AZ-500 Practice Test 35 — 15 Questions

Question 1

A company uses Azure Kubernetes Service (AKS) with a private cluster. Developers need to access the Kubernetes API server from their on-premises workstations without exposing it to the internet. What is the most secure solution?

Accepted Answer

Deploy Azure Bastion in the AKS VNet and use a jump box VM to access the API server.. Option B is correct because Azure Bastion provides secure RDP/SSH access to VMs without public IPs, and can be used to access a jump box that can reach the API server. Option A is wrong because a VPN would expose the API server to the on-premises network. Option C is wrong because enabling a public endpoint defeats the private cluster purpose. Option D is wrong because Azure Front Door is for web applications.

Answer

Use Azure Front Door with Private Link to access the API server.

Answer

Enable the API server public endpoint and restrict access to the on-premises public IP.

Answer

Create a site-to-site VPN from on-premises to the AKS VNet and allow access from the on-premises IP range.

Question 2

You manage a multi-tier application in Azure with a web tier, application tier, and database tier. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure networking feature should you use to isolate the tiers?

Accepted Answer

Network security groups (NSGs) on each subnet.. Option A is correct because network security groups (NSGs) can be applied to subnets to control inbound and outbound traffic between tiers. The other options either don't provide isolation (VNet peering) or are not cost-effective (Azure Firewall for simple rules).

Answer

Virtual network peering between tiers.

Answer

Azure Firewall with application rules.

Answer

Application security groups (ASGs) within the same subnet.

Question 3

Your organization has a Microsoft Entra ID tenant and uses Azure Virtual Desktop (AVD). You need to ensure that AVD session hosts in a virtual network can access on-premises resources securely without exposing the session hosts to the internet. The on-premises network is connected to Azure via ExpressRoute. All AVD traffic should be routed through the ExpressRoute connection. You have already deployed a reverse connect transport for AVD. What else should you configure to meet the requirements?

Accepted Answer

Add a user-defined route (UDR) in the AVD subnet for the on-premises IP prefixes with next hop to the ExpressRoute gateway.. Option A is correct: For AVD reverse connect, the session hosts initiate outbound connections to the AVD service. To route this traffic through ExpressRoute, you need to enable forced tunneling so that all internet-bound traffic from the session hosts goes through the firewall or VPN gateway, but the requirement is to use ExpressRoute for on-premises access. For AVD, the session hosts need to connect to AVD service endpoints; if you force tunnel internet traffic, it breaks the AVD connection. However, the scenario states that the on-premises network is connected via ExpressRoute, and you need to ensure AVD session hosts can access on-premises resources. The correct approach is to ensure that the route table in the AVD subnet has a route to on-premises via ExpressRoute. Option A is correct because you need to add a UDR for the on-premises prefix with next hop as the ExpressRoute gateway. Option B is incorrect because peering doesn't route traffic. Option C is incorrect because disabling reverse connect would require inbound access. Option D is incorrect because AVD control plane is outside the virtual network.

Answer

Configure VNet peering between the AVD virtual network and the on-premises network.

Answer

Disable reverse connect transport and allow inbound RDP traffic from the internet.

Answer

Create a private endpoint for the AVD control plane.

Question 4

You have an Azure subscription with a virtual network (VNet1) that hosts a SQL Managed Instance. You need to connect from an on-premises application to the SQL Managed Instance using a private IP address, with minimal latency and without traversing the public internet. The on-premises network has a high-speed ExpressRoute connection to Microsoft. What should you configure?

Accepted Answer

Connect the on-premises network to Azure via ExpressRoute private peering and ensure the SQL Managed Instance subnet is reachable.. Option D is correct because SQL Managed Instance is deployed in a dedicated subnet and requires a private endpoint or direct connectivity. ExpressRoute with private peering is the best option for low latency and private connectivity.

Answer

Configure a public endpoint on the SQL Managed Instance and allow the on-premises public IP.

Answer

Use Azure Private Link Service and connect via a VPN.

Answer

Create a site-to-site VPN connection and enable forced tunneling.

Question 5

Your organization has deployed Azure Firewall in a hub-and-spoke network topology. You have configured forced tunneling so that all internet-bound traffic from the spoke virtual networks is routed through the Azure Firewall. Recently, a critical application in a spoke virtual network is experiencing intermittent connectivity failures to an external partner service. The partner service requires that traffic originate from a specific public IP address. You have configured Azure Firewall with a public IP address and have set up DNAT rules to allow inbound traffic. However, the outbound traffic from the application is still using the spoke's default outbound access via SNAT. You need to ensure that all outbound traffic from the application uses the Azure Firewall's public IP address. What should you do?

