An application uses a customer-managed key stored in Key Vault for encryption. The security policy requires that the key be rotated automatically every 90 days. What should you configure?

Enable the Key Vault for disk encryption and set the key to auto-rotate.

Use Azure Automation to call the Key Vault API to rotate the key every 90 days.

Set up a key rotation policy in Key Vault with a rotation period of 90 days.

Create a new key version every 90 days using a manual process.

You review the compliance data for an assigned Azure Policy and see that a resource is marked as 'Non-compliant'. What does this indicate?

The resource is excluded from the policy scope.

The resource was created before the policy was assigned and is not evaluated.

The resource is compliant but the policy assignment is disabled.

The resource does not meet the conditions defined in the policy rule.

An application needs to retrieve a database connection string from Azure Key Vault at runtime. The application runs on an Azure VM with a system-assigned managed identity. You need to grant the VM access to the secret without storing credentials in the application. What should you do?

Create a service principal and embed its credentials in the application.

Add the VM's managed identity to the Key Vault access policy with Get permission for secrets.

Store the connection string in the VM's custom data and read it at startup.

Assign the VM the Key Vault Administrator role.

Microsoft Certified:Azure Security Engineer Associate

Domain 4Objective 1

Implement and Manage Enforcement of Cloud Governance Policies AZ-500 Practice Questions (Page 9)

Part of the Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel domain, which accounts for 30–35% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~12–23 in this domain), expect 3–6 from this objective — we provide 47 practice questions to prepare you well beyond it. (estimate)

47questions here

10free pages

15concepts

30–35%of the exam

15 Concepts in This Objective

Azure Policy Creation
Azure Policy Assignment
Azure Policy Interpretation
Azure Policy Initiatives
Key Vault Network Configuration
Key Vault Access Policies
Azure RBAC for Key Vault
Manage Key Vault Certificates
Manage Key Vault Secrets
Manage Key Vault Keys
Key Rotation Configuration
Backup Key Vault Items
Recovery of Key Vault Items
Backup Security Controls
Asset Management Security Controls

Questions 41–45

41foundation · easy
You need to allow a developer to manage all aspects of an Azure Key Vault, including creating and deleting it, but not grant access to the secrets. Which Azure RBAC role should you assign?
Select an answer first
42application · medium
An application uses a customer-managed key stored in Key Vault for encryption. The security policy requires that the key be rotated automatically every 90 days. What should you configure?
Select an answer first
43foundation · easy
You review the compliance data for an assigned Azure Policy and see that a resource is marked as 'Non-compliant'. What does this indicate?
Select an answer first
44application · medium
An application needs to retrieve a database connection string from Azure Key Vault at runtime. The application runs on an Azure VM with a system-assigned managed identity. You need to grant the VM access to the secret without storing credentials in the application. What should you do?
Select an answer first
45foundation · easy
You want to automatically rotate a key every 90 days. Which rotation policy setting should you configure?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Implement and Manage Enforcement of Cloud Governance Policies AZ-500 Practice Questions (Page 9)

Questions 41–45

You need to allow a developer to manage all aspects of an Azure Key Vault, including creating and deleting it, but not grant access to the secrets. Which Azure RBAC role should you assign?

An application uses a customer-managed key stored in Key Vault for encryption. The security policy requires that the key be rotated automatically every 90 days. What should you configure?

You review the compliance data for an assigned Azure Policy and see that a resource is marked as 'Non-compliant'. What does this indicate?

An application needs to retrieve a database connection string from Azure Key Vault at runtime. The application runs on an Azure VM with a system-assigned managed identity. You need to grant the VM access to the secret without storing credentials in the application. What should you do?

You want to automatically rotate a key every 90 days. Which rotation policy setting should you configure?

Keep studying — Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel