You have an Azure Policy assignment that uses the 'audit' effect to check for storage accounts without HTTPS-only traffic. The compliance report shows 100% compliant, but you know that some storage accounts do not have HTTPS-only enabled. What is the most likely cause?

The storage accounts are in a different subscription.

The policy assignment scope does not include the resource group containing those storage accounts.

The policy definition has a syntax error.

The policy effect is set to 'deny' instead of 'audit'.

A developer needs to read a secret from Azure Key Vault for a new application. The developer's account is in Azure AD. You want to grant the minimum necessary permission using the Key Vault access policy model. What should you do?

Share the secret with the developer over email.

Add the developer's account to the Key Vault access policy with the Get permission for secrets.

Create a custom role with read access to all secrets and assign it to the developer.

Assign the developer the Key Vault Contributor role at the subscription level.

A company backs up Key Vault keys and secrets to a storage account. They want to ensure that the backup files are protected from ransomware attacks. What is the most effective control?

Use Azure Backup for the storage account to create point-in-time recovery.

Encrypt the backup files with a customer-managed key.

Store the backup files in a separate Azure region with geo-redundant storage.

Enable soft-delete and purge protection on the storage account.

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 1

Implement and Manage Enforcement of Cloud Governance Policies AZ-500 Practice Questions (Page 6)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

30–35%of the exam

15 Concepts in This Objective

Azure Policy Creation
Azure Policy Assignment
Azure Policy Interpretation
Azure Policy Initiatives
Key Vault Network Configuration
Key Vault Access Policies
Azure RBAC for Key Vault
Manage Key Vault Certificates
Manage Key Vault Secrets
Manage Key Vault Keys
Key Rotation Configuration
Backup Key Vault Items
Recovery of Key Vault Items
Backup Security Controls
Asset Management Security Controls

Questions 26–30

26expert · hard
You have an Azure Policy assignment that uses the 'audit' effect to check for storage accounts without HTTPS-only traffic. The compliance report shows 100% compliant, but you know that some storage accounts do not have HTTPS-only enabled. What is the most likely cause?
Select an answer first
27foundation · easy
You have an Azure Policy assigned at the subscription scope. A resource group within the subscription has an explicit exclusion. What is the compliance status of resources in that excluded resource group?
Select an answer first
28application · medium
A developer needs to read a secret from Azure Key Vault for a new application. The developer's account is in Azure AD. You want to grant the minimum necessary permission using the Key Vault access policy model. What should you do?
Select an answer first
29foundation · easy
You have an Azure Policy that must apply to all subscriptions in your organization. Which scope should you use for the policy assignment?
Select an answer first
30expert · hard
A company backs up Key Vault keys and secrets to a storage account. They want to ensure that the backup files are protected from ransomware attacks. What is the most effective control?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Implement and Manage Enforcement of Cloud Governance Policies AZ-500 Practice Questions (Page 6)

Questions 26–30

You have an Azure Policy assignment that uses the 'audit' effect to check for storage accounts without HTTPS-only traffic. The compliance report shows 100% compliant, but you know that some storage accounts do not have HTTPS-only enabled. What is the most likely cause?

You have an Azure Policy assigned at the subscription scope. A resource group within the subscription has an explicit exclusion. What is the compliance status of resources in that excluded resource group?

A developer needs to read a secret from Azure Key Vault for a new application. The developer's account is in Azure AD. You want to grant the minimum necessary permission using the Key Vault access policy model. What should you do?

You have an Azure Policy that must apply to all subscriptions in your organization. Which scope should you use for the policy assignment?

A company backs up Key Vault keys and secrets to a storage account. They want to ensure that the backup files are protected from ransomware attacks. What is the most effective control?

Keep studying — Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel