A company uses customer-managed keys for Azure Storage encryption. The key in Azure Key Vault is due for rotation. The security team wants to rotate the key without re-encrypting the data. You need to ensure that the storage account continues to use the new key. What should you do?

Delete the old key and create a new key with the same name.

Disable the old key and enable a new key in the same Key Vault.

Create a new key version in Azure Key Vault and update the storage account to use the new version.

Regenerate the storage account access keys.

A company wants to protect Azure Blob Storage data from accidental deletion and overwrite. They enable soft delete for blobs and versioning. What additional feature should they enable to protect against ransomware that encrypts blobs?

Enable Azure Defender for Storage to detect ransomware.

Enable immutable storage with a time-based retention policy.

Assign the Storage Blob Data Reader role to all users.

Create a lifecycle management policy to delete old versions.

A security architect is designing a storage solution for highly sensitive data. The requirement is to have two independent encryption layers, with at least one layer using customer-managed keys. The architect also wants to minimize the risk of key revocation causing data loss. What should they implement?

Use two customer-managed keys, one for SSE and one for infrastructure encryption.

Enable double encryption using two service-managed keys.

Use a customer-managed key for SSE and rely on Azure Defender for additional protection.

Enable infrastructure encryption and use a customer-managed key for SSE.

A security team requires that data at rest in Azure Storage be encrypted with two independent encryption layers. They have already enabled Azure Storage Service Encryption (SSE) using a customer-managed key. What additional step is needed to achieve double encryption?

Enable infrastructure encryption on the storage account.

Create a second customer-managed key and assign it to the storage account.

Enable soft delete and versioning on the storage account.

Enable Azure Defender for Storage on the storage account.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 2

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 3)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

20–25%of the exam

Questions 11–15

11expert · medium
A company uses customer-managed keys for Azure Storage encryption. The key in Azure Key Vault is due for rotation. The security team wants to rotate the key without re-encrypting the data. You need to ensure that the storage account continues to use the new key. What should you do?
Select an answer first
12application · medium
A company wants to protect Azure Blob Storage data from accidental deletion and overwrite. They enable soft delete for blobs and versioning. What additional feature should they enable to protect against ransomware that encrypts blobs?
Select an answer first
13expert · medium
A security architect is designing a storage solution for highly sensitive data. The requirement is to have two independent encryption layers, with at least one layer using customer-managed keys. The architect also wants to minimize the risk of key revocation causing data loss. What should they implement?
Select an answer first
14foundation · easy
Which Azure Storage feature is used to meet compliance requirements that mandate data cannot be modified or deleted for a specific retention period?
Select an answer first
15application · medium
A security team requires that data at rest in Azure Storage be encrypted with two independent encryption layers. They have already enabled Azure Storage Service Encryption (SSE) using a customer-managed key. What additional step is needed to achieve double encryption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 3)

Questions 11–15

A company uses customer-managed keys for Azure Storage encryption. The key in Azure Key Vault is due for rotation. The security team wants to rotate the key without re-encrypting the data. You need to ensure that the storage account continues to use the new key. What should you do?

A company wants to protect Azure Blob Storage data from accidental deletion and overwrite. They enable soft delete for blobs and versioning. What additional feature should they enable to protect against ransomware that encrypts blobs?

Which Azure Storage feature is used to meet compliance requirements that mandate data cannot be modified or deleted for a specific retention period?

A security team requires that data at rest in Azure Storage be encrypted with two independent encryption layers. They have already enabled Azure Storage Service Encryption (SSE) using a customer-managed key. What additional step is needed to achieve double encryption?

Keep studying — Secure compute, storage, and databases