Plan and Implement Security for Azure SQL Database and Azure SQL Managed Instance AZ-500 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is using Azure SQL Database with service-managed TDE. The security team wants to use customer-managed keys to meet a compliance requirement that the company control key rotation. The database is in a production environment and cannot tolerate downtime. What should you do?

   • AUse Always Encrypted instead of TDE to meet the key control requirement.
   • BExport the database and re-import it with TDE enabled using a customer-managed key.
   • CDisable TDE, then re-enable it with a customer-managed key.
   • DEnable TDE with a customer-managed key in Azure Key Vault and rotate the key using a key version update.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   Your organization has a strict policy: no SQL authentication on any Azure SQL resource. You are migrating an existing Azure SQL Database that currently uses SQL logins. The application will be updated to support Microsoft Entra ID authentication. You need to ensure that during the migration, the application can still connect while you transition, and that all data at rest is encrypted. What is the best approach?

   • AEnable Azure AD-only authentication immediately and then update the application.
   • BSet the Entra admin, create contained users for the application, update the connection string, and then enable Azure AD-only authentication.
   • CKeep SQL authentication and add auditing to prove compliance.
   • DDisable TDE during migration to improve performance, then re-enable it.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A software vendor is building a multi-tenant SaaS application on Azure SQL Database. Each tenant's data must be encrypted with a unique key, and the application must be able to query the data without exposing it to the database engine. Which feature should you recommend?

   • ATransparent Data Encryption with a per-tenant customer-managed key.
   • BDynamic data masking with a per-tenant masking function.
   • CRow-level security with a per-tenant predicate.
   • DAlways Encrypted with a column master key per tenant stored in Azure Key Vault.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   Contoso's Azure SQL Database must support users who authenticate with their Microsoft Entra ID credentials. The security team also needs a record of which Entra ID user executed each login and query. You are configuring the logical server. What should you do first?

   • ACreate SQL authentication logins for every Entra user and map them to database users.
   • BSet the server's Microsoft Entra admin to a user or group, then create contained database users mapped to Entra identities.
   • CConfigure auditing first, then assign the Entra admin role to the security team.
   • DEnable Azure AD-only authentication and then create database users with passwords.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   You need to ensure that sensitive data in an Azure SQL Database is encrypted even from database administrators. Which feature should you use?

   • ARow-Level Security
   • BDynamic Data Masking
   • CTransparent Data Encryption
   • DAlways Encrypted
   Reveal Solution Discussion Select an answer first