AZ-500 Practice Test 28 — 15 Questions

Question 1

You are designing a secure network for an e-commerce application in Azure. The application consists of web servers, application servers, and database servers. You need to ensure that inbound traffic is filtered at multiple layers. Which THREE Azure services should you use to implement defense in depth for network security?

Accepted Answer

Azure Application Gateway with WAF policy. Option A is correct because Azure Front Door with WAF provides application-layer filtering at the edge. Option B is correct because Azure Application Gateway with WAF provides application-layer filtering before traffic reaches the web servers. Option C is correct because Network Security Groups (NSGs) provide network-layer filtering between tiers. Option D is wrong because Azure Bastion is for management access, not traffic filtering. Option E is wrong because Azure DNS is for name resolution.

Answer

Azure Bastion

Answer

Azure DNS

Question 2

You are designing a network security strategy for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure solution should you use to isolate the tiers?

Accepted Answer

Network security groups (NSGs) on each subnet. Network security groups (NSGs) applied to subnets can control traffic between tiers by allowing only inbound traffic from the web tier subnet to the application tier subnet, and similarly between app and DB tiers. This provides network segmentation.

Answer

Azure DDoS Protection

Answer

Azure Firewall with application rules

Answer

Azure Private Link

Question 3

Refer to the exhibit. You are reviewing an Azure Firewall policy rule. The rule is intended to allow traffic from the 10.0.0.0/16 network to *.contoso.com on HTTPS. However, the rule is not working as expected. What is the most likely issue?

Accepted Answer

Application rules cannot have both targetFqdns and destinationAddresses; destinationAddresses should be removed.. In Azure Firewall application rules, the destinationAddresses field is typically used for network rules; for application rules, the destination is specified by FQDN. However, specifying both targetFqdns and destinationAddresses in an application rule is invalid because application rules use FQDNs, not IP addresses. The presence of destinationAddresses may cause the rule to be misconfigured or ignored.

Answer

The source address range is too broad and should be more specific.

Answer

The protocol should be Http, not Https.

Answer

The rule should be a network rule, not an application rule.

Question 4

Your organization has multiple Azure subscriptions connected via a hub-spoke topology using Azure Firewall in the hub. You need to ensure that traffic between spoke VNets is routed through the firewall for inspection. You configure user-defined routes (UDRs) on the spoke subnets. However, traffic between spokes is still bypassing the firewall. What is the most likely reason?

Accepted Answer

The 'Use remote gateway' setting is disabled on the spoke VNet peering.. Option D is correct because for VNet peering, the 'Use remote gateway' setting on the spoke peering must be enabled to route traffic through the hub firewall. Without this, peered traffic may bypass the firewall. Option A is wrong because Azure Firewall can handle traffic between spokes. Option B is wrong because 'Allow gateway transit' is needed on the hub side. Option C is wrong because the firewall subnet does not need a UDR for spoke-to-spoke traffic; the spokes' UDRs point to the firewall's private IP.

Answer

Azure Firewall does not support traffic between spoke VNets.

Answer

The UDR on the firewall subnet does not include the spoke address spaces.

Answer

The 'Allow gateway transit' setting is disabled on the spoke peering.

Question 5

You need to securely connect an on-premises network to an Azure virtual network. The connection must use the internet and provide authenticated and encrypted communication. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway provides site-to-site VPN connections over the internet with IPsec/IKE encryption, meeting the requirements for authenticated and encrypted communication.

Answer

Azure ExpressRoute

Answer

Azure Application Gateway

Answer

Azure Virtual WAN

Question 6

A company plans to use Azure Private Endpoint to securely connect to an Azure SQL Database from an on-premises network via ExpressRoute. The private endpoint is deployed in a hub virtual network. The on-premises network is connected to the hub via ExpressRoute. What additional configuration is needed to ensure on-premises clients can resolve the private endpoint's DNS name?

Accepted Answer

Configure a DNS forwarder on-premises to forward the private link domain to Azure DNS.. Private endpoints require DNS configuration to resolve the private IP address. Azure Private DNS zones can be linked to the hub VNet, and on-premises DNS servers must forward queries for the private endpoint's domain (e.g., privatelink.database.windows.net) to Azure or use a custom DNS server that resolves the private IP.

Answer

Configure a network security group to allow inbound traffic from on-premises to the private endpoint.

Answer

Deploy a VPN gateway in the hub VNet for additional encryption.

Answer

Add a public DNS record for the SQL Database pointing to the private endpoint IP.

Question 7

Which THREE components are required to implement Azure Virtual WAN with secured virtual hub? (Choose three.)

Accepted Answer

Azure Firewall deployed in the virtual hub. Azure Virtual WAN secured hub includes a virtual hub, Azure Firewall (for security), and VPN gateway (for connectivity). A Network Virtual Appliance (NVA) is not required as Azure Firewall is the native security service. ExpressRoute gateway is optional and not required for baseline secured hub.

Answer

ExpressRoute gateway in the virtual hub

Answer

Network Virtual Appliance (NVA)

Question 8

You need to block outbound internet access from all VMs in a VNet except for specific allowed destinations (e.g., Microsoft updates). You cannot use a third-party NVA. Which Azure service should you use to meet this requirement?

Accepted Answer

Azure Firewall. Azure Firewall can inspect and control outbound traffic with application rules (FQDN-based) and network rules. You can allow specific destinations and deny all else. Azure Firewall is a managed, cloud-native service that fits the requirement.

