Microsoft AZ-500 Practice Test 73
Question 720
An Azure storage account encryption policy changes to a customer-managed key but the managed identity lacks key access. A review identifies this consequence: A removed or inaccessible CMK can prevent required storage encryption operations. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to assume a storage account key is the same key as the customer-managed encryption key.
- The controlled remediation is to upload a password to a blob container instead of assigning encryption key access.
- The controlled remediation is to revoke the service identity from the key vault immediately after configuring CMK.
- The controlled remediation is to repair key access, identity and rotation configuration and verify storage encryption health.
Explanation
Correct Answer
D:Test using these records: Storage encryption key URI, managed identity, Key Vault authorization and encryption state. Customer-managed storage encryption depends on an accessible customer-controlled key and authorized service identity.
Incorrect Answers
A:Assume a storage account key is the same key as the customer-managed encryption key. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.
B:Upload a password to a blob container instead of assigning encryption key access. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.
C:Revoke the service identity from the key vault immediately after configuring CMK. This would not reliably restore the intended security boundary. A removed or inaccessible CMK can prevent required storage encryption operations. The appropriate controlled recovery is: Repair key access, identity and rotation configuration and verify storage encryption health.
Question 721
A storage customer requires independent additional encryption at the infrastructure layer beyond default service encryption. What is the BEST supported implementation or corrective action?
- Enable Azure Storage infrastructure encryption on an eligible account at creation when required.
- Assume changing a blob access tier turns on infrastructure encryption.
- Enable default encryption only and report that two layers are now guaranteed.
- Change the account firewall instead of checking infrastructure encryption flags.
Explanation
Correct Answer
A:Confirm the change against these records: Account infrastructure encryption flag, deployment configuration and effective account properties. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
Incorrect Answers
B:If double encryption was not enabled at required deployment time, the account may not meet the additional requirement.
C:Enable default encryption only and report that two layers are now guaranteed. The proposed change targets the wrong mechanism or lacks essential validation. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Relevant evidence is account infrastructure encryption flag, deployment configuration and effective account properties.
D:If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The intended action is: Enable Azure Storage infrastructure encryption on an eligible account at creation when required.
Question 722
A storage customer requires independent additional encryption at the infrastructure layer beyond default service encryption. Which evidence BEST verifies the intended technical behavior?
- Account infrastructure encryption flag, deployment configuration and effective account properties.
- A powered-on VM status without the actual guest or data-plane security state.
- The identity name without a corresponding workload data authorization test.
- A database online indicator without a log of the protected operation.
Explanation
Correct Answer
A:These records test the actual infrastructure double encryption behavior rather than an unrelated dashboard state. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Account infrastructure encryption flag, deployment configuration and effective account properties.
D:On its own, that evidence does not prove the specified security control works. In the given case, a storage customer requires independent additional encryption at the infrastructure layer beyond default service encryption.
Question 723
A storage customer requires independent additional encryption at the infrastructure layer beyond default service encryption. Which principle BEST explains why the recommended solution is appropriate?
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
- Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
- Setting a registry image tag guarantees security monitoring of the running workload.
- A valid Azure management role always gives full access to every blob object and SQL row.
Explanation
Correct Answer
B:This principle supports the security response: Enable Azure Storage infrastructure encryption on an eligible account at creation when required. Confirmation depends on Account infrastructure encryption flag, deployment configuration and effective account properties.
Incorrect Answers
A:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for infrastructure double encryption. The relevant security behavior is: Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Check evidence such as account infrastructure encryption flag, deployment configuration and effective account properties.
C:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for infrastructure double encryption. The relevant security behavior is: Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Check evidence such as account infrastructure encryption flag, deployment configuration and effective account properties.
D:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for infrastructure double encryption. The relevant security behavior is: Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Check evidence such as account infrastructure encryption flag, deployment configuration and effective account properties.
Question 724
A storage customer requires independent additional encryption at the infrastructure layer beyond default service encryption. Suppose the operator instead follows this unsafe shortcut: Assume changing a blob access tier turns on infrastructure encryption. What is the MOST significant failure introduced by that shortcut?
- The observed issue is fully explained by the service display name.
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- If double encryption was not enabled at required deployment time, the account may not meet the additional requirement.
Explanation
Correct Answer
D:The suitable control is: Enable Azure Storage infrastructure encryption on an eligible account at creation when required. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
Incorrect Answers
A:This does not explain the real infrastructure double encryption weakness after the shortcut. The material failure is: If double encryption was not enabled at required deployment time, the account may not meet the additional requirement.
B:This does not explain the real infrastructure double encryption weakness after the shortcut. Inspect evidence such as account infrastructure encryption flag, deployment configuration and effective account properties.
C:This does not explain the real infrastructure double encryption weakness after the shortcut. In the given case, a storage customer requires independent additional encryption at the infrastructure layer beyond default service encryption.
