AZ-500 Practice Test 4 — 25 Questions

Question 1

You need to secure traffic between two VNets in different Azure regions. The VNets contain virtual machines that must communicate over private IP addresses. Which Azure service should you use?

Accepted Answer

VNet peering. VNet peering enables direct, private IP connectivity between two VNets in different Azure regions (global VNet peering). Traffic flows over the Microsoft backbone network, not the public internet, ensuring low-latency and secure communication between virtual machines using private IP addresses without requiring a gateway or additional appliance.

Answer

Azure Firewall

Answer

Azure VPN Gateway

Answer

ExpressRoute

Question 2

You need to securely connect two Azure virtual networks in the same region to allow VM-to-VM communication using private IP addresses. The solution must minimize latency and administrative overhead. What should you use?

Accepted Answer

VNet peering. VNet peering is the correct choice because it connects two Azure virtual networks in the same region using the Microsoft backbone infrastructure, enabling VM-to-VM communication over private IP addresses with near-zero latency and no intermediate hops. It requires no additional gateways or bandwidth charges within the same region, minimizing administrative overhead as it is a simple, one-time configuration.

Answer

Azure VPN Gateway

Answer

Azure Front Door

Answer

ExpressRoute

Question 3

You are designing a network security solution for a multi-tier application in Azure. The web tier must be accessible from the internet, the application tier only from the web tier, and the database tier only from the application tier. All tiers are in different subnets of the same VNet. What is the minimum configuration?

Accepted Answer

Configure NSGs on each subnet with appropriate allow rules.. Network Security Groups (NSGs) applied to each subnet can enforce least-privilege network access: allow inbound from Internet to the web tier subnet, allow inbound only from the web tier subnet to the application tier subnet, and allow inbound only from the application tier subnet to the database tier subnet. This is the minimum configuration as it uses built-in, no-cost Azure constructs without additional services or complex routing.

Answer

Use service endpoints for each tier.

Answer

Create separate VNets for each tier and use VNet peering.

Answer

Deploy Azure Firewall in the VNet and route all traffic through it.

Question 4

A company needs to demonstrate compliance with the Payment Card Industry Data Security Standard (PCI DSS) for their Azure workloads. They use Microsoft Defender for Cloud for security management. Which feature should they use to view their current compliance status against PCI DSS controls and track progress over time?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a pre-built view of compliance posture against standards like PCI DSS. It maps Azure resource configurations to specific PCI DSS controls, shows pass/fail status per control, and tracks compliance score over time, enabling continuous monitoring and evidence collection for auditors.

Answer

Security policy

Answer

Recommendations

Answer

Security incidents

Question 5

Refer to the exhibit. You are reviewing an NSG rule configuration for a subnet. The source subnet is 10.0.0.0/24 and the destination subnet is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

Allows inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.. The rule shown in the exhibit is an inbound security rule with source 10.0.0.0/24, destination 10.0.1.0/24, protocol TCP, destination port 22 (SSH), and action Allow. This explicitly permits inbound SSH traffic from the source subnet to the destination subnet. Therefore, option D is correct.

Answer

Allows outbound SSH traffic from 10.0.1.0/24 to 10.0.0.0/24.

Answer

Blocks inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.

Answer

Allows all inbound traffic from 10.0.0.0/24 to 10.0.1.0/24.

Question 6

Your company has an Azure subscription with several VNets. You deploy Azure Firewall in a hub VNet. You need to ensure that all traffic from spoke VNets to the internet goes through the firewall. What should you configure?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. To force all internet-bound traffic from spoke VNets through Azure Firewall, you must create a user-defined route (UDR) with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. This route table must be associated with the subnets in the spoke VNets, ensuring that any traffic destined for the internet is redirected to the firewall for inspection and policy enforcement.

Answer

Configure forced tunneling on the spoke VNet gateways.

Answer

Enable VNet peering to the hub VNet.

Answer

Apply an Azure Firewall policy that denies internet access for spoke VNets.

Question 7

You need to restrict access to a web app hosted on Azure App Service so that only traffic from a specific virtual network (VNet) is allowed. Which Azure service should you configure?

Accepted Answer

App Service access restrictions. App Service access restrictions allow you to define an allow/deny list of IP addresses or virtual network (VNet) sources directly at the App Service level. By configuring a VNet integration and a service endpoint or private endpoint, you can restrict inbound traffic to only originate from a specific VNet, without needing an additional network appliance.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Firewall

Question 8

You are troubleshooting connectivity issues from an Azure VM to an on-premises server. The VM is in a VNet that uses a custom DNS server. The on-premises network is connected via ExpressRoute. You can ping the on-premises server by IP address but not by name. What is the most likely cause?

