Plan and Implement Security for Storage AZ-500 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company has an Azure Storage account with a private endpoint. A third-party service outside Azure needs to read a specific blob for a limited time. You need to provide access without exposing the storage account to the public internet and without granting permanent access. What should you do?

   • AAssign the Storage Blob Data Reader role to the third party's service principal.
   • BAdd the third party's IP address to the storage account firewall.
   • CCreate a new storage account and copy the blob, then share the account key.
   • DCreate a shared access signature (SAS) with read permission and a short expiry, and provide it to the third party.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company requires that all data in Azure Storage be encrypted with customer-managed keys. You have created an Azure Key Vault and a key. You need to configure the storage account to use the customer-managed key. What should you do?

   • AAssign the Key Vault Contributor role to the storage account's managed identity.
   • BSet the encryption type of the storage account to 'Customer-managed keys' and select the key from the Key Vault.
   • CEnable double encryption on the storage account.
   • DCreate a shared access signature (SAS) that includes the key identifier.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A company has a hybrid environment with on-premises Windows servers and Azure VMs. They need to share files between both environments using Azure Files. The on-premises servers are not joined to Azure AD. The Azure VMs are joined to Azure AD. They want to use identity-based authentication for the Azure VMs and key-based authentication for on-premises servers. What should you configure?

   • ACreate a shared access signature (SAS) for the Azure VMs and use keys for on-premises servers.
   • BUse only storage account keys for both environments.
   • CEnable Azure AD DS authentication for the storage account, and use storage account keys for on-premises SMB access.
   • DEnable Active Directory (AD) authentication for the storage account, and use Azure AD authentication for on-premises servers.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   You need to provide a third-party application temporary, time-limited access to a specific blob in a storage account without exposing the storage account access key. Which mechanism should you use?

   • AShared access signature (SAS)
   • BAzure AD managed identity
   • CAzure Key Vault secret
   • DStorage account access key
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A company stores financial records in Azure Blob Storage. They have enabled soft delete and versioning. A security audit requires that the records be retained for 7 years and cannot be deleted by anyone, including administrators. They also want to minimize storage costs. What should you implement?

   • AAssign the Storage Blob Data Reader role to all users and remove the Owner role.
   • BEnable Azure Defender for Storage to alert on deletion attempts.
   • CUse a lifecycle management policy to transition blobs to cool and archive tiers after 30 days.
   • DEnable a time-based immutability policy on the container with a retention period of 7 years.
   Reveal Solution Discussion Select an answer first