Question 725
A storage customer requires independent additional encryption at the infrastructure layer beyond default service encryption. A review identifies this consequence: If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. What is the BEST controlled recovery once this failure is recognized?
- Provision a compliant storage account and validate double-encryption properties.
- Enable default encryption only and report that two layers are now guaranteed.
- Change the account firewall instead of checking infrastructure encryption flags.
- Assume changing a blob access tier turns on infrastructure encryption.
Explanation
Correct Answer
A:This addresses the observed security problem while providing a verifiable outcome. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
Incorrect Answers
B:Enable default encryption only and report that two layers are now guaranteed. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
C:Change the account firewall instead of checking infrastructure encryption flags. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
D:Assume changing a blob access tier turns on infrastructure encryption. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
Question 726
A regulated storage deployment mistakenly treats a customer-managed key alone as proof infrastructure double encryption is enabled. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should enable default encryption only and report that two layers are now guaranteed.
- For this Azure workload, the team should enable Azure Storage infrastructure encryption on an eligible account at creation when required.
- For this Azure workload, the team should change the account firewall instead of checking infrastructure encryption flags.
- For this Azure workload, the team should assume changing a blob access tier turns on infrastructure encryption.
Explanation
Correct Answer
B:Confirm the change against these records: Account infrastructure encryption flag, deployment configuration and effective account properties.
Incorrect Answers
A:Enable default encryption only and report that two layers are now guaranteed. The proposed change targets the wrong mechanism or lacks essential validation. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Relevant evidence is account infrastructure encryption flag, deployment configuration and effective account properties.
C:If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. Change the account firewall instead of checking infrastructure encryption flags.
D:If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. Assume changing a blob access tier turns on infrastructure encryption.
Question 727
A regulated storage deployment mistakenly treats a customer-managed key alone as proof infrastructure double encryption is enabled. What evidence most directly confirms the intended security behavior?
- In this security review, examine an outdated deployment template without current effective settings.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine account infrastructure encryption flag, deployment configuration and effective account properties.
- In this security review, examine the identity name without a corresponding workload data authorization test.
Explanation
Correct Answer
C:These records test the actual infrastructure double encryption behavior rather than an unrelated dashboard state. The intended action is: Enable Azure Storage infrastructure encryption on an eligible account at creation when required.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a regulated storage deployment mistakenly treats a customer-managed key alone as proof infrastructure double encryption is enabled.
B:Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
D:The more relevant observations are: Account infrastructure encryption flag, deployment configuration and effective account properties.
Question 728
A regulated storage deployment mistakenly treats a customer-managed key alone as proof infrastructure double encryption is enabled. Which security principle best explains the intended decision?
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
Explanation
Correct Answer
D:This principle supports the security response: Enable Azure Storage infrastructure encryption on an eligible account at creation when required. Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption.
Incorrect Answers
A:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for infrastructure double encryption. The relevant security behavior is: Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Check evidence such as account infrastructure encryption flag, deployment configuration and effective account properties.
B:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for infrastructure double encryption. The relevant security behavior is: Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Check evidence such as account infrastructure encryption flag, deployment configuration and effective account properties.
C:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for infrastructure double encryption. The relevant security behavior is: Infrastructure encryption adds a second encryption layer distinct from regular service-level storage encryption. Check evidence such as account infrastructure encryption flag, deployment configuration and effective account properties.
Question 729
A regulated storage deployment mistakenly treats a customer-managed key alone as proof infrastructure double encryption is enabled. Suppose the operator instead follows this unsafe shortcut: Assume changing a blob access tier turns on infrastructure encryption. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that if double encryption was not enabled at required deployment time, the account may not meet the additional requirement.
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
Explanation
Correct Answer
A:The suitable control is: Enable Azure Storage infrastructure encryption on an eligible account at creation when required. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real infrastructure double encryption weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
C:This does not explain the real infrastructure double encryption weakness after the shortcut. The security flaw is that the team retained a tested database backup.
D:This does not explain the real infrastructure double encryption weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
Question 730
A regulated storage deployment mistakenly treats a customer-managed key alone as proof infrastructure double encryption is enabled. A review identifies this consequence: If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. Which remediation most directly restores the intended behavior?
- The controlled remediation is to change the account firewall instead of checking infrastructure encryption flags.
- The controlled remediation is to provision a compliant storage account and validate double-encryption properties.
- The controlled remediation is to assume changing a blob access tier turns on infrastructure encryption.
- The controlled remediation is to enable default encryption only and report that two layers are now guaranteed.
Explanation
Correct Answer
B:This addresses the observed security problem while providing a verifiable outcome. Test using these records: Account infrastructure encryption flag, deployment configuration and effective account properties.
Incorrect Answers
A:Change the account firewall instead of checking infrastructure encryption flags. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
C:Assume changing a blob access tier turns on infrastructure encryption. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
D:Enable default encryption only and report that two layers are now guaranteed. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
