Microsoft AZ-500 Practice Test 78
Question 770
A team configures SQL Dynamic Data Masking and incorrectly assumes masked values are cryptographically protected at rest. A review identifies this consequence: Treating masking as a replacement for encryption or access control can expose actual sensitive values. Which remediation most directly restores the intended behavior?
- The controlled remediation is to disable all SQL authorization and rely exclusively on query result masking.
- The controlled remediation is to grant everyone UNMASK because the table has a masking rule.
- The controlled remediation is to align masking and access restrictions and use encryption where confidentiality requires it.
- The controlled remediation is to assume masking makes raw files and backups cryptographically unreadable.
Explanation
Correct Answer
C:Dynamic Data Masking limits exposed data in query results for nonprivileged users but is not encryption. Test using these records: Mask definitions, effective SQL roles, unmask access and tested query results.
Incorrect Answers
A:Disable all SQL authorization and rely exclusively on query result masking. This would not reliably restore the intended security boundary. Treating masking as a replacement for encryption or access control can expose actual sensitive values. The appropriate controlled recovery is: Align masking and access restrictions and use encryption where confidentiality requires it.
B:Grant everyone UNMASK because the table has a masking rule. This would not reliably restore the intended security boundary. Treating masking as a replacement for encryption or access control can expose actual sensitive values. The appropriate controlled recovery is: Align masking and access restrictions and use encryption where confidentiality requires it.
D:Assume masking makes raw files and backups cryptographically unreadable. This would not reliably restore the intended security boundary. Treating masking as a replacement for encryption or access control can expose actual sensitive values. The appropriate controlled recovery is: Align masking and access restrictions and use encryption where confidentiality requires it.
Question 771
An Azure SQL database has no audit trail for privileged schema modifications during an investigation. Which configuration decision MOST directly resolves the issue?
- Enable only TDE and assume it records every failed login event.
- Enable Azure SQL auditing to an approved destination and validate captured database events.
- Use a blob access tier to decide which SQL commands generate audit logs.
- Disable auditing to keep sensitive query history out of storage without another control.
Explanation
Correct Answer
B:Confirm the change against these records: SQL audit setting, selected actions, diagnostic destination, sample event and retention. Azure SQL auditing records specified database operations to support accountability and incident investigation.
Incorrect Answers
A:Missing or misrouted audit data prevents reconstruction of important database activity. Enable only TDE and assume it records every failed login event.
C:Use a blob access tier to decide which SQL commands generate audit logs. The proposed change targets the wrong mechanism or lacks essential validation. Azure SQL auditing records specified database operations to support accountability and incident investigation. Relevant evidence is SQL audit setting, selected actions, diagnostic destination, sample event and retention.
D:Missing or misrouted audit data prevents reconstruction of important database activity. The intended action is: Enable Azure SQL auditing to an approved destination and validate captured database events.
Question 772
An Azure SQL database has no audit trail for privileged schema modifications during an investigation. What evidence most directly confirms the intended security behavior?
- SQL audit setting, selected actions, diagnostic destination, sample event and retention.
- A powered-on VM status without the actual guest or data-plane security state.
- The identity name without a corresponding workload data authorization test.
- A database online indicator without a log of the protected operation.
Explanation
Correct Answer
A:These records test the actual SQL auditing and Defender for SQL alerts behavior rather than an unrelated dashboard state. Azure SQL auditing records specified database operations to support accountability and incident investigation.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. Azure SQL auditing records specified database operations to support accountability and incident investigation.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: SQL audit setting, selected actions, diagnostic destination, sample event and retention.
D:On its own, that evidence does not prove the specified security control works. In the given case, an Azure SQL database has no audit trail for privileged schema modifications during an investigation.
Question 773
An Azure SQL database has no audit trail for privileged schema modifications during an investigation. Which security principle best explains the intended decision?
- Encrypting network transport guarantees all storage at-rest and column-level security requirements.
- Setting a registry image tag guarantees security monitoring of the running workload.
- A valid Azure management role always gives full access to every blob object and SQL row.
- Azure SQL auditing records specified database operations to support accountability and incident investigation.
Explanation
Correct Answer
D:This principle supports the security response: Enable Azure SQL auditing to an approved destination and validate captured database events. Confirmation depends on SQL audit setting, selected actions, diagnostic destination, sample event and retention.
