A developer is building an application that will upload files to Azure Blob Storage. The application will run on an Azure VM with a system-assigned managed identity. The developer wants to avoid storing any secrets in the application code. What is the recommended way to authenticate the application to Blob Storage?

Use the Azure portal to generate a connection string and include it in the application code.

Use the managed identity to obtain an Azure AD token and pass it in the Authorization header of REST API calls.

Generate a shared access signature (SAS) with a long expiry and embed it in the application configuration.

Store the storage account key in Azure Key Vault and retrieve it at runtime.

A company stores critical documents in Azure Blob Storage. They want to protect against accidental deletion and ransomware attacks. They enable soft delete for blobs and versioning. Additionally, they want to ensure that a specific container's blobs cannot be modified or deleted for a retention period of 5 years. What should they configure?

Assign the Storage Blob Data Reader role to all users for that container.

Create a shared access signature with a 5-year expiry and restrict permissions to read-only.

Set an immutability policy on the container with a time-based retention of 5 years.

Enable blob versioning and set a lifecycle management rule to delete old versions after 5 years.

A company uses Azure Storage with customer-managed keys stored in Azure Key Vault. They want to add a second layer of encryption at the infrastructure level. They also want to ensure that if the customer-managed key is revoked, the storage account becomes inaccessible. What should they do?

Enable infrastructure encryption on the storage account and configure the customer-managed key with a key revocation policy.

Use a service-managed key for the second layer and keep the customer-managed key for the first layer.

Enable double encryption by using two customer-managed keys.

Enable soft delete and purge protection on the Key Vault.

A web application hosted in Azure needs to read and write blobs in a storage account. The application uses Azure AD authentication. You need to grant the application the minimum permissions required to read and write blob data. What should you do?

Assign the Storage Blob Data Contributor role to the application's service principal.

Assign the Reader role to the application's service principal.

Generate a shared access signature (SAS) with read and write permissions and embed it in the application code.

Assign the Storage Account Contributor role to the application's service principal.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 2

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 1)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

20–25%of the exam

Questions 1–5

1foundation · easy
Which access method for Azure Files is designed for Linux clients that require POSIX-compliant file semantics, such as root squash and uid/gid mapping?
Select an answer first
2application · medium
A developer is building an application that will upload files to Azure Blob Storage. The application will run on an Azure VM with a system-assigned managed identity. The developer wants to avoid storing any secrets in the application code. What is the recommended way to authenticate the application to Blob Storage?
Select an answer first
3application · medium
A company stores critical documents in Azure Blob Storage. They want to protect against accidental deletion and ransomware attacks. They enable soft delete for blobs and versioning. Additionally, they want to ensure that a specific container's blobs cannot be modified or deleted for a retention period of 5 years. What should they configure?
Select an answer first
4expert · medium
A company uses Azure Storage with customer-managed keys stored in Azure Key Vault. They want to add a second layer of encryption at the infrastructure level. They also want to ensure that if the customer-managed key is revoked, the storage account becomes inaccessible. What should they do?
Select an answer first
5application · medium
A web application hosted in Azure needs to read and write blobs in a storage account. The application uses Azure AD authentication. You need to grant the application the minimum permissions required to read and write blob data. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 1)

Questions 1–5

Which access method for Azure Files is designed for Linux clients that require POSIX-compliant file semantics, such as root squash and uid/gid mapping?

A company uses Azure Storage with customer-managed keys stored in Azure Key Vault. They want to add a second layer of encryption at the infrastructure level. They also want to ensure that if the customer-managed key is revoked, the storage account becomes inaccessible. What should they do?

A web application hosted in Azure needs to read and write blobs in a storage account. The application uses Azure AD authentication. You need to grant the application the minimum permissions required to read and write blob data. What should you do?

Keep studying — Secure compute, storage, and databases