Courseiva

CCNA Secure compute, storage, and databases Questions

55 questions · Secure compute, storage, and databases · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key stored in Azure Key Vault. The Key Vault is configured with a firewall that denies all public access. The SQL server must be able to access the key. What additional configuration is necessary?

A.Enable trusted Microsoft services on the Key Vault firewall
B.Create a private endpoint for Key Vault
C.Assign the SQL server's managed identity to the Key Vault
D.Configure a service endpoint on the SQL server
AnswerA

Enabling “Allow trusted Microsoft services to bypass this firewall” on the Key Vault is the correct fix because Azure SQL Database’s TDE key fetches originate from Microsoft’s PaaS infrastructure and, with this setting, those requests are exempted from the Key Vault firewall even when all public network access is otherwise blocked. This setting must be combined with the SQL server’s managed identity being granted the required key permissions, but without it, firewall rules alone would continue to reject the TDE key-wrap and unwrap calls.

Why this answer

When Azure Key Vault's firewall denies all public access, enabling 'Allow trusted Microsoft services' is necessary because Azure SQL Database's TDE key retrieval is considered a trusted service operation. This setting bypasses the firewall for specific Azure services like SQL Database that are authenticated and authorized to access the vault, without requiring a private endpoint or service endpoint.

Exam trap

The trap here is that candidates often confuse the authentication/authorization step (assigning managed identity) with the network connectivity step (firewall bypass), assuming that granting permissions alone is sufficient when the Key Vault firewall is blocking all traffic.

How to eliminate wrong answers

Option B is wrong because creating a private endpoint for Key Vault would provide private connectivity from a virtual network, but the SQL server is a platform-as-a-service resource that does not reside in a VNet by default; while possible, it is not the simplest or required configuration for TDE key access when the firewall is enabled. Option C is wrong because assigning the SQL server's managed identity to Key Vault is necessary for authentication and authorization (to grant the SQL server permissions to the key), but it does not bypass the Key Vault firewall; the firewall must still allow the request. Option D is wrong because configuring a service endpoint on the SQL server is not applicable; service endpoints are used for VNet integration, and Azure SQL Database does not have a service endpoint that directly controls Key Vault access.

Practice this question →
2
Multi-Selectmedium

You are designing security for an Azure SQL Database that will store personally identifiable information (PII). The database will be accessed by multiple applications, some of which are legacy and cannot use Azure AD authentication. Your requirements include: encrypting data at rest, encrypting data in transit, and dynamically masking PII columns for non-privileged users. Which THREE features should you implement?

Select 3 answers
A.Configure Dynamic Data Masking (DDM) for the PII columns.
B.Implement Always Encrypted for the PII columns.
C.Set the 'Minimum TLS Version' to 1.2 on the Azure SQL Server.
D.Enable Transparent Data Encryption (TDE) for the Azure SQL Database.
E.Apply Azure Information Protection labels to the database.
AnswersA, C, D

Dynamic Data Masking (DDM) hides sensitive PII from non-privileged users by applying masking rules (e.g., email or credit-card patterns) at query runtime without altering the underlying data. It is a server/database-level security feature that can be enabled on specific columns, and privileged users can still see the full values. DDM does not protect data in transit or at rest—it only addresses unauthorized viewing by presenting masked values to certain principals.

Why this answer

(Dynamic Data Masking) masks PII columns for non-privileged users. Option C (Minimum TLS Version 1.2) ensures data in transit is encrypted. Option D (Transparent Data Encryption) encrypts data at rest.

Option B (Always Encrypted) is client-side and requires client support, not suitable for legacy apps. Option E (Azure Information Protection) is not a database security feature for this scenario.

Practice this question →
3
MCQhard

A company uses Azure Disk Encryption (ADE) on Windows virtual machines. They use a key encryption key (KEK) stored in Azure Key Vault to wrap the disk encryption key. The security policy requires that the KEK be automatically rotated every 90 days. They need to ensure that after rotation, the OS and data disks of running VMs automatically get re-wrapped with the new KEK version. Which configuration should they implement?

A.Enable soft-delete and purge protection on the Key Vault.
B.Use Key Vault key auto-rotation with a 90-day rotation period, and configure the disk encryption set to use the latest key version (empty string).
C.Create a new KEK every 90 days and modify the disk encryption set to point to the new key version.
D.Use Azure Policy to enforce automatic key rotation.
AnswerB

Key Vault key auto-rotation creates new key versions on schedule. By setting the key version to empty in the disk encryption set, the VMs automatically re-wrap their disks with the latest key version after rotation.

Why this answer

Azure Key Vault supports automatic key rotation with a configurable rotation period, and when a disk encryption set (DES) is configured with an empty string as the key version, it automatically uses the latest version of the KEK. This ensures that after the KEK is rotated every 90 days, the running VMs' OS and data disks are re-wrapped with the new KEK version without manual intervention or VM restart.

Exam trap

The trap here is that candidates may confuse Azure Policy (which enforces compliance) with actual key rotation and re-wrapping mechanisms, or mistakenly believe that manual key version updates in the DES are sufficient for automatic re-wrapping of running VMs.

How to eliminate wrong answers

Option A is wrong because enabling soft-delete and purge protection on the Key Vault is a data protection and recovery feature, not a mechanism for automatic key rotation or re-wrapping of disks. Option C is wrong because manually creating a new KEK every 90 days and updating the DES to point to the new key version is a manual process that does not meet the requirement for automatic rotation and re-wrapping. Option D is wrong because Azure Policy can enforce compliance rules but cannot directly trigger automatic key rotation or re-wrapping of disks; it is a governance tool, not a key lifecycle management feature.

Practice this question →
4
MCQmedium

A company uses Azure SQL Database to store customer data, including credit card numbers. The security policy requires that database administrators (DBAs) must not be able to view the credit card numbers in plaintext. The column containing the credit card numbers must be encrypted at rest and in transit, and only a specific application (using a dedicated client library) should be able to decrypt the data. Which technology should they implement?

A.Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.
B.Dynamic Data Masking (DDM) for the credit card column.
C.Always Encrypted with a client-side encryption key stored in Azure Key Vault.
D.Row-Level Security (RLS) to restrict DBA access to the credit card column.
AnswerC

Correct. Always Encrypted encrypts the data on the client side, so the SQL Database never sees the plaintext. Only the client application with access to the encryption key can decrypt the data, preventing DBAs from viewing sensitive columns.

Why this answer

Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted on the client side before being sent to Azure SQL Database, and the encryption keys are never revealed to the database engine. This prevents DBAs or any server-side administrators from viewing the plaintext data, as decryption can only occur using the client-side encryption key stored in Azure Key Vault and accessed by the dedicated application library.

Exam trap

The trap here is that candidates often confuse Dynamic Data Masking (DDM) with encryption, not realizing that DDM only masks output and does not protect the underlying plaintext from privileged users or direct database access.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts data at rest but does not protect data from DBAs who have access to the database; the database engine can still decrypt the data in memory and in transit unless additional measures are taken, and it does not enforce client-side-only decryption. Option B is wrong because Dynamic Data Masking (DDM) only obfuscates data in query results for unauthorized users, but the underlying plaintext is still stored in the database and can be accessed by privileged users or through direct queries. Option D is wrong because Row-Level Security (RLS) restricts access to rows based on predicates but does not encrypt the data; DBAs with elevated permissions can bypass RLS or still view the plaintext column values.

Practice this question →
5
MCQmedium

A company stores sensitive financial documents in Azure Blob Storage. The security team needs to maintain an immutable log of all changes to the blob content, including the previous versions and the identity of the user who made the changes, for forensic analysis. Which Azure Storage feature should they enable on the storage account to meet this requirement?

A.Azure Blob Storage soft delete.
B.Azure Blob Storage versioning.
C.Blob Storage change feed.
D.Azure Storage analytics logs.
AnswerC

Blob Storage change feed is the correct choice because it provides an append-only, immutable transaction log that captures every creation, update, and deletion of blobs in a storage account, ordered by blob modification time. Each change feed record includes the blob's ETag, content length, and a timestamp, but it does not natively capture user identity; however, by correlating change feed events with Azure Storage Analytics logs (which record the caller's user ID, IP address, and operation details), you can attribute each change to a specific principal. This enables a tamper-resistant, chronological audit trail that satisfies the requirement to show 'who' performed each action, something soft delete, versioning, or analytics logs alone cannot guarantee.

Why this answer

The Blob Storage change feed provides an immutable, append-only log of all changes (create, update, delete) to blobs and blob metadata, including the previous version and the identity of the user who made the change via the requestor's object ID. This meets the forensic requirement for a complete audit trail of blob content changes.

Exam trap

The trap here is that candidates often confuse versioning (which preserves previous versions for recovery) with the change feed (which provides an immutable audit log of changes), leading them to select versioning when the requirement explicitly calls for a forensic log with user identity.

How to eliminate wrong answers

Option A is wrong because soft delete only preserves deleted blobs for a retention period and does not log changes to existing blob content or track user identity. Option B is wrong because versioning maintains previous versions of blobs but does not provide a chronological log of changes with user identity; it is a point-in-time recovery feature, not an audit trail. Option D is wrong because Storage analytics logs (now deprecated in favor of Azure Monitor resource logs) capture storage service operations but are not immutable by default and do not include previous blob content or a guaranteed append-only log.

Practice this question →
6
Multi-Selectmedium

A company uses Azure Key Vault to store keys and secrets. They want to ensure that even if an administrator accidentally deletes a key, it can be recovered for up to 90 days. Additionally, they want to prevent anyone from permanently purging the key during that period. Which two features must be enabled?

Select 1 answer
A.Soft-delete and purge protection
B.Soft-delete and resource locks
C.Purge protection and access policies
D.Soft-delete and backup
AnswersA

Correct. Soft-delete retains deleted keys for up to 90 days, and purge protection prevents permanent purging during that period.

Why this answer

Soft-delete must be enabled to retain a deleted key for a configurable retention period (default 90 days), allowing recovery. To prevent permanent purging during that period, purge protection must be enabled, as it directly blocks purge operations on soft-deleted keys. Resource locks on the Key Vault do not prevent purging of keys themselves, as purging is an operation on the key resource, not on the vault.

Therefore, only option A (soft-delete + purge protection) satisfies both requirements.

Exam trap

The trap is that candidates may think resource locks on the vault can prevent purging of keys, but purging is a direct operation on the key resource that is not blocked by a lock on the vault. Only purge protection on the vault prevents purging during the retention period.

Practice this question →
7
MCQhard

You are designing a secure database solution for a financial application using Azure SQL Database. The database contains highly sensitive columns (e.g., credit card numbers). Which combination of features should you implement to protect data at rest, in transit, and in use, while minimizing performance impact?

A.Always Encrypted with secure enclaves, TDE, and enforce TLS 1.2.
B.Dynamic Data Masking, TDE, and enforce TLS 1.2.
C.Always Encrypted (with deterministic encryption for equality searches), TDE, and enforce TLS 1.2.
D.Column-level encryption using Azure Key Vault, TDE, and enforce TLS 1.2.
AnswerC

Always Encrypted protects data in use and at rest on the server; TDE encrypts at rest; TLS enforces in-transit encryption.

Why this answer

It combines Always Encrypted with deterministic encryption (which supports equality searches while protecting data in use), Transparent Data Encryption (TDE) for data at rest, and enforced TLS 1.2 for data in transit. This provides comprehensive protection across all three states while minimizing performance impact, as deterministic encryption allows efficient querying without decrypting on the server side.

Exam trap

The trap here is that candidates often confuse Dynamic Data Masking with encryption, thinking it protects data in use, when in fact it only masks output and does not encrypt data at rest or in transit, leaving it vulnerable to privileged users or direct database access.

