Secure storage, databases, and networking
Domain 2 of SC-500 accounts for 25-30% of the exam, the heaviest part of the syllabus. EarnYourCert has 106 original questions for this domain, all with explanations: 71 multiple choice, 16 yes/no and 19 completion or ordering items, like the real exam.
Domain 2 sample questions
8 questions from our 106-question bank for this domain. Try to answer before revealing the solution.
1. Which storage account setting prevents anonymous public read access to blobs at the account level?
- Disable 'Allow Blob anonymous access'
- Enable public containers with read-only SAS
- Enable static website with a custom domain
- Use account keys in code
Show answer
Correct answer: A. Disabling anonymous access is a baseline hardening step.
2. Which feature ensures blob data cannot be modified or deleted for a set period to meet regulatory requirements?
- A lifecycle rule that deletes blobs after seven years
- Blob versioning combined with soft delete
- Immutable storage with a time-based retention policy
- A read-only resource lock on the storage account
Show answer
Correct answer: C. WORM storage meets SEC and similar requirements.
3. Where does auditing for SQL Managed Instance write its logs?
- Local files on the instance host
- Microsoft 365 audit logs only
- Azure Storage, Log Analytics or Event Hubs
- The Azure Activity log only
Show answer
Correct answer: C. Auditing destinations include Storage, Log Analytics and Event Hubs.
4. Which authentication option for Azure Database for PostgreSQL Flexible Server lets you use Microsoft Entra identities?
- Public tokens
- Shared admin password only
- Anonymous login
- Microsoft Entra authentication
Show answer
Correct answer: D. Entra auth centralizes identity management.
5. Which Azure Firewall rule type translates inbound internet traffic to a private IP and port in the virtual network?
- Application rules
- Network rules
- Threat intelligence-based filtering
- DNAT rules
Show answer
Correct answer: D. DNAT publishes internal services through the firewall IP.
6. An organization wants to secure a Virtual WAN hub with firewall inspection of branch-to-branch and internet traffic. What should it deploy?
- Network security groups on each branch connection
- A secured virtual hub with Azure Firewall and routing intent
- A public IP address on each branch device
- A virtual hub without routing intent or a firewall
Show answer
Correct answer: B. Routing intent sends traffic through the firewall in the hub.
7. Which Network Watcher feature tests whether a specific packet is allowed or denied by NSG rules for a VM?
- IP flow verify
- Packet capture only
- Cost view
- Topology only
Show answer
Correct answer: A. IP flow verify identifies the rule allowing or denying traffic.
8. NSG flow logs are being retired. Which Network Watcher feature should you use instead to log traffic at the virtual network level?
- Virtual network flow logs
- IP flow verify
- Connection monitor
- Packet capture on every VM in the virtual network
Show answer
Correct answer: A. VNet flow logs record traffic for the whole virtual network, including traffic not governed by NSGs.