A company runs a Linux-based application that needs to mount an Azure Files share using the NFS protocol. The application is hosted on an Azure VM in the same virtual network as the storage account. The storage account is configured with the NFS protocol enabled. What additional configuration is required to allow the VM to mount the share?

Open port 445 on the network security group (NSG) for the VM.

Ensure the storage account has a service endpoint for Microsoft.Storage on the virtual network subnet.

Create a shared access signature (SAS) token and provide it to the VM for mounting.

Assign the Storage File Data SMB Share Reader role to the VM's managed identity.

A company has an Azure file share that is accessed by several Windows VMs in the same region. The VMs are joined to an on-premises Active Directory domain that is synced to Azure AD. You need to configure access so that users authenticate with their domain credentials and permissions are enforced based on Active Directory groups. What should you do?

Create a shared access signature (SAS) for the file share and provide it to the users.

Mount the file share using the storage account key and rely on NTFS permissions on the share.

Enable identity-based authentication for the storage account and assign RBAC roles to Azure AD groups for the file share.

Configure the file share to use NFS and mount it from the Windows VMs.

A company stores highly sensitive data in Azure Blob Storage. The security team requires that data be encrypted at rest with two independent encryption layers. You need to meet this requirement. What should you do?

Configure customer-managed keys in Azure Key Vault.

Enable infrastructure encryption using a customer-managed key.

Enable double encryption for the storage account.

Use Azure Disk Encryption on the VMs that access the storage.

A company uses Azure Storage with customer-managed keys. They want to ensure that if the key is accidentally deleted, the storage account remains accessible. What should they enable on the Key Vault?

Diagnostic settings for key operations.

Soft delete and purge protection.

Access policies for the storage account.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 2

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 2)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

20–25%of the exam

Questions 6–10

6application · medium
A company runs a Linux-based application that needs to mount an Azure Files share using the NFS protocol. The application is hosted on an Azure VM in the same virtual network as the storage account. The storage account is configured with the NFS protocol enabled. What additional configuration is required to allow the VM to mount the share?
Select an answer first
7application · medium
A company has an Azure file share that is accessed by several Windows VMs in the same region. The VMs are joined to an on-premises Active Directory domain that is synced to Azure AD. You need to configure access so that users authenticate with their domain credentials and permissions are enforced based on Active Directory groups. What should you do?
Select an answer first
8foundation · easy
Which Azure service is used to store and manage customer-managed keys for Azure Storage encryption?
Select an answer first
9application · medium
A company stores highly sensitive data in Azure Blob Storage. The security team requires that data be encrypted at rest with two independent encryption layers. You need to meet this requirement. What should you do?
Select an answer first
10application · medium
A company uses Azure Storage with customer-managed keys. They want to ensure that if the key is accidentally deleted, the storage account remains accessible. What should they enable on the Key Vault?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 2)

Questions 6–10

Which Azure service is used to store and manage customer-managed keys for Azure Storage encryption?

A company stores highly sensitive data in Azure Blob Storage. The security team requires that data be encrypted at rest with two independent encryption layers. You need to meet this requirement. What should you do?

A company uses Azure Storage with customer-managed keys. They want to ensure that if the key is accidentally deleted, the storage account remains accessible. What should they enable on the Key Vault?

Keep studying — Secure compute, storage, and databases