How to eliminate wrong answers

Option A is wrong because Always Encrypted with secure enclaves is designed for rich computations (e.g., range searches, pattern matching) but introduces additional overhead and complexity, which is unnecessary for equality-only searches and may increase performance impact. Option B is wrong because Dynamic Data Masking only obfuscates data at query results level, not protecting data in use (it does not encrypt data in memory or during processing), and it does not prevent privileged users from seeing the actual data. Option D is wrong because column-level encryption using Azure Key Vault is a manual, application-driven approach that requires significant code changes and does not natively support querying encrypted columns, leading to severe performance degradation and operational complexity.

Practice this question →
8
MCQmedium

A company uses Azure Key Vault to store secrets. They want to grant developers the ability to read secrets, but only for specific secret names (e.g., 'App--ConnectionString'). They also want to use Azure RBAC instead of the Key Vault access policy model. Which RBAC role should they assign, and at which scope?

A.Assign the 'Key Vault Secrets User' role at the secret scope
B.Assign the 'Key Vault Secrets User' role at the vault scope
C.Assign the 'Key Vault Reader' role at the secret scope
D.Assign the 'Key Vault Secrets Officer' role at the secret scope
AnswerA

The 'Key Vault Secrets User' role permits reading secret content. When scoped to an individual secret, it restricts access to that specific secret only. Azure RBAC supports data plane roles at the secret, key, or certificate level.

Why this answer

The 'Key Vault Secrets User' role, when assigned at the individual secret scope (e.g., /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.KeyVault/vaults/{vault}/secrets/{secretName}), grants read-only access to that specific secret. This satisfies the requirement to use Azure RBAC (instead of the legacy access policy model) and to limit developers to reading only secrets with a specific name, such as 'App--ConnectionString'.

Exam trap

The trap here is that candidates often assume RBAC roles can only be assigned at the vault scope, forgetting that Azure RBAC supports fine-grained scoping down to the individual secret level, which is essential for least-privilege access control.

How to eliminate wrong answers

Option B is wrong because assigning the 'Key Vault Secrets User' role at the vault scope would grant read access to all secrets in the vault, not just the specific secret name required. Option C is wrong because the 'Key Vault Reader' role only allows listing vaults and reading metadata (e.g., vault properties), not reading secret values; it does not include the 'Microsoft.KeyVault/vaults/secrets/read' action needed to retrieve secret content. Option D is wrong because the 'Key Vault Secrets Officer' role includes write and delete permissions (e.g., 'Microsoft.KeyVault/vaults/secrets/write' and 'delete'), which exceeds the required read-only access and violates the principle of least privilege.

Practice this question →
9
MCQmedium

A company uses Azure SQL Database with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server has a system-assigned managed identity assigned the 'Key Vault Crypto Service Encryption User' role. However, TDE operations are failing because the SQL server cannot access the Key Vault. What additional configuration is needed?

A.Enable the Key Vault firewall to allow trusted Microsoft services
B.Create a private endpoint for the SQL server to access the Key Vault
C.Enable public network access on the Key Vault
D.Assign the SQL server's managed identity the 'Reader' role on the Key Vault
AnswerA

Azure SQL Database TDE with customer-managed keys requires SQL to access Key Vault for key wrap and unwrap operations. The Key Vault firewall blocks public access, but the 'Allow trusted Microsoft services' exception lets Azure SQL's underlying service bypass the firewall for these cryptographic operations, using the SQL server's managed identity. This is the only network change needed while keeping public access blocked.

Why this answer

When Azure Key Vault has its firewall enabled to deny all public network access, it blocks all traffic, including requests from Azure SQL Database. By enabling the 'Allow trusted Microsoft services' exception, Azure Key Vault permits specific Azure platform services (like Azure SQL Database) to bypass the firewall, provided the service authenticates using a managed identity with appropriate permissions. This setting is essential for TDE with CMK because the SQL server's system-assigned managed identity must reach the Key Vault to unwrap the encryption key, even when public access is disabled.

Exam trap

The trap here is that candidates often assume a private endpoint is required for any cross-service communication when firewalls are involved, but Azure's 'Allow trusted Microsoft services' exception is a simpler, first-line configuration that enables necessary platform-level access without exposing the Key Vault to the internet.

How to eliminate wrong answers

Option B is wrong because creating a private endpoint for the SQL server to access the Key Vault would require the SQL server to initiate a connection through a private IP, but the SQL server itself does not support outbound private endpoints to Key Vault; private endpoints are configured on the Key Vault side, not the SQL server side, and the scenario already has the Key Vault firewall denying all public access, so a private endpoint on the Key Vault would be needed, but that is not listed as an option and would not resolve the immediate firewall block without the trusted services exception. Option C is wrong because enabling public network access on the Key Vault would defeat the security purpose of the firewall and is unnecessary; the trusted services exception allows the required access without exposing the Key Vault to the public internet. Option D is wrong because the 'Reader' role on the Key Vault only grants read access to the vault's metadata and secrets list, not the cryptographic permissions needed for TDE operations; the 'Key Vault Crypto Service Encryption User' role is already assigned and provides the necessary unwrap key permission, so adding 'Reader' is irrelevant.

Practice this question →
10
MCQhard

A company has an Azure Storage account with infrastructure encryption enabled. They configure the storage account to use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. Despite this configuration, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

A.The storage account was created before infrastructure encryption was generally available
B.The customer-managed key in Key Vault is disabled or expired
C.The storage account's encryption type is set to Microsoft-managed keys
D.The blob container has a policy that overrides the encryption setting
AnswerC

The storage account's encryption type is the explicit control that determines which key type is used for Azure Storage encryption. If the encryption type is set to 'Microsoft-managed keys', all blob data is encrypted with Microsoft-managed keys regardless of any customer-managed key configuration that may also exist in the account. To use a customer-managed key, the account must be created or updated with the encryption type set to 'Customer-managed keys' and a key must be specified in Key Vault. Since the blobs are encrypted with Microsoft-managed keys, the encryption type must be the one controlling this behavior.

Why this answer

The storage account's encryption type must be explicitly set to 'Customer-managed keys' to use CMK from Azure Key Vault. If the encryption type remains at the default 'Microsoft-managed keys', newly uploaded blobs will continue to be encrypted with Microsoft-managed keys regardless of the CMK configuration in Key Vault. Infrastructure encryption is a separate feature that encrypts data at the hardware level and does not affect the key management type.

Exam trap

The trap here is that candidates often assume that simply configuring a customer-managed key in Key Vault automatically changes the storage account's encryption type, but Azure requires an explicit configuration step to switch the encryption type from 'Microsoft-managed keys' to 'Customer-managed keys'.

How to eliminate wrong answers

Option A is wrong because infrastructure encryption is a separate feature that encrypts data at the storage infrastructure level (before the data is written to disk) and does not influence the choice between Microsoft-managed and customer-managed keys; the storage account's creation date does not prevent CMK from being applied. Option B is wrong because if the customer-managed key in Key Vault is disabled or expired, the storage account would fail to encrypt new blobs with CMK and would likely throw an error or fall back to Microsoft-managed keys only if the account is configured to allow that fallback, but the question states the blobs are still encrypted with Microsoft-managed keys without error, indicating the encryption type was never set to CMK. Option D is wrong because blob containers do not have policies that can override the storage account's encryption setting; encryption at rest is configured at the storage account level and applies to all blobs uniformly.

Practice this question →
11
MCQmedium

You are a security engineer for Contoso Ltd., a multinational company that uses Azure extensively. The company has a custom line-of-business application hosted on Azure VMs. The application stores sensitive customer data in Azure SQL Database. The security policy requires: (1) All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault. (2) Encryption keys must be rotated automatically every 90 days. (3) Access to the keys must be audited. (4) The application must not have direct access to the key vault; only Azure services should access keys on behalf of the application. You need to recommend a solution. What should you do?

A.Use Azure Storage Service Encryption with Microsoft-managed keys for the database backup.
B.Enable Azure Disk Encryption on the VMs and store keys in Azure Key Vault.
C.Configure Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault and set key rotation policy to auto-renew every 90 days.
D.Implement Always Encrypted with column encryption keys stored in Azure Key Vault.
AnswerC

Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access.

Why this answer

Azure Storage Service Encryption with Microsoft-managed keys only applies to Azure Storage accounts, not to Azure SQL Database. It does not use customer-managed keys or support automatic rotation. Option B is wrong because Azure Disk Encryption encrypts VM disks, not the Azure SQL Database.

It does not meet the requirement for encrypting the database at rest. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database at rest, supports automatic key rotation via Key Vault's rotation policy, and allows Azure SQL Database to access the keys without direct application access. Option D is wrong because Always Encrypted encrypts specific columns but requires the client application to handle the column encryption keys, violating the requirement that the application not have direct access to the key vault.

Practice this question →
12
MCQmedium

Your organization uses Azure Storage accounts with blob containers. You need to ensure that only authorized applications can access the storage account, without using shared keys or shared access signatures. What should you configure?

A.Use a stored access policy with a shared access signature
B.Configure a firewall on the storage account to allow only the application's IP address
C.Enable a private endpoint for the storage account
D.Use Azure AD authentication with managed identities
AnswerD

Azure AD authentication with managed identities assigns an automatically managed service principal to the compute resource, and the SDK obtains an OAuth 2.0 token from Azure Instance Metadata Service without storing any secrets. The identity is then mapped to Azure RBAC roles such as Storage Blob Data Contributor/Reader, providing granular, revocable access. This eliminates shared-key management and clearly ties each request to an application identity, aligning with the requirement to authenticate without managing credentials.

Why this answer

Azure AD authentication with managed identities allows applications to authenticate to Azure Storage without using shared keys or SAS tokens. Managed identities provide an automatically managed identity in Azure AD, enabling applications to use OAuth 2.0 tokens for secure access to storage accounts. This approach eliminates the need for any shared secrets or keys, meeting the requirement exactly.

Exam trap

The trap here is that candidates often confuse network-level controls (firewall or private endpoint) with authentication mechanisms, mistakenly believing that restricting network access alone satisfies the requirement to avoid shared keys or SAS.

How to eliminate wrong answers

Option A is wrong because a stored access policy with a shared access signature still uses a SAS token, which is a shared key-based mechanism and does not eliminate the use of shared keys. Option B is wrong because configuring a firewall on the storage account to allow only the application's IP address does not authenticate the application; it only restricts network access and still requires shared keys or SAS for authorization. Option C is wrong because enabling a private endpoint ensures private network connectivity but does not replace the need for authentication; the application still requires shared keys, SAS, or Azure AD credentials to access the storage account.

Practice this question →
13
MCQmedium

A company uses Azure Blob Storage to store sensitive documents. The security policy requires that the storage account can only be accessed from a specific Azure virtual network (VNet) and that all access must use Azure Active Directory (Azure AD) authentication. They want to block any access that uses storage account keys or shared access signatures (SAS). Which configuration should they implement?

A.Configure the storage account firewall to allow access from the specific VNet, and disable 'Allow storage account key access'.
B.Configure a private endpoint for the storage account and disable 'Allow storage account key access'.
C.Configure the storage account firewall to deny all networks, and set 'Allow storage account key access' to 'Disabled'.
D.Configure the storage account firewall to allow access from the specific VNet, and enable 'Require secure transfer' (HTTPS only).
AnswerA

Configuring the firewall with an allow rule for the specific VNet permits only traffic originating from that VNet's service endpoint or private endpoint, while setting 'Allow storage account key access' to Disabled forces Azure AD authentication by rejecting shared keys and SAS tokens. With this combination, clients in the allowed VNet must authenticate via Azure AD and be granted an RBAC role such as Storage Blob Data Reader or Storage Blob Data Contributor. This satisfies both the network restriction and the authentication requirement precisely.

Why this answer

It combines two essential controls: the storage account firewall restricts access to only the specified VNet, and disabling 'Allow storage account key access' enforces Azure AD authentication by blocking all requests that use account keys or SAS tokens. This ensures that only authenticated Azure AD identities from the allowed VNet can access the storage account, meeting the security policy requirements.

Exam trap

The trap here is that candidates often confuse 'Require secure transfer' (which only mandates HTTPS) with authentication enforcement, or assume that a private endpoint alone blocks key-based access, when in fact it only secures network connectivity.