Answer

Azure Bastion

Answer

Network Security Groups (NSGs)

Answer

Azure Virtual Network NAT

Question 9

You have an Azure Application Gateway v2 with WAF policy in prevention mode to protect a web app. Users report that legitimate requests are being blocked. You review the WAF logs and see many false positives. You need to resolve this while maintaining security. What should you do?

Accepted Answer

Use managed rule sets with custom rules to allow the legitimate traffic that is being falsely blocked.. Option D is correct because using managed rule sets with custom rules to allow legitimate traffic is the best practice. Option A is wrong because disabling the WAF removes protection. Option B is wrong because detection mode only logs, not blocks, which may be a temporary solution but does not fine-tune rules. Option C is wrong because creating custom rules to block all requests is too restrictive.

Answer

Add a custom rule to block all requests that do not match a known pattern.

Answer

Disable the WAF and rely on NSGs.

Answer

Switch the WAF policy to detection mode.

Question 10

You are designing a network security solution for a multi-tier application running in Azure. The front-end VMs must only accept traffic from Azure Front Door. Back-end VMs must only accept traffic from the front-end tier. You plan to use NSGs and ASGs. Which configuration should you use to meet these requirements with minimal administrative overhead?

Accepted Answer

Place front-end VMs in an ASG, back-end VMs in another ASG. Configure NSG rules referencing these ASGs.. Option C is correct because using Application Security Groups (ASGs) allows you to define network security policies based on application groups, and you can reference an ASG as the source or destination in NSG rules. By placing front-end VMs in an ASG and back-end VMs in another ASG, you can create NSG rules that restrict traffic accordingly. Option A is wrong because using individual VM IP addresses is not scalable. Option B is wrong because service tags for Azure Front Door exist, but they don't cover front-end VMs. Option D is wrong because VNet peering alone does not provide traffic filtering.

Answer

Create NSG rules that allow traffic from the Front Door service tag and from the front-end VM IP addresses.

Answer

Use service tags for Azure Front Door and for the front-end subnet.

Answer

Use VNet peering between the front-end and back-end subnets, and configure route tables.

Question 11

You need to monitor network traffic to detect anomalies and potential security threats. Which THREE Azure services can you use to achieve this? (Choose three.)

Accepted Answer

Microsoft Sentinel. Options A, B, and D are correct. Network Watcher provides traffic capture and flow logs. Azure Sentinel (now Microsoft Sentinel) can ingest network logs for threat detection. Azure Firewall logs can be used for monitoring. Option C is wrong because Azure Policy is for compliance, not monitoring. Option E is wrong because Azure Monitor Metrics can monitor performance, not network traffic anomalies.

Answer

Azure Monitor Metrics

Answer

Azure Policy

Question 12

You have an Azure application that uses a private endpoint for Azure SQL Database. Users report intermittent connectivity failures. You need to diagnose whether the private endpoint DNS resolution is working correctly. Which tool should you use?

Accepted Answer

nslookup. Option B is correct because nslookup queries DNS servers and can verify if the private endpoint FQDN resolves to a private IP. Option A is wrong because ping tests ICMP, which may be blocked. Option C is wrong because tracert shows the route but not DNS. Option D is wrong because netstat shows active connections, not resolution.

Answer

tracert

Answer

netstat

Answer

ping

Question 13

A company uses Azure Firewall to inspect traffic between a spoke VNet hosting a web application and a hub VNet hosting a SQL database. The web application fails to connect to the database after a recent network topology change. You verify that the Azure Firewall rules allow the traffic. Which Azure Network Watcher feature should you use to identify the root cause?

Accepted Answer

IP flow verify. IP flow verify checks if a packet is allowed or denied to/from a VM based on security rules. Since firewall rules are correct, the issue might be other security rules (NSGs, ASGs) or routing. IP flow verify can test connectivity end-to-end, highlighting where the packet is dropped.

Answer

Connection troubleshoot

Answer

Next hop

Answer

Network Performance Monitor

Question 14

Your company uses ExpressRoute to connect on-premises to Azure. You need to ensure that only traffic from the on-premises network can reach a specific Azure App Service, and all other internet traffic to that App Service must be blocked. You also want to avoid exposing the App Service's public endpoint. Which THREE actions should you take?

Accepted Answer

Configure the App Service with a Private Endpoint.. To restrict access to only on-premises traffic without using the public endpoint, you can use an App Service Environment (ASE) with an internal load balancer, or use Private Endpoint. The combination of Private Endpoint, disabling public access, and restricting access to the ExpressRoute gateway IP range ensures only on-premises traffic can reach the app via Private Link.

Answer

Configure an IP restriction on the App Service to allow only the on-premises public IP range.

Answer

Configure a Service Endpoint for App Service on the on-premises-connected subnet.

Answer

Upload a trusted root certificate to App Service to enforce client certificate authentication for on-premises clients.

Question 15

Which THREE benefits does Azure DDoS Protection Standard provide over Basic?

Accepted Answer

Adaptive tuning based on application traffic patterns.. Options A, C, and D are correct. DDoS Protection Standard provides adaptive tuning, cost protection, and access to DDoS Rapid Response. Option B is wrong because always-on monitoring is a Basic feature. Option E is wrong because both tiers use Azure's global network capacity.

Answer

Always-on monitoring and mitigation of layer 3/4 attacks.

Answer

Mitigation of attacks using Azure's global network capacity.