Microsoft AZ-500 Practice Test 74
Question 730
A regulated storage deployment mistakenly treats a customer-managed key alone as proof infrastructure double encryption is enabled. A review identifies this consequence: If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. Which remediation most directly restores the intended behavior?
- The controlled remediation is to change the account firewall instead of checking infrastructure encryption flags.
- The controlled remediation is to provision a compliant storage account and validate double-encryption properties.
- The controlled remediation is to assume changing a blob access tier turns on infrastructure encryption.
- The controlled remediation is to enable default encryption only and report that two layers are now guaranteed.
Explanation
Correct Answer
B:This addresses the observed security problem while providing a verifiable outcome. Test using these records: Account infrastructure encryption flag, deployment configuration and effective account properties.
Incorrect Answers
A:Change the account firewall instead of checking infrastructure encryption flags. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
C:Assume changing a blob access tier turns on infrastructure encryption. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
D:Enable default encryption only and report that two layers are now guaranteed. This would not reliably restore the intended security boundary. If double encryption was not enabled at required deployment time, the account may not meet the additional requirement. The appropriate controlled recovery is: Provision a compliant storage account and validate double-encryption properties.
Question 731
A SQL administrator wants to stop using shared SQL passwords and use managed identities for application connections. Which configuration decision MOST directly resolves the issue?
- Store one SQL administrator password in every application config file.
- Configure a supported Microsoft Entra administrator and create least-privileged Entra users or identities in the database.
- Assume subscription Owner automatically has SELECT permission on every SQL table.
- Disable Azure SQL firewall rules in order to create Entra database users.
Explanation
Correct Answer
B:Confirm the change against these records: Entra admin setting, contained database user, SQL connection token and access results. This directly addresses Microsoft Entra authentication for Azure SQL.
Incorrect Answers
A:Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. Store one SQL administrator password in every application config file.
C:Assume subscription Owner automatically has SELECT permission on every SQL table. The proposed change targets the wrong mechanism or lacks essential validation. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Relevant evidence is Entra admin setting, contained database user, SQL connection token and access results.
D:Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The intended action is: Configure a supported Microsoft Entra administrator and create least-privileged Entra users or identities in the database.
Question 732
A SQL administrator wants to stop using shared SQL passwords and use managed identities for application connections. What evidence most directly confirms the intended security behavior?
- An outdated deployment template without current effective settings.
- Entra admin setting, contained database user, SQL connection token and access results.
- A storage account resource name without its encryption or retention configuration.
- The identity name without a corresponding workload data authorization test.
Explanation
Correct Answer
B:These records test the actual Microsoft Entra authentication for Azure SQL behavior rather than an unrelated dashboard state. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Entra admin setting, contained database user, SQL connection token and access results.
C:On its own, that evidence does not prove the specified security control works. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
D:On its own, that evidence does not prove the specified security control works. In the given case, a SQL administrator wants to stop using shared SQL passwords and use managed identities for application connections.
Question 733
A SQL administrator wants to stop using shared SQL passwords and use managed identities for application connections. Which security principle best explains the intended decision?
- A protected storage account is immune to every accidental deletion and overwrite.
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
- A running compute resource automatically enforces least-privilege Kubernetes permissions.
- Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Explanation
Correct Answer
D:Confirmation depends on Entra admin setting, contained database user, SQL connection token and access results. This principle supports the security response: Configure a supported Microsoft Entra administrator and create least-privileged Entra users or identities in the database.
Incorrect Answers
A:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Microsoft Entra authentication for Azure SQL. The relevant security behavior is: Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Check evidence such as Entra admin setting, contained database user, SQL connection token and access results.
B:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for Microsoft Entra authentication for Azure SQL. The relevant security behavior is: Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Check evidence such as Entra admin setting, contained database user, SQL connection token and access results.
C:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for Microsoft Entra authentication for Azure SQL. The relevant security behavior is: Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Check evidence such as Entra admin setting, contained database user, SQL connection token and access results.
Question 734
A SQL administrator wants to stop using shared SQL passwords and use managed identities for application connections. Suppose the operator instead follows this unsafe shortcut: Store one SQL administrator password in every application config file. Which resulting risk or fault should the reviewer identify?
- Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
- The security flaw is that the team retained a tested database backup.
- Inspecting encryption settings itself disables a healthy disk.
Explanation
Correct Answer
A:The suitable control is: Configure a supported Microsoft Entra administrator and create least-privileged Entra users or identities in the database. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real Microsoft Entra authentication for Azure SQL weakness after the shortcut. The material failure is: Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user.
C:This does not explain the real Microsoft Entra authentication for Azure SQL weakness after the shortcut. Inspect evidence such as Entra admin setting, contained database user, SQL connection token and access results.
