AZ-500 Secure compute, storage, and databases Practice Question
You have an Azure Cosmos DB account that stores sensitive data. You need to ensure that all data in transit between the client application and Cosmos DB is encrypted using TLS 1.2 or higher. Additionally, you want to enforce that only Azure services within the same region can access the Cosmos DB account. What two configurations should you implement? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a private endpoint
Configuring a private endpoint ensures that traffic between the client and Cosmos DB traverses the Microsoft backbone network, enforcing that only Azure services within the same region can access via private IPs. Option C is correct because setting the minimum TLS version to 1.2 enforces encryption in transit for all connections. Option A (service endpoints) does not enforce encryption or regional restriction. Option D (disable public network access) is a prerequisite for private endpoints but alone does not enforce encryption. Option E (firewall rules to allow only Azure services) does not enforce TLS version.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable service endpoints for the Cosmos DB account
Why it's wrong here
Incorrect. Service endpoints allow access from selected subnets but do not enforce TLS version or restrict to same region.
- ✓
Configure a private endpoint
Why this is correct
Correct. Private endpoint ensures traffic stays within Azure backbone and enforces regional restriction.
- ✓
Set the minimum TLS version to 1.2
Why this is correct
Correct. Setting minimum TLS version to 1.2 enforces encryption in transit.
- ✗
Disable public network access
Why it's wrong here
Incorrect. Disabling public network access is a prerequisite for private endpoints but does not alone enforce TLS 1.2 or regional access.
- ✗
Configure firewall rules to allow only Azure services
Why it's wrong here
Incorrect. Firewall rules to allow only Azure services do not enforce TLS version or regional restriction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.