Incorrect Answers
A:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for SQL auditing and Defender for SQL alerts. The relevant security behavior is: Azure SQL auditing records specified database operations to support accountability and incident investigation. Check evidence such as SQL audit setting, selected actions, diagnostic destination, sample event and retention.
B:Setting a registry image tag guarantees security monitoring of the running workload. This is an incorrect assumption for SQL auditing and Defender for SQL alerts. The relevant security behavior is: Azure SQL auditing records specified database operations to support accountability and incident investigation. Check evidence such as SQL audit setting, selected actions, diagnostic destination, sample event and retention.
C:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for SQL auditing and Defender for SQL alerts. The relevant security behavior is: Azure SQL auditing records specified database operations to support accountability and incident investigation. Check evidence such as SQL audit setting, selected actions, diagnostic destination, sample event and retention.
Question 774
An Azure SQL database has no audit trail for privileged schema modifications during an investigation. Suppose the operator instead follows this unsafe shortcut: Enable only TDE and assume it records every failed login event. Which resulting risk or fault should the reviewer identify?
- The observed issue is fully explained by the service display name.
- Missing or misrouted audit data prevents reconstruction of important database activity.
- Collecting VM diagnostic data caused the original unauthorized storage read.
- Keeping historic blob versions is the cause of the missing RBAC assignment.
Explanation
Correct Answer
B:The suitable control is: Enable Azure SQL auditing to an approved destination and validate captured database events. Azure SQL auditing records specified database operations to support accountability and incident investigation.
Incorrect Answers
A:This does not explain the real SQL auditing and Defender for SQL alerts weakness after the shortcut. The material failure is: Missing or misrouted audit data prevents reconstruction of important database activity.
C:This does not explain the real SQL auditing and Defender for SQL alerts weakness after the shortcut. Inspect evidence such as SQL audit setting, selected actions, diagnostic destination, sample event and retention.
D:This does not explain the real SQL auditing and Defender for SQL alerts weakness after the shortcut. Keeping historic blob versions is the cause of the missing RBAC assignment.
Question 775
An Azure SQL database has no audit trail for privileged schema modifications during an investigation. A review identifies this consequence: Missing or misrouted audit data prevents reconstruction of important database activity. Which remediation most directly restores the intended behavior?
- Use a blob access tier to decide which SQL commands generate audit logs.
- Disable auditing to keep sensitive query history out of storage without another control.
- Configure the audit destination and verify current events can be queried securely.
- Enable only TDE and assume it records every failed login event.
Explanation
Correct Answer
C:Test using these records: SQL audit setting, selected actions, diagnostic destination, sample event and retention. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Use a blob access tier to decide which SQL commands generate audit logs. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
B:Disable auditing to keep sensitive query history out of storage without another control. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
D:Enable only TDE and assume it records every failed login event. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
Question 776
Security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records. Which operator action best meets this technical requirement?
- For this Azure workload, the team should use a blob access tier to decide which SQL commands generate audit logs.
- For this Azure workload, the team should disable auditing to keep sensitive query history out of storage without another control.
- For this Azure workload, the team should enable only TDE and assume it records every failed login event.
- For this Azure workload, the team should enable Azure SQL auditing to an approved destination and validate captured database events.
Explanation
Correct Answer
D:Confirm the change against these records: SQL audit setting, selected actions, diagnostic destination, sample event and retention. This directly addresses SQL auditing and Defender for SQL alerts.
Incorrect Answers
A:Use a blob access tier to decide which SQL commands generate audit logs. The proposed change targets the wrong mechanism or lacks essential validation. Azure SQL auditing records specified database operations to support accountability and incident investigation. Relevant evidence is SQL audit setting, selected actions, diagnostic destination, sample event and retention.
B:Missing or misrouted audit data prevents reconstruction of important database activity. Disable auditing to keep sensitive query history out of storage without another control.
C:Missing or misrouted audit data prevents reconstruction of important database activity. In the given case, security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records.
Question 777
Security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records. Which collection of observations most directly tests the suspected cause?
- In this security review, examine an outdated deployment template without current effective settings.
