nerdexam
Microsoft

AZ-500 · Question #377

Hotspot Question You have an Azure subscription that contains the resources shown in the following table. Transparent Data Encryption (TDE) is disabled on SQL1. You assign policies to the resource…

The correct answer is SQL1 will have TDE enabled automatically. = No; The deployment of SQL2 will fail. = Yes; SQL3 will be deployed and marked as noncompliant. = Yes. Azure Policy effects determine how compliance is enforced. An 'Audit' or 'AuditIfNotExists' policy on RG1 (where SQL1 resides) only checks for compliance and reports noncompliance but does NOT automatically remediate or change existing resources - so TDE remains disabled on…

Submitted by ricky.ec· Mar 6, 2026Manage Azure identities and governance - specifically implementing and managing Azure Policy to enforce organizational standards and assess compliance across Azure resources (AZ-104 Domain: Governance and Compliance)

Question

Hotspot Question You have an Azure subscription that contains the resources shown in the following table. Transparent Data Encryption (TDE) is disabled on SQL1. You assign policies to the resource groups as shown in the following table. You plan to deploy Azure SQL databases by using an Azure Resource Manager (ARM) template. The databases will be configured as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #377 exhibit 1
AZ-500 question #377 exhibit 2
AZ-500 question #377 exhibit 3
AZ-500 question #377 exhibit 4
AZ-500 question #377 exhibit 5
AZ-500 question #377 exhibit 6

Answer Area

  • SQL1 will have TDE enabled automatically.No
  • The deployment of SQL2 will fail.Yes
  • SQL3 will be deployed and marked as noncompliant.Yes

Explanation

Azure Policy effects determine how compliance is enforced. An 'Audit' or 'AuditIfNotExists' policy on RG1 (where SQL1 resides) only checks for compliance and reports noncompliance but does NOT automatically remediate or change existing resources - so TDE remains disabled on SQL1. A 'Deny' policy on RG2 actively blocks deployments that violate the policy, meaning SQL2's deployment will fail because it violates the TDE requirement. An 'Audit' policy on RG3 allows SQL3 to deploy successfully but flags it as noncompliant in the compliance dashboard since TDE is disabled.

Topics

#Azure Policy Effects#Transparent Data Encryption#ARM Template Deployment#Azure SQL Database Compliance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice