AZ-500 Practice Test 17 — 15 Questions

Question 1

Your company has two Azure virtual networks: VNet-A (10.0.0.0/16) and VNet-B (10.1.0.0/16). They are connected via VNet peering. You deploy a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic between the VNets. You configure a user-defined route (UDR) on the subnet in VNet-B that points the address space of VNet-A (10.0.0.0/16) to the next hop as the private IP of the NVA. However, traffic from VNet-B to VNet-A still bypasses the NVA and takes the direct peered path. What is the most likely cause?

Accepted Answer

IP forwarding is not enabled on the NVA's network interface. The NVA must have IP forwarding enabled on its network interface to forward traffic that is not destined to its own IP address. Without IP forwarding, the NVA will drop packets routed to it via the UDR, causing traffic to fall back to the default peered path. Enabling IP forwarding allows the NVA to act as a router and forward traffic between VNet-A and VNet-B as intended.

Answer

The UDR is not applied to the subnet in VNet-B

Answer

VNet peering does not support user-defined routes

Answer

The NVA must be in the same virtual network as the spoke

Question 2

You have an Azure virtual machine that hosts a web application. You need to allow inbound HTTP (80) and HTTPS (443) traffic from the internet to this VM only. You also need to allow outbound traffic to the internet from the VM. You want to use a managed Azure service with minimal configuration. What should you use?

Accepted Answer

Network Security Group (NSG). A Network Security Group (NSG) is the correct choice because it is a managed Azure service that provides a stateful, layer-3/4 firewall for filtering inbound and outbound traffic to a virtual machine. With minimal configuration, you can create inbound rules to allow HTTP (TCP/80) and HTTPS (TCP/443) from the internet (source 'Internet' or 'Any') and an outbound rule to allow all traffic to the internet (default outbound rule already allows this). NSGs are directly associated with a VM's subnet or network interface, making them the simplest managed solution for this scenario.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure Bastion

Question 3

A cloud security team wants Defender for Cloud to assess AWS accounts and GCP projects from the same portal used for Azure posture management. What should they configure?

Accepted Answer

Environment settings with multicloud connectors. Option A is correct because Defender for Cloud's multicloud connectors allow you to onboard AWS accounts and GCP projects directly into the Azure portal, enabling unified security posture management across all three cloud environments. This feature integrates with AWS Security Hub and GCP Security Command Center to aggregate findings and assessments into a single dashboard, without requiring any migration of workloads.

Answer

Azure Arc-enabled Kubernetes only

Answer

Microsoft Sentinel data connector for AWS CloudTrail only

Answer

Azure Lighthouse delegation

Question 4

A company deploys a web application on Azure VMs behind an Azure Load Balancer (Standard SKU). They want to protect the application from common web attacks like SQL injection and cross-site scripting. Which Azure service should they enable?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) policy.. Azure Application Gateway with a Web Application Firewall (WAF) policy is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and provides centralized, inbound protection against common web attacks such as SQL injection and cross-site scripting (XSS). The WAF policy uses OWASP Core Rule Sets (CRS) to inspect HTTP request payloads and headers, blocking malicious traffic before it reaches the backend VMs behind the Load Balancer.

Answer

Azure Firewall.

Answer

Network Security Groups on the VM subnet.

Answer

Azure DDoS Protection.

Question 5

A company uses Azure AD Privileged Identity Management (PIM) for the Security Administrator role. The security policy requires that when a user activates the Security Administrator role, they must: 1) Provide a justification, 2) Get approval from a designated security group, and 3) The activation must last a maximum of 4 hours. Which combination of PIM settings should they configure?

Accepted Answer

Enable 'Require justification', 'Require approval', and set 'Maximum activation duration' to 4 hours. Assign the security group as the approver.. Option A is correct because Azure AD PIM allows you to enforce all three requirements: justification, approval from a specified security group, and a maximum activation duration. By enabling 'Require justification' and 'Require approval' and setting the 'Maximum activation duration' to 4 hours, you meet the security policy exactly. The approval step requires assigning a designated security group as the approver, which is supported in PIM role settings.

Answer

Enable 'Require justification', 'Require ticket information', and set 'Maximum activation duration' to 8 hours.

Answer

Enable 'Require approval' and set 'Maximum activation duration' to 4 hours. Do not require justification.

Answer

Enable 'Require Azure MFA on activation', 'Require justification', and set 'Maximum activation duration' to 4 hours.

Question 6

A company deploys Azure Firewall to inspect and control outbound traffic from a virtual network. The security team wants to allow outbound HTTPS traffic only to specific FQDNs such as *.microsoft.com and *.windowsupdate.com, while blocking all other outbound internet access. Which type of rule should they configure in Azure Firewall to achieve this filtering?

Accepted Answer

Application Rule. Azure Firewall uses Application Rules to filter outbound traffic based on fully qualified domain names (FQDNs) for HTTP/HTTPS protocols. Since the requirement is to allow HTTPS traffic to specific FQDNs like *.microsoft.com and *.windowsupdate.com, an Application Rule is the correct choice because it can inspect the TLS Server Name Indication (SNI) extension to match the target FQDN, enabling granular allow/deny decisions for web traffic.

Answer

Network Rule

Answer

NAT Rule

Answer

DNAT Rule

Question 7

A company uses Azure AD Privileged Identity Management (PIM) to manage the 'Security Administrator' role. They want to require that activation of this role must be approved by a designated group of security engineers before it becomes active. Which PIM role setting should they configure?

Accepted Answer

Require approval. Option C is correct because Azure AD PIM's 'Require approval' setting enforces that a designated group of approvers must authorize each activation request before the role becomes active. This directly meets the requirement for approval by security engineers, ensuring that role activation is gated by explicit consent rather than being automatic.

Answer

Activation maximum duration (hours)

Answer

MFA on activation

Answer

Require justification on activation

Question 8

A company deploys Azure virtual machines in a virtual network. A security policy requires that only Remote Desktop Protocol (RDP) traffic from the corporate VPN's public IP address (203.0.113.0/26) is allowed. All other inbound RDP traffic must be denied. Which configuration should be applied to the network security group (NSG) associated with the VM subnet?

Accepted Answer

Add an inbound rule to allow RDP from the corporate IP range, and add a default deny rule for all other inbound RDP traffic.. Option C is correct because the requirement is to allow RDP (TCP port 3389) only from the corporate VPN's public IP range (203.0.113.0/26) and deny all other inbound RDP traffic. An NSG processes rules in priority order; by adding an inbound allow rule for the corporate IP range with a high priority (e.g., 100) and relying on the default deny rule (which denies all inbound traffic not explicitly allowed), only RDP from the specified range is permitted. This matches the security policy precisely.

Answer

Add an inbound rule to allow RDP from the Internet and a deny rule for RDP from the corporate IP.

Answer

Add an inbound rule to deny RDP from the corporate IP and a default deny all inbound.

Answer

No additional rules are needed because the default NSG rules already deny RDP.

Question 9

A company has an Azure SQL Database with a private endpoint connection. The database is accessed from on-premises via ExpressRoute and from other Azure virtual networks (VNets) via VNet peering. The security team wants to ensure that all queries from both on-premises and peered VNets go through the private endpoint and NEVER use the public endpoint, even as a fallback. Which additional configuration is required to enforce this?

Accepted Answer

Disable public network access on the Azure SQL server.. Option C is correct because disabling public network access on the Azure SQL server explicitly blocks all traffic that does not originate from a private endpoint. This setting ensures that even if a client attempts to connect using the public endpoint (e.g., via a misconfigured connection string or DNS resolution fallback), the server will reject the connection. This is the only configuration that enforces the requirement that all queries—from on-premises via ExpressRoute or from peered VNets—must go through the private endpoint and never use the public endpoint.

Answer

Configure a Network Security Group (NSG) on the subnet hosting the private endpoint to deny outbound traffic to the public endpoint's IP addresses.

Answer

Enable Azure SQL Auditing and configure a log analytics workspace to monitor for public endpoint calls, then manually block them.

Answer

Configure a service endpoint for Azure SQL on the VNet and associate a firewall rule allowing only the VNet traffic.

Question 10

A company has an Azure virtual network with a subnet hosting internal web applications. The security team needs to allow inbound HTTPS traffic only from the company's corporate network IP range (203.0.113.0/24). All other inbound traffic must be denied. They want to use a network security group (NSG) associated with the subnet. Which inbound security rule configuration meets this requirement?

Accepted Answer

Two inbound rules: Allow HTTPS from 203.0.113.0/24 with priority 100, and Deny All from Any with priority 110.. Option B is correct because NSGs process rules in priority order, and the default implicit deny rule only applies if no explicit rule matches. By placing an explicit 'Deny All from Any' rule with a higher priority number (110) after the explicit 'Allow HTTPS' rule (priority 100), traffic from 203.0.113.0/24 on HTTPS is allowed, and all other inbound traffic is explicitly denied, ensuring no unintended implicit allow or bypass.

Answer

One inbound rule: Allow HTTPS from 203.0.113.0/24 with priority 100. No other rules. Rely on the default deny-all rule.

Answer

Two inbound rules: Deny All from Any with priority 100, and Allow HTTPS from 203.0.113.0/24 with priority 110.

Answer

One inbound rule: Deny All from Any with priority 100. No allow rules. Use application security groups.

Question 11

A company has a partner organization in another Azure AD tenant. They want to allow users from the partner tenant to access their Azure resources through Azure AD B2B collaboration. They also want the partner's Multi-Factor Authentication (MFA) claims to be trusted when partner users access their resources, so that they do not need to perform MFA again. Which configuration in cross-tenant access settings should they enable?