Accepted Answer

Add a user-defined route (UDR) on the application's subnet with 0.0.0.0/0 next hop to Azure Firewall.. Forced tunneling ensures that all internet-bound traffic is routed through the firewall. Option A is correct because a user-defined route (UDR) on the application's subnet with 0.0.0.0/0 next hop to Azure Firewall enforces that traffic goes through the firewall, thus using its public IP. Option B configures Azure Firewall as a next hop for the spoke gateway, which is not needed. Option C is not directly related to routing. Option D incorrectly suggests disabling SNAT, which would cause traffic to use the spoke's original IP, not the firewall's.

Answer

Disable SNAT on the Azure Firewall for the application's public IP range.

Answer

Modify the Azure Firewall policy to enable forced tunneling.

Answer

Configure Azure Firewall as a next hop for the virtual network gateway in the hub.

Question 6

You are a security architect for a global company. The company uses Azure Front Door to publish web applications. You need to ensure that only traffic from Azure Front Door's backend IP ranges can reach the origin servers. The origin servers are behind Azure Application Gateway. You have already configured Access Restrictions on the Application Gateway to allow only Azure Front Door's backend IP ranges. However, you discover that the Application Gateway is still receiving traffic from other sources. You need to implement a defense-in-depth approach to ensure only Azure Front Door traffic reaches the origin. What should you do?

Accepted Answer

Configure Azure Front Door Premium with Private Link origin to the Application Gateway.. Option A is correct: Private Link with Front Door Private Endpoint ensures traffic from Front Door to the origin goes over the Microsoft backbone and is not exposed to the internet. This, combined with Access Restrictions, provides defense-in-depth. Option B is incorrect because WAF does not restrict source IPs. Option C is incorrect because the origin is already behind Application Gateway, and adding NSG at the subnet does not prevent traffic from other sources that are allowed through Application Gateway. Option D is incorrect because geo-filtering does not restrict to Front Door IPs.

Answer

Enable Web Application Firewall (WAF) on the Application Gateway to block non-Front Door traffic.

Answer

Add a network security group (NSG) on the Application Gateway subnet to deny all traffic except from Front Door's IP ranges.

Answer

Use Azure Front Door geo-filtering to block all countries except the home country.

Question 7

Refer to the exhibit. You ran the PowerShell command shown. Which statement about the network interface is true?

Accepted Answer

The network interface is attached to a virtual machine that is not accessible from the internet.. The output shows an empty PublicIpAddress field and no application security groups or load balancer pools. The NIC is in subnet 'web' with private IP 10.0.1.4. It is not associated with a public IP.

Answer

The network interface is part of an availability set.

Answer

The network interface is associated with a public IP address.

Answer

The network interface is configured with application security groups.

Question 8

Your company has deployed Azure Kubernetes Service (AKS) in a virtual network. The AKS cluster needs to pull images from a private Azure Container Registry (ACR) that has a private endpoint configured. The virtual network where AKS is deployed is peered to the ACR's virtual network. You have configured the AKS cluster to use managed identity for authentication to ACR. However, the AKS cluster is unable to pull images from the ACR. You need to resolve the connectivity issue without exposing the ACR to the internet. What should you do?

Accepted Answer

Link the private DNS zone of the ACR private endpoint to the AKS virtual network.. Option A is correct: The AKS cluster needs a route to the ACR's private endpoint. Since the virtual networks are peered, the AKS cluster should be able to resolve the ACR's private endpoint DNS name to the private IP. However, by default, AKS might not use the custom DNS if it doesn't have the proper DNS configuration. The most common cause is that the private endpoint's private DNS zone is not linked to the AKS virtual network. Option A correctly links the private DNS zone to the AKS virtual network. Option B is incorrect because deleting the private endpoint would expose ACR to the internet. Option C is incorrect because the AKS cluster's DNS servers should be the Azure default unless custom. Option D is incorrect because the managed identity is already in use; the issue is network connectivity.

Answer

Update the AKS cluster's DNS server to use a custom DNS that can resolve the private endpoint.

Answer

Delete the private endpoint and configure ACR firewall rules to allow the AKS subnet.

Answer

Recreate the AKS cluster with a different managed identity that has ACR pull permissions.

