Microsoft AZ-500 Practice Test 62
Question 610
A platform uses storage service encryption but its security requirements also cover data handled on the virtualization host. A review identifies this consequence: Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. Which remediation most directly restores the intended behavior?
- The controlled remediation is to disable encryption on temporary storage to avoid performance testing.
- The controlled remediation is to install a SQL firewall rule as a replacement for host disk encryption.
- The controlled remediation is to assume Azure managed disk encryption and host encryption are always the same control.
- The controlled remediation is to deploy compatible host encryption and verify the VM and disk state.
Explanation
Correct Answer
D:Test using these records: VM encryptionAtHost state, supported SKU, disk encryption configuration and effective encryption status.
Incorrect Answers
A:Disable encryption on temporary storage to avoid performance testing. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
B:Install a SQL firewall rule as a replacement for host disk encryption. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
C:Assume Azure managed disk encryption and host encryption are always the same control. This would not reliably restore the intended security boundary. Assuming every temporary disk is covered by a managed disk encryption setting can leave a protection gap. The appropriate controlled recovery is: Deploy compatible host encryption and verify the VM and disk state.
Question 611
A confidential VM must protect disk content with keys released only to an attested confidential computing environment. Which configuration decision MOST directly resolves the issue?
- Treat an Azure NSG as the confidential VM disk key.
- Assume any VM can enable confidential disk encryption without compatible hardware.
- Use a supported confidential VM and confidential disk encryption design with appropriate key management.
- Publish the disk key in the VM custom data to bypass key release.
Explanation
Correct Answer
C:Confirm the change against these records: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result. Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
Incorrect Answers
A:Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls.
B:Assume any VM can enable confidential disk encryption without compatible hardware. The proposed change targets the wrong mechanism or lacks essential validation. Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Relevant evidence is confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
D:Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The intended action is: Use a supported confidential VM and confidential disk encryption design with appropriate key management.
Question 612
A confidential VM must protect disk content with keys released only to an attested confidential computing environment. What evidence most directly confirms the intended security behavior?
- A storage account resource name without its encryption or retention configuration.
- A database online indicator without a log of the protected operation.
- Confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
- An outdated deployment template without current effective settings.
Explanation
Correct Answer
C:These records test the actual confidential disk encryption and key release behavior rather than an unrelated dashboard state. Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
B:On its own, that evidence does not prove the specified security control works. Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
D:On its own, that evidence does not prove the specified security control works. In the given case, a confidential VM must protect disk content with keys released only to an attested confidential computing environment.
Question 613
A confidential VM must protect disk content with keys released only to an attested confidential computing environment. Which security principle best explains the intended decision?
- Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
- Setting a registry image tag guarantees security monitoring of the running workload.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- A protected storage account is immune to every accidental deletion and overwrite.
Explanation
Correct Answer
A:Confirmation depends on Confidential VM SKU, disk encryption type, key release or attestation policy and boot result. This principle supports the security response: Use a supported confidential VM and confidential disk encryption design with appropriate key management.
Incorrect Answers
B:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for confidential disk encryption and key release. The relevant security behavior is: Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Check evidence such as confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
C:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for confidential disk encryption and key release. The relevant security behavior is: Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Check evidence such as confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
D:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for confidential disk encryption and key release. The relevant security behavior is: Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Check evidence such as confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
Question 614
A confidential VM must protect disk content with keys released only to an attested confidential computing environment. Suppose the operator instead follows this unsafe shortcut: Treat an Azure NSG as the confidential VM disk key. Which resulting risk or fault should the reviewer identify?
- The security flaw is that the team retained a tested database backup.
- Inspecting encryption settings itself disables a healthy disk.
- The observed issue is fully explained by the service display name.
- Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls.
Explanation
Correct Answer
D:The suitable control is: Use a supported confidential VM and confidential disk encryption design with appropriate key management. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real confidential disk encryption and key release weakness after the shortcut. The material failure is: Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls.
B:This does not explain the real confidential disk encryption and key release weakness after the shortcut. Inspect evidence such as confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
C:This does not explain the real confidential disk encryption and key release weakness after the shortcut. In the given case, a confidential VM must protect disk content with keys released only to an attested confidential computing environment.
Question 615
A confidential VM must protect disk content with keys released only to an attested confidential computing environment. A review identifies this consequence: Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. Which remediation most directly restores the intended behavior?
