You save $69.98
A stakeholder asks whether the proposed configuration guarantees: select read-access geo-redundancy rather than a zone-only replication scheme. What qualification is technically accurate?
Asynchronous cross-region replication can have lag; the secondary may not contain the newest writes. That remains a practical service boundary even after the recommended change (configure read-access geo-redundant storage (RA-GRS) where supported) is implemented; retest it when identities, policies, service capacity or network paths change.
The two checks cover separate behavior: 'Read an existing object through the read-only secondary endpoint in a test' and 'Confirm writes still target the permitted primary endpoint rather than the secondary'. Neither check removes the remaining operational limitation: Asynchronous cross-region replication can have lag; the secondary may not contain the newest writes.
The incident (the application cannot read from the secondary endpoint before failover even though geo-replication is configured) could recur if a related Azure dependency changes. The design still faces the limitation: Asynchronous cross-region replication can have lag; the secondary may not contain the newest writes.
The successful check 'Read an existing object through the read-only secondary endpoint in a test' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Asynchronous cross-region replication can have lag; the secondary may not contain the newest writes.
A production subscription has this use case: A firm creates a new StorageV2 account and needs to ensure every client negotiates encrypted transport for normal Azure Storage calls. The owner specifies: require secure transport by policy rather than relying on every caller choosing HTTPS correctly. What is the best administrative approach?
The account-level setting rejects supported insecure HTTP data requests instead of treating encryption as optional client behavior. This achieves require secure transport by policy rather than relying on every caller choosing HTTPS correctly through enable Secure transfer required on the storage account and configure clients to use TLS-protected endpoints instead of relying on merely similar resource settings.
Lifecycle tiering does not enforce TLS for client connections; that would not meet require secure transport by policy rather than relying on every caller choosing HTTPS correctly, for which the relevant Azure action is enable Secure transfer required on the storage account and configure clients to use TLS-protected endpoints.
A budget is a billing notification tool, not a transport-control mechanism; that would not meet require secure transport by policy rather than relying on every caller choosing HTTPS correctly, for which the relevant Azure action is enable Secure transfer required on the storage account and configure clients to use TLS-protected endpoints.
Public access authorization is independent of encrypted transport; that would not meet require secure transport by policy rather than relying on every caller choosing HTTPS correctly, for which the relevant Azure action is enable Secure transfer required on the storage account and configure clients to use TLS-protected endpoints.
An Azure administrator is investigating this symptom: An old integration successfully uses plaintext HTTP despite the security policy. Which root cause best matches the underlying requirement: require secure transport by policy rather than relying on every caller choosing HTTPS correctly?
The trace reports: An old integration successfully uses plaintext HTTP despite the security policy. The causal misconfiguration is: The secure transfer required property is disabled or the client reaches an unintended unprotected path. The targeted action is to enable secure transfer and migrate the integration to supported HTTPS requests.
Required versioning, change feed, or the active object replication policy was not configured correctly; that mechanism would be more consistent with an observation such as new block blobs stop appearing at the destination despite an intended object replication rule, rather than this case's an old integration successfully uses plaintext HTTP despite the security policy.
The account uses GRS rather than a read-access geo-redundant configuration; that mechanism would be more consistent with an observation such as the application cannot read from the secondary endpoint before failover even though geo-replication is configured, rather than this case's an old integration successfully uses plaintext HTTP despite the security policy.
The selected redundancy keeps copies in one local fault domain instead of independent zones; that mechanism would be more consistent with an observation such as the app's LRS data becomes inaccessible during a zone-level storage failure, rather than this case's an old integration successfully uses plaintext HTTP despite the security policy.
An Azure rollout fails because: An old integration successfully uses plaintext HTTP despite the security policy. Which change most directly restores the intended control?
Enable secure transfer and migrate the integration to supported HTTPS requests. This addresses the documented failure condition: the secure transfer required property is disabled or the client reaches an unintended unprotected path. Retest the affected operation and retain the original least-privilege boundaries.
Public access authorization is independent of encrypted transport. In the reported incident (an old integration successfully uses plaintext HTTP despite the security policy), that change would not correct the cause: the secure transfer required property is disabled or the client reaches an unintended unprotected path.
Lifecycle tiering does not enforce TLS for client connections. In the reported incident (an old integration successfully uses plaintext HTTP despite the security policy), that change would not correct the cause: the secure transfer required property is disabled or the client reaches an unintended unprotected path.