How to eliminate wrong answers

Option B is wrong because while a private endpoint restricts network access to a specific VNet, disabling 'Allow storage account key access' alone does not block SAS tokens—SAS can still be generated and used unless explicitly disabled via other settings. Option C is wrong because denying all networks in the firewall blocks all traffic, including from the specific VNet, making the storage account inaccessible even with Azure AD authentication. Option D is wrong because enabling 'Require secure transfer' enforces HTTPS but does not block storage account keys or SAS tokens; it only ensures encrypted transport, not authentication method enforcement.

Practice this question →
14
Drag & Dropmedium

Drag and drop the steps to configure Azure Defender for SQL on an Azure SQL Database into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Defender for SQL is enabled per database under security settings, requiring storage for scans.

Practice this question →
15
MCQmedium

A company stores sensitive job processing messages in Azure Queue Storage. They have a web application running on an Azure virtual machine in a VNet that reads and writes to the queue. The security team requires that only the web application's VM can access the queue, and all access from the public internet must be blocked. Which configuration should they implement?

A.Configure a service endpoint for Azure Storage on the VNet subnet and add a firewall rule allowing the VNet.
B.Deploy a private endpoint for the storage account in the same VNet and disable public network access on the storage account.
C.Route all traffic from the VNet through an Azure Firewall and create a NAT rule to the storage account.
D.Generate a shared access signature (SAS) token with narrow permissions and require the web app to use that token.
AnswerB

This is correct because a private endpoint assigns the storage account a private IP address from the VNet's address space, and all traffic to the storage account is routed over the Microsoft backbone rather than the public internet. Disabling public network access on the storage account then blocks every connection that does not originate from that private endpoint. Together these controls enforce a network-level isolation boundary, ensuring that only resources inside the VNet can reach the queue messages and no external client or public internet path exists.

Why this answer

Deploying a private endpoint for the storage account in the same VNet assigns the storage account a private IP from the VNet, effectively bringing the service into the VNet. Disabling public network access then ensures that all traffic to the queue must traverse the private endpoint, blocking any public internet access. This meets the requirement that only the web application's VM can access the queue, as the private endpoint is accessible only from within that VNet.

Exam trap

The trap here is that candidates often confuse service endpoints (which only extend VNet identity but leave the public endpoint exposed) with private endpoints (which fully remove public exposure), leading them to choose option A instead of B.

How to eliminate wrong answers

Option A is wrong because a service endpoint for Azure Storage on the VNet subnet only extends the VNet identity to the storage account but does not remove the public endpoint; the storage account remains accessible from the public internet unless additional firewall rules explicitly block all other traffic, which is not specified. Option C is wrong because routing traffic through an Azure Firewall with a NAT rule does not inherently block public internet access to the storage account; the storage account's public endpoint would still be reachable from the internet, and the NAT rule only translates traffic, not restrict source. Option D is wrong because a shared access signature (SAS) token with narrow permissions does not restrict network-level access; the storage account's public endpoint remains accessible from the internet, and any client with the SAS token (including potentially malicious actors) could access the queue from anywhere.

Practice this question →
16
Drag & Dropmedium

Drag and drop the steps to implement Azure AD Identity Protection to detect risky sign-ins into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Identity Protection policies are configured under Security, with user risk policy settings.

Practice this question →
17
MCQmedium

A company is enabling Azure Disk Encryption (ADE) on Windows virtual machines. They have enabled soft-delete on Azure Key Vault and configured a Key Encryption Key (KEK). However, the disk encryption fails with an error indicating that the key vault does not have the required permissions. What is the most likely missing configuration?

A.The Key Vault access policy does not grant the Azure Disk Encryption service principal the 'unwrap key' and 'wrap key' permissions.
B.The Key Vault firewall is blocking the Azure platform.
C.The VM does not have a managed identity assigned.
D.The KEK is in a different Azure region than the VM.
AnswerA

Correct. Azure Disk Encryption (ADE) relies on the Azure Disk Encryption service principal (AzureDiskEncryption) to access your Key Vault. When a KEK is used, that service principal must be granted the 'unwrap key' and 'wrap key' permissions in the Key Vault's access policy; otherwise, the service cannot decrypt or re-encrypt the disk encryption key. The error you see is a classic permissions failure, not a network or identity issue, because the service principal lacks the required cryptographic operations on the vault's keys.

Why this answer

Azure Disk Encryption (ADE) requires the Azure Disk Encryption service principal (also known as the Azure Disk Encryption service) to have 'unwrap key' and 'wrap key' permissions on the Key Vault. These permissions allow the service to encrypt and decrypt the disk encryption keys using the Key Encryption Key (KEK). Without these specific cryptographic permissions, the encryption operation fails, even if soft-delete and a KEK are correctly configured.

Exam trap

The trap here is that candidates often confuse the required permissions for ADE with general Key Vault access policies (e.g., 'get' and 'list') or mistakenly think a managed identity or firewall configuration is the root cause, rather than recognizing the need for explicit 'wrap key' and 'unwrap key' permissions for the Azure Disk Encryption service principal.

How to eliminate wrong answers

Option B is wrong because the Key Vault firewall, if enabled, would block external access, but the error message specifically indicates a permissions issue, not a network connectivity problem. Option C is wrong because a managed identity is not required for ADE on Windows VMs; ADE uses the Azure Disk Encryption service principal, not the VM's identity, to access the Key Vault. Option D is wrong because the KEK can be in a different region than the VM; ADE supports cross-region key references as long as the Key Vault is in the same Azure subscription and the service principal has the required permissions.

Practice this question →
18
MCQmedium

A company stores sensitive healthcare data in Azure SQL Database. They need to encrypt specific columns containing patient diagnosis codes so that even database administrators with the 'sysadmin' role cannot view the plaintext. The application must be able to perform equality searches (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

A.Transparent Data Encryption (TDE)
B.Always Encrypted (deterministic encryption)
C.Row-Level Security (RLS)
D.Dynamic Data Masking (DDM)
AnswerB

Always Encrypted is the correct choice because it encrypts selected column data between the client application and the database engine, with the column encryption keys never being passed to or stored in SQL Database in plaintext. The client-side driver performs encryption and decryption, so the database engine only ever sees ciphertext; even a sysadmin with full server access cannot view the sensitive values without the client-held Column Master Key. Deterministic encryption is specifically suitable here because it allows equality comparison and inner join operations on the ciphertext, enabling indexed equality searches on fields like national identifiers or medical record numbers while still shielding the values from DBAs.

Why this answer

Always Encrypted with deterministic encryption ensures that sensitive columns are encrypted at the client side, so the encryption keys are never revealed to the database engine, including sysadmin roles. Deterministic encryption generates the same ciphertext for the same plaintext, enabling equality searches (WHERE clauses) on encrypted columns without exposing plaintext data to the server.

Exam trap

The trap here is that candidates confuse encryption at rest (TDE) with client-side column-level encryption, failing to recognize that TDE does not protect data from privileged users who can run queries, while Always Encrypted does by keeping keys off the server.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest (pages on disk) but does not protect data from database administrators who have access to the decrypted data in memory or via queries. Option C is wrong because Row-Level Security (RLS) controls access to rows based on user predicates but does not encrypt data; it relies on database permissions and can be bypassed by privileged users. Option D is wrong because Dynamic Data Masking (DDM) obfuscates data in query results for non-privileged users but does not encrypt the underlying data; privileged users like sysadmin can still view plaintext by querying directly.

Practice this question →
19
MCQmedium

A healthcare organization stores sensitive patient data in Azure SQL Database. They need to encrypt specific columns containing medical history so that even database administrators with highly privileged roles, such as 'sysadmin', cannot view the plaintext data. Additionally, they need to support complex queries on the encrypted data, including pattern matching and range comparisons. Which encryption technology should they implement?

A.Always Encrypted with secure enclaves
B.Transparent Data Encryption (TDE)
C.Dynamic Data Masking
D.Row-Level Security
AnswerA

Always Encrypted with secure enclaves performs client-side column encryption, so the database engine only ever processes ciphertext while the encryption keys are held outside SQL Server. The enclave—a trusted hardware environment such as Intel SGX inside Azure Confidential Computing—enables rich operations like pattern matching, range comparisons, and sorting without ever exposing plaintext to the database process. This makes it the only option that both prevents database administrators from seeing data and supports computed queries over encrypted columns.

Why this answer

Always Encrypted with secure enclaves is correct because it encrypts specific columns at the client side, ensuring that even database administrators with sysadmin privileges cannot view the plaintext data. The secure enclave feature allows computations (such as pattern matching and range comparisons) to be performed on the encrypted data inside a trusted execution environment, which is required by the question's need for complex queries on encrypted columns.

Exam trap

The trap here is that candidates often confuse Transparent Data Encryption (TDE) with column-level encryption, assuming TDE protects data from privileged users, but TDE only protects data at rest and does not prevent authorized database users from reading plaintext data.

How to eliminate wrong answers

Option B (Transparent Data Encryption) is wrong because it encrypts the entire database at rest (on disk) but does not protect data from users or administrators who have access to the database engine; the data is decrypted transparently when queried, so sysadmins can still view plaintext. Option C (Dynamic Data Masking) is wrong because it only obfuscates data in query results for unauthorized users, but the underlying data remains stored in plaintext and can be accessed by privileged users like sysadmins. Option D (Row-Level Security) is wrong because it controls access to rows based on user context but does not encrypt the data; privileged users can still read the plaintext data directly.

Practice this question →
20
MCQmedium

A company uses Azure Managed Disks for their virtual machines. They want to ensure that all managed disks are encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also want to automatically revoke access to the disks if the key is disabled or deleted. Which feature should they configure?

A.Azure Disk Encryption (ADE) with a Key Encryption Key (KEK)
B.Server-side encryption with customer-managed keys (SSE-CMK)
C.Azure Storage Service Encryption (SSE) with platform-managed keys
D.Azure Key Vault soft-delete and purge protection
AnswerB

Server-side encryption with customer-managed keys (SSE-CMK) is the native Azure managed-disk encryption feature that encrypts disk data at rest using a customer-provided key from Azure Key Vault or a managed HSM. Because the managed-disk service must unwrap the disk encryption key from the CMK for every attach and I/O operation, disabling or deleting the CMK makes the disk inaccessible and fully satisfies the key-revocation requirement without any in-VM agent or manual configuration. This approach works at the platform layer, applying encryption to all writes sent to the disk, and is the preferred way to achieve both encryption at rest and customer-controlled revocation.

Why this answer

Server-side encryption with customer-managed keys (SSE-CMK) encrypts Azure Managed Disks at rest using a key stored in Azure Key Vault. When the key is disabled or deleted, Azure automatically revokes access to the disk by failing any I/O operations that require that key, ensuring the disk becomes inaccessible. This directly meets the requirement for both CMK-based encryption and automatic access revocation upon key loss.

Exam trap

The trap here is that candidates confuse Azure Disk Encryption (ADE) with server-side encryption (SSE-CMK), mistakenly thinking ADE provides automatic access revocation when the key is disabled, whereas ADE only encrypts at the guest OS level and does not enforce platform-level access control based on key state.

How to eliminate wrong answers

Option A is wrong because Azure Disk Encryption (ADE) with a KEK uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt the OS and data disks at the VM guest OS level, not at the Azure platform level, and disabling the KEK does not automatically revoke access to the underlying managed disk; the disk remains accessible at the storage layer. Option C is wrong because Azure Storage Service Encryption (SSE) with platform-managed keys uses Microsoft-managed keys, not customer-managed keys, so it cannot meet the requirement for CMK-based encryption or allow key revocation by the customer. Option D is wrong because Azure Key Vault soft-delete and purge protection only prevents permanent deletion of keys and secrets; it does not encrypt disks or automatically revoke access to disks when a key is disabled or deleted.

Practice this question →
21
Drag & Dropmedium

Drag and drop the steps to enable Azure Security Center's enhanced security features for a subscription into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

To enable Azure Security Center's enhanced security features for a subscription, you must first navigate to Security Center, then access 'Security policy' under Management. Within that blade, select the target subscription and set its pricing tier to Standard. This activates advanced threat detection and vulnerability assessment capabilities.