Accepted Answer

Trust multi-factor authentication from the partner tenant (inbound trust).. Option A is correct because cross-tenant access settings in Azure AD allow you to configure inbound trust for MFA from an external Azure AD tenant. When enabled, Azure AD B2B collaboration will accept the partner tenant's MFA claims, so partner users who have already satisfied MFA in their home tenant will not be prompted again when accessing your resources. This is configured under 'Cross-tenant access settings' > 'Inbound trust settings' for the specific partner tenant.

Answer

Trust device compliance from the partner tenant.

Answer

Enable a Conditional Access policy that grants access to the partner tenant.

Answer

Configure identity synchronization with the partner tenant.

Question 12

A company has a hub-spoke network topology in Azure. The spoke virtual networks contain Azure virtual machines that need to access the internet. The security team requires that all outbound internet traffic from the spoke VMs passes through the Azure Firewall deployed in the hub virtual network for inspection and logging. Which configuration should be implemented to ensure this traffic is routed through the firewall?

Accepted Answer

Create a user-defined route (UDR) in the spoke subnet with 0.0.0.0/0 pointing to the private IP of the Azure Firewall.. Option B is correct because a user-defined route (UDR) with the 0.0.0.0/0 prefix and the next hop set to the private IP address of the Azure Firewall forces all outbound internet traffic from the spoke subnet to be routed through the firewall in the hub. This ensures the traffic passes through the firewall for inspection and logging, as required by the security team.

Answer

Configure an Azure Load Balancer in the hub to distribute traffic from spokes to the firewall.

Answer

Use Azure Firewall Manager to automatically enforce a global default route on all spokes. This is the only configuration needed.

Answer

Enable IP forwarding on the NICs of the spoke VMs so they forward traffic to the firewall.

Question 13

A company has a virtual network in Azure with a subnet that hosts a web application. They want to allow inbound HTTPS traffic only from a specific source IP range (198.51.100.0/24). They are using Network Security Groups (NSGs) associated with the subnet. What is the minimal set of inbound security rules required?

Accepted Answer

One inbound rule: Allow TCP port 443 from source '198.51.100.0/24'. Option A is correct because NSGs have a default implicit 'DenyAllInbound' rule at the lowest priority (65500). Since you only need to allow HTTPS from the specific source IP range, a single inbound rule permitting TCP port 443 from source '198.51.100.0/24' is sufficient. The implicit deny will block all other traffic, including any traffic from other sources or ports, without needing an explicit deny rule.

Answer

Two inbound rules: one to allow HTTPS, and one to deny all other traffic

Answer

Three inbound rules: allow HTTPS, allow RDP for management, and deny all

Answer

One inbound rule: Allow TCP port 443 from source 'Any' and a separate rule to deny from '198.51.100.0/24'

Question 14

A company has an Azure virtual network with a subnet that contains virtual machines. They have deployed Azure Firewall in a hub VNet and peered the spoke VNet to the hub. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop. However, traffic from the VMs is still going directly to the internet. What is the most likely cause?

Accepted Answer

The route table is not associated with the subnet.. The most likely cause is that the route table containing the default route (0.0.0.0/0) with the Azure Firewall's private IP as the next hop has not been associated with the spoke subnet. Without this association, the subnet's VMs will use the system default route, which sends internet-bound traffic directly out via the Azure default gateway (0.0.0.0/0, next hop type Internet), bypassing the firewall entirely.

Answer

The Azure Firewall's private IP is not configured as the next hop; it should be the public IP.

Answer

The VNet peering is not configured correctly.

Answer

The Azure Firewall has a default route that bypasses itself.

Question 15

A company has an Azure virtual network with a subnet that hosts Azure virtual machines. They want to restrict access to an Azure SQL Database so that only traffic originating from that specific subnet is allowed. They have enabled a service endpoint for Microsoft.Sql on the subnet and configured the SQL server firewall to allow only that subnet's virtual network rule. However, connections from the VMs to the SQL database are failing with an authorization error. What is the most likely cause?

Accepted Answer

The service endpoint for Microsoft.Sql was not enabled on the subnet before creating the firewall rule. The most likely cause is that the service endpoint for Microsoft.Sql was not enabled on the subnet before the virtual network (VNet) firewall rule was created on the SQL server. When a VNet rule is added to the SQL server firewall, Azure validates that the specified subnet has a service endpoint for Microsoft.Sql enabled. If the endpoint is not enabled at the time the rule is created, the rule will be created but will not be effective, and traffic from the subnet will not be recognized as originating from the VNet, resulting in authorization errors. The service endpoint must be enabled first to ensure the subnet's traffic is routed through the Azure backbone and correctly identified by the SQL server firewall.

Answer

The SQL server's firewall also has a rule allowing all Azure services, which overrides the VNet rule

Answer

The virtual machine's operating system firewall is blocking outbound traffic

Answer

The subnet's NSG is blocking outbound traffic to Azure SQL