- Assume any VM can enable confidential disk encryption without compatible hardware.
- Publish the disk key in the VM custom data to bypass key release.
- Configure the supported confidential VM encryption mode and verify secure boot and key access.
- Treat an Azure NSG as the confidential VM disk key.
Explanation
Correct Answer
C:Test using these records: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume any VM can enable confidential disk encryption without compatible hardware. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
B:Publish the disk key in the VM custom data to bypass key release. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
D:Treat an Azure NSG as the confidential VM disk key. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
Question 616
A sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees. Which operator action best meets this technical requirement?
- For this Azure workload, the team should assume any VM can enable confidential disk encryption without compatible hardware.
- For this Azure workload, the team should use a supported confidential VM and confidential disk encryption design with appropriate key management.
- For this Azure workload, the team should publish the disk key in the VM custom data to bypass key release.
- For this Azure workload, the team should treat an Azure NSG as the confidential VM disk key.
Explanation
Correct Answer
B:Confirm the change against these records: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
Incorrect Answers
A:Assume any VM can enable confidential disk encryption without compatible hardware. The proposed change targets the wrong mechanism or lacks essential validation. Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Relevant evidence is confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
C:Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. Publish the disk key in the VM custom data to bypass key release.
D:Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. Treat an Azure NSG as the confidential VM disk key.
Question 617
A sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine a database online indicator without a log of the protected operation.
- In this security review, examine confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
Explanation
Correct Answer
D:These records test the actual confidential disk encryption and key release behavior rather than an unrelated dashboard state. The intended action is: Use a supported confidential VM and confidential disk encryption design with appropriate key management.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees.
B:The more relevant observations are: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
C:A database online indicator without a log of the protected operation. On its own, that evidence does not prove the specified security control works. The more relevant observations are: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result. Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
Question 618
A sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees. Which statement most accurately explains this scenario?
- The applicable security principle is that confidential disk encryption combines supported confidential computing and disk protection mechanisms.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
Explanation
Correct Answer
A:Confirmation depends on Confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
Incorrect Answers
B:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for confidential disk encryption and key release. The relevant security behavior is: Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Check evidence such as confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
C:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for confidential disk encryption and key release. The relevant security behavior is: Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Check evidence such as confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
D:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for confidential disk encryption and key release. The relevant security behavior is: Confidential disk encryption combines supported confidential computing and disk protection mechanisms. Check evidence such as confidential VM SKU, disk encryption type, key release or attestation policy and boot result.
Question 619
A sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees. Suppose the operator instead follows this unsafe shortcut: Treat an Azure NSG as the confidential VM disk key. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that the observed issue is fully explained by the service display name.
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls.
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
Explanation
Correct Answer
C:The suitable control is: Use a supported confidential VM and confidential disk encryption design with appropriate key management. Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
Incorrect Answers
A:This does not explain the real confidential disk encryption and key release weakness after the shortcut. The observed issue is fully explained by the service display name.
B:This does not explain the real confidential disk encryption and key release weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
D:This does not explain the real confidential disk encryption and key release weakness after the shortcut. In the given case, a sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees.
Question 620
A sensitive workload uses ordinary disk encryption despite a policy requiring confidential VM disk encryption guarantees. A review identifies this consequence: Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to configure the supported confidential VM encryption mode and verify secure boot and key access.
- The controlled remediation is to publish the disk key in the VM custom data to bypass key release.
- The controlled remediation is to treat an Azure NSG as the confidential VM disk key.
- The controlled remediation is to assume any VM can enable confidential disk encryption without compatible hardware.
Explanation
Correct Answer
A:Test using these records: Confidential VM SKU, disk encryption type, key release or attestation policy and boot result. Confidential disk encryption combines supported confidential computing and disk protection mechanisms.
Incorrect Answers
B:Publish the disk key in the VM custom data to bypass key release. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
C:Treat an Azure NSG as the confidential VM disk key. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
D:Assume any VM can enable confidential disk encryption without compatible hardware. This would not reliably restore the intended security boundary. Selecting ordinary managed disk encryption alone does not establish confidential VM attested key-release controls. The appropriate controlled recovery is: Configure the supported confidential VM encryption mode and verify secure boot and key access.