Common mistakes include confusing the order of subscription selection and tier setting, or mixing up the security policy with auto-provisioning settings.

Practice this question →
22
MCQhard

A company stores sensitive files in Azure Files shares. They require encryption at rest using customer-managed keys (CMK) and encryption in transit using SMB 3.0 encryption. They have created a premium Azure Files share in a storage account and configured encryption at rest with a CMK. However, clients are able to connect without enforcing SMB encryption. What additional configuration is necessary to ensure that all connections to the file share are encrypted in transit?

A.Enable the 'Secure transfer required' property on the storage account.
B.Configure a network security group (NSG) to allow only encrypted traffic.
C.Set the minimum SMB protocol version to 3.0 on the file share.
D.Create a service endpoint for the storage account.
AnswerA

Enabling the storage account's 'Secure transfer required' property rejects requests over unencrypted connections. For Azure Files, this forces clients to use SMB 3.0 with encryption (or HTTPS for REST), so sensitive data is encrypted while traversing the network. This is the proper, supported control for enforcing encryption in transit for Azure Files.

Why this answer

Enabling the 'Secure transfer required' property on the storage account enforces encryption in transit for all client connections, including SMB 3.0 encryption for Azure Files. Without this setting, clients can connect using unencrypted SMB 2.1 or SMB 3.0 without encryption, even if the file share itself supports encryption. This property is a storage account-level flag that rejects any request not using HTTPS or SMB 3.0 with encryption.

Exam trap

The trap here is that candidates confuse protocol version enforcement (Option C) with encryption enforcement, not realizing that SMB 3.0 can be used without encryption unless the 'Secure transfer required' property is explicitly enabled.

How to eliminate wrong answers

Option B is wrong because a network security group (NSG) filters traffic at the network layer based on IP addresses and ports, but cannot inspect or enforce SMB encryption at the application layer; it would only block or allow traffic on port 445, not differentiate between encrypted and unencrypted SMB connections. Option C is wrong because setting the minimum SMB protocol version to 3.0 on the file share only restricts the protocol version, but SMB 3.0 can operate without encryption (encryption is an optional feature within SMB 3.0); this does not enforce encryption in transit. Option D is wrong because creating a service endpoint for the storage account secures traffic to the Azure backbone network but does not enforce encryption in transit; it only ensures traffic stays within the Azure network, leaving the connection potentially unencrypted.

Practice this question →
23
Multi-Selecteasy

A company stores sensitive financial records in Azure Blob Storage. They want to ensure that if a blob is deleted or overwritten, it can be recovered within 30 days. They also want to protect against accidental deletion of the storage account itself. Which two configurations should they implement? (Choose two.)

Select 2 answers
A.Enable blob soft delete with a retention period of 30 days
B.Enable storage account soft delete with a retention period of 30 days
C.Enable container soft delete with a retention period of 30 days
D.Enable blob versioning
AnswersA, B

Blob soft delete retains deleted or overwritten blobs for a configurable retention period (here, 30 days), so a mistakenly deleted financial record can be undeleted from the soft-deleted state. Unlike versioning, it explicitly covers deletion events, and unlike container soft delete, it operates at the individual blob level, which is where the company's sensitive files live. This makes it a direct data-recovery safeguard for the scenario.

Why this answer

Blob soft delete (Option A) protects individual blobs by retaining deleted or overwritten blobs for a specified retention period, allowing recovery within that window. Storage account soft delete (Option B) protects the entire storage account from accidental deletion by retaining the deleted account for a configurable period. Together, they address both the blob-level and account-level recovery requirements for the 30-day window.

Exam trap

The trap here is that candidates often confuse blob versioning with soft delete, assuming versioning alone provides deletion recovery, but versioning only protects against overwrites, not deletions, and lacks a configurable retention period for recovery.

Practice this question →
24
MCQmedium

A company has an Azure SQL Database that stores personally identifiable information (PII) in columns. They need to encrypt those columns so that only authorized applications can decrypt the data, and even database administrators cannot view the plaintext. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they use?

A.Always Encrypted with deterministic encryption
B.Always Encrypted with randomized encryption
C.Transparent Data Encryption (TDE)
D.Dynamic Data Masking
AnswerA

Always Encrypted with deterministic encryption encrypts PII client-side so the SQL engine and database administrators never see plaintext. It uses a deterministic algorithm where the same plaintext always produces the same ciphertext for a given column encryption key, enabling the server to perform equality comparisons in WHERE, JOIN, and GROUP BY clauses. This supports business queries that require filtering on PII (e.g., searching by social security number) while preserving confidentiality. However, deterministic encryption can reveal equality patterns and is less secure than randomized, but it remains the correct choice for applications needing strict DBA access control.

Why this answer

Always Encrypted with deterministic encryption is the correct choice because it encrypts PII columns at the client side, ensuring that even database administrators cannot view plaintext data. Deterministic encryption generates the same ciphertext for the same plaintext, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting the requirement for query support.

Exam trap

The trap here is that candidates often confuse Always Encrypted with TDE, thinking TDE provides client-side encryption and column-level query support, but TDE only encrypts data at rest and does not prevent database administrators from seeing plaintext data in memory or during queries.

How to eliminate wrong answers

Option B is wrong because Always Encrypted with randomized encryption does not support equality comparisons; it produces different ciphertext for the same plaintext, making WHERE clauses impossible on encrypted columns. Option C is wrong because Transparent Data Encryption (TDE) encrypts data at rest (the entire database file) but does not protect data from database administrators who have access to the database engine, and it does not support column-level encryption or client-side key control. Option D is wrong because Dynamic Data Masking only obfuscates data at query results for unauthorized users, but the underlying data remains in plaintext in storage and can be accessed by administrators or through direct queries.

Practice this question →
25
MCQmedium

You manage Azure Storage accounts for a healthcare organization. To comply with HIPAA, you need to ensure that all data at rest is encrypted and that encryption keys are rotated automatically every 90 days. What should you implement?

A.Configure Azure RBAC roles for storage accounts.
B.Enable infrastructure encryption for storage accounts.
C.Generate new storage account access keys manually every 90 days.
D.Use customer-managed keys (CMK) in Azure Key Vault with automatic key rotation.
AnswerD

Customer-managed keys in Azure Key Vault let you supply the key encryption key (KEK) that wraps the data encryption key (DEK) used to encrypt every storage object, giving you full control over key lifecycle. When you enable automatic key rotation, Azure Key Vault creates a new key version according to the rotation policy you define, and Azure Storage re-wraps the DEK without any downtime or data re-encryption. This directly satisfies both the encryption-at-rest and automatic-rotation requirements, which is why it is the correct choice.

Why this answer

Customer-managed keys (CMK) stored in Azure Key Vault with automatic key rotation fulfill the requirement for encrypted data at rest and automatic rotation of encryption keys. This ensures that HIPAA compliance is met by maintaining control over encryption keys and enforcing their periodic rotation. The other options do not provide automatic key rotation: RBAC controls access but does not rotate keys; infrastructure encryption adds another layer but does not include key rotation; manually rotating storage account access keys addresses authentication keys, not encryption keys, and is not automatic.

Exam trap

The main trap is confusing storage account access keys (used for authentication) with encryption keys (used for data at rest). Candidates may choose manual rotation of access keys, but that does not meet the automatic rotation requirement for encryption keys and only addresses a different type of key.

How to eliminate wrong answers

Option A is wrong because Azure RBAC roles control access permissions to storage accounts (e.g., who can read/write data), not encryption or key rotation. Option B is wrong because infrastructure encryption adds an extra layer of encryption at the infrastructure level but does not manage or rotate access keys. Option C is wrong because manually generating new storage account access keys every 90 days is error-prone, does not scale, and does not meet the requirement for automatic rotation; it also does not address encryption at rest with customer-controlled keys.

Practice this question →
26
MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall that blocks all public access. The SQL server is a managed service that needs to access the key to perform TDE operations. The Key Vault is in the same Azure region as the SQL server. Which additional configuration is needed?

A.Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings
B.Configure a service endpoint for Microsoft.KeyVault on the SQL server's subnet
C.Assign the SQL server's server identity the 'Contributor' role on the Key Vault
D.Create a private endpoint for the Key Vault in the SQL server's virtual network
AnswerA

The Key Vault firewall blocks all data plane access by default, which would break TDE key operations. Enabling 'Allow trusted Microsoft services to bypass this firewall' explicitly authorizes Azure SQL Database (as a trusted Microsoft service) to reach the vault for wrap/unwrap operations, provided the SQL server's managed identity is also granted the correct RBAC role or access policy. This is the standard configuration when using customer-managed keys for TDE on Azure SQL Database while the vault firewall is turned on.

Why this answer

When Azure Key Vault has a firewall that blocks all public access, Azure services like SQL Database that need to access the key for TDE operations must be explicitly allowed. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits the SQL server's managed service identity to authenticate and retrieve the CMK from Key Vault, even when public network access is denied. This setting is required because the SQL server, as a platform-as-a-service (PaaS) resource, does not reside in a virtual network by default and cannot use a private endpoint or service endpoint without additional networking configuration.

Exam trap

The trap here is that candidates often assume a private endpoint or service endpoint is always required for secure access, but for PaaS services like Azure SQL Database that use managed identities, the 'Allow trusted Microsoft services' setting is the simplest and correct solution when the Key Vault firewall blocks public access.

How to eliminate wrong answers

Option B is wrong because configuring a service endpoint for Microsoft.KeyVault on the SQL server's subnet is not applicable—Azure SQL Database is a PaaS service that does not have a subnet in a virtual network by default; service endpoints are used for VNet-integrated resources like VMs or App Service, not for SQL Database's managed identity access to Key Vault. Option C is wrong because assigning the 'Contributor' role on the Key Vault grants excessive permissions (e.g., ability to modify keys) and is not required; the SQL server's identity only needs the 'Get' and 'Unwrap Key' permissions on the key itself, which are granted via a Key Vault access policy, not RBAC roles. Option D is wrong because creating a private endpoint for Key Vault in the SQL server's virtual network would require the SQL server to be integrated into a VNet, which is not the default configuration for Azure SQL Database; private endpoints are used for network isolation but do not solve the firewall bypass issue for a managed service that needs to reach Key Vault over the public endpoint.

Practice this question →
27
MCQmedium

A company stores critical business data in an Azure Storage account (Blob Storage). They want to ensure that all data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data quickly if a breach is suspected. Which feature should they enable on the storage account to enforce CMK?

A.Enable infrastructure encryption for the storage account
B.Enable Azure Storage encryption with customer-managed keys
C.Enable soft delete for blobs
D.Enable versioning for blobs
AnswerB

This configures the storage account to use a CMK from Key Vault. Revocation is done by disabling the key in Key Vault, making the data inaccessible.

Why this answer

Enabling Azure Storage encryption with customer-managed keys (CMK) allows you to use your own key stored in Azure Key Vault to encrypt all data at rest in the storage account. This also provides the ability to revoke access to the data quickly by disabling, deleting, or rotating the key in Key Vault, which renders the data inaccessible until the key is restored.

Exam trap

The trap here is that candidates often confuse infrastructure encryption (which adds a second encryption layer but uses Microsoft-managed keys) with customer-managed key encryption, or they mistakenly think soft delete or versioning can enforce encryption key control and revocation.

How to eliminate wrong answers

Option A is wrong because infrastructure encryption provides an additional layer of encryption at the infrastructure level using platform-managed keys, not customer-managed keys, and does not support revocation via Key Vault. Option C is wrong because soft delete for blobs protects against accidental deletion by retaining deleted data for a specified retention period, but it does not enforce encryption with customer-managed keys or provide revocation capabilities. Option D is wrong because versioning for blobs preserves previous versions of blobs for data recovery and point-in-time restore, but it does not relate to encryption key management or revocation.

Practice this question →
28
MCQmedium

A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?