A budget is a billing notification tool, not a transport-control mechanism. In the reported incident (an old integration successfully uses plaintext HTTP despite the security policy), that change would not correct the cause: the secure transfer required property is disabled or the client reaches an unintended unprotected path.
For the configuration goal, require secure transport by policy rather than relying on every caller choosing HTTPS correctly. The Azure context is: A firm creates a new StorageV2 account and needs to ensure every client negotiates encrypted transport for normal Azure Storage calls. Which TWO observations provide useful assurance? Select TWO answers.
Send a valid authorized HTTPS data request and confirm normal success. This supplies observed evidence for require secure transport by policy rather than relying on every caller choosing HTTPS correctly. It is not interchangeable with the second required check, attempt an insecure HTTP request and confirm it is rejected by the account, because that checks a separate success or failure boundary.
Attempt an insecure HTTP request and confirm it is rejected by the account. This supplies observed evidence for require secure transport by policy rather than relying on every caller choosing HTTPS correctly. It is not interchangeable with the second required check, send a valid authorized HTTPS data request and confirm normal success, because that checks a separate success or failure boundary.
A release checklist recording 'Attempt an insecure HTTP request and confirm it is rejected by the account' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must attempt an insecure HTTP request and confirm it is rejected by the account on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The required check must exercise send a valid authorized HTTPS data request and confirm normal success on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Send a valid authorized HTTPS data request and confirm normal success' even though the intended caller fails. This does not prove the required behavior for send a valid authorized https data request and confirm normal success.
A stakeholder asks whether the proposed configuration guarantees: require secure transport by policy rather than relying on every caller choosing HTTPS correctly. What qualification is technically accurate?
Secure transport protects the connection but does not replace identity authorization or stored-data encryption key management. That remains a practical service boundary even after the recommended change (enable Secure transfer required on the storage account and configure clients to use TLS-protected endpoints) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (an old integration successfully uses plaintext HTTP despite the security policy) could recur if a related Azure dependency changes. The design still faces the limitation: Secure transport protects the connection but does not replace identity authorization or stored-data encryption key management.
The successful check 'Send a valid authorized HTTPS data request and confirm normal success' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Secure transport protects the connection but does not replace identity authorization or stored-data encryption key management.
The two checks cover separate behavior: 'Send a valid authorized HTTPS data request and confirm normal success' and 'Attempt an insecure HTTP request and confirm it is rejected by the account'. Neither check removes the remaining operational limitation: Secure transport protects the connection but does not replace identity authorization or stored-data encryption key management.
An Azure administrator must resolve a specific request: A regulated application stores customer files in Azure Storage and must control who can use the encryption key outside the storage service. The expected outcome is: use a customer-managed encryption key under separately governed key custody. Which option is appropriate?
A customer-managed key separates key access policy and rotation ownership from the storage service's default key management. This achieves use a customer-managed encryption key under separately governed key custody through configure storage account encryption with a supported customer-managed key in Azure Key Vault or Managed HSM and authorize the account identity instead of relying on merely similar resource settings.
Unprotected storage of the key negates meaningful key custody; that would not meet use a customer-managed encryption key under separately governed key custody, for which the relevant Azure action is configure storage account encryption with a supported customer-managed key in Azure Key Vault or Managed HSM and authorize the account identity.
Removing encryption defeats the confidentiality requirement; that would not meet use a customer-managed encryption key under separately governed key custody, for which the relevant Azure action is configure storage account encryption with a supported customer-managed key in Azure Key Vault or Managed HSM and authorize the account identity.
Tags are not cryptographic key configuration; that would not meet use a customer-managed encryption key under separately governed key custody, for which the relevant Azure action is configure storage account encryption with a supported customer-managed key in Azure Key Vault or Managed HSM and authorize the account identity.
Operations sees an unexpected outcome: The storage account cannot read encrypted blobs after its key vault access permission is revoked. The original demand was: use a customer-managed encryption key under separately governed key custody. Which cause is most consistent with the evidence?
The trace reports: The storage account cannot read encrypted blobs after its key vault access permission is revoked. The causal misconfiguration is: The account identity cannot unwrap or retrieve the customer-managed key under the configured encryption dependency. The targeted action is to restore correctly scoped key permissions and verify the key version is available.
The proposed mechanism concerns the storage account uses only platform-managed keys and is not dependent on the revoked Key Vault principal, which is not established by the observed the storage account cannot read encrypted blobs after its key vault access permission is revoked. Test the more directly supported condition: The account identity cannot unwrap or retrieve the customer-managed key under the configured encryption dependency.
The selected redundancy keeps copies in one local fault domain instead of independent zones; that mechanism would be more consistent with an observation such as the app's LRS data becomes inaccessible during a zone-level storage failure, rather than this case's the storage account cannot read encrypted blobs after its key vault access permission is revoked.
The account uses GRS rather than a read-access geo-redundant configuration; that mechanism would be more consistent with an observation such as the application cannot read from the secondary endpoint before failover even though geo-replication is configured, rather than this case's the storage account cannot read encrypted blobs after its key vault access permission is revoked.
A service owner needs a practical fix after this failure: The storage account cannot read encrypted blobs after its key vault access permission is revoked. What is the best remediation?
Restore correctly scoped key permissions and verify the key version is available. This addresses the documented failure condition: the account identity cannot unwrap or retrieve the customer-managed key under the configured encryption dependency. Retest the affected operation and retain the original least-privilege boundaries.
Removing encryption defeats the confidentiality requirement. In the reported incident (the storage account cannot read encrypted blobs after its key vault access permission is revoked), that change would not correct the cause: the account identity cannot unwrap or retrieve the customer-managed key under the configured encryption dependency.
Unprotected storage of the key negates meaningful key custody. In the reported incident (the storage account cannot read encrypted blobs after its key vault access permission is revoked), that change would not correct the cause: the account identity cannot unwrap or retrieve the customer-managed key under the configured encryption dependency.
Tags are not cryptographic key configuration. In the reported incident (the storage account cannot read encrypted blobs after its key vault access permission is revoked), that change would not correct the cause: the account identity cannot unwrap or retrieve the customer-managed key under the configured encryption dependency.
A deployment claims to meet: use a customer-managed encryption key under separately governed key custody. The environment is: A regulated application stores customer files in Azure Storage and must control who can use the encryption key outside the storage service. Which TWO test results would substantiate that claim? Select TWO answers.
Read an existing encrypted blob after granting intended key access. This supplies observed evidence for use a customer-managed encryption key under separately governed key custody. It is not interchangeable with the second required check, temporarily deny key operations in a safe test and confirm failure is detected and recoverable, because that checks a separate success or failure boundary.
Temporarily deny key operations in a safe test and confirm failure is detected and recoverable. This supplies observed evidence for use a customer-managed encryption key under separately governed key custody. It is not interchangeable with the second required check, read an existing encrypted blob after granting intended key access, because that checks a separate success or failure boundary.
A configured resource is not proof of live behavior. The required check must exercise read an existing encrypted blob after granting intended key access on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Read an existing encrypted blob after granting intended key access' even though the intended caller fails. This does not prove the required behavior for read an existing encrypted blob after granting intended key access.
A release checklist recording 'Temporarily deny key operations in a safe test and confirm failure is detected and recoverable' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must temporarily deny key operations in a safe test and confirm failure is detected and recoverable on the actual workload to prove its independent boundary.
An infrastructure design was selected to meet: use a customer-managed encryption key under separately governed key custody. What caveat remains relevant during operation?
Customer-managed keys increase operational responsibility; unavailable or deleted keys can make stored data inaccessible. That remains a practical service boundary even after the recommended change (configure storage account encryption with a supported customer-managed key in Azure Key Vault or Managed HSM and authorize the account identity) is implemented; retest it when identities, policies, service capacity or network paths change.
The successful check 'Read an existing encrypted blob after granting intended key access' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Customer-managed keys increase operational responsibility; unavailable or deleted keys can make stored data inaccessible.
The two checks cover separate behavior: 'Read an existing encrypted blob after granting intended key access' and 'Temporarily deny key operations in a safe test and confirm failure is detected and recoverable'. Neither check removes the remaining operational limitation: Customer-managed keys increase operational responsibility; unavailable or deleted keys can make stored data inaccessible.
The incident (the storage account cannot read encrypted blobs after its key vault access permission is revoked) could recur if a related Azure dependency changes. The design still faces the limitation: Customer-managed keys increase operational responsibility; unavailable or deleted keys can make stored data inaccessible.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
