Secure compute, storage, and databases

AZ-500 · 71 questions

• Harbor pilots still RDP to lock-chamber virtual machines over the Internet because each VM has a public IP. How should the security engineer provide remote access while removing those public IPs?
• A contractor tries to deploy Azure Bastion into the same subnet as the lock-chamber virtual machines and the deployment fails. What must the security engineer create for Bastion?
• Some lock operators must use a local SSH or RDP client instead of only the Azure portal browser. Which Bastion capability should the security engineer select?
• Lock-chamber NSGs currently allow TCP 3389 from Any so night shift can always reach the VMs. How should just-in-time (JIT) VM access change that posture?
• Just-in-time VM access will not enable on a grain-elevator virtual machine because the subscription lacks a workload protection plan. What should the security engineer identify as the prerequisite?
• A reviewer treats Azure Bastion and just-in-time VM access as the same control for lock-chamber servers. How should the security engineer describe their relationship?
• A contractor requests just-in-time access to a lock-chamber VM from a coffee-shop IP that is not on the allowed prefix and leaves the window open for days. Which JIT configuration should the security engineer enforce?
• The tugboat-scheduler AKS API server is on a public IP and appears on Internet scanners. How should the security engineer isolate the control plane?
• Harbor laptops must keep using kubectl against a public AKS API FQDN, but only from known office prefixes. What should the security engineer configure?
• A contractor tries to add API server authorized IP ranges to an AKS cluster that is already private. What should the security engineer explain?
• The canal authority wants the AKS API server projected into the cluster virtual network so hub firewall and custom DNS see that traffic, not only a private-link endpoint in a managed network. Which isolation pattern should the security engineer choose?
• Nobody is alerted when a privileged tugboat pod or a suspicious kube-api call appears on AKS. Which product should the security engineer enable for cluster security monitoring?
• Night-shift charts keep deploying privileged pods and hostPath volumes on AKS. How should the security engineer enforce Kubernetes guardrails without writing a custom admission-controller manifest?
• After a kubeconfig leak, nobody can determine who deleted the lock-gate deployment on AKS. What should the security engineer configure for API-server accountability?
• A reviewer answers “secure AKS” with a twelve-chart service mesh for the canal scheduler. Which host and cluster security controls should the security engineer prioritize instead?
• The tugboat AKS cluster still hands every contractor the same cluster-admin kubeconfig certificate. How should the security engineer change authentication?
• Entra sign-in works on the harbor AKS cluster, but every authenticated user is still effectively cluster-admin. What should the security engineer enable for authorization?
• After Entra ID integration and Azure RBAC for Kubernetes are live, the old admin kubeconfig certificate still works on the canal AKS cluster. What follow-through should the security engineer perform?
• A burst lock-sensor container in Azure Container Instances crashed and nobody has stdout or security-relevant events. What should the security engineer configure?
• Security wants runtime security signals on Azure Container Instances groups that pull images from the harbor registry. Which monitoring product should the security engineer enable?
• The canal public API runs on Azure Container Apps and security cannot see ingress or console logs. What should the security engineer configure?
• A reviewer answers “secure Azure Container Apps” with a Dapr secret-store tutorial for the canal API. Which security-engineer controls should be emphasized instead?
• AKS cannot pull tugboat images because someone pasted the Azure Container Registry admin password into a Kubernetes secret. How should the security engineer fix registry access?
• The harbor Azure Container Registry still has the admin user enabled and two long-lived passwords shared in chat. What should the security engineer do first for registry identity hygiene?
• A partner CI pipeline for the harbor lock-gate images must push only to repositories under lockgate/ and must not list every registry repository. Which access approach meets least privilege for Azure Container Registry?
• A reviewer closes a lock-chamber VM encryption finding because Azure Disk Storage server-side encryption with platform-managed keys is already on. What should the security engineer explain about that baseline versus Domain 3 disk encryption options?
• An older lock-chamber virtual machine must encrypt OS and data volumes inside the guest with BitLocker or dm-crypt and store encryption secrets in Key Vault. Which control should the security engineer select?
• Compliance requires end-to-end encryption of temporary disks, caches, and the compute-to-storage path for lock VMs without burning guest CPU on BitLocker. Which control should the security engineer enable?
• A lock-controller VM must keep its OS disk sealed so the host and hypervisor cannot read it. Which approach meets that requirement?
• A contractor tries to enable encryption at host on a lock-chamber VM that already uses Azure Disk Encryption. What should the security engineer tell them?
• The lock-status API in Azure API Management is protected only by a subscription key passed in the query string. What should the security engineer recommend for stronger inbound authentication?
• Azure API Management still presents a username and password from a named value when calling the canal backend. What should the security engineer recommend?
• A harbor analyst has Contributor on the lock-photo storage account but still cannot list blobs in the portal or tools. What should the security engineer assign?
• Night-shift staff only need to read blobs in one lock-photo container. Which access design follows least privilege?
• A lock-photo container was set to Blob anonymous read so a website could load images, and the storage account still allows public access. What should the security engineer do first for access control?
• Scripts still call the lock-photo account with the account key even though identities already have Storage Blob Data roles. Which end-state access-control change should the security engineer make?
• The grain-silo storage account key appeared in a support ticket. How should the security engineer rotate keys with minimal downtime?
• A contractor treats a storage account access key as a read-only password for lock photos. What should the security engineer emphasize?
• Help-desk staff with Reader can open the storage account blade but cannot reveal access keys, while a custom role that includes Microsoft.Storage/storageAccounts/listKeys/action can. What should the security engineer do?
• Lock operators map \\account.file.core.windows.net\share by pasting the storage account key into Windows. Which access method should the security engineer select instead?
• Microsoft Entra Kerberos is enabled for an Azure Files share, yet everyone who can mount it still sees every lock plan. What authorization layers should the security engineer configure?
• A Linux job must read one Azure Files file over HTTPS and must not mount SMB or join AD DS. Which access approach fits?
• A partner needs time-boxed read access to one lock-photo container, and the team was about to sign an account SAS with the storage account key. What should the security engineer mint instead?
• A service SAS for lock photos was emailed with expiry baked into the URI; the contractor left and the URI still works. How should the security engineer make future service SAS revocable?
• Someone minted an account SAS with read, write, delete, and list on blob, file, and queue for one year and allowed HTTP. What should the security engineer issue instead?
• The lock-photo API on App Service still stores a SAS in application settings. What should the security engineer do instead?
• An operator deleted the wrong lock-photo blob and needs a retention window to undelete it. Which protection should the security engineer enable?
• A lock-photo blob was overwritten with an empty file; soft delete did not help because the blob still exists. Which feature restores the previous content?
• Canal bylaws require lock-camera footage to remain unaltered and undeleted for seven years. Which storage protection should the security engineer configure?
• A canal-authority lawsuit needs lock-camera blobs frozen with no planned end date. Which immutable-storage control keeps those objects write-once until counsel explicitly clears the hold?
• Compliance wants an off-account recoverable copy of the lock-photo storage account, not only a same-account recycle bin. Soft delete and versioning are already on. What should you configure next?
• The grain-silo storage account still uses Microsoft-managed keys, and auditors want the canal authority to hold the encryption key. How do you configure Bring Your Own Key for Storage encryption?
• A reviewer starts answering the grain-silo BYOK task by drafting Key Vault access-policy JSON, private-endpoint rules, and a rotation schedule. For Domain 3 storage encryption, what is the correct focus?
• A regulator wants two independent encryption layers under Microsoft’s storage infrastructure for the lock-photo account, not only the default SSE with a platform-managed or customer-managed key. Which control meets that requirement?
• A contractor tries to turn on infrastructure encryption for an existing grain-silo storage account that was created without it. What should you tell them?
• Lock-lab Azure SQL still has only the SQL server admin password. What must you configure so Microsoft Entra identities can become database principals?
• Auditors want no SQL passwords on the water-quality database. Which server authentication setting enforces that goal?
• The Entra admin can connect to lock-lab Azure SQL, but the lock-lab analysts cannot. What should you create so the analysts’ Entra security group can sign in with least privilege?
• The lock-lab API still embeds a SQL username and password for Azure SQL. How should the app authenticate instead?
• Only one water-quality database was audited; a new database was added later and nobody noticed. How do you ensure new databases inherit audit coverage?
• Security needs durable records of failed logins and SELECT activity on the lock-chemistry table. Where should Azure SQL auditing send those events?
• A DBA disables server auditing on the lock-lab SQL server “because the water-quality database already has its own audit.” What is the correct guidance?
• Help-desk analysts run SELECT on lock-operator email addresses and see full values. Which control obfuscates those emails in the result set without rewriting the data at rest?
• After dynamic data masking is applied, the lock-lab DBA still sees plaintext while analysts see masked emails. How should you let a specific support lead see real values without removing the mask?
• A reviewer treats dynamic data masking, Transparent Data Encryption, and Always Encrypted as interchangeable “SQL encryption.” Which distinction should you apply for the lock-lab database?
• A migration checklist says “enable TDE” as if the water-quality Azure SQL Database were unprotected. What should you verify first?
• Auditors want the canal authority to hold the TDE protector for lock-lab Azure SQL. What change meets that requirement without turning this into Key Vault administration?
• A reviewer claims Transparent Data Encryption stops the lock-lab DBA from reading operator Social Security numbers with SELECT. Why is that claim wrong?
• Lock-operator national IDs and card numbers must stay hidden from DBAs and from the SQL engine itself, and TDE is already enabled. What should you recommend?
• A contractor wants Always Encrypted “turned on at the server” for lock-lab Azure SQL the same way TDE is enabled. What must you explain?
• The lock-lab app must equality-search on a hashed employee ID but must never support grouping on card numbers. Always Encrypted will protect both columns. What should you recommend?