A.Enable Azure Storage encryption with customer-managed keys (CMK)
B.Use service-managed keys (SSE) with platform-managed keys
C.Enable Azure Disk Encryption on VMs that access the storage account
D.Configure Azure Information Protection for the storage account
AnswerA

Azure Storage always encrypts data at rest with AES-256, but enabling customer-managed keys (CMK) lets you supply your own key in Azure Key Vault or Managed HSM. You control the key lifecycle, rotation, and revocation; if you disable or delete the key, Azure Storage begins rejecting blob operation requests and the data becomes inaccessible. There is a short delay of up to 24 hours before the cached key is evicted, which is why revocation is not instantaneous. This meets the requirement of giving the customer the ability to revoke access on demand, which is the core control needed here.

Why this answer

Enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.

Exam trap

The trap here is that candidates often confuse Azure Disk Encryption (which encrypts VM disks) with storage account encryption, or assume that platform-managed keys (SSE) provide the same revocation capability as customer-managed keys.

How to eliminate wrong answers

Option B is wrong because service-managed keys (SSE) with platform-managed keys do not allow the customer to control or disable the key; Microsoft manages the keys, so the customer cannot revoke access in a breach scenario. Option C is wrong because Azure Disk Encryption encrypts the OS and data disks of VMs, not the data stored in Azure Storage accounts; it does not provide encryption at rest for the storage account itself. Option D is wrong because Azure Information Protection is a classification and labeling service for documents and emails, not a storage encryption mechanism; it does not encrypt data at rest in Azure Storage accounts.

Practice this question →
29
MCQhard

Your company uses Azure SQL Database and wants to protect sensitive data stored in a column named 'CreditCardNumber'. You need to ensure that the data is encrypted at rest and that only authorized users can decrypt the data at the application layer. Additionally, you want to prevent unauthorized administrators from accessing the plaintext. Which solution should you implement?

A.Enable Transparent Data Encryption (TDE) and store the encryption key in Azure Key Vault
B.Use Dynamic Data Masking to mask the credit card column for non-privileged users
C.Implement Azure SQL Database's Always Encrypted with enclaves
D.Implement Always Encrypted and store the column encryption key in Azure Key Vault
AnswerD

Always Encrypted is a client-side encryption technology that encrypts sensitive column data before it is sent to Azure SQL Database, so the database engine and its administrators never see plaintext. The application's driver uses the column encryption key (CEK) to encrypt and decrypt, while the CEK is wrapped by a column master key (CMK); storing the CMK in Azure Key Vault provides centralized, audited key management without exposing the CEK to the database server. Because only client applications possessing the necessary key material can decrypt the credit card values, database administrators and cloud operators are prevented from viewing the data.

Why this answer

Always Encrypted ensures that sensitive data, such as credit card numbers, is encrypted at rest and remains encrypted throughout its lifecycle, including during query processing. By storing the column encryption key in Azure Key Vault, you separate key management from the database, preventing even database administrators from accessing plaintext data. Only authorized applications with access to the key can decrypt the data at the application layer, meeting all stated requirements.

Exam trap

The trap here is confusing Transparent Data Encryption (TDE) with Always Encrypted; TDE protects at rest but not from database administrators or during query processing, whereas Always Encrypted provides client-side encryption that prevents even the database engine from seeing plaintext data.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest but does not protect data from database administrators or during query execution; it also does not enforce application-layer decryption. Option B is wrong because Dynamic Data Masking only obfuscates data in query results for non-privileged users but does not encrypt data at rest or prevent privileged users from accessing plaintext. Option C is wrong because Always Encrypted with enclaves allows computations on encrypted data within a secure enclave, which is unnecessary here and introduces additional complexity; the core requirement of application-layer decryption with key separation is met by standard Always Encrypted.

Practice this question →
30
MCQhard

Your organization uses Azure Files shares. You need to enforce access control using on-premises Active Directory (AD) credentials. The Azure Files share is already created. What should you do?

A.Enable Azure AD Domain Services authentication and join the storage account to the managed domain.
B.Assign RBAC roles (e.g., Storage File Data SMB Share Contributor) to AD users at the share level.
C.Enable AD DS authentication for the storage account, sync identities with Azure AD Connect, and configure NTFS permissions on the share.
D.Use storage account keys to mount the share and rely on Windows ACLs.
AnswerC

This allows on-prem AD authentication.

Why this answer

Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). To enforce access control with on-premises AD credentials, you must enable AD DS authentication on the storage account, sync the on-premises identities to Azure AD using Azure AD Connect (so the storage account can resolve the security principals), and then configure classic NTFS ACLs (permissions) on the share itself. This allows users to mount the share using their domain credentials and have their access governed by both share-level RBAC and file/directory-level NTFS permissions.

Exam trap

The trap here is that candidates confuse Azure AD DS (a managed domain) with on-premises AD DS, or they assume RBAC roles alone are sufficient for SMB file access, forgetting that NTFS permissions are required for actual file-level control.

How to eliminate wrong answers

Option A is wrong because Azure AD Domain Services (Azure AD DS) is a managed domain service that does not use on-premises AD credentials; it uses Azure AD identities, and the scenario explicitly requires on-premises AD credentials. Option B is wrong because RBAC roles (like Storage File Data SMB Share Contributor) control Azure management-plane access to the share, not the actual SMB file-level access; NTFS permissions are required for file/directory-level control. Option D is wrong because using storage account keys bypasses identity-based access entirely, granting full administrative access to the share and preventing per-user access control with on-premises AD credentials.

Practice this question →
31
MCQeasy

You need to securely connect to an Azure SQL Database from an on-premises application without exposing the database to the public internet. Which solution should you use?

A.Configure a firewall rule to allow the on-premises public IP address
B.Use Azure Private Link to connect via a private endpoint
C.Enable Always Encrypted on the database
D.Use a virtual network service endpoint for Azure SQL Database
AnswerB

Azure Private Link creates a private endpoint inside your virtual network, assigning the database a private IP address that is reachable only through your network. On-premises clients can securely connect to this endpoint via a VPN gateway or ExpressRoute, ensuring traffic never traverses the public internet. This eliminates exposure to the public endpoint and provides the highest level of network security for connecting to Azure SQL Database.

Why this answer

Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address from your on-premises network via ExpressRoute or VPN. This ensures traffic never traverses the public internet, meeting the requirement for secure, non-public connectivity.

Exam trap

The trap here is that candidates often confuse service endpoints (which still use the public endpoint) with private endpoints (which provide truly private connectivity), leading them to choose Option D thinking it eliminates internet exposure.

How to eliminate wrong answers

Option A is wrong because configuring a firewall rule to allow the on-premises public IP address still exposes the database to the public internet, as traffic flows over the internet and the database endpoint remains publicly resolvable. Option C is wrong because Always Encrypted is a client-side encryption feature that protects data at rest and in transit, but it does not control network connectivity or prevent public internet exposure. Option D is wrong because a virtual network service endpoint for Azure SQL Database still uses the database's public endpoint, and traffic from on-premises would need to traverse the internet unless routed through a VPN/ExpressRoute, which still leaves the endpoint publicly accessible.

Practice this question →
32
MCQhard

Your organization uses Azure Files shares for user home directories. You need to enforce that users access these shares only from trusted locations (corporate IP ranges) and that all access is logged. Which combination of actions should you take?

A.Use a Private Endpoint for the storage account and configure a service endpoint on the virtual network.
B.Generate a shared access signature (SAS) token that is valid only from corporate IPs and attach it to the file share.
C.Configure a storage account firewall to allow only the corporate IP range, and enable diagnostic settings to send logs to a Log Analytics workspace.
D.Assign Azure AD DS to the storage account and enable Azure AD authentication for Azure Files, then configure conditional access policies.
AnswerC

A storage account firewall is a network-level access control that evaluates the source IP of every request to the Azure Files endpoint, so locking it to the corporate IP range prevents all other clients from reaching the share over SMB or REST. Enabling diagnostic settings exports StorageRead and StorageWrite operation logs to a Log Analytics workspace, giving you a queryable record of access attempts, successful reads, and failures. Together, they enforce the IP restriction and provide the visibility needed to audit and alert on file share activity.

Why this answer

Azure Files supports network security via storage account firewalls, which can restrict access to specific IP ranges. Enabling diagnostic settings allows sending logs (e.g., to a Log Analytics workspace) for auditing. Option C correctly combines both requirements.

Option A is incorrect because Private Endpoints and service endpoints provide network isolation but do not filter by IP source. Option B is incorrect because while a SAS token can include an IP restriction, it is not designed for persistent user access to home directories and complicates management. Option D is incorrect because Azure AD DS and conditional access control authentication but do not enforce network-level IP restrictions.

Practice this question →
33
MCQmedium

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is a Microsoft service. How can the SQL server be granted access to the key vault to perform TDE operations?

A.Create a private endpoint on the Key Vault for the SQL server
B.Disable the Key Vault firewall
C.Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault
D.Assign the SQL server a system-assigned managed identity and grant it access to the key vault
AnswerC

This setting permits Azure Key Vault to accept requests from Azure SQL Database and other first-party Microsoft services even when the firewall is enabled, without opening the vault to public internet traffic. The service's request originates from Azure's internal infrastructure, and the firewall bypass is combined with strict identity-based authorization via the SQL server's managed identity and access policies. It directly addresses the network-layer restriction for TDE operations while keeping the vault protected against all other external clients.

Why this answer

Azure Key Vault's firewall includes a setting to 'Allow trusted Microsoft services to bypass this firewall.' Azure SQL Database is a trusted Microsoft service, so enabling this setting allows the SQL server to authenticate to Key Vault using its system-assigned managed identity to retrieve the customer-managed key for TDE operations, without needing to disable the firewall or create a private endpoint.

Exam trap

The trap here is that candidates often think a private endpoint is required for PaaS services to access a firewalled Key Vault, but they overlook that Azure SQL Database is a trusted Microsoft service that can bypass the firewall with the appropriate setting, and that a private endpoint would require the SQL server to be network-integrated, which it is not by default.

How to eliminate wrong answers

Option A is wrong because creating a private endpoint on the Key Vault for the SQL server would require the SQL server to be in a virtual network, but Azure SQL Database is a platform-as-a-service (PaaS) resource that does not reside in a customer VNet by default; a private endpoint on Key Vault does not directly grant the SQL server network access. Option B is wrong because disabling the Key Vault firewall would expose the vault to all public network traffic, violating the security requirement to deny all public network access. Option D is wrong because while assigning a system-assigned managed identity and granting it access to the key vault is necessary for authentication and authorization, it does not solve the network connectivity issue caused by the Key Vault firewall blocking all public traffic; the managed identity alone cannot bypass the firewall without the 'Allow trusted Microsoft services' setting.

Practice this question →
34
MCQhard

A company uses Azure SQL Database to store personally identifiable information (PII). They need to encrypt specific columns containing social security numbers so that even database administrators with the 'db_owner' role cannot view the plaintext. The application must be able to perform equality searches on the encrypted columns. Which encryption technology should they implement?

A.Transparent Data Encryption (TDE)
B.Always Encrypted with deterministic encryption
C.Dynamic Data Masking
D.Row-Level Security
AnswerB

Always Encrypted encrypts sensitive columns in the client driver using a column encryption key, which is protected by a column master key held outside SQL Server in Azure Key Vault or Windows Certificate Store. The SQL Server Database Engine receives only ciphertext and never sees the plaintext, so DBAs cannot read the data. With deterministic encryption, the same plaintext always produces the same ciphertext, allowing the server to perform equality comparisons (e.g., WHERE clause lookups) without exposing the values.

Why this answer

Always Encrypted with deterministic encryption is the correct choice because it encrypts specific columns at the client-side, ensuring that even database administrators with db_owner cannot view plaintext data. Deterministic encryption generates the same ciphertext for a given plaintext value, enabling equality searches (e.g., WHERE SSN = '123-45-6789') directly on the encrypted column without decrypting the data on the server.

