AZ-500 Practice Test 29 — 15 Questions

Question 1

You are designing a network security strategy for an Azure Kubernetes Service (AKS) cluster. You need to restrict egress traffic from the cluster to only allow connections to specific Azure services (e.g., Microsoft Container Registry, Azure Key Vault). The solution must minimize administrative overhead. What should you use?

Accepted Answer

Deploy Azure Firewall and use FQDN tags to allow traffic to Azure services.. Option D is correct because Azure Firewall with FQDN tags can allow traffic to Azure services by tag, simplifying management. Option A is wrong because NSGs do not support allowlisting by FQDN. Option B is wrong because AKS does not natively support network policies for egress to Azure services. Option C is wrong because Azure Policy can audit but not enforce egress rules.

Answer

Configure Azure Policy to deny egress to non-approved destinations.

Answer

Use Kubernetes network policies for egress.

Answer

Define NSG rules to allow outbound traffic to the service IP ranges.

Question 2

Your company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. You need to ensure that all outbound traffic from spoke VMs to the internet is routed through the Azure Firewall. What should you configure on the spoke virtual networks?

Accepted Answer

Create a route table with a route for 0.0.0.0/0 pointing to the Azure Firewall private IP, and associate it with the spoke subnets. Option C is correct because adding a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall as the next hop forces all outbound traffic through the firewall. Option A is wrong because VNet peering does not automatically route internet traffic through a firewall. Option B is wrong because NSGs can control inbound/outbound rules but cannot route traffic. Option D is wrong because the firewall itself doesn't need a route table change.

Answer

Apply a network security group (NSG) to the spoke subnets with a deny rule for internet traffic

Answer

Configure VNet peering with 'Use remote gateway' enabled

Answer

Configure the Azure Firewall to use forced tunneling

Question 3

Your organization is deploying a multi-region application using Azure Front Door to distribute traffic. You need to ensure that only traffic from Azure Front Door can reach the backend origins (App Services) and that no direct internet traffic bypasses Front Door. What combination of steps should you take?

Accepted Answer

Configure App Service Access Restrictions to allow only the Azure Front Door backend IP ranges and validate the X-Azure-FDID header.. Azure Front Door uses a set of backend IP ranges. By configuring Access Restrictions on App Service to allow only those IP ranges and enabling the 'X-Azure-FDID' header check, you ensure only Front Door traffic is accepted. Disabling public access entirely would break Front Door's ability to reach the backend.

Answer

Configure App Service Access Restrictions to deny all public traffic and enable Azure Front Door private link.

Answer

Configure Azure Front Door to use a custom domain and enable Azure WAF on Front Door.

Answer

Configure App Service Access Restrictions to allow only the 'AzureFrontDoor.Backend' service tag.

Question 4

You are configuring Azure DDoS Network Protection for your VNet. Which TWO benefits does enabling DDoS Protection Standard provide?

Accepted Answer

Adaptive tuning to baseline traffic patterns.. DDoS Protection Standard provides adaptive tuning based on traffic patterns and cost protection against scaled attacks. It does not offer a WAF (that's separate) nor does it monitor application-layer vulnerabilities; it focuses on network-layer DDoS attacks.

Answer

Integration with Azure Firewall for packet inspection.

Answer

Application-layer (Layer 7) protection via integrated WAF.

Answer

Vulnerability scanning for web applications.

Question 5

Which TWO actions can be taken using Azure Network Watcher?

Accepted Answer

Diagnose whether a security rule is blocking traffic to a VM.. Options A and D are correct. Network Watcher provides IP flow verify and next hop. Option B is wrong because configuring Azure Firewall rules is done via Firewall Manager. Option C is wrong because WAF policies are configured separately. Option E is wrong because private endpoints are created via Private Link Center.

Answer

Create and manage private endpoints.

Answer

Configure WAF policies on Application Gateway.

Answer

Configure Azure Firewall rules.