- In this security review, examine SQL audit setting, selected actions, diagnostic destination, sample event and retention.
- In this security review, examine a powered-on VM status without the actual guest or data-plane security state.
- In this security review, examine the identity name without a corresponding workload data authorization test.
Explanation
Correct Answer
B:These records test the actual SQL auditing and Defender for SQL alerts behavior rather than an unrelated dashboard state. The intended action is: Enable Azure SQL auditing to an approved destination and validate captured database events.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records.
C:Azure SQL auditing records specified database operations to support accountability and incident investigation.
D:The more relevant observations are: SQL audit setting, selected actions, diagnostic destination, sample event and retention.
Question 778
Security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records. Which statement most accurately explains this scenario?
- The applicable security principle is that a valid Azure management role always gives full access to every blob object and SQL row.
- The applicable security principle is that encrypting network transport guarantees all storage at-rest and column-level security requirements.
- The applicable security principle is that Azure SQL auditing records specified database operations to support accountability and incident investigation.
- The applicable security principle is that a running compute resource automatically enforces least-privilege Kubernetes permissions.
Explanation
Correct Answer
C:This principle supports the security response: Enable Azure SQL auditing to an approved destination and validate captured database events.
Incorrect Answers
A:A valid Azure management role always gives full access to every blob object and SQL row. This is an incorrect assumption for SQL auditing and Defender for SQL alerts. The relevant security behavior is: Azure SQL auditing records specified database operations to support accountability and incident investigation. Check evidence such as SQL audit setting, selected actions, diagnostic destination, sample event and retention.
B:Encrypting network transport guarantees all storage at-rest and column-level security requirements. This is an incorrect assumption for SQL auditing and Defender for SQL alerts. The relevant security behavior is: Azure SQL auditing records specified database operations to support accountability and incident investigation. Check evidence such as SQL audit setting, selected actions, diagnostic destination, sample event and retention.
D:A running compute resource automatically enforces least-privilege Kubernetes permissions. This is an incorrect assumption for SQL auditing and Defender for SQL alerts. The relevant security behavior is: Azure SQL auditing records specified database operations to support accountability and incident investigation. Check evidence such as SQL audit setting, selected actions, diagnostic destination, sample event and retention.
Question 779
Security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records. Suppose the operator instead follows this unsafe shortcut: Enable only TDE and assume it records every failed login event. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that keeping historic blob versions is the cause of the missing RBAC assignment.
- The resulting security weakness is that the security flaw is that the team retained a tested database backup.
- The resulting security weakness is that collecting VM diagnostic data caused the original unauthorized storage read.
- The resulting security weakness is that missing or misrouted audit data prevents reconstruction of important database activity.
Explanation
Correct Answer
D:The suitable control is: Enable Azure SQL auditing to an approved destination and validate captured database events. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real SQL auditing and Defender for SQL alerts weakness after the shortcut. In the given case, security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records.
B:This does not explain the real SQL auditing and Defender for SQL alerts weakness after the shortcut. The security flaw is that the team retained a tested database backup.
C:This does not explain the real SQL auditing and Defender for SQL alerts weakness after the shortcut. Collecting VM diagnostic data caused the original unauthorized storage read.
Question 780
Security analysts need to correlate suspicious SQL access with Azure Monitor or storage audit records. A review identifies this consequence: Missing or misrouted audit data prevents reconstruction of important database activity. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to disable auditing to keep sensitive query history out of storage without another control.
- The controlled remediation is to configure the audit destination and verify current events can be queried securely.
- The controlled remediation is to enable only TDE and assume it records every failed login event.
- The controlled remediation is to use a blob access tier to decide which SQL commands generate audit logs.
Explanation
Correct Answer
B:Test using these records: SQL audit setting, selected actions, diagnostic destination, sample event and retention. Azure SQL auditing records specified database operations to support accountability and incident investigation.
Incorrect Answers
A:Disable auditing to keep sensitive query history out of storage without another control. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
C:Enable only TDE and assume it records every failed login event. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
D:Use a blob access tier to decide which SQL commands generate audit logs. This would not reliably restore the intended security boundary. Missing or misrouted audit data prevents reconstruction of important database activity. The appropriate controlled recovery is: Configure the audit destination and verify current events can be queried securely.