D:This does not explain the real Microsoft Entra authentication for Azure SQL weakness after the shortcut. In the given case, a SQL administrator wants to stop using shared SQL passwords and use managed identities for application connections.
Question 735
A SQL administrator wants to stop using shared SQL passwords and use managed identities for application connections. A review identifies this consequence: Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. Which remediation most directly restores the intended behavior?
- Assume subscription Owner automatically has SELECT permission on every SQL table.
- Correct the identity administrator and database grants and validate token-based connections.
- Disable Azure SQL firewall rules in order to create Entra database users.
- Store one SQL administrator password in every application config file.
Explanation
Correct Answer
B:Test using these records: Entra admin setting, contained database user, SQL connection token and access results. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume subscription Owner automatically has SELECT permission on every SQL table. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
C:Disable Azure SQL firewall rules in order to create Entra database users. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
D:Store one SQL administrator password in every application config file. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
Question 736
An Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration. Which operator action best meets this technical requirement?
- For this Azure workload, the team should assume subscription Owner automatically has SELECT permission on every SQL table.
- For this Azure workload, the team should disable Azure SQL firewall rules in order to create Entra database users.
- For this Azure workload, the team should configure a supported Microsoft Entra administrator and create least-privileged Entra users or identities in the database.
- For this Azure workload, the team should store one SQL administrator password in every application config file.
Explanation
Correct Answer
C:Confirm the change against these records: Entra admin setting, contained database user, SQL connection token and access results. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Incorrect Answers
A:Assume subscription Owner automatically has SELECT permission on every SQL table. The proposed change targets the wrong mechanism or lacks essential validation. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Relevant evidence is Entra admin setting, contained database user, SQL connection token and access results.
B:Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user.
D:In the given case, an Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration.
Question 737
An Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a database online indicator without a log of the protected operation.
- In this security review, examine an outdated deployment template without current effective settings.
- In this security review, examine a storage account resource name without its encryption or retention configuration.
- In this security review, examine Entra admin setting, contained database user, SQL connection token and access results.
Explanation
Correct Answer
D:These records test the actual Microsoft Entra authentication for Azure SQL behavior rather than an unrelated dashboard state. The intended action is: Configure a supported Microsoft Entra administrator and create least-privileged Entra users or identities in the database.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration.
B:The more relevant observations are: Entra admin setting, contained database user, SQL connection token and access results.
C:Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Question 738
An Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration. Which statement most accurately explains this scenario?
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
- The applicable security principle is that a protected storage account is immune to every accidental deletion and overwrite.
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Explanation
Correct Answer
D:Confirmation depends on Entra admin setting, contained database user, SQL connection token and access results.
Incorrect Answers
A:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for Microsoft Entra authentication for Azure SQL. The relevant security behavior is: Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Check evidence such as Entra admin setting, contained database user, SQL connection token and access results.
B:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for Microsoft Entra authentication for Azure SQL. The relevant security behavior is: Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Check evidence such as Entra admin setting, contained database user, SQL connection token and access results.
C:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for Microsoft Entra authentication for Azure SQL. The relevant security behavior is: Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals. Check evidence such as Entra admin setting, contained database user, SQL connection token and access results.
Question 739
An Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration. Suppose the operator instead follows this unsafe shortcut: Store one SQL administrator password in every application config file. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that inspecting encryption settings itself disables a healthy disk.
- The resulting security weakness is that creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user.
- The resulting security weakness is that the observed issue is fully explained by the service display name.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
Explanation
Correct Answer
B:The suitable control is: Configure a supported Microsoft Entra administrator and create least-privileged Entra users or identities in the database. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Incorrect Answers
A:This does not explain the real Microsoft Entra authentication for Azure SQL weakness after the shortcut. In the given case, an Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration.
C:This does not explain the real Microsoft Entra authentication for Azure SQL weakness after the shortcut. The observed issue is fully explained by the service display name.
D:This does not explain the real Microsoft Entra authentication for Azure SQL weakness after the shortcut. The security flaw is that the team retained a tested database backup.
Question 740
An Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration. A review identifies this consequence: Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to disable Azure SQL firewall rules in order to create Entra database users.
- The controlled remediation is to correct the identity administrator and database grants and validate token-based connections.
- The controlled remediation is to store one SQL administrator password in every application config file.
- The controlled remediation is to assume subscription Owner automatically has SELECT permission on every SQL table.
Explanation
Correct Answer
B:Test using these records: Entra admin setting, contained database user, SQL connection token and access results. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Incorrect Answers
A:Disable Azure SQL firewall rules in order to create Entra database users. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
C:Store one SQL administrator password in every application config file. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
D:Assume subscription Owner automatically has SELECT permission on every SQL table. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
