You need to generate a new self-signed certificate and store it in Azure Key Vault. Which operation should you perform?

Use the Azure CLI to generate a certificate locally and then upload it

Create a key and then export it as a certificate

Import a certificate from a file

Create a certificate in Key Vault

You assigned a custom Azure Policy that requires all managed disks to use SSE with customer-managed keys. The compliance dashboard shows 80% compliant and 20% non-compliant. You need to determine why the non-compliant resources are failing. What should you do first?

Check the policy definition's evaluation details for each non-compliant resource.

Reassign the policy with a different effect.

Check the activity log for policy assignment errors.

Delete and recreate the policy definition.

Your company has a custom compliance requirement that is not covered by built-in Azure Policy definitions. You need to create a policy that checks if all storage accounts have the 'minimumTlsVersion' set to 'TLS1_2'. What should you do?

Use the Azure Policy 'audit' effect with a custom policy definition.

Use Azure Security Center's regulatory compliance dashboard.

Use Azure Monitor alerts to detect TLS version.

Use Azure Blueprints to enforce TLS version.

You have backed up a Key Vault secret to a storage account. Which additional security measure should you apply to the backup blob?

Enable Azure Storage encryption

Use a shared access signature (SAS) with limited permissions and expiry

Store the backup in the same Key Vault

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 1

Implement and Manage Enforcement of Cloud Governance Policies AZ-500 Practice Questions (Page 5)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

30–35%of the exam

15 Concepts in This Objective

Azure Policy Creation
Azure Policy Assignment
Azure Policy Interpretation
Azure Policy Initiatives
Key Vault Network Configuration
Key Vault Access Policies
Azure RBAC for Key Vault
Manage Key Vault Certificates
Manage Key Vault Secrets
Manage Key Vault Keys
Key Rotation Configuration
Backup Key Vault Items
Recovery of Key Vault Items
Backup Security Controls
Asset Management Security Controls

Questions 21–25

21foundation · easy
You need to group multiple Azure Policy definitions to enforce a set of related governance rules as a single assignment. What should you create?
Select an answer first
22foundation · easy
You need to generate a new self-signed certificate and store it in Azure Key Vault. Which operation should you perform?
Select an answer first
23application · medium
You assigned a custom Azure Policy that requires all managed disks to use SSE with customer-managed keys. The compliance dashboard shows 80% compliant and 20% non-compliant. You need to determine why the non-compliant resources are failing. What should you do first?
Select an answer first
24application · medium
Your company has a custom compliance requirement that is not covered by built-in Azure Policy definitions. You need to create a policy that checks if all storage accounts have the 'minimumTlsVersion' set to 'TLS1_2'. What should you do?
Select an answer first
25foundation · easy
You have backed up a Key Vault secret to a storage account. Which additional security measure should you apply to the backup blob?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.