AZ-500 Secure compute, storage, and databases Practice Test 8 — 15 Questions

Question 1

Your organization has an Azure Cosmos DB account that stores IoT telemetry data. The data is ingested from multiple devices and is time-sensitive. Security requirements mandate that all data be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. You configure CMK for the Cosmos DB account. After a security incident, you need to revoke access to the data immediately by disabling the CMK in Key Vault. However, you find that data can still be read from Cosmos DB. You need to ensure that disabling the key renders the data inaccessible. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the specific key version used by Cosmos DB in Key Vault.. To revoke access to data encrypted with customer-managed keys in Azure Cosmos DB, you must disable the key version that is currently used by the account. Disabling the key (the parent object) does not automatically disable existing key versions, so Cosmos DB can still unwrap the data encryption key using the still-enabled key version. Changing the default identity to a user-assigned managed identity without access is not the documented method for immediate revocation and is more disruptive. Therefore, the correct action is to disable the specific key version used by Cosmos DB.

Answer

Rotate the CMK to a new key version and update the Cosmos DB account to use the new key.

Answer

Delete the CMK from Key Vault.

Answer

Change the Cosmos DB account's default identity to a user-assigned managed identity and remove that identity's access to the Key Vault.

Question 2

Your company uses Azure Managed Disks for VMs running a production database. The disks are encrypted with Azure Disk Encryption (ADE) using Azure Key Vault. Security policy requires that all encryption keys be rotated every 90 days. You have automated key rotation in Key Vault. However, after rotating the key, you find that the disks are still using the old key. You need to ensure that the disks use the new key after rotation. What should you do?

Accepted Answer

Disable encryption on the VM, then re-enable ADE specifying the new key version.. Azure Disk Encryption (ADE) does not automatically re-encrypt disks when the key is rotated in Key Vault. To force the disk to use the new key version, you must disable encryption on the VM and then re-enable ADE, specifying the new key version. This triggers a re-encryption process that applies the updated key to the managed disks.

Answer

Delete the old key version from Key Vault to force the disk to use the new key.

Answer

No action is needed; ADE automatically re-encrypts disks with the new key after rotation.

Answer

Update the disk encryption set to reference the new key version; the disk will automatically use it.

Question 3

Your company has a large number of Azure SQL databases that contain personally identifiable information (PII). You need to classify and protect sensitive columns across all databases. The solution must automatically discover and label sensitive data, and enable auditing of access to that data. What should you implement?

Accepted Answer

Data Discovery & Classification. Azure SQL Database's Data Discovery & Classification automatically discovers sensitive columns, allows labeling, and integrates with auditing and vulnerability assessment. Option A is wrong because Dynamic Data Masking only masks data, it does not classify. Option B is wrong because Always Encrypted encrypts data at rest, but does not classify or audit. Option C is wrong because Microsoft Defender for SQL provides security alerts and vulnerability assessment, but not classification.

Answer

Always Encrypted with secure enclaves

Answer

Microsoft Defender for SQL

Answer

Dynamic Data Masking

Question 4

You need to secure a Linux virtual machine running a web application in Azure. The solution must ensure that only traffic on port 443 (HTTPS) is allowed from the internet, and that SSH access is restricted to a management subnet. What should you configure?

Accepted Answer

Network Security Group (NSG) on the VM NIC with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound. An NSG applied to the VM NIC allows granular control: inbound rules can allow HTTPS (port 443) from the Internet and SSH (port 22) only from the management subnet, while denying all other inbound traffic. This meets the requirements without affecting other resources. Option A is wrong because Azure Firewall is more complex and costly than necessary for this simple rule set. Option C is wrong because Application Security Groups do not filter traffic by themselves; they are logical groupings used in NSG rules. Option D is wrong because an NSG on the subnet would apply to all VMs in that subnet, which is broader than needed.

Answer

Azure Firewall with application rules to allow HTTPS and SNAT SSH traffic

Answer

Application Security Group with a network security group that allows HTTPS and SSH

Answer

Network Security Group on the subnet with inbound rules: Allow HTTPS from Internet, Allow SSH from management subnet, Deny all other inbound

Question 5

Your organization uses Azure Kubernetes Service (AKS) for containerized workloads. You need to ensure that only approved container images from a private Azure Container Registry (ACR) can run in the cluster. The solution must also enforce that pods run with least privilege. What should you configure?

