Microsoft AZ-500 Practice Test 75
Question 740
An Azure SQL database accepts only traditional SQL logins after the team forgot to configure Entra authentication integration. A review identifies this consequence: Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to disable Azure SQL firewall rules in order to create Entra database users.
- The controlled remediation is to correct the identity administrator and database grants and validate token-based connections.
- The controlled remediation is to store one SQL administrator password in every application config file.
- The controlled remediation is to assume subscription Owner automatically has SELECT permission on every SQL table.
Explanation
Correct Answer
B:Test using these records: Entra admin setting, contained database user, SQL connection token and access results. Azure SQL supports Microsoft Entra authentication with database-level authorization for supported principals.
Incorrect Answers
A:Disable Azure SQL firewall rules in order to create Entra database users. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
C:Store one SQL administrator password in every application config file. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
D:Assume subscription Owner automatically has SELECT permission on every SQL table. This would not reliably restore the intended security boundary. Creating an Azure RBAC Contributor assignment alone does not necessarily create a SQL database user. The appropriate controlled recovery is: Correct the identity administrator and database grants and validate token-based connections.
Question 741
A database security plan incorrectly assumes TLS transit encryption also ensures data files and backups are encrypted at rest. Which operator action best meets this technical requirement?
- Enable HTTPS for a web API and assume SQL database storage is encrypted by that alone.
- Configure and verify SQL Transparent Data Encryption and the intended service-managed or customer-managed protector.
- Change a Dynamic Data Masking rule to provide file-level database encryption.
- Delete the key vault protector before validating SQL recovery support.
Explanation
Correct Answer
B:Confirm the change against these records: TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status. TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption.
Incorrect Answers
A:An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. Enable HTTPS for a web API and assume SQL database storage is encrypted by that alone.
C:TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. The proposed change targets the wrong mechanism or lacks essential validation.
D:An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. The intended action is: Configure and verify SQL Transparent Data Encryption and the intended service-managed or customer-managed protector.
Question 742
A database security plan incorrectly assumes TLS transit encryption also ensures data files and backups are encrypted at rest. Which collection of observations most directly tests the suspected cause?
- A database online indicator without a log of the protected operation.
- TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
- A powered-on VM status without the actual guest or data-plane security state.
- A storage account resource name without its encryption or retention configuration.
Explanation
Correct Answer
B:These records test the actual transparent Data Encryption protection behavior rather than an unrelated dashboard state. TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
C:On its own, that evidence does not prove the specified security control works. TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption.
D:On its own, that evidence does not prove the specified security control works. In the given case, a database security plan incorrectly assumes TLS transit encryption also ensures data files and backups are encrypted at rest.
Question 743
A database security plan incorrectly assumes TLS transit encryption also ensures data files and backups are encrypted at rest. Which statement most accurately explains this scenario?
- A valid Azure management role always gives full access to every blob object and SQL row.
- A protected storage account is immune to every accidental deletion and overwrite.
- Setting a registry image tag guarantees security monitoring of the running workload.
- TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption.
Explanation
Correct Answer
D:Confirmation depends on TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status. This principle supports the security response: Configure and verify SQL Transparent Data Encryption and the intended service-managed or customer-managed protector.
Incorrect Answers
A:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for transparent Data Encryption protection. The relevant security behavior is: TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. Check evidence such as tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
B:A protected storage account is immune to every accidental deletion and overwrite. This is an incorrect assumption for transparent Data Encryption protection. The relevant security behavior is: TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. Check evidence such as tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
C:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for transparent Data Encryption protection. The relevant security behavior is: TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. Check evidence such as tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
Question 744
A database security plan incorrectly assumes TLS transit encryption also ensures data files and backups are encrypted at rest. Suppose the operator instead follows this unsafe shortcut: Enable HTTPS for a web API and assume SQL database storage is encrypted by that alone. What is the principal technical consequence of the mistaken choice?
- Inspecting encryption settings itself disables a healthy disk.
- An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet.
- The observed issue is fully explained by the service display name.
- Collecting VM diagnostic data caused the original unauthorized storage read.
Explanation
Correct Answer
B:TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real transparent Data Encryption protection weakness after the shortcut. The material failure is: An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet.
C:This does not explain the real transparent Data Encryption protection weakness after the shortcut. Inspect evidence such as tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
D:This does not explain the real transparent Data Encryption protection weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
Question 745
A database security plan incorrectly assumes TLS transit encryption also ensures data files and backups are encrypted at rest. A review identifies this consequence: An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. Which recovery action restores the intended control and validates its effect?
- Change a Dynamic Data Masking rule to provide file-level database encryption.
