A web application uses a certificate stored in Key Vault for TLS. The certificate is about to expire. The security team wants to automate the renewal process without manual intervention. What should they configure?

Set up a Key Vault certificate auto-renewal policy with a percentage lifetime and contact email.

Create a new certificate in Key Vault and manually update the application to use it.

Use an Azure Automation runbook to renew the certificate every year.

Export the current certificate and reimport it with a new expiry date.

Your security team requires that encryption keys be rotated automatically every 30 days, but your current Key Vault key was created with a manual rotation policy. You need to implement automatic rotation without disrupting the application that uses the key. What should you do?

Update the key's rotation policy to 30 days and enable automatic rotation.

Set the key's expiration date to 30 days and recreate it.

Use Azure Automation to run a script every 30 days to create a new key version.

Create a new key with automatic rotation and update the application to use it.

A company has an Azure Policy initiative assigned to a subscription. The compliance dashboard shows that a specific resource is non-compliant, but the resource was created after the policy was assigned. The policy effect is 'Deny'. What is the most likely reason for the non-compliance?

The resource was created before the policy assignment but the compliance scan just ran.

The resource was created by a user with 'Owner' role, which bypasses policy.

The policy initiative includes an 'AuditIfNotExists' policy that evaluates the resource's configuration.

The resource was created using an ARM template that bypassed the policy evaluation.

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 1

Implement and Manage Enforcement of Cloud Governance Policies AZ-500 Practice Questions (Page 4)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

30–35%of the exam

15 Concepts in This Objective

Azure Policy Creation
Azure Policy Assignment
Azure Policy Interpretation
Azure Policy Initiatives
Key Vault Network Configuration
Key Vault Access Policies
Azure RBAC for Key Vault
Manage Key Vault Certificates
Manage Key Vault Secrets
Manage Key Vault Keys
Key Rotation Configuration
Backup Key Vault Items
Recovery of Key Vault Items
Backup Security Controls
Asset Management Security Controls

Questions 16–20

16foundation · easy
You need to prevent accidental deletion of a critical Azure resource. Which security control should you implement?
Select an answer first
17application · medium
A web application uses a certificate stored in Key Vault for TLS. The certificate is about to expire. The security team wants to automate the renewal process without manual intervention. What should they configure?
Select an answer first
18foundation · easy
You have a backup blob of a secret from Azure Key Vault. You need to restore it into a Key Vault. Which operation should you use?
Select an answer first
19expert · hard
Your security team requires that encryption keys be rotated automatically every 30 days, but your current Key Vault key was created with a manual rotation policy. You need to implement automatic rotation without disrupting the application that uses the key. What should you do?
Select an answer first
20expert · hard
A company has an Azure Policy initiative assigned to a subscription. The compliance dashboard shows that a specific resource is non-compliant, but the resource was created after the policy was assigned. The policy effect is 'Deny'. What is the most likely reason for the non-compliance?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Implement and Manage Enforcement of Cloud Governance Policies AZ-500 Practice Questions (Page 4)

Questions 16–20

You need to prevent accidental deletion of a critical Azure resource. Which security control should you implement?

A web application uses a certificate stored in Key Vault for TLS. The certificate is about to expire. The security team wants to automate the renewal process without manual intervention. What should they configure?

You have a backup blob of a secret from Azure Key Vault. You need to restore it into a Key Vault. Which operation should you use?

Your security team requires that encryption keys be rotated automatically every 30 days, but your current Key Vault key was created with a manual rotation policy. You need to implement automatic rotation without disrupting the application that uses the key. What should you do?

A company has an Azure Policy initiative assigned to a subscription. The compliance dashboard shows that a specific resource is non-compliant, but the resource was created after the policy was assigned. The policy effect is 'Deny'. What is the most likely reason for the non-compliance?

Keep studying — Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel