What is the purpose of enabling infrastructure encryption on an Azure Storage account?

To add a second layer of encryption using platform-managed keys

To use customer-managed keys instead of Microsoft-managed keys

To enable soft delete for blobs

To restrict access to the storage account via virtual networks

A security policy requires that storage account access keys be rotated every 90 days. Which action should you perform to rotate the primary access key without disrupting applications that are currently using the secondary key?

Regenerate both keys simultaneously

Regenerate the primary key after updating applications to use the secondary key

Use the Azure portal to change the key expiration date

Regenerate the secondary key first, then the primary key

You need to upload a small text file to an Azure Blob Storage container using the Azure portal. Which action should you perform?

Navigate to the container and use the Upload button

Send an HTTP PUT request to the REST API

Mount the container as a network drive

Use the az storage blob upload CLI command

A developer wants to allow a third-party application to read a specific blob for 24 hours. The application does not support Azure AD authentication. The developer wants to grant the least privilege possible. What should they do?

Generate a service SAS for the blob with read permission and an expiry of 24 hours.

Generate an account SAS for the storage account with read permission and an expiry of 24 hours.

Set the container access level to Blob and provide the blob URL.

Share the storage account key with the third-party application.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 2

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 5)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

20–25%of the exam

Questions 21–25

21foundation · easy
What is the purpose of enabling infrastructure encryption on an Azure Storage account?
Select an answer first
22foundation · easy
A security policy requires that storage account access keys be rotated every 90 days. Which action should you perform to rotate the primary access key without disrupting applications that are currently using the secondary key?
Select an answer first
23foundation · easy
You need to upload a small text file to an Azure Blob Storage container using the Azure portal. Which action should you perform?
Select an answer first
24application · medium
A developer wants to allow a third-party application to read a specific blob for 24 hours. The application does not support Azure AD authentication. The developer wants to grant the least privilege possible. What should they do?
Select an answer first
25foundation · easy
Which Azure Storage feature provides a second layer of encryption at the infrastructure level, using platform-managed keys, in addition to the default service-side encryption?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.