- Restore valid TDE protector access and confirm encrypted database status.
- Delete the key vault protector before validating SQL recovery support.
- Enable HTTPS for a web API and assume SQL database storage is encrypted by that alone.
Explanation
Correct Answer
B:Test using these records: TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Change a Dynamic Data Masking rule to provide file-level database encryption. This would not reliably restore the intended security boundary. An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. The appropriate controlled recovery is: Restore valid TDE protector access and confirm encrypted database status.
C:Delete the key vault protector before validating SQL recovery support. This would not reliably restore the intended security boundary. An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. The appropriate controlled recovery is: Restore valid TDE protector access and confirm encrypted database status.
D:That option would enable HTTPS for a web API and assume SQL database storage is encrypted by that alone, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 746
A managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions. What is the most defensible Azure security action?
- For this Azure workload, the team should change a Dynamic Data Masking rule to provide file-level database encryption.
- For this Azure workload, the team should delete the key vault protector before validating SQL recovery support.
- For this Azure workload, the team should enable HTTPS for a web API and assume SQL database storage is encrypted by that alone.
- For this Azure workload, the team should configure and verify SQL Transparent Data Encryption and the intended service-managed or customer-managed protector.
Explanation
Correct Answer
D:Confirm the change against these records: TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
Incorrect Answers
A:TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. Relevant evidence is tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
B:An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet.
C:In the given case, a managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions.
Question 747
A managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions. Which diagnostic record would most strongly confirm the result?
- In this security review, examine the identity name without a corresponding workload data authorization test.
- In this security review, examine a database online indicator without a log of the protected operation.
- In this security review, examine tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
Explanation
Correct Answer
C:These records test the actual transparent Data Encryption protection behavior rather than an unrelated dashboard state. The intended action is: Configure and verify SQL Transparent Data Encryption and the intended service-managed or customer-managed protector.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions.
B:The more relevant observations are: TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
D:TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption.
Question 748
A managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that setting a registry image tag guarantees security monitoring of the running workload.
- The applicable security principle is that tDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption.
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
Explanation
Correct Answer
B:Confirmation depends on TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
Incorrect Answers
A:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for transparent Data Encryption protection. The relevant security behavior is: TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. Check evidence such as tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
C:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for transparent Data Encryption protection. The relevant security behavior is: TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. Check evidence such as tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
D:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for transparent Data Encryption protection. The relevant security behavior is: TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. Check evidence such as tDE state, server encryption protector, Key Vault identity and encrypted database files or backup status.
Question 749
A managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions. Suppose the operator instead follows this unsafe shortcut: Enable HTTPS for a web API and assume SQL database storage is encrypted by that alone. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
- The resulting security weakness is that an invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet.
- The resulting security weakness is that the observed issue is fully explained by the service display name.
Explanation
Correct Answer
C:TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption. The suitable control is: Configure and verify SQL Transparent Data Encryption and the intended service-managed or customer-managed protector.
Incorrect Answers
A:This does not explain the real transparent Data Encryption protection weakness after the shortcut. In the given case, a managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions.
B:This does not explain the real transparent Data Encryption protection weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
D:This does not explain the real transparent Data Encryption protection weakness after the shortcut. The observed issue is fully explained by the service display name.
Question 750
A managed SQL database needs an approved customer-managed TDE protector with valid Key Vault permissions. A review identifies this consequence: An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to delete the key vault protector before validating SQL recovery support.
- The controlled remediation is to enable HTTPS for a web API and assume SQL database storage is encrypted by that alone.
- The controlled remediation is to change a Dynamic Data Masking rule to provide file-level database encryption.
- The controlled remediation is to restore valid TDE protector access and confirm encrypted database status.
Explanation
Correct Answer
D:Test using these records: TDE state, server encryption protector, Key Vault identity and encrypted database files or backup status. TDE encrypts supported database data at rest and is separate from client transport TLS and column-level encryption.
Incorrect Answers
A:Delete the key vault protector before validating SQL recovery support. This would not reliably restore the intended security boundary. An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. The appropriate controlled recovery is: Restore valid TDE protector access and confirm encrypted database status.
B:Enable HTTPS for a web API and assume SQL database storage is encrypted by that alone. This would not reliably restore the intended security boundary. An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. The appropriate controlled recovery is: Restore valid TDE protector access and confirm encrypted database status.
C:Change a Dynamic Data Masking rule to provide file-level database encryption. This would not reliably restore the intended security boundary. An invalid TDE protector can make the database unavailable or leave the planned key-control requirement unmet. The appropriate controlled recovery is: Restore valid TDE protector access and confirm encrypted database status.
