynamic Data Masking can mask columns based on user permissions. You can define masking rules and grant unmask permission to managers. Option A is correct. Option B is wrong because Always Encrypted prevents DBAs from seeing data entirely. Option C is wrong because column-level security controls access to rows. Option D is wrong because Azure Information Protection is for classification, not masking.

Answer

Always Encrypted with separate column encryption keys for managers

Answer

Azure Information Protection labels and encryption

Answer

Row-level security to restrict rows for support staff

Question 3

You are reviewing an Azure Resource Manager template for a storage account. The exhibit shows a snippet of the template. Which statement about the template is true?

Accepted Answer

The storage account will use Microsoft-managed keys for encryption.. The template shows encryption enabled for blob and file services using Microsoft-managed keys (keySource: Microsoft.Storage). Option A is correct. Option B is wrong because key source is not Key Vault. Option C is wrong because encryption is for both blob and file. Option D is wrong because encryption is not disabled.

Answer

Encryption is disabled for the storage account.

Answer

The storage account will use customer-managed keys from Azure Key Vault.

Answer

Encryption is enabled only for blob storage.

Question 4

You are deploying an Azure SQL Database with a security alert policy as shown in the exhibit. Which statement is true?

Accepted Answer

Alerts are enabled and notifications are sent to both account admins and admin@contoso.com.. The policy enables alerts, sends email to admins and a specific address, and retains alerts for 30 days. Option D is correct. Option A is wrong because retentionDays is 30, not 0. Option B is wrong because emailAccountAdmins is true. Option C is wrong because disabledAlerts is empty, so all alerts are enabled.

Answer

Email notifications are sent only to admin@contoso.com.

Answer

Alerts are not retained because retentionDays is set to 30.

Answer

All alerts are disabled because disabledAlerts is empty.

Question 5

You need to ensure that an Azure Storage account only allows access from a specific virtual network. Which configuration should you use?

Accepted Answer

Configure a service endpoint for Azure Storage and add the virtual network subnet to the firewall rules.. Service endpoints allow restricting access to Azure services from a specific virtual network. Option C is correct. Firewalls and IP rules are for public IP addresses, not VNets. Private endpoints provide private IP connectivity but do not block public access by default. Access keys don't restrict network access.

Answer

Enable Azure Private Link and assign a private endpoint.

Answer

Configure firewall rules to allow only the virtual network's public IP range.

Answer

Generate new storage account access keys and share them only with the virtual network.

Question 6

Your company uses Azure SQL Database. You need to ensure that all queries are audited for compliance. Which feature should you enable?

Accepted Answer

Enable SQL Auditing on the server and configure the audit log destination.. Azure SQL Auditing tracks database events and writes them to an audit log. Option A is correct. Vulnerability assessment identifies vulnerabilities. Advanced Threat Protection detects anomalous activities. Dynamic Data Masking hides sensitive data from non-privileged users.

Answer

Enable SQL Vulnerability Assessment.

Answer

Configure Dynamic Data Masking.

Answer

Enable Advanced Threat Protection.

Question 7

You are designing a solution to store sensitive documents in Azure Blob Storage. The documents must be encrypted at rest using a customer-managed key that is automatically rotated every 90 days. Microsoft Entra ID must be used to control access to the key. What should you use?

Accepted Answer

Azure Storage Service Encryption (SSE) with a customer-managed key stored in Azure Key Vault and configure key rotation.. Azure Key Vault with customer-managed keys and automatic rotation via Azure Policy or key rotation configuration meets the requirements. Option D is correct. SSE with PMK does not allow customer-managed keys. CSE uses client-side encryption, not server-side. Infrastructure encryption is additional encryption but does not involve customer key management.

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys.

Answer

Azure Storage encryption with infrastructure encryption enabled.

Answer

Client-side encryption (CSE) using Azure Key Vault.

Question 8

You need to prevent data from being exfiltrated from an Azure SQL Database by unauthorized users. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) policies can be applied to SQL Database to detect and prevent sensitive data exfiltration. Option B is correct. Information Protection focuses on classification and labeling. Insider Risk Management detects risky user activities. eDiscovery is for legal discovery.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Question 9

Your company has an Azure Cosmos DB account that stores customer profiles. You need to ensure that only authenticated and authorized users can access the data. Which access control method should you use?