Question 9

Your organization uses Azure Storage for sensitive customer data. You need to ensure that data at rest is encrypted using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, you want to automatically rotate the key every 90 days. What should you configure?

Accepted Answer

Enable Azure Storage encryption with a customer-managed key and configure a key rotation policy in Azure Key Vault.. Option A is correct because Azure Storage encryption with CMK supports automatic key rotation via Key Vault key rotation policy. Option B is wrong because SSE with platform-managed key cannot use CMK. Option C is wrong because Azure Disk Encryption is for VMs, not storage accounts. Option D is wrong because client-side encryption shifts responsibility to the client and does not leverage Azure Key Vault automatic rotation.

Answer

Enable Azure Disk Encryption on the storage account and store the key in Key Vault with rotation policy.

Answer

Enable server-side encryption with a platform-managed key and use Azure Policy to enforce rotation.

Answer

Use client-side encryption with .NET client library and implement custom rotation logic.

Question 10

You have an Azure SQL Database that stores financial data. You need to prevent unauthorized access by encrypting specific columns containing credit card numbers. The solution must allow authorized applications to query the data transparently. What should you implement?

Accepted Answer

Always Encrypted. Option D is correct because Always Encrypted encrypts sensitive columns and allows authorized applications to decrypt transparently using the client driver. Option A is wrong because TDE encrypts the entire database at rest but does not provide column-level granularity or transparent querying for applications. Option B is wrong because Dynamic Data Masking only masks data but does not encrypt it. Option C is wrong because Azure Storage encryption applies to Azure Storage, not SQL Database.

Answer

Azure Storage service encryption

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 11

You need to securely store secrets, such as connection strings and API keys, for use by an Azure Functions app. The solution must automatically rotate the secrets and audit access. What should you use?

Accepted Answer

Azure Key Vault. Option B is correct because Azure Key Vault is designed to store secrets securely, supports automatic rotation, and provides auditing. Option A is wrong because App Settings are not encrypted at rest by default and do not support rotation or auditing. Option C is wrong because Azure Storage is not optimized for secrets management. Option D is wrong because Managed Identities provide identity, not secret storage.

Answer

Azure Blob Storage with encryption

Answer

Managed Identity

Answer

Application settings in the function app configuration

Question 12

Your company runs a critical application on Azure Virtual Machines. You need to ensure that the OS disks and data disks are encrypted to meet compliance requirements. The solution must use Azure Key Vault to store encryption keys and support automated backup. What should you implement?

Accepted Answer

Azure Disk Encryption (ADE). Option C is correct because Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt disks and integrates with Azure Key Vault. Option A is wrong because Azure Storage Service Encryption encrypts data at rest in storage accounts, not VM disks. Option B is wrong because Azure Backup does not provide encryption itself. Option D is wrong because Azure Confidential Computing is a different technology for protecting data in use.

Answer

Azure Backup with encryption using platform-managed keys

Answer

Azure Confidential Computing

Answer

Azure Storage Service Encryption (SSE)

Question 13

You are designing a security solution for Azure Cosmos DB that stores Personally Identifiable Information (PII). You need to encrypt data at rest and in transit. You also need to implement row-level security to restrict access based on user role. What should you configure?

Accepted Answer

Encryption at rest is automatically enabled; enforce TLS for transit; implement row-level security via application code.. Option D is correct because Cosmos DB encryption at rest is enabled by default and enforced through the service, transport encryption uses TLS, and row-level security is implemented using user-defined functions or stored procedures in the application layer. Option A is wrong because Always Encrypted is for SQL Server. Option B is wrong because Azure Disk Encryption is for VMs. Option C is wrong because Dynamic Data Masking is for SQL Server.

Answer

Enable Azure Disk Encryption on the Cosmos DB account.

Answer

Enable Always Encrypted and configure column encryption.

Answer

Use Dynamic Data Masking to restrict sensitive data.

Question 14

You have an Azure Storage account that contains sensitive documents. You need to generate a time-limited, secure URL that allows a specific user to download a file without requiring storage account keys. What should you use?

Accepted Answer

Shared Access Signature (SAS). Option A is correct because a shared access signature (SAS) token provides delegated access with time-limited permissions. Option B is wrong because a storage account key grants full access and cannot be time-limited. Option C is wrong because Azure RBAC does not generate URLs. Option D is wrong because Azure Front Door is a global load balancer, not a mechanism for generating secure URLs.

Answer

Azure Front Door custom domain

Answer

Storage