Question 6

You need to provide secure remote access to Azure virtual machines for developers without exposing public IP addresses. The solution must authenticate users via Microsoft Entra ID and support multifactor authentication. Which service should you use?

Accepted Answer

Azure Bastion. Option A is correct because Azure Bastion provides secure RDP/SSH access to VMs over TLS, with Microsoft Entra ID authentication and MFA support. Option B is wrong because Azure Front Door is a global load balancer. Option C is wrong because VPN Gateway requires public IPs and client VPN software. Option D is wrong because Azure Firewall does not provide remote access to VMs.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure Firewall

Question 7

You are designing a secure network architecture for a three-tier application. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. Which Azure service should you use to isolate the tiers most securely?

Accepted Answer

Network security groups (NSGs) on subnets. Option A is correct because NSGs with subnet-level rules can restrict traffic between tiers. Option B is wrong because Azure Firewall is a centralized firewall, but for simple tier isolation, NSGs are more appropriate and cost-effective. Option C is wrong because VNet peering connects networks, not isolates tiers. Option D is wrong because Azure Front Door is for global load balancing, not tier isolation.

Answer

Azure Firewall with application rules

Answer

Azure Front Door with Web Application Firewall

Answer

VNet peering between tiers

Question 8

Which TWO Azure services can be used to filter inbound internet traffic to a virtual network? (Choose two.)

Accepted Answer

Azure Firewall. Options A and C are correct. NSGs filter traffic at the subnet/NIC level. Azure Firewall provides centralized filtering. Option B is wrong because Azure Front Door is a global load balancer. Option D is wrong because VPN gateway encrypts traffic but does not filter. Option E is wrong because Azure Bastion is a jump server.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

VPN gateway

Question 9

You need to monitor and log network traffic between Azure VMs for security analysis. Which THREE components should you enable?

Accepted Answer

Azure Monitor Logs (Log Analytics workspace). Option A is correct because NSG flow logs capture IP traffic. Option C is correct because Traffic Analytics provides insights from flow logs. Option E is correct because Azure Monitor Logs stores and queries the logs. Option B is wrong because Azure Firewall logs are for firewall traffic, not VM-to-VM. Option D is wrong because VNet flow logs are not a separate feature; NSG flow logs are used.

Answer

Azure Firewall logs

Answer

VNet flow logs

Question 10

You are designing a hub-spoke network topology in Azure. The hub VNet contains Azure Firewall and a VPN gateway. Spoke VNets need to communicate with each other and with on-premises network through the hub. Which peering configuration is required to allow spoke-to-spoke communication via the hub?

Accepted Answer

Enable 'Allow gateway transit' on the hub-to-spoke peering and configure spoke subnets with a default route pointing to the Azure Firewall private IP.. To allow spoke-to-spoke communication through the hub, you need to enable 'Use remote gateway' on spoke VNet peering (to use the hub's VPN gateway) and 'Allow gateway transit' on hub VNet peering. Additionally, you need to configure routes in the spoke subnets to send traffic to the hub firewall.

Answer

Configure spoke VNets with a route table that has a default route to the hub VNet IP address.

Answer

Enable 'Use remote gateway' on the spoke-to-hub peering and 'Allow gateway transit' on the hub-to-spoke peering.

Answer

Enable 'Use remote gateway' on the hub-to-spoke peering and configure spoke subnets with a default route pointing to the hub VPN gateway.

Question 11

You are designing network security for a multi-tier application deployed in Azure. The application consists of a front-end web tier, a middle-tier API, and a back-end database. All tiers must be isolated from the internet except the front-end, which must accept HTTPS traffic from the internet. You need to ensure that no traffic can bypass the network security controls. What should you implement?

Accepted Answer

Deploy Azure Firewall in a hub virtual network and route all traffic between tiers through the firewall for inspection.. Option D is correct because Azure Firewall provides centralized network traffic filtering and can inspect traffic between tiers, while NSGs are for subnet/NIC-level filtering. Option A is wrong because NSGs alone cannot inspect east-west traffic if rules are misconfigured. Option B is wrong because Application Gateway is for inbound HTTP/S, not for filtering east-west traffic. Option C is wrong because Azure Front Door is for global load balancing, not internal traffic filtering.