Exam trap

The trap here is that candidates often confuse encryption at rest (TDE) with client-side column encryption, mistakenly believing TDE protects against privileged users, but TDE only protects against physical theft of the database files, not against authorized database access.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest (pages written to disk) but does not protect data from users or DBAs who have access to the database; plaintext is visible to anyone with query permissions. Option C is wrong because Dynamic Data Masking obfuscates data in query results for non-privileged users but does not encrypt the underlying data; DBAs with db_owner can still view the unmasked values by altering the masking rule or querying directly. Option D is wrong because Row-Level Security restricts access to rows based on a predicate function but does not encrypt column values; DBAs with db_owner can bypass or modify the security policy to see all data.

Practice this question →
35
MCQmedium

A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

A.The Key Vault is in a different Azure region than the storage account.
B.The storage account does not have a system-assigned managed identity enabled.
C.A default encryption scope is configured on the blob container that uses a Microsoft-managed key.
D.The customer-managed key in Key Vault is disabled or expired.
AnswerC

Encryption scopes can be set at the container level. A default encryption scope overrides the storage account-level encryption. If the scope uses Microsoft-managed keys, new blobs in that container will not use the customer-managed key.

Why this answer

When a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.

Exam trap

The trap here is that candidates assume the storage account-level CMK setting applies uniformly to all blobs, but they overlook that encryption scopes at the container level can override that setting, causing a silent fallback to Microsoft-managed keys.

How to eliminate wrong answers

Option A is wrong because Azure Key Vault and the storage account can be in different regions; cross-region CMK is supported as long as the Key Vault is in the same Azure Active Directory tenant. Option B is wrong because a system-assigned managed identity is not required for CMK; a user-assigned managed identity can be used, or the storage account can use its own identity implicitly when granted access to Key Vault via access policies or RBAC. Option D is wrong because if the customer-managed key were disabled or expired, the storage account would fail to encrypt or decrypt blobs, resulting in errors (e.g., 403 Forbidden) rather than silently falling back to Microsoft-managed keys.

Practice this question →
36
MCQeasy

You need to ensure that all data at rest in an Azure Storage account is encrypted using a customer-managed key. Which feature should you enable?

A.Azure Disk Encryption
B.Azure Storage Service Encryption (SSE) with platform-managed key
C.Azure Storage Service Encryption with customer-managed key
D.Azure Information Protection
AnswerC

Allows you to use your own key from Azure Key Vault for encryption at rest.

Why this answer

Azure Storage Service Encryption (SSE) automatically encrypts data at rest in Azure Storage accounts. By default, it uses Microsoft-managed keys, but you can configure it to use customer-managed keys (CMK) stored in Azure Key Vault. This ensures that you control the encryption keys and can manage their lifecycle, rotation, and access policies, meeting the requirement for customer-managed key encryption.

Exam trap

The trap here is that candidates often confuse Azure Disk Encryption (which encrypts VM disks) with Storage Service Encryption (which encrypts the storage account's blob, file, queue, and table data), leading them to select Option A instead of the correct SSE with CMK.

How to eliminate wrong answers

Option A is wrong because Azure Disk Encryption (ADE) uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt OS and data disks of virtual machines, not the data at rest in an Azure Storage account. Option B is wrong because SSE with platform-managed key uses Microsoft-managed keys, not customer-managed keys, so it does not satisfy the requirement for customer-managed key control. Option D is wrong because Azure Information Protection (AIP) is a classification and labeling service for documents and emails, not an encryption mechanism for data at rest in Azure Storage.

Practice this question →
37
MCQhard

A healthcare organization stores sensitive patient data in Azure SQL Database. They need to encrypt specific columns containing medical history so that even database administrators with the 'sysadmin' role cannot view the plaintext data. Additionally, they need to support equality comparisons (WHERE clauses) on the encrypted columns. Which encryption technology should they implement?

A.Transparent Data Encryption (TDE)
B.Always Encrypted with randomized encryption
C.Always Encrypted with deterministic encryption
D.Dynamic Data Masking
AnswerC

Always Encrypted with deterministic encryption derives a fixed initialization vector from the plaintext value, so identical plaintexts always yield identical ciphertexts, enabling the server to perform equality comparisons, joins, and exact-match lookups without ever seeing the plaintext. The column encryption key is stored and used only on the client side (for example, in Windows Certificate Store or Azure Key Vault), meaning SQL Server and DBAs see only opaque ciphertext and cannot decrypt the data. This achieves the dual goal of secure patient data protection while retaining the ability to query by known identifiers.

Why this answer

Always Encrypted with deterministic encryption is correct because it encrypts specific columns at the client side, ensuring that even database administrators with 'sysadmin' role cannot view plaintext data. Deterministic encryption generates the same ciphertext for identical plaintext values, which allows equality comparisons (WHERE clauses) on encrypted columns, meeting both requirements.

Exam trap

The trap here is that candidates confuse Dynamic Data Masking with encryption, thinking it prevents privileged users from seeing data, when in fact it only masks output and does not protect data at rest or from direct queries by sysadmins.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts the entire database at rest but does not protect data from database administrators who have access to the database engine; they can still query plaintext data. Option B is wrong because Always Encrypted with randomized encryption does not support equality comparisons (WHERE clauses) on encrypted columns, as it produces different ciphertext for the same plaintext each time. Option D is wrong because Dynamic Data Masking only obfuscates data at query result time but does not encrypt the underlying data, so administrators with 'sysadmin' role can still access plaintext by running queries without masking.

Practice this question →
38
MCQmedium

A company stores sensitive data in Azure Blob Storage. They want to encrypt the data at rest using customer-managed keys (CMK) stored in Azure Key Vault. Additionally, they want the key to be automatically rotated every 90 days without manual intervention. Which configuration should they implement?

A.Enable Azure Storage encryption with a CMK and configure a rotation policy on the storage account.
B.Enable Azure Storage encryption with a CMK and enable automatic key rotation in Azure Key Vault by creating a rotation policy.
C.Enable Azure Storage encryption with a CMK and manually rotate the key every 90 days.
D.Use Azure Storage service-side encryption with platform-managed keys and enforce rotation via Azure Policy.
AnswerB

This is correct because with a customer-managed key (CMK) in Azure Key Vault, you can define a key rotation policy that automatically generates new key versions on a schedule. The storage account must reference the key URI without a specific version so it automatically uses the latest key version. This provides the required automatic rotation of the encryption key, fully managed through Azure Key Vault, without manual intervention.

Why this answer

Azure Key Vault supports automatic key rotation through a rotation policy, which can be configured to rotate a customer-managed key (CMK) every 90 days without manual intervention. When Azure Storage encryption uses a CMK stored in Key Vault, the storage account references the key version, and enabling a rotation policy in Key Vault automatically creates new key versions, which Azure Storage then uses for encryption. This satisfies the requirement for automated 90-day rotation without manual steps.

Exam trap

The trap here is that candidates confuse where the rotation policy is configured—thinking it is on the storage account (Option A) rather than in Azure Key Vault, or they assume platform-managed keys can be scheduled for rotation (Option D), which is not supported.

How to eliminate wrong answers

Option A is wrong because a rotation policy cannot be configured on the storage account itself; key rotation is managed in Azure Key Vault, not on the storage account resource. Option C is wrong because it requires manual rotation every 90 days, which contradicts the requirement for automatic rotation without manual intervention. Option D is wrong because platform-managed keys (PMK) cannot be rotated on a custom schedule; they are managed entirely by Microsoft, and Azure Policy cannot enforce a specific rotation interval for PMKs.

Practice this question →
39
MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is in the same region and has a system-assigned managed identity with the 'Key Vault Crypto Service Encryption User' role assigned at the key scope. However, TDE operations fail because the SQL server cannot access the Key Vault. What additional configuration is required to allow the SQL server to access the Key Vault for TDE operations?

A.Configure a private endpoint for the SQL server to the Key Vault.
B.Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault.
C.Change the Key Vault firewall to allow all Azure services.
D.Create a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet.
AnswerB

This setting allows trusted Azure services, including Azure SQL Database, to access the Key Vault even when the firewall is enabled. Since the SQL server's managed identity already has the cryptographic role, this is the missing piece to allow TDE operations.

Why this answer

When Azure Key Vault has a firewall that denies all public network access, the 'Allow trusted Microsoft services to bypass this firewall' setting is required for Azure SQL Database (a trusted Microsoft service) to authenticate using its system-assigned managed identity and access the customer-managed key for TDE. This setting allows the SQL server to reach the Key Vault over the Microsoft backbone network without requiring a private endpoint or VNet integration, as the service is explicitly trusted by Azure.

Exam trap

The trap here is that candidates often assume a private endpoint or VNet service endpoint is always required for Key Vault access when firewalls are enabled, but they overlook the 'Allow trusted Microsoft services' bypass which is specifically designed for Azure PaaS services like SQL Database to access Key Vault without additional network configuration.

How to eliminate wrong answers

Option A is wrong because configuring a private endpoint for the SQL server to the Key Vault would require the SQL server to be in a VNet with a private endpoint connection, but the SQL server is not VNet-injected by default and the question does not indicate VNet integration; additionally, the system-assigned managed identity and role assignment are already in place, so the issue is firewall bypass, not network connectivity. Option C is wrong because 'Allow all Azure services' is a legacy setting that is overly permissive and deprecated in favor of the more specific 'Allow trusted Microsoft services' option; it would also allow all Azure services, not just trusted ones, which violates least-privilege principles. Option D is wrong because a VNet service endpoint for Microsoft.KeyVault on the SQL server's subnet would only help if the SQL server were deployed in a VNet (which it is not by default for Azure SQL Database), and service endpoints do not bypass the Key Vault firewall's deny-all rule unless the firewall explicitly allows the specific VNet/subnet, which is not mentioned.

Practice this question →
40
MCQhard

A company plans to enable Azure Disk Encryption (ADE) on their Windows virtual machines. They will use a Key Encryption Key (KEK) stored in Azure Key Vault. What additional configuration must be made in the Key Vault to allow the Azure platform to access the KEK for encrypting the VM disks?

A.Grant the Azure Disk Encryption service principal 'Reader' role on the key vault.
B.Set the key vault's 'enabledForDiskEncryption' property to true.
C.Grant the virtual machine's managed identity 'Contributor' role on the key vault.
D.Configure soft-delete and purge protection on the key vault.
AnswerB

The 'enabledForDiskEncryption' boolean property on the key vault is a specific vault-level flag that tells Azure's compute platform that the vault is allowed to be used by the Azure Disk Encryption service. When set to true, it grants the ADE service (which runs as part of the Microsoft.Compute resource provider) the necessary access to read secrets and use keys wrapped in the vault during the encryption workflow. This is the standard prerequisite because neither a user-assigned identity nor a service principal with RBAC on the vault alone can suffice without this setting.

Why this answer

Azure Disk Encryption requires the key vault's 'enabledForDiskEncryption' property to be set to true. This property explicitly authorizes the Azure platform (specifically the Azure Disk Encryption service) to access the Key Encryption Key (KEK) stored in the vault for encrypting VM disks. Without this flag, the platform cannot retrieve the KEK, even if other permissions exist.

Exam trap

The trap here is that candidates often confuse the 'enabledForDiskEncryption' property with RBAC roles or managed identity permissions, assuming that granting a role to the VM or service principal is sufficient, when in fact the platform requires this specific vault-level flag to be enabled.

How to eliminate wrong answers

Option A is wrong because granting the Azure Disk Encryption service principal the 'Reader' role on the key vault is unnecessary; the platform uses the 'enabledForDiskEncryption' property, not an RBAC role, to authorize access. Option C is wrong because granting the VM's managed identity 'Contributor' role on the key vault is not required; ADE does not use the VM's identity to access the KEK—it uses the platform's identity authorized by the vault property. Option D is wrong because soft-delete and purge protection are important for recovery and compliance but are not required for the platform to access the KEK during encryption; they are separate prerequisites for some scenarios but not the specific configuration needed here.

