cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 72

Question 710

An attacker with write privileges can remove audit documents because the storage container has no immutability policy. A review identifies this consequence: Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. Which recovery action addresses the underlying technical fault?

  1. The controlled remediation is to grant all users Storage Blob Data Owner to enforce retention.
  2. The controlled remediation is to use blob versioning alone as proof every retained version is legally immutable.
  3. The controlled remediation is to configure the intended immutable policy and verify unauthorized modifications fail.
  4. The controlled remediation is to turn off soft delete and assume audit objects become tamper proof.

Explanation

Correct Answer

C:

Test using these records: Retention policy state, lock status, protected blob operation test and compliance authorization. Immutable Blob policies provide write-once-read-many style protections against modification and deletion during defined retention.

Incorrect Answers

A:

Grant all users Storage Blob Data Owner to enforce retention. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.

B:

Use blob versioning alone as proof every retained version is legally immutable. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.

D:

Turn off soft delete and assume audit objects become tamper proof. This would not reliably restore the intended security boundary. Blob RBAC write controls alone may not satisfy mandated tamper-resistant record retention. The appropriate controlled recovery is: Configure the intended immutable policy and verify unauthorized modifications fail.

Question 711

An organization requires storage at-rest encryption backed by a controlled Key Vault key rather than only Microsoft-managed keys. What is the most defensible Azure security action?

  1. Upload a password to a blob container instead of assigning encryption key access.
  2. Revoke the service identity from the key vault immediately after configuring CMK.
  3. Assume a storage account key is the same key as the customer-managed encryption key.
  4. Configure the supported customer-managed key with Key Vault or managed HSM permissions and managed identity.

Explanation

Correct Answer

D:

Confirm the change against these records: Storage encryption key URI, managed identity, Key Vault authorization and encryption state. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.

Incorrect Answers

A:

A removed or inaccessible CMK can prevent required storage encryption operations. Upload a password to a blob container instead of assigning encryption key access.

B:

Revoke the service identity from the key vault immediately after configuring CMK. The proposed change targets the wrong mechanism or lacks essential validation. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Relevant evidence is Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

C:

A removed or inaccessible CMK can prevent required storage encryption operations. The intended action is: Configure the supported customer-managed key with Key Vault or managed HSM permissions and managed identity.

Question 712

An organization requires storage at-rest encryption backed by a controlled Key Vault key rather than only Microsoft-managed keys. Which diagnostic record would most strongly confirm the result?

  1. A storage account resource name without its encryption or retention configuration.
  2. A database online indicator without a log of the protected operation.
  3. Storage encryption key URI, managed identity, Key Vault authorization and encryption state.
  4. An outdated deployment template without current effective settings.

Explanation

Correct Answer

C:

These records test the actual customer-managed key for storage encryption behavior rather than an unrelated dashboard state.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.

B:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

D:

On its own, that evidence does not prove the specified security control works. In the given case, an organization requires storage at-rest encryption backed by a controlled Key Vault key rather than only Microsoft-managed keys.

Question 713

An organization requires storage at-rest encryption backed by a controlled Key Vault key rather than only Microsoft-managed keys. Which platform concept should guide the engineer’s assessment?

  1. Setting a registry image tag guarantees security monitoring of the running workload.
  2. A running compute resource automatically enforces least-privilege Kubernetes permissions.
  3. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.
  4. A protected storage account is immune to every accidental deletion and overwrite.

Explanation

Correct Answer

C:

Confirmation depends on Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

Incorrect Answers

A:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for customer-managed key for storage encryption. The relevant security behavior is: Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Check evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

B:

A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for customer-managed key for storage encryption. The relevant security behavior is: Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Check evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

D:

A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for customer-managed key for storage encryption. The relevant security behavior is: Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Check evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

Question 714

An organization requires storage at-rest encryption backed by a controlled Key Vault key rather than only Microsoft-managed keys. Suppose the operator instead follows this unsafe shortcut: Upload a password to a blob container instead of assigning encryption key access. Which root-cause observation follows from that incorrect change?

  1. The security flaw is that the team retained a tested database backup.
  2. A removed or inaccessible CMK can prevent required storage encryption operations.
  3. Inspecting encryption settings itself disables a healthy disk.
  4. The observed issue is fully explained by the service display name.

Explanation

Correct Answer

B:

The suitable control is: Configure the supported customer-managed key with Key Vault or managed HSM permissions and managed identity. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.

Incorrect Answers

A:

The security flaw is that the team retained a tested database backup. This does not explain the real customer-managed key for storage encryption weakness after the shortcut. The material failure is: A removed or inaccessible CMK can prevent required storage encryption operations. Inspect evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

C:

Inspecting encryption settings itself disables a healthy disk. This does not explain the real customer-managed key for storage encryption weakness after the shortcut. The material failure is: A removed or inaccessible CMK can prevent required storage encryption operations. Inspect evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

D:

The observed issue is fully explained by the service display name. This does not explain the real customer-managed key for storage encryption weakness after the shortcut. The material failure is: A removed or inaccessible CMK can prevent required storage encryption operations. Inspect evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

Question 715

An organization requires storage at-rest encryption backed by a controlled Key Vault key rather than only Microsoft-managed keys. A review identifies this consequence: A removed or inaccessible CMK can prevent required storage encryption operations. Which recovery action addresses the underlying technical fault?