Answer

Place all tiers in the same virtual network and use Azure Front Door with WAF for the web tier, and rely on NSGs for internal traffic.

Answer

Deploy Network Security Groups (NSGs) on each subnet and allow only necessary traffic between tiers.

Answer

Use Azure Application Gateway with Web Application Firewall (WAF) in front of the web tier, and use NSGs for the other tiers.

Question 12

You need to design a network security solution for a hub-spoke topology. The hub contains Azure Firewall and Azure Bastion. Spoke VNets contain application workloads. You need to ensure that all traffic from the spokes to the internet is routed through the Azure Firewall. What should you configure?

Accepted Answer

Add a user-defined route (UDR) on the spoke subnets with 0.0.0.0/0 next hop to the Azure Firewall private IP.. Option B is correct because user-defined routes (UDRs) with 0.0.0.0/0 next hop to the firewall force traffic to the firewall. Option A is wrong because Azure Firewall Manager can propagate routes but the spoke must have a route. Option C is wrong because BGP is for dynamic routing, not for forced tunneling. Option D is wrong because service endpoints do not route through the firewall.

Answer

Use service endpoints for internet-bound traffic.

Answer

Enable BGP on the spoke VNets and advertise a default route from the hub.

Answer

Configure the Azure Firewall to have a default route to the internet.

Question 13

You have an Azure subscription with multiple VNets connected via VNet peering. You need to ensure that traffic between VNets is encrypted. What should you do?

Accepted Answer

No additional configuration is needed; VNet peering traffic is encrypted by default.. Option C is correct because VNet peering traffic over the Microsoft backbone is encrypted by default using MACsec. Option A is wrong because VPN gateways are not needed for VNet peering. Option B is wrong because NSGs do not encrypt traffic. Option D is wrong because Azure Firewall does not encrypt traffic between VNets.

Answer

Configure Azure Firewall to enforce encryption.

Answer

Apply NSGs to block unencrypted traffic.

Answer

Deploy a VPN gateway in each VNet and configure site-to-site VPN connections.

Question 14

Your company has multiple Azure subscriptions managed through Azure Firewall Manager. You need to deploy Azure Firewall policies that apply to all subscriptions in a region. What is the most efficient way to manage this?

Accepted Answer

Use Azure Firewall Manager to create a parent policy and assign it to all firewalls. Option D is correct because Azure Firewall Manager allows creating policy-based firewalls that can be applied across multiple subscriptions. Option A is wrong because each firewall has its own policy; you would need to duplicate. Option B is wrong because Azure Policy can enforce compliance but not directly manage firewall rules. Option C is wrong because NSGs are per-subnet, not cross-subscription.

Answer

Create a separate firewall policy for each subscription

Answer

Use Azure Policy to enforce firewall rules across subscriptions

Answer

Deploy a single network security group (NSG) to all VNets

Question 15

Refer to the exhibit. The JSON snippet shows a network rule from an Azure Firewall policy. You have a subnet with IP range 10.0.1.0/24 that needs to connect to Azure SQL Database in Southeast Asia. However, connections are failing. What is the most likely reason?

Accepted Answer

Network rules do not support service tags as destination addresses. Option A is correct because the destination address 'AzureCloud.southeastasia' is a service tag, but Azure Firewall network rules require an IP address or CIDR, not service tags. Service tags are only supported in application rules (FQDN filtering) or when using Azure Firewall Premium with IDPS. Option B is wrong because the protocol TCP is correct for SQL. Option C is wrong because the port 1433 is correct. Option D is wrong because the priority 100 is fine.

Answer

The protocol should be UDP instead of TCP

Answer

The destination port should be 1434 instead of 1433

Answer

The rule priority is too low and may be overridden