AZ-500 Secure compute, storage, and databases — Timed 10 Questions

Question 1

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.. Option B is correct because when Azure Key Vault has a firewall that denies all public network access, the 'Allow trusted Microsoft services to bypass this firewall' setting is required for Azure SQL Database (a trusted Microsoft service) to authenticate using its system-assigned managed identity and access the customer-managed key for TDE. This setting allows the SQL server to reach the Key Vault over the Microsoft backbone network without requiring a private endpoint or VNet integration, as the service is explicitly trusted by Azure.

Answer

Configure a private endpoint for the SQL server to the Key Vault.

Answer

Change the Key Vault firewall to allow all Azure services.

Answer

Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.

Question 2

A company stores sensitive files in Azure Files shares. They require that data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault, and that all client connections use SMB 3.0 encryption for end-to-end encryption in transit. They create a premium Azure Files share in a storage account and configure encryption at rest with a CMK. However, clients are unable to connect without SMB encryption. What additional configuration is necessary to enforce SMB encryption for all connections?

Accepted Answer

Enable 'Secure transfer required' in the storage account's configuration to enforce SMB 3.0 encryption.. Option B is correct because enabling 'Secure transfer required' on the storage account enforces that all client connections use SMB 3.0 with encryption, which is necessary for end-to-end encryption in transit. Even though encryption at rest is configured with a CMK, the storage account does not automatically require encrypted connections; this setting explicitly denies unencrypted SMB 2.1 or SMB 3.0 without encryption.

Answer

No additional configuration is needed; Azure Files uses SMB encryption by default and cannot be disabled.

Answer

Configure a network security group (NSG) rule to block SMB traffic on port 445 that does not use encryption.

Answer

Set the Azure Files share to use the 'Premium' performance tier; encryption is only available on premium shares.

Question 3

A company stores sensitive files in Azure Files shares. They require encryption at rest using customer-managed keys (CMK) and encryption in transit using SMB 3.0 encryption. They have created a premium Azure Files share in a storage account and configured encryption at rest with a CMK. However, clients are able to connect without enforcing SMB encryption. What additional configuration is necessary to ensure that all connections to the file share are encrypted in transit?

Accepted Answer

Enable the 'Secure transfer required' property on the storage account.. Enabling the 'Secure transfer required' property on the storage account enforces encryption in transit for all client connections, including SMB 3.0 encryption for Azure Files. Without this setting, clients can connect using unencrypted SMB 2.1 or SMB 3.0 without encryption, even if the file share itself supports encryption. This property is a storage account-level flag that rejects any request not using HTTPS or SMB 3.0 with encryption.

Answer

Configure a network security group (NSG) to allow only encrypted traffic.

Answer

Set the minimum SMB protocol version to 3.0 on the file share.

Answer

Create a service endpoint for the storage account.

Question 4

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?

Accepted Answer

Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.. Option B is correct because Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.

Answer

Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.

Answer

Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.

Answer

Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.

Question 5

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key stored in Azure Key Vault. The Key Vault has a firewall enabled that blocks all public network access. The SQL server has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. Despite this, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required?

Accepted Answer

Configure the Key Vault firewall to allow trusted Microsoft services to bypass the firewall.. The Key Vault firewall blocks all public network access, so even though the SQL server has the correct managed identity and role assignment, the connection is denied by the firewall. By enabling the 'Allow trusted Microsoft services to bypass this firewall' setting, Azure SQL Database (a trusted Microsoft service) can connect to the Key Vault without exposing it to the public internet. This is the required additional configuration to resolve the TDE access failure.

Answer

Enable the Azure SQL Database server's firewall to allow Azure services to access the server.

Answer

Assign a user-assigned managed identity to the SQL server instead of a system-assigned identity.

Answer

Change the Key Vault firewall to allow all networks.

Question 6

A company uses Azure SQL Database. They want to ensure that all data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. They also require that the key is automatically rotated every 12 months. Which two actions must be configured to meet this requirement? (Select two.)

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key.. Option A is correct because Transparent Data Encryption (TDE) with a customer-managed key (CMK) stored in Azure Key Vault is the mechanism that encrypts Azure SQL Database data at rest using a key you control. This meets the requirement for CMK-based encryption. Option B is correct because Azure Key Vault supports automatic key rotation on a schedule; by configuring a rotation policy (e.g., every 12 months), the key used for TDE is automatically replaced, satisfying the rotation requirement.

Answer

Configure Azure SQL Database auditing to log key usage.

Answer

Enable Azure Information Protection for the database.

Question 7

A company plans to enable Azure Disk Encryption (ADE) on a set of Windows virtual machines using a Key Encryption Key (KEK) stored in Azure Key Vault. They have enabled soft-delete and purge protection on the Key Vault. The encryption fails with an error indicating that the key vault does not have the required permissions. Which additional configuration is most likely required for ADE to use the KEK?

Accepted Answer

Configure the key vault access policy to grant the Azure Disk Encryption service (or the VM's managed identity) the 'Key Vault Crypto Service Encryption User' role.. Azure Disk Encryption (ADE) requires the Key Vault to have an access policy that grants the Azure Disk Encryption service (or the VM's managed identity) the 'Key Vault Crypto Service Encryption User' role. This role provides the necessary cryptographic permissions (e.g., 'wrapKey' and 'unwrapKey') to use the Key Encryption Key (KEK) for encrypting and decrypting the Disk Encryption Key (DEK). Without this specific role assignment, the encryption operation fails with a permissions error, even if soft-delete and purge protection are enabled.

Answer

Enable the key vault for deployment by setting the 'Enabled for deployment' access policy.

Answer

Enable the key vault for disk encryption by setting the 'Enabled for Azure Disk Encryption' access policy.

Answer

Add the 'Storage Account Contributor' role for the VMs to access the key vault.

Question 8

A company uses Azure Disk Encryption (ADE) on Windows virtual machines. They use a key encryption key (KEK) stored in Azure Key Vault to wrap the disk encryption key. The security policy requires that the KEK be automatically rotated every 90 days. They need to ensure that after rotation, the OS and data disks of running VMs automatically get re-wrapped with the new KEK version. Which configuration should they implement?

Accepted Answer

Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).. Option B is correct because Azure Key Vault supports automatic key rotation with a configurable rotation period, and when a disk encryption set (DES) is configured with an empty string as the key version, it automatically uses the latest version of the KEK. This ensures that after the KEK is rotated every 90 days, the running VMs' OS and data disks are re-wrapped with the new KEK version without manual intervention or VM restart.

Answer

Enable soft-delete and purge protection on the Key Vault.

Answer

Create a new KEK every 90 days and modify the disk encryption set to point to the new key version.

Answer

Use Azure Policy to enforce automatic key rotation.

Question 9

An Azure Storage account is configured with server-side encryption (SSE) using a customer-managed key stored in Azure Key Vault. The security team requires that the storage account's identity be used to authenticate to the key vault for key access. Additionally, they want the identity to be automatically deleted when the storage account is deleted. Which type of identity should they assign to the storage account?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied to the lifecycle of the Azure resource (the storage account) and is automatically deleted when the resource is deleted. This identity can be used to authenticate to Azure Key Vault for accessing the customer-managed key used in server-side encryption (SSE), satisfying the security team's requirement for automatic deletion upon storage account deletion.

Answer

User-assigned managed identity

Answer

Service principal

Answer

Azure AD user account

Question 10

A company uses Azure SQL Database with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server has a system-assigned managed identity assigned the 'Key Vault Crypto Service Encryption User' role. However, TDE operations are failing because the SQL server cannot access the Key Vault. What additional configuration is needed?

Accepted Answer

Enable the Key Vault firewall to allow trusted Microsoft services. When Azure Key Vault has its firewall enabled to deny all public network access, it blocks all traffic, including requests from Azure SQL Database. By enabling the 'Allow trusted Microsoft services' exception, Azure Key Vault permits specific Azure platform services (like Azure SQL Database) to bypass the firewall, provided the service authenticates using a managed identity with appropriate permissions. This setting is essential for TDE with CMK because the SQL server's system-assigned managed identity must reach the Key Vault to unwrap the encryption key, even when public access is disabled.

Answer

Create a private endpoint for the SQL server to access the Key Vault

Answer

Enable public network access on the Key Vault

Answer

Assign the SQL server's managed identity the 'Reader' role on the Key Vault