Accepted Answer

Apply Azure Policy with built-in initiatives 'Kubernetes cluster containers should only use allowed images' and 'Kubernetes cluster pods should use specified service account'. Azure Policy for AKS (via the Azure Policy add-on and Gatekeeper/OPA) can enforce the built-in initiative that restricts container images to an allowed registry and enforces pod security controls such as requiring a specified service account, which addresses both the approved-images requirement and least-privilege enforcement. The 'Kubernetes cluster containers should only use allowed images' policy denies pods whose images do not originate from the approved ACR, while the service account policy constrains pods to a designated least-privilege identity. Option A does not restrict image sources (NetworkPolicy only controls pod-to-pod traffic) and Secrets merely supply pull credentials. Option B's ACR Tasks scan for vulnerabilities but do not block unapproved images at admission, and pod security policies are deprecated in current AKS. Option C's pod-managed identities and RBAC authenticate workloads to ACR but do not enforce which images may run or enforce least-privilege pod settings.

Answer

Create a Kubernetes NetworkPolicy to restrict pod-to-pod communication and use Secrets for image pull

Answer

Configure ACR tasks to scan images for vulnerabilities and use AKS pod security policies

Answer

Use Azure AD pod-managed identities to authenticate to ACR and assign RBAC roles

Question 6

Your company plans to use Azure SQL Managed Instance to store customer data. You need to comply with regulatory requirements for data encryption at rest and in transit, and you must ensure that only authorized applications can access the database. Which TWO actions should you take? (Choose two.)

Accepted Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys. Option A is correct because Transparent Data Encryption (TDE) with customer-managed keys (stored in Azure Key Vault) satisfies the encryption-at-rest requirement while giving the organization control over the key lifecycle, which regulators often demand for sensitive customer data in Azure SQL Managed Instance. Option C is correct because setting 'Encrypt=True' forces the client to negotiate TLS for the connection and 'TrustServerCertificate=False' enforces validation of the server certificate against a trusted CA, thereby guaranteeing encryption in transit and preventing man-in-the-middle interception. Option B is not selected because a virtual network rule restricts network reachability by subnet, which addresses network access control rather than the stated encryption and authorized-application requirements. Option D is not selected because Always Encrypted protects specific column data from the database engine and administrators, but it is a column-level confidentiality control, not the mechanism that fulfills the general encryption-at-rest and in-transit mandates. Option E is not selected because Microsoft Entra ID authentication strengthens identity and access management but does not itself provide encryption of data at rest or in transit.

Answer

Configure a virtual network rule to allow only specific subnets

Answer

Enable Always Encrypted for sensitive columns

Answer

Configure Azure AD authentication for the managed instance

Question 7

You are the Azure Security Engineer for a financial services company. The company has a multi-tier application deployed on Azure Virtual Machines (VMs) in a hub-spoke network topology. The application consists of web servers, application servers, and database servers. The database servers run SQL Server on Windows Server 2022 and store sensitive financial data. Compliance requires that all data at rest be encrypted using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, all network traffic between tiers must be encrypted, and the database must be accessible only from the application servers. You have the following resources: a Key Vault with an HSM-backed key (key1) for disk encryption, and a Key Vault with a software-protected key (key2) for SQL Server TDE. Current configuration: The web servers are in subnet A, application servers in subnet B, and database servers in subnet C. Network Security Groups (NSGs) allow traffic from subnet B to subnet C on TCP 1433. The database servers are not using TDE. You need to implement the required security controls. What should you do first?

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server instance using a service-managed key, then rotate to use key2 from Key Vault. The correct first step is option A: enable Transparent Data Encryption (TDE) on the SQL Server instance using a service-managed key, then rotate to use key2 from Key Vault. TDE is the SQL Server feature that encrypts data and log files at rest, and the requirement explicitly calls for customer-managed keys (CMK) stored in Key Vault, so starting with a service-managed key and then switching to key2 (the software-protected Key Vault key designated for TDE) satisfies the compliance mandate. Option B is wrong because Azure Disk Encryption with key1 protects the VM OS/data disks, not the SQL Server database files at the TDE layer, and key1 is designated for disk encryption rather than TDE. Option C is wrong because SQL authentication addresses login/access control, not encryption of data at rest. Option D is wrong because Always Encrypted protects specific columns in use and does not encrypt the entire database at rest as TDE does.