Accepted Answer

Use Azure RBAC with Microsoft Entra ID authentication.. Azure RBAC for Cosmos DB provides fine-grained access control using Microsoft Entra ID authentication. Option C is correct. Primary keys provide full access and are not user-specific. Resource tokens are used for granular permission but require master keys. IP firewall restricts network access, not user access.

Answer

Configure an IP firewall rule to allow only corporate IP ranges.

Answer

Use primary read-write keys with connection strings.

Answer

Use resource tokens generated from a master key.

Question 10

You are deploying a critical application on Azure Virtual Machines that must remain highly available. You need to implement a security solution that ensures the application can recover from a ransomware attack that encrypts all data disks. What is the most cost-effective approach?

Accepted Answer

Configure Azure Backup with immutable vault and soft delete.. Azure Backup with immutable vault and soft delete protects against ransomware by preventing deletion and allowing recovery. Option B is correct. Azure Site Recovery is for disaster recovery, not ransomware recovery. Snapshots alone can be deleted by malware. Azure Files share backup is not applicable to VM disks.

Answer

Use Azure Files share with snapshots for the application data.

Answer

Enable Azure Site Recovery for the virtual machines.

Answer

Take daily snapshots of the disks and store them in the same storage account.

Question 11

You need to enable transparent data encryption (TDE) for an Azure SQL Managed Instance. What is the prerequisite?

Accepted Answer

No additional configuration is needed; TDE is enabled by default.. TDE at rest is enabled by default with a service-managed key. Option A is correct. Bring your own key (BYOK) requires Key Vault but is optional. TDE does not require a specific backup policy. Service endpoints are not required.

Answer

Configure a backup policy for the managed instance.

Answer

Enable a service endpoint for Azure SQL.

Answer

Create an Azure Key Vault and configure a customer-managed key.

Question 12

Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?

Accepted Answer

Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.. Identity-based authentication using Microsoft Entra ID allows per-user access control based on Microsoft Entra ID permissions. Option D is correct. Access keys provide full access to the share. SAS tokens grant time-limited access but not user-specific. Firewall rules only restrict network.

Answer

Configure a firewall rule to allow only corporate IP ranges.

Answer

Use storage account access keys to mount the file share.

Answer

Generate a shared access signature (SAS) with read permissions.

Question 13

You are deploying a multi-tier application on Azure Kubernetes Service (AKS). The application uses Azure Disks for persistent storage. You need to ensure that the disks are encrypted at rest using a customer-managed key stored in a Key Vault in a different region. What should you do?

Accepted Answer

Configure disk encryption set (DES) with a customer-managed key from a Key Vault in the same region as the disks.. Azure Disk Encryption with customer-managed keys requires the Key Vault to be in the same region as the disks. Option D is correct. Server-side encryption with PMK does not use customer keys. CMK must be in the same region. Azure Disk Encryption (ADE) with Key Vault also requires same region.

Answer

Enable Azure Disk Encryption (ADE) using Azure Key Vault in the same region as AKS.

Answer

Use server-side encryption (SSE) with platform-managed keys.

Answer

Use Azure Storage Service Encryption (SSE) with customer-managed keys from the remote Key Vault.

Question 14

Which TWO actions are required to enable Azure Defender for SQL on an Azure SQL Database?

Accepted Answer

Enable Advanced Data Security on the server.. Azure Defender for SQL requires enabling Advanced Data Security on the server and configuring a Microsoft Defender for Cloud pricing tier. Options B and D are correct. Enabling auditing is optional for Defender. Configuring vulnerability assessment is a separate feature. Enabling threat detection is part of the process but not listed separately as an action.

Answer

Configure SQL Vulnerability Assessment.

Answer

Enable threat detection policies at the database level.

Answer

Enable SQL Auditing.

Question 15

Which THREE capabilities are provided by Azure Storage Service Encryption (SSE) when using customer-managed keys?

Accepted Answer

Auditing of key usage via Azure Key Vault logs.. SSE with CMK provides automatic encryption, key rotation support, and audit of key usage. Options A, C, and D are correct. Client-side encryption is separate. Access control via RBAC is possible but not a capability of SSE itself.

Answer

Client-side encryption of data before upload.

Answer

Control access to the storage account using RBAC.