Accepted Answer

The custom DNS server does not have a conditional forwarder to the on-premises DNS.. The custom DNS server in the Azure VNet is authoritative for the VNet's DNS resolution. When the VM tries to resolve the on-premises server's name, the custom DNS server does not know how to forward the query to the on-premises DNS infrastructure. A conditional forwarder must be configured on the custom DNS server to send queries for the on-premises domain to the on-premises DNS server, which is reachable via ExpressRoute. Without this forwarder, name resolution fails even though IP connectivity (ping) works.

Answer

The ExpressRoute circuit is not configured for DNS forwarding.

Answer

The Azure Private DNS zone does not include the on-premises hostname.

Answer

An NSG rule is blocking DNS traffic.

Question 9

You are designing a hub-spoke network topology in Azure. You need to ensure that all traffic between spokes is inspected by a network virtual appliance (NVA) deployed in the hub. What should you configure?

Accepted Answer

Create user-defined routes (UDRs) in each spoke pointing to the NVA's IP address.. To force all inter-spoke traffic through a network virtual appliance (NVA) in the hub, you must create user-defined routes (UDRs) in each spoke's subnet that direct traffic destined for other spoke address spaces to the NVA's private IP address. This overrides the default system route that would otherwise allow direct communication over VNet peering, ensuring the NVA inspects every packet.

Answer

Deploy Azure Firewall in the hub.

Answer

Configure VNet peering between all spokes.

Answer

Use a VPN gateway to route traffic through the hub.

Question 10

A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?

Accepted Answer

A default encryption scope is configured on the blob container that uses a Microsoft-managed key.. When a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.

Answer

The Key Vault is in a different Azure region than the storage account.

Answer

The storage account does not have a system-assigned managed identity enabled.

Answer

The customer-managed key in Key Vault is disabled or expired.

Question 11

A company has an on-premises web application that they want to expose to external users over the internet without requiring a VPN. External users must authenticate with Modern Authentication (e.g., using Azure Multi-Factor Authentication) and access policies must be enforced via Conditional Access. The application does not support SAML or OAuth. Which Azure service should they use to publish this application securely?

Accepted Answer

Azure AD Application Proxy.. Microsoft Entra application proxy is the correct choice because it allows publishing on-premises web applications to external users without requiring a VPN, supports Modern Authentication (including Azure MFA), and enforces Conditional Access policies. It works by installing a connector on-premises that proxies traffic through Microsoft Entra ID, enabling authentication and policy enforcement even for legacy applications that do not support SAML or OAuth.

Answer

Azure AD B2C (Business-to-Consumer).

Answer

Azure Application Gateway with Web Application Firewall (WAF).

Answer

Azure Front Door.

Question 12

You are troubleshooting connectivity between two Azure VMs in the same virtual network. VM1 can ping VM2, but VM1's application cannot connect to VM2's application on port 8080. Both VMs have NSGs that allow inbound traffic on port 8080. What is the most likely cause?

Accepted Answer

The guest OS firewall on VM2 is blocking inbound port 8080.. Since ICMP (ping) succeeds between the VMs, the network path is functional at Layer 3, and the NSGs are allowing traffic (as stated). The application failure on a specific port (8080) while ICMP works strongly indicates a host-level firewall blocking the TCP connection. The guest OS firewall (e.g., Windows Firewall or iptables) on VM2 is the most likely cause because it operates independently of Azure NSGs and can filter traffic by port and protocol, even when NSGs permit it.

Answer

The VNet is peered with another VNet that has a conflicting address space.

Answer

An Azure Load Balancer is directing traffic away from VM2.

Answer

The NSG on VM2's subnet has a deny rule for port 8080.

Question 13

You have an Azure SQL Database that stores financial data. You need to prevent unauthorized access by encrypting specific columns containing credit card numbers. The solution must allow authorized applications to query the data transparently. What should you implement?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it encrypts specific columns (e.g., credit card numbers) at the client-side, ensuring that the data remains encrypted both at rest and in transit, and only authorized applications with the column encryption key can decrypt and query the data transparently. This meets the requirement of preventing unauthorized access (including database administrators) while allowing transparent querying for authorized applications.

Answer

Azure Storage service encryption

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 14

Your organization needs to securely connect an on-premises data center to Azure for disaster recovery. The connection must be encrypted and use the public internet. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway.. Azure VPN Gateway is the correct choice because it provides encrypted site-to-site IPsec/IKE VPN tunnels over the public internet, enabling secure connectivity between an on-premises data center and Azure for disaster recovery. This meets the requirement for encryption and use of the public internet, as VPN Gateway leverages standard protocols like IKEv2 and IPsec to protect data in transit.

