A company is moving a legacy application to Azure SQL Database. The application stores credit card numbers that must be encrypted at rest. The security team wants to use a customer-managed key stored in Azure Key Vault so they can rotate the key independently. What should you implement?

Enable dynamic data masking on the credit card number column.

Enable Always Encrypted with the column master key stored in Azure Key Vault.

Enable auditing and store the audit logs in a storage account with infrastructure encryption.

Enable Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.

A support team needs to query a customer database in Azure SQL Database but should not see full email addresses. The compliance team requires a log of all queries that access the email column. You need to implement this with the least impact on the support team's existing queries. What should you do?

Encrypt the email column with Always Encrypted and provide the support team with the decryption key.

Apply a dynamic data masking rule to the email column and enable auditing at the server level.

Use row-level security to filter out rows containing email addresses.

Create a view that returns a masked email and grant the support team access to the view only.

A retail company stores customer payment card data in Azure SQL Database. The security team requires that the data be encrypted even from database administrators and that queries on the encrypted column still work. The application can be modified to support client-side encryption. What should you recommend?

Use Transparent Data Encryption (TDE) with a customer-managed key.

Use Azure SQL Database's built-in row-level security to restrict DBA access.

Use dynamic data masking to hide the payment card data from DBAs.

Use Always Encrypted with the column encryption key stored in Azure Key Vault.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 3

Plan and Implement Security for Azure SQL Database and Azure SQL Managed Instance AZ-500 Practice Questions (Page 4)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

20–25%of the exam

Questions 16–20

16application · medium
A company is moving a legacy application to Azure SQL Database. The application stores credit card numbers that must be encrypted at rest. The security team wants to use a customer-managed key stored in Azure Key Vault so they can rotate the key independently. What should you implement?
Select an answer first
17foundation · easy
You need to prevent unauthorized users from seeing full credit card numbers in query results, while authorized users see the full number. Which Azure SQL Database feature should you use?
Select an answer first
18application · medium
A support team needs to query a customer database in Azure SQL Database but should not see full email addresses. The compliance team requires a log of all queries that access the email column. You need to implement this with the least impact on the support team's existing queries. What should you do?
Select an answer first
19application · medium
A retail company stores customer payment card data in Azure SQL Database. The security team requires that the data be encrypted even from database administrators and that queries on the encrypted column still work. The application can be modified to support client-side encryption. What should you recommend?
Select an answer first
20foundation · easy
When using Transparent Data Encryption (TDE) with customer-managed keys, which Azure service is used to store the key?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Azure SQL Database and Azure SQL Managed Instance AZ-500 Practice Questions (Page 4)

Questions 16–20

A company is moving a legacy application to Azure SQL Database. The application stores credit card numbers that must be encrypted at rest. The security team wants to use a customer-managed key stored in Azure Key Vault so they can rotate the key independently. What should you implement?

You need to prevent unauthorized users from seeing full credit card numbers in query results, while authorized users see the full number. Which Azure SQL Database feature should you use?

When using Transparent Data Encryption (TDE) with customer-managed keys, which Azure service is used to store the key?

Keep studying — Secure compute, storage, and databases