AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive files in Azure Files shares. They require encryption at rest using customer-managed keys (CMK) and encryption in transit using SMB 3.0 encryption. They have created a premium Azure Files share in a storage account and configured encryption at rest with a CMK. However, clients are able to connect without enforcing SMB encryption. What additional configuration is necessary to ensure that all connections to the file share are encrypted in transit?
⚠ Common exam trap
Many candidates confuse protocol version enforcement (Option C) with encryption enforcement, not realizing that SMB 3.0 can be used without encryption unless the 'Secure transfer required' property is explicitly enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Secure transfer required' property on the storage account.
Enabling the 'Secure transfer required' property on the storage account enforces encryption in transit for all client connections, including SMB 3.0 encryption for Azure Files. Without this setting, clients can connect using unencrypted SMB 2.1 or SMB 3.0 without encryption, even if the file share itself supports encryption. This property is a storage account-level flag that rejects any request not using HTTPS or SMB 3.0 with encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the 'Secure transfer required' property on the storage account.
Why this is correct
Enabling the storage account's 'Secure transfer required' property rejects requests over unencrypted connections. For Azure Files, this forces clients to use SMB 3.0 with encryption (or HTTPS for REST), so sensitive data is encrypted while traversing the network. This is the proper, supported control for enforcing encryption in transit for Azure Files.
- ✗
Configure a network security group (NSG) to allow only encrypted traffic.
Why it's wrong here
An NSG is a layer-3/4 stateful firewall: it filters by source/destination IP, port, and protocol. It cannot inspect SMB session negotiation or detect whether encryption is in use, so it can't 'allow only encrypted' SMB. A rule permitting 445/tcp would allow both encrypted and unencrypted SMB.
- ✗
Set the minimum SMB protocol version to 3.0 on the file share.
Why it's wrong here
Azure Files shares do not expose a property for setting a minimum SMB protocol version — SMB versions are negotiated during connection setup, and Microsoft's control is at the storage-account level. Moreover, SMB 3.0 itself is a protocol version, not an encryption toggle; SMB 3.0 connections can be unencrypted unless encryption is explicitly required. Thus this setting, even if it existed, would not guarantee encryption in transit.
- ✗
Create a service endpoint for the storage account.
Why it's wrong here
Creating a service endpoint routes traffic from a VNet to Azure service over the Microsoft backbone, but it does not encrypt SMB traffic. It restricts source IPs to specific subnets, preventing public internet access; however, it has no effect on the encryption of file-share data in transit. It is a network security control, not a transport encryption control.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.