Answer

Enable Azure Disk Encryption on the database VMs using key1 from the HSM-backed Key Vault

Answer

Configure SQL Server to use SQL authentication and create a login for the application servers

Answer

Implement Always Encrypted for the sensitive columns using key2 from Key Vault

Question 8

You are a security engineer for a company that runs an Azure Kubernetes Service (AKS) cluster. The cluster hosts a multi-tenant application. You need to ensure that each tenant's pods can only access their own secrets and that the secrets are stored encrypted at rest with a customer-managed key. Which AKS feature should you enable to achieve this?

Accepted Answer

Azure Key Vault provider for Secrets Store CSI Driver. The Azure Key Vault provider for Secrets Store CSI Driver is the correct choice because it enables AKS pods to access secrets stored in Azure Key Vault, which can be encrypted with customer-managed keys. It also supports per-tenant isolation by using Azure RBAC and workload identity to restrict access to specific Key Vault instances or secrets. This meets both requirements: encryption at rest and tenant-specific secret access.

Answer

Kubernetes Secrets with etcd encryption using Azure Disk Encryption

Answer

Azure Policy for AKS with allowed secret scopes

Answer

Azure RBAC for Kubernetes Authorization with Azure AD integration

Question 9

You are a security engineer for a company that runs a customer-facing web application on an Azure Virtual Machine Scale Set. The application must be able to write to an Azure SQL Database using a system-assigned managed identity. The database server currently has Microsoft Entra authentication enabled. You need to ensure that the virtual machine scale set instances can obtain an access token for the database without storing credentials. What should you do?

Accepted Answer

Assign the system-assigned managed identity to the virtual machine scale set and create a contained database user mapped to that identity in the Azure SQL Database.. The system-assigned managed identity on the virtual machine scale set provides an automatically managed identity in Microsoft Entra ID that Azure SQL Database can recognize. Creating a contained database user mapped to that identity allows the application to authenticate without storing credentials, satisfying the security requirement. Other options either rely on secrets or misapply role assignments.

Answer

Create a service principal with a client secret, store the secret in Azure Key Vault, and configure the application to retrieve the secret at startup.

Answer

Configure the virtual machine scale set to use a user-assigned managed identity and grant it the Storage Blob Data Contributor role on the Azure SQL Database.

Answer

Enable Microsoft Entra authentication on the Azure SQL Database and use the virtual machine scale set's administrator credentials to connect.

Question 10

You are a security engineer for a company that uses Azure Virtual Machines. You need to ensure that the OS disks and data disks of the VMs are encrypted at rest using keys managed by your organization. Which Azure feature should you use?

Accepted Answer

Server-side encryption (SSE) with customer-managed keys. Server-side encryption with customer-managed keys is the correct choice because it allows you to encrypt managed disks using keys stored in Azure Key Vault. You create a disk encryption set that references the Key Vault key, and then associate it with your VMs. This provides encryption at rest with keys managed by your organization, satisfying the requirement.

Answer

Azure Confidential Computing with encrypted memory

Answer

Azure Disk Encryption (ADE)

Answer

Azure Storage Service Encryption (SSE) with platform-managed keys

Question 11

You are securing an Azure Kubernetes Service (AKS) cluster that hosts a multi-tenant application. You need to ensure that pods can access Azure Key Vault secrets without storing credentials in the cluster and that only authorized pods can retrieve specific secrets. Which two actions should you take? (Choose two.)

Accepted Answer

Deploy the Azure Key Vault Provider for Secrets Store CSI Driver and configure a SecretProviderClass with pod identity or workload identity.. Using the Azure Key Vault Provider for Secrets Store CSI Driver with workload identity allows pods to authenticate without credentials and retrieve only the secrets they are authorized for. Assigning a unique managed identity to each pod and granting access to specific secrets enforces least privilege. Together, these actions provide secure, credential-free access with pod-level isolation, which is essential for multi-tenant clusters.