  1. Revoke the service identity from the key vault immediately after configuring CMK.
  2. Assume a storage account key is the same key as the customer-managed encryption key.
  3. Repair key access, identity and rotation configuration and verify storage encryption health.
  4. Upload a password to a blob container instead of assigning encryption key access.

Explanation

Correct Answer

C:

Test using these records: Storage encryption key URI, managed identity, Key Vault authorization and encryption state. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Revoke the service identity from the key vault immediately after configuring CMK. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.

B:

Assume a storage account key is the same key as the customer-managed encryption key. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.

D:

Upload a password to a blob container instead of assigning encryption key access. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.

Question 716

An Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access. What is the BEST supported implementation or corrective action?

  1. For this Azure workload, the team should revoke the service identity from the key vault immediately after configuring CMK.
  2. For this Azure workload, the team should configure the supported customer-managed key with Key Vault or managed HSM permissions and managed identity.
  3. For this Azure workload, the team should assume a storage account key is the same key as the customer-managed encryption key.
  4. For this Azure workload, the team should upload a password to a blob container instead of assigning encryption key access.

Explanation

Correct Answer

B:

Confirm the change against these records: Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

Incorrect Answers

A:

Revoke the service identity from the key vault immediately after configuring CMK. The proposed change targets the wrong mechanism or lacks essential validation. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Relevant evidence is Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

C:

A removed or inaccessible CMK can prevent required storage encryption operations. Assume a storage account key is the same key as the customer-managed encryption key.

D:

A removed or inaccessible CMK can prevent required storage encryption operations. In the given case, an Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access.

Question 717

An Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access. Which evidence BEST verifies the intended technical behavior?

  1. In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
  2. In this security review, examine a storage account resource name without its encryption or retention configuration.
  3. In this security review, examine Storage encryption key URI, managed identity, Key Vault authorization and encryption state.
  4. In this security review, examine a database online indicator without a log of the protected operation.

Explanation

Correct Answer

C:

The intended action is: Configure the supported customer-managed key with Key Vault or managed HSM permissions and managed identity.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. In the given case, an Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access.

B:

Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.

D:

The more relevant observations are: Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

Question 718

An Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access. Which principle BEST explains why the recommended solution is appropriate?

  1. The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
  2. The applicable security principle is that customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.
  3. The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
  4. The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.

Explanation

Correct Answer

B:

This principle supports the security response: Configure the supported customer-managed key with Key Vault or managed HSM permissions and managed identity.

Incorrect Answers

A:

A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for customer-managed key for storage encryption. The relevant security behavior is: Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Check evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

C:

Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for customer-managed key for storage encryption. The relevant security behavior is: Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Check evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

D:

A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for customer-managed key for storage encryption. The relevant security behavior is: Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity. Check evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

Question 719

An Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access. Suppose the operator instead follows this unsafe shortcut: Upload a password to a blob container instead of assigning encryption key access. What is the MOST significant failure introduced by that shortcut?

  1. The resulting security weakness is that the observed issue is fully explained by the service display name.
  2. The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
  3. The resulting security weakness is that a removed or inaccessible CMK can prevent required storage encryption operations.
  4. The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.

Explanation

Correct Answer

C:

The suitable control is: Configure the supported customer-managed key with Key Vault or managed HSM permissions and managed identity. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

The observed issue is fully explained by the service display name. This does not explain the real customer-managed key for storage encryption weakness after the shortcut. The material failure is: A removed or inaccessible CMK can prevent required storage encryption operations. Inspect evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

B:

Collecting VM diagnostic data caused the original unauthorized storage read. This does not explain the real customer-managed key for storage encryption weakness after the shortcut. The material failure is: A removed or inaccessible CMK can prevent required storage encryption operations. Inspect evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

D:

Inspecting encryption settings itself disables a healthy disk. This does not explain the real customer-managed key for storage encryption weakness after the shortcut. The material failure is: A removed or inaccessible CMK can prevent required storage encryption operations. Inspect evidence such as Storage encryption key URI, managed identity, Key Vault authorization and encryption state.

Question 720

An Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access. A review identifies this consequence: A removed or inaccessible CMK can prevent required storage encryption operations. What is the BEST controlled recovery once this failure is recognized?

  1. The controlled remediation is to assume a storage account key is the same key as the customer-managed encryption key.
  2. The controlled remediation is to upload a password to a blob container instead of assigning encryption key access.
  3. The controlled remediation is to revoke the service identity from the key vault immediately after configuring CMK.
  4. The controlled remediation is to repair key access, identity and rotation configuration and verify storage encryption health.

Explanation

Correct Answer

D:

Test using these records: Storage encryption key URI, managed identity, Key Vault authorization and encryption state. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.

Incorrect Answers

A:

Assume a storage account key is the same key as the customer-managed encryption key. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.

B:

Upload a password to a blob container instead of assigning encryption key access. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.

C:

Revoke the service identity from the key vault immediately after configuring CMK. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.

Microsoft Azure Security Technologies (AZ-500) Practice Tests