A company wants to protect against accidental deletion of blobs by users. They also want to be able to restore a previous version of a blob if it is overwritten. You need to implement a solution that provides both capabilities. What should you do?

Enable soft delete for blobs and enable blob versioning.

Configure a lifecycle management policy to retain deleted blobs.

A company uses an Azure Storage account for a line-of-business application. The application runs on an Azure VM and accesses blobs using the account key. The security team requires that the application no longer use the account key and that access be limited to the VM's identity. You need to configure access with the least administrative overhead while meeting the requirement. What should you do?

Create a shared access signature (SAS) with a long expiry and embed it in the application configuration.

Generate a new account key and store it in Azure Key Vault, then update the application to retrieve the key from Key Vault.

Assign the Storage Account Contributor role to the VM's managed identity and update the application to use Azure AD authentication.

Assign the Storage Blob Data Reader role to the VM's managed identity and update the application to use Azure AD authentication.

You need to encrypt Azure Storage data using a customer-managed key stored in Azure Key Vault. Which feature should you enable on the storage account?

Azure Storage encryption with customer-managed keys

A user needs to upload a blob to an Azure Storage container using the Azure portal. The user has been assigned the Storage Blob Data Contributor role on the storage account. However, the user cannot see the storage account in the portal. What is the most likely reason?

The user is not assigned the Contributor role on the resource group.

The user lacks the Reader role on the storage account, which is required to list the storage account in the portal.

The user does not have the Storage Account Key Operator role.

The storage account firewall is blocking the user's IP address.

Microsoft Certified:Azure Security Engineer Associate

Domain 3Objective 2

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 6)

Part of the Secure compute, storage, and databases domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

7concepts

20–25%of the exam

Questions 26–30

26application · medium
A company wants to protect against accidental deletion of blobs by users. They also want to be able to restore a previous version of a blob if it is overwritten. You need to implement a solution that provides both capabilities. What should you do?
Select an answer first
27foundation · easy
Which access method is used to interact with Azure Blob Storage from a custom application that needs to perform operations such as uploading, downloading, and listing blobs programmatically?
Select an answer first
28application · medium
A company uses an Azure Storage account for a line-of-business application. The application runs on an Azure VM and accesses blobs using the account key. The security team requires that the application no longer use the account key and that access be limited to the VM's identity. You need to configure access with the least administrative overhead while meeting the requirement. What should you do?
Select an answer first
29foundation · easy
You need to encrypt Azure Storage data using a customer-managed key stored in Azure Key Vault. Which feature should you enable on the storage account?
Select an answer first
30application · medium
A user needs to upload a blob to an Azure Storage container using the Azure portal. The user has been assigned the Storage Blob Data Contributor role on the storage account. However, the user cannot see the storage account in the portal. What is the most likely reason?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Storage AZ-500 Practice Questions (Page 6)

Questions 26–30

A company wants to protect against accidental deletion of blobs by users. They also want to be able to restore a previous version of a blob if it is overwritten. You need to implement a solution that provides both capabilities. What should you do?

Which access method is used to interact with Azure Blob Storage from a custom application that needs to perform operations such as uploading, downloading, and listing blobs programmatically?

You need to encrypt Azure Storage data using a customer-managed key stored in Azure Key Vault. Which feature should you enable on the storage account?

A user needs to upload a blob to an Azure Storage container using the Azure portal. The user has been assigned the Storage Blob Data Contributor role on the storage account. However, the user cannot see the storage account in the portal. What is the most likely reason?

Keep studying — Secure compute, storage, and databases