Answer

Enable the AKS cluster's managed identity and grant it the Key Vault Secrets User role on the Key Vault.

Answer

Use Kubernetes secrets to store the Key Vault access keys and mount them as environment variables in the pods.

Answer

Enable Azure Key Vault firewall to allow only the AKS cluster's virtual network and use the cluster's kubelet identity to access secrets.

Question 12

You are a Security Engineer for a company that runs a Linux-based Azure Kubernetes Service (AKS) cluster. The security team wants to ensure that only trusted container images are deployed. You need to enforce that all images are signed and verified before deployment. Which two actions should you perform? (Choose two.)

Accepted Answer

Deploy an Open Policy Agent (OPA) Gatekeeper admission controller with a constraint template that verifies image signatures using the notation verifier.. To enforce signed container images in AKS, you need a mechanism to sign images and a verifying admission controller. The Notary Project (notation) provides signing and verification. An admission controller such as OPA Gatekeeper with a notation verifier (e.g., Ratify) can enforce that only signed images are admitted. Together, these actions ensure that images are signed and verified before deployment.

Answer

Configure Azure Container Registry (ACR) with content trust and enable Docker Content Trust on the AKS nodes.

Answer

Use Azure Policy to audit and deny pods that use images from untrusted registries.

Answer

Enable the Azure Policy add-on for AKS and assign the built-in policy initiative for Kubernetes pod security.

Question 13

You are a security engineer for a company that uses Azure Virtual Machines (VMs) running Windows Server. The company wants to encrypt the OS and data disks of these VMs using Azure Disk Encryption (ADE). The VMs are in a virtual network with no internet access, but they can reach Azure Key Vault via a private endpoint. You need to ensure that the encryption keys are stored in a key vault that is accessible to the VMs. What should you do?

Accepted Answer

Create a Key Vault with a private endpoint, and enable the 'Azure Disk Encryption for volume encryption' firewall exception on the key vault.. To allow ADE to access a key vault in a network-isolated environment, you must use a private endpoint and enable the Azure Disk Encryption firewall exception on the key vault. This exception permits the ADE extension to bypass the firewall and access the key vault. Managed identity and permissions are also required, but the firewall exception is the key step to ensure connectivity. Soft-delete and purge protection are recommended but not sufficient for access.

Answer

Create a Key Vault with a public endpoint, and configure the VMs to use a system-assigned managed identity to access the key vault.

Answer

Create a Key Vault with a private endpoint, and enable soft-delete and purge protection on the key vault.

Answer

Create a Key Vault with a private endpoint, and assign the VMs a managed identity with get and wrapKey permissions on the key vault.

Question 14

You are a security engineer for a company that uses Azure App Service to host a web application. The application connects to an Azure SQL Database using a connection string that includes a SQL username and password. The company wants to eliminate the need to store the password in the application configuration and instead use a managed identity for authentication. What should you do?

Accepted Answer

Enable a system-assigned managed identity on the App Service, and grant the identity access to the Azure SQL Database by creating a contained database user.. The correct approach is to enable a system-assigned managed identity on the App Service and create a contained database user in Azure SQL Database for that identity. This allows the application to authenticate without a password. The connection string can then use 'Authentication=Active Directory Managed Identity'. Other options either still involve secrets or omit necessary database permission configuration.

Answer

Enable a user-assigned managed identity on the App Service, and configure the connection string to use 'Authentication=Active Directory Managed Identity'.

Answer

Store the connection string in Azure Key Vault, and configure the App Service to retrieve it at runtime.

Answer

Configure the App Service to use an Azure AD service principal with a client secret, and store the secret in Key Vault.

Question 15

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.. When Azure Key Vault has a firewall that denies all public network access, the 'Allow trusted Microsoft services to bypass this firewall' setting is required for Azure SQL Database (a trusted Microsoft service) to authenticate using its system-assigned managed identity and access the customer-managed key for TDE. This setting allows the SQL server to reach the Key Vault over the Microsoft backbone network without requiring a private endpoint or VNet integration, as the service is explicitly trusted by Azure.

Answer

Configure a private endpoint for the SQL server to the Key Vault.

Answer

Change the Key Vault firewall to allow all Azure services.

Answer

Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.