Answer

Azure Front Door.

Answer

Azure ExpressRoute with private peering.

Answer

Azure DNS.

Question 15

A company stores sensitive financial records in Azure Blob Storage. They want to ensure that if a blob is deleted or overwritten, it can be recovered within 30 days. They also want to protect against accidental deletion of the storage account itself. Which two configurations should they implement? (Choose two.)

Accepted Answer

Enable blob soft delete with a retention period of 30 days. Blob soft delete (Option A) protects individual blobs by retaining deleted or overwritten blobs for a specified retention period, allowing recovery within that window. Storage account soft delete (Option B) protects the entire storage account from accidental deletion by retaining the deleted account for a configurable period. Together, they address both the blob-level and account-level recovery requirements for the 30-day window.

Answer

Enable container soft delete with a retention period of 30 days

Answer

Enable blob versioning

Question 16

Your organization uses Azure Virtual Network Manager (AVNM) to manage network groups. You need to ensure that all virtual networks in a network group are automatically peered with a hub VNet. Which AVNM configuration should you use?

Accepted Answer

Create a connectivity configuration with Hub and Spoke topology. To automatically peer all virtual networks in a network group with a hub VNet, you need a connectivity configuration with Hub and Spoke topology. AVNM's connectivity configuration defines the network topology (e.g., hub-and-spoke or mesh) and automatically creates the necessary VNet peering connections between the hub and all spoke VNets in the assigned network group, without manual peering setup.

Answer

Create a network group and assign it to a connectivity configuration

Answer

Create a security admin configuration

Answer

Use Azure Policy to enforce peering

Question 17

You need to encrypt an Azure Storage account at rest using a customer-managed key stored in Azure Key Vault. Which feature should you enable?

Accepted Answer

Azure Storage Service Encryption with customer-managed keys. Azure Storage Service Encryption (SSE) encrypts data at rest automatically. By enabling customer-managed keys (CMK) in Azure Key Vault, you can control the encryption key used for SSE, meeting the requirement to encrypt the storage account with a key you manage.

Answer

Azure Information Protection

Answer

Azure Confidential Computing

Answer

Azure Disk Encryption

Question 18

You are a security engineer for Contoso. The company uses Azure Firewall for all inbound and outbound traffic. To prevent misconfiguration, you assign the Azure Policy shown in the exhibit at the management group scope. After assignment, a network administrator reports that they cannot create a new subnet in an existing virtual network. The subnet creation fails with a 'deny' policy error. You need to allow subnet creation while still blocking NSG rule changes. What should you do?

Accepted Answer

Modify the policy rule to remove the subnet condition from the anyOf array.. The policy rule uses an `anyOf` array that includes conditions for both NSG rule changes and subnet creation. By removing the subnet condition from the `anyOf` array, the policy will no longer evaluate subnet creation against the deny effect, allowing subnets to be created while still blocking NSG rule modifications. This directly addresses the administrator's issue without weakening the security posture for NSG changes.

Answer

Change the effect to 'audit' instead of 'deny'.

Answer

Add an exemption for the virtual network resource group.

Answer

Remove the policy assignment and create a custom role to block subnet creation.

Question 19

You have an Azure Storage account that contains sensitive documents. You need to generate a time-limited, secure URL that allows a specific user to download a file without requiring storage account keys. What should you use?

Accepted Answer

Shared Access Signature (SAS). A Shared Access Signature (SAS) is the correct choice because it provides delegated, time-limited access to a specific storage resource (e.g., a blob) without exposing the storage account keys. You can scope the SAS to a specific user by using a stored access policy or by generating a service SAS with fine-grained permissions, and you can enforce expiration and allowed IP ranges. This meets the requirement of a secure, time-bound URL for a single file download.

Answer

Azure Front Door custom domain

Answer

Storage account access key

Answer

Azure RBAC role assignment

Question 20

A Defender for Cloud recommendation is valid for most subscriptions but not for a legacy subscription with an approved exception. The team wants secure score to reflect the exception without disabling the recommendation everywhere. What should they do?

Accepted Answer

Create an exemption for the affected scope with a justification. Azure Policy exemptions allow you to exclude a specific scope (e.g., a subscription or resource group) from a policy or initiative effect while still having the policy enforced elsewhere. By creating an exemption for the legacy subscription with a justification, the Defender for Cloud recommendation remains active for all other subscriptions, and the secure score calculation will correctly reflect the exception without disabling the recommendation globally.

Answer

Delete the built-in initiative from the management group

Answer

Change the recommendation severity to Low

Answer

Disable Defender for Cloud on the legacy subscription