Practice this question →
41
MCQmedium

A company uses Azure SQL Database and wants to protect sensitive data (e.g., credit card numbers) from database administrators. They require that the data is encrypted at rest and in transit, and only a client application using a specific driver can decrypt it. Which technology should they implement?

A.Transparent Data Encryption (TDE)
B.Always Encrypted
C.Dynamic Data Masking (DDM)
D.Row-Level Security (RLS)
AnswerB

Always Encrypted encrypts sensitive columns at the client side, ensuring that the data is never exposed in plaintext to the server or DBAs. Only the client application with the column master key can decrypt the data.

Why this answer

Always Encrypted is the correct choice because it ensures that sensitive data (e.g., credit card numbers) is encrypted both at rest and in transit, and the encryption keys are never exposed to the database engine. Only a client application using the Always Encrypted-enabled driver (e.g., ADO.NET with Column Encryption Setting=enabled) can decrypt the data, protecting it from database administrators or any unauthorized access to the database server.

Exam trap

The trap here is that candidates often confuse Transparent Data Encryption (TDE) with Always Encrypted because both involve encryption, but TDE does not protect data from database administrators or encrypt data in transit, which is the core requirement in this scenario.

How to eliminate wrong answers

Option A is wrong because Transparent Data Encryption (TDE) encrypts data at rest but does not protect data in transit, and the database engine has access to the encryption keys, so DBAs can still see plaintext data. Option C is wrong because Dynamic Data Masking (DDM) only obfuscates data at query results for unauthorized users, but the underlying data remains unencrypted in storage and in transit, and DBAs can bypass masking. Option D is wrong because Row-Level Security (RLS) controls access to rows based on user context but does not encrypt data at rest or in transit, and DBAs with elevated permissions can still read all data.

Practice this question →
42
Multi-Selectmedium

You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)

Select 2 answers
A.Enable service endpoints for the Cosmos DB account
B.Configure a private endpoint
C.Set the minimum TLS version to 1.2
D.Disable public network access
E.Configure firewall rules to allow only Azure services
AnswersB, C

Correct. Private endpoint ensures traffic stays within Azure backbone and enforces regional restriction.

Why this answer

Configuring a private endpoint ensures that traffic between the client and Cosmos DB traverses the Microsoft backbone network, enforcing that only Azure services within the same region can access via private IPs. Option C is correct because setting the minimum TLS version to 1.2 enforces encryption in transit for all connections. Option A (service endpoints) does not enforce encryption or regional restriction.

Option D (disable public network access) is a prerequisite for private endpoints but alone does not enforce encryption. Option E (firewall rules to allow only Azure services) does not enforce TLS version.

Practice this question →
43
MCQmedium

A company uses Azure SQL Database with Azure Active Directory authentication. To meet compliance requirements, they need to audit all failed login attempts and store the audit logs in a storage account located in a different Azure region for disaster recovery. What should they configure?

A.Enable SQL Auditing and set the destination to a Log Analytics workspace in a different region.
B.Enable SQL Auditing and set the destination to an Event Hub namespace in the same region.
C.Enable SQL Auditing and set the destination to an Azure Storage account in a different region.
D.Enable Advanced Threat Protection for Azure SQL Database and configure email notifications.
AnswerC

Azure SQL Auditing can write audit logs directly to an Azure Storage account, and placing that account in a different region provides geographic separation for disaster recovery. You can select a storage account configured with geo-redundant storage (GRS) or geo-zone-redundant storage (GZRS), so audit .xel files are replicated to a paired region and remain accessible even if the primary SQL database region fails. This durable, long-term storage model satisfies compliance requirements for failed-login auditing and supports immutable retention policies to prevent tampering.

Why this answer

Azure SQL Database auditing can be configured to write audit logs directly to an Azure Storage account. Storing the logs in a storage account located in a different Azure region meets the disaster recovery requirement by ensuring logs survive a regional outage. The audit logs capture all database events, including failed login attempts, which satisfies the compliance need.

Exam trap

The trap here is that candidates often confuse auditing with threat detection or choose a Log Analytics workspace for centralized logging, overlooking the explicit requirement for durable, cross-region storage for compliance and disaster recovery.

How to eliminate wrong answers

Option A is wrong because a Log Analytics workspace does not provide geo-redundant storage for disaster recovery; it is primarily for log analytics and monitoring, not for long-term archival in a different region. Option B is wrong because an Event Hub namespace is a real-time streaming service, not a durable storage destination for audit logs, and it is specified to be in the same region, which fails the disaster recovery requirement. Option D is wrong because Advanced Threat Protection (ATP) detects suspicious activities and sends email notifications, but it does not audit or store failed login attempts in a storage account for compliance purposes.

Practice this question →
44
Multi-Selectmedium

You need to protect Azure SQL Database from SQL injection attacks. Which TWO measures should you implement?

Select 2 answers
A.Enable Transparent Data Encryption (TDE)
B.Implement Azure Web Application Firewall (WAF)
C.Configure Azure SQL Database firewall rules
D.Use parameterized queries in application code
E.Enable Always Encrypted for sensitive columns
AnswersB, D

WAF can detect and block SQL injection patterns.

Why this answer

Azure Web Application Firewall (WAF) can inspect incoming HTTP/HTTPS traffic and block malicious payloads, including SQL injection attempts, before they reach the application or database. It provides a perimeter defense that filters out common attack patterns, reducing the attack surface for SQL injection.

Exam trap

The trap here is that candidates often confuse network-level controls (firewall rules) or encryption features (TDE, Always Encrypted) with application-layer defenses against SQL injection, leading them to select options that protect data confidentiality or access but do not prevent the injection attack itself.

Practice this question →
45
Multi-Selecthard

Which THREE components are part of Azure Disk Encryption for Windows VMs?

Select 3 answers
A.DM-Crypt
B.Microsoft Entra ID (Azure AD)
C.BitLocker Drive Encryption
D.Azure Key Vault with Key Encryption Key (KEK)
E.Azure Key Vault with Volume Encryption Key (VEK)
AnswersC, D, E

BitLocker is used for Windows VMs.

Why this answer

BitLocker Drive Encryption is the correct component because Azure Disk Encryption for Windows VMs leverages BitLocker to provide volume-level encryption for the OS and data disks. BitLocker is the native Windows technology that encrypts the entire volume, ensuring data at rest is protected within Azure managed disks.

Exam trap

The trap here is that candidates often confuse DM-Crypt with BitLocker, mistakenly selecting DM-Crypt for Windows VMs, or they incorrectly assume Microsoft Entra ID is a required component of the encryption process rather than understanding it is only used for authentication in specific scenarios.

Practice this question →
46
MCQhard

A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?

A.Yes, but the storage account must use a different key vault per region; no other implications.
B.Yes, but you must enable cross-region replication for the key vault and pay additional costs.
C.No, Azure does not support CMK from a different region than the storage account.
D.Yes, but you must use a managed identity from the storage account's region to access the key vault.
AnswerC

Correct. Azure Storage customer-managed keys require the key vault (or managed HSM) to be in the same Azure region as the storage account. Azure Key Vault is a regional service, and the key material cannot be used for encryption operations outside that region, so a CMK from a different region is simply not supported. This is a documented architectural constraint, and no configuration or feature—such as geo-replication or multi-region vaults—bypasses this requirement.

Why this answer

Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.

Exam trap

The trap here is that candidates assume Azure's global infrastructure allows cross-region key vault access for CMK, but Azure explicitly restricts CMK to the same region to maintain low-latency encryption operations and avoid cross-region dependency for data at rest.

How to eliminate wrong answers

Option A is wrong because it incorrectly states that a different key vault per region is acceptable; Azure does not allow CMK from a different region at all, regardless of the number of key vaults. Option B is wrong because cross-region replication for the key vault does not enable cross-region CMK usage—the storage account's encryption service still requires the key vault to be in the same region, and Azure does not offer a feature to bypass this restriction. Option D is wrong because while a managed identity is required for the storage account to access the key vault, it does not override the regional constraint; the key vault must still be in the same region as the storage account.

Practice this question →
47
Multi-Selecthard

A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?

Select 2 answers
A.Configure Key Vault networking with private endpoint or selected networks
B.Disable soft delete permanently
C.Use firewall and virtual network restrictions
D.Store secrets as plain text tags
AnswersA, C

Correct for the stated requirement.

Why this answer

Configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.

Exam trap

The trap here is that candidates often confuse data protection features like soft delete (Option B) with network access controls, or mistakenly think that storing secrets in tags (Option D) is a valid configuration, when in fact tags are unencrypted metadata and never intended for secret storage.

Practice this question →
48
MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?

A.Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.
B.Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.
C.Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.
D.Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.
AnswerB

Enabling 'Allow trusted Microsoft services to bypass this firewall' is the correct solution because Azure SQL Database is a trusted Microsoft service and its managed identity can authenticate to the Key Vault using Azure AD, then fetch the encryption key for TDE. With this setting, the Key Vault firewall remains enabled for public internet traffic, but Azure services like SQL Database are permitted to bypass the IP restrictions. This is the intended pattern for TDE with customer-managed keys, as SQL Database runs outside your virtual network and its outbound IPs cannot be reliably scoped.

Why this answer

Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.

Exam trap

The trap here is that candidates often confuse network-level access controls (firewall rules) with authorization (RBAC or access policies), leading them to select Option D, which addresses permissions but not the network restriction imposed by the Key Vault firewall.

How to eliminate wrong answers

Option A is wrong because Azure SQL Database does not have a static public IP range; its outbound IPs can change and are not predictable, so adding a public IP range would be unreliable and insecure. Option C is wrong because a private endpoint would require the Azure SQL Database to be in the same virtual network or have connectivity to it, but Azure SQL Database is a PaaS service that does not reside in a customer's virtual network by default, and creating a private endpoint for Key Vault does not grant the SQL Database access unless the SQL Database itself is network-integrated (e.g., via Azure SQL Managed Instance or a private endpoint for SQL). Option D is wrong because role-based access control (RBAC) is used for authorization, not network access; the 'Key Vault Crypto Service Encryption User' role grants permissions to use the key, but it does not bypass the Key Vault firewall, which is a network-level restriction.

Practice this question →
49
MCQmedium

A company enables Azure SQL Database auditing to log database events to a storage account. The security policy requires that the audit logs be protected from tampering and deletion after they are written. Which storage account feature should the company enable to ensure that audit log files cannot be modified or deleted by anyone for a specified retention period?

A.Soft delete
B.Immutable storage
C.Hierarchical namespace
D.Firewall and virtual networks
AnswerB

Immutable storage is correct because it enforces a Write-Once-Read-Many (WORM) policy at the container or version level, blocking any delete or modify operation on blobs for a set retention period. This time-based retention lock makes the stored audit logs tamper-proof and compliant with regulatory frameworks such as SEC 17a-4f. After the policy is locked, even an account administrator cannot shorten the retention interval or disable immutability, ensuring that Azure SQL Database audit records remain intact until the policy expires.

Why this answer

Immutable storage for Azure Blob Storage provides a WORM (Write Once, Read Many) policy that prevents audit log files from being modified or deleted by any user, including administrators, for a specified retention period. This directly meets the security requirement to protect audit logs from tampering and deletion after they are written.

Exam trap

The trap here is that candidates often confuse soft delete with immutable storage, thinking that soft delete's ability to recover deleted blobs is sufficient for tamper-proofing, but soft delete does not prevent modification or deletion in the first place.

How to eliminate wrong answers

Option A is wrong because soft delete only protects against accidental deletion by retaining deleted blobs for a configurable period, but it does not prevent intentional modification or deletion by authorized users during the retention period. Option C is wrong because hierarchical namespace is a feature of Azure Data Lake Storage Gen2 that organizes blobs into a directory hierarchy, but it provides no data immutability or tamper-proof protection. Option D is wrong because firewall and virtual networks restrict network access to the storage account but do not prevent modification or deletion of blobs by users who have legitimate access through the network.

Practice this question →
50
MCQhard

A company stores business records in Azure Blob Storage. Due to a legal investigation, they must prevent any modification or deletion of the blobs for an indefinite period until the legal hold is released. They also need to ensure that even storage account owners cannot alter the data during the hold. Which blob storage feature should they enable?

A.Time-based retention policy
B.Legal hold
C.Soft delete
D.Blob versioning
AnswerB

Legal hold is the correct choice because it applies an indefinite, immutable lock on blob storage, preventing any modification or deletion until the hold is explicitly released by an authorized user. This hold is designed for legal and compliance scenarios where records must be preserved for an unknown or open-ended duration, such as active litigation or an ongoing investigation. Unlike time-based retention, legal hold does not expire automatically and continues protecting data until the hold is removed, ensuring that records remain untouched for as long as legally required.

Why this answer

Legal hold (option B) is the correct choice because it is designed to protect blobs from any modification or deletion for an indefinite period, even by storage account owners. Unlike time-based retention policies, a legal hold has no expiration and cannot be removed until explicitly cleared by an authorized user, making it ideal for indefinite legal investigations.

Exam trap

The trap here is that candidates often confuse time-based retention policies (which have a fixed duration) with legal holds (which are indefinite), or assume that soft delete or versioning can prevent modification or deletion by privileged users, when in fact they only provide recovery options and do not block destructive operations.

How to eliminate wrong answers

Option A is wrong because a time-based retention policy enforces a fixed retention period (e.g., 1–146,000 days) and automatically expires, which does not meet the indefinite hold requirement. Option C is wrong because soft delete only protects against accidental deletion by retaining deleted blobs for a configurable retention period (default 7 days), but it does not prevent modification or allow indefinite holds, and storage account owners can still permanently delete blobs if soft delete is disabled. Option D is wrong because blob versioning preserves previous versions of blobs but does not prevent modification or deletion of the current version; storage account owners can still overwrite or delete blobs, and versioning alone cannot enforce an indefinite legal hold.

Practice this question →
51
MCQmedium

A company stores highly sensitive data in Azure Blob Storage. The security policy requires that all data is encrypted at rest using a key that is stored in Azure Key Vault, and that the storage account uses its system-assigned managed identity to access the key. Which encryption configuration should they use?

A.Server-side encryption with service-managed keys
B.Server-side encryption with customer-managed keys (CMK)
C.Client-side encryption
D.Azure Disk Encryption
AnswerB

Server-side encryption with customer-managed keys (CMK) encrypts data at rest using a data encryption key wrapped by a customer-controlled key encryption key stored in Azure Key Vault. The storage account's system-assigned managed identity authenticates to Key Vault to perform encryption and decryption of the underlying data key, giving the organization direct control over key rotation, auditing, and revocation. This satisfies the requirement of using a customer-managed key stored in Key Vault and is the appropriate mechanism for enforcing separation of duties and meeting compliance obligations.

Why this answer

Server-side encryption with customer-managed keys (CMK) is required because the security policy mandates that the encryption key be stored in Azure Key Vault and that the storage account uses its system-assigned managed identity to access that key. CMK allows you to bring your own key (BYOK) into Key Vault and grants the storage account access via a managed identity, ensuring the key is under your control and not managed by Azure. Service-managed keys (option A) use Microsoft-managed keys, which do not satisfy the requirement for customer-controlled key storage.

Exam trap

The trap here is that candidates confuse 'encryption at rest' with 'client-side encryption' or 'Azure Disk Encryption', failing to recognize that the requirement for a managed identity to access a Key Vault key directly points to server-side CMK, not client-side or disk-level encryption.

How to eliminate wrong answers

Option A is wrong because server-side encryption with service-managed keys uses keys managed entirely by Microsoft, not stored in the customer's Azure Key Vault, and does not involve a managed identity for access. Option C is wrong because client-side encryption encrypts data before it is sent to Azure Blob Storage, meaning the storage account never accesses the key via its managed identity; the key is managed on the client side. Option D is wrong because Azure Disk Encryption is used to encrypt virtual machine disks (OS and data disks) using BitLocker or DM-Crypt, not Azure Blob Storage data.

Practice this question →
52
MCQmedium

Your company uses Azure Files shares to store business documents. You need to ensure that access to the shares is restricted to users who have been granted explicit permissions. What should you configure?

A.Configure a firewall rule to allow only corporate IP ranges.
B.Use storage account access keys to mount the file share.
C.Enable identity-based authentication for Azure Files using Microsoft Entra ID and set share-level permissions.
D.Generate a shared access signature (SAS) with read permissions.
AnswerC

Identity-based authentication maps users to share permissions.

Why this answer

Identity-based authentication for Azure Files using Microsoft Entra ID allows you to assign share-level permissions (e.g., Storage File Data SMB Share Contributor) to specific users or groups, ensuring only explicitly authorized identities can access the share. This meets the requirement of restricting access to users with explicit permissions, as opposed to relying on network rules or shared keys.

Exam trap

The trap here is that candidates often confuse network-level restrictions (firewall rules) or token-based access (SAS) with identity-based access control, mistakenly believing that restricting IP ranges or using SAS tokens satisfies the requirement for explicit user permissions, when in fact only identity-based authentication with Microsoft Entra ID provides per-user authorization.

How to eliminate wrong answers

Option A is wrong because configuring a firewall rule to allow only corporate IP ranges restricts access based on network location, not on user identity or explicit permissions; any user from a corporate IP could still access the share if they have the storage account key or SAS. Option B is wrong because using storage account access keys grants full administrative access to the entire storage account, not just the file share, and cannot be scoped to individual users or groups, violating the principle of least privilege. Option D is wrong because a shared access signature (SAS) with read permissions provides time-limited, token-based access that is not tied to a specific user identity and cannot enforce per-user explicit permissions; it also exposes the share to anyone possessing the SAS token.

Practice this question →
53
MCQhard

A company uses Azure SQL Database with Transparent Data Encryption (TDE) encrypted using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault is protected by a firewall that denies all public access. The SQL server must be able to access the key for TDE operations. Which additional configuration is necessary in the Key Vault to allow this?

A.Configure a private endpoint for the Key Vault and assign it to the SQL server's virtual network.
B.Enable soft-delete on the Key Vault.
C.Enable the 'Allow trusted Microsoft services to bypass this firewall' setting.
D.Add a firewall rule to allow traffic from the Azure SQL Database's public IP address.
AnswerC

This setting allows Azure services like Azure SQL Database, which are trusted by Azure, to access the Key Vault even when the firewall is enabled to deny public traffic. It is the required configuration to allow TDE operations.

Why this answer

When Azure Key Vault is protected by a firewall that denies all public access, the Azure SQL Database service (a trusted Microsoft service) must be explicitly allowed to bypass the firewall to retrieve the customer-managed key for TDE operations. Enabling the 'Allow trusted Microsoft services to bypass this firewall' setting permits the SQL server's managed identity to authenticate and access the key vault without requiring a public IP address or network rule.

Exam trap

The trap here is that candidates often confuse network-level controls (private endpoints, firewall rules) with the Azure platform's built-in trust mechanism, mistakenly thinking that a private endpoint or a static IP rule is required when the simpler 'trusted Microsoft services' bypass is the correct and intended solution for PaaS services like Azure SQL Database.

How to eliminate wrong answers

Option A is wrong because a private endpoint for Key Vault would require the SQL server to be on the same virtual network, but Azure SQL Database is a PaaS service that does not reside in a customer's virtual network by default; the SQL server's managed identity accesses Key Vault over the Azure backbone, not via a private endpoint. Option B is wrong because soft-delete is a data protection feature that prevents permanent deletion of keys, secrets, or certificates, but it does not control network access or firewall bypass for TDE operations. Option D is wrong because Azure SQL Database does not have a static public IP address; its outbound IPs can change and are not assigned to the logical server, making a firewall rule based on a public IP unreliable and unnecessary when the trusted Microsoft services bypass is available.

Practice this question →
54
MCQeasy

A company stores sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they need the ability to immediately make the data inaccessible in case of a security breach. Which configuration on the storage account enables this?

A.Enable Azure Storage encryption with a customer-managed key (CMK)
B.Enable infrastructure encryption
C.Enable soft delete for the storage account
D.Enable Azure AD authentication for Blob Storage
AnswerA

Customer-managed keys (CMK) give you explicit control over the key hierarchy used to encrypt Azure Storage. Under envelope encryption, the CMK is a key encryption key (KEK) stored in Azure Key Vault that protects the data encryption key (DEK) used for blob encryption. Revoking or disabling the CMK in Key Vault causes Azure Storage to reject any attempt to decrypt the DEK, effectively making the data inaccessible almost immediately. This provides a deliberate, auditable kill switch that meets the requirement to block access on demand.

Why this answer

Enabling Azure Storage encryption with a customer-managed key (CMK) stored in Azure Key Vault allows the customer to control the encryption key used for data at rest. In the event of a security breach, the customer can immediately revoke access to the CMK in Key Vault (e.g., by disabling the key or deleting the key vault), which renders the encrypted Blob Storage data inaccessible because Azure Storage cannot decrypt it without the key. This satisfies both the encryption-at-rest requirement and the ability to make data inaccessible on demand.

Exam trap

The trap here is that candidates often confuse soft delete (which protects against accidental deletion) with the ability to make data inaccessible via key revocation, or they assume infrastructure encryption or Azure AD authentication provide the same control as CMK, but only CMK with key revocation in Key Vault gives the customer direct, immediate control over data accessibility.

How to eliminate wrong answers

Option B is wrong because infrastructure encryption provides an additional layer of encryption at the storage infrastructure level using platform-managed keys, but it does not use customer-managed keys and does not allow the customer to revoke access to make data inaccessible. Option C is wrong because soft delete for the storage account protects against accidental deletion by retaining deleted data for a retention period, but it does not provide encryption with customer-managed keys or the ability to immediately make data inaccessible during a breach. Option D is wrong because Azure AD authentication for Blob Storage controls access to data via identity-based authorization, but it does not encrypt data at rest with customer-managed keys or provide a mechanism to revoke encryption keys to make data inaccessible.

Practice this question →
55
MCQhard

A company plans to enable Azure Disk Encryption (ADE) on a fleet of Windows virtual machines. They want to use a key stored in Azure Key Vault to encrypt the disks. Which additional access configuration must be made in the Key Vault to allow ADE to succeed?

A.Grant the Azure Disk Encryption service principal (Microsoft.Azure.Security) appropriate key permissions in the Key Vault access policy.
B.Assign a managed identity to each VM and grant that identity key permissions in the Key Vault.
C.Enable soft-delete and purge protection on the Key Vault.
D.Assign the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal.
AnswerA

ADE relies on the Azure Disk Encryption service principal to access the encryption key. You must grant this principal the 'get', 'wrapKey', and 'unwrapKey' permissions in the access policy.

Why this answer

Azure Disk Encryption (ADE) uses the Azure platform's built-in service principal (Microsoft.Azure.Security) to access the Key Vault and retrieve the disk encryption key. Without granting this service principal the necessary 'Get', 'WrapKey', and 'UnwrapKey' key permissions in the Key Vault access policy, ADE cannot authenticate and perform the encryption operations. This is a mandatory configuration step for ADE to succeed.

Exam trap

The trap here is that candidates often confuse the need to grant permissions to the VM's managed identity (Option B) with the actual requirement to grant permissions to the Azure Disk Encryption service principal, because ADE does not use the VM's identity to access the Key Vault.

How to eliminate wrong answers

Option B is wrong because assigning a managed identity to each VM and granting that identity key permissions is not the required access configuration for ADE; ADE uses the Azure platform service principal, not the VM's identity, to access the Key Vault. Option C is wrong because enabling soft-delete and purge protection is a recommended security feature for Key Vault but is not an additional access configuration required for ADE to succeed; ADE can work without these settings. Option D is wrong because assigning the 'Key Vault Contributor' RBAC role to the Azure Disk Encryption service principal grants management plane permissions (e.g., to modify the vault itself), not the data plane key permissions (e.g., WrapKey, UnwrapKey) that ADE needs to encrypt disks.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Secure compute, storage, and databases questions.

Start 20-question session