A healthcare organization uses Azure SQL Database for a patient portal. The support team needs to see patient names and phone numbers to verify identities, but they should not see the full social security number (SSN). The compliance team requires an audit trail of any access to the SSN column. What should you implement?

Enable Transparent Data Encryption (TDE) and configure row-level security to filter SSN values.

Implement dynamic data masking on the SSN column for the support team role and enable auditing on the database.

Implement Always Encrypted on the SSN column and grant the support team access to the column master key.

Create a view that excludes the SSN column and grant the support team access to the view only.

Your Azure SQL Database is configured with auditing to a Log Analytics workspace. The security team wants to query audit logs for all failed login attempts and also wants to ensure that the database is encrypted at rest with a service-managed key. What should you do?

Enable Always Encrypted to encrypt the audit logs.

Disable TDE to improve audit query performance.

Keep auditing to Log Analytics and query the AzureDiagnostics table for failed logins; verify TDE is enabled with the default service-managed key.

Switch auditing to Azure Storage and query the blobs for failed logins.

Your Azure SQL Managed Instance currently uses SQL authentication. You need to migrate to Microsoft Entra ID authentication. The instance has a custom DNS zone and is integrated with a virtual network. You have already set the Entra admin. What is the next step to ensure that Entra users can authenticate?

Restart the managed instance to apply the Entra admin setting.

Create SQL logins for the Entra users.

Create contained database users mapped to Entra identities in each database.

Enable Azure AD-only authentication immediately.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 3

Plan and Implement Security for Azure SQL Database and Azure SQL Managed Instance AZ-500 Practice Questions (Page 5)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

5concepts

20–25%of the exam

Questions 21–23

21application · medium
A healthcare organization uses Azure SQL Database for a patient portal. The support team needs to see patient names and phone numbers to verify identities, but they should not see the full social security number (SSN). The compliance team requires an audit trail of any access to the SSN column. What should you implement?
Select an answer first
22expert · hard
Your Azure SQL Database is configured with auditing to a Log Analytics workspace. The security team wants to query audit logs for all failed login attempts and also wants to ensure that the database is encrypted at rest with a service-managed key. What should you do?
Select an answer first
23expert · hard
Your Azure SQL Managed Instance currently uses SQL authentication. You need to migrate to Microsoft Entra ID authentication. The instance has a custom DNS zone and is integrated with a virtual network. You have already set the Entra admin. What is the next step to ensure that Entra users can authenticate?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Azure SQL Database and Azure SQL Managed Instance AZ-500 Practice Questions (Page 5)

Questions 21–23

Your Azure SQL Database is configured with auditing to a Log Analytics workspace. The security team wants to query audit logs for all failed login attempts and also wants to ensure that the database is encrypted at rest with a service-managed key. What should you do?

Keep studying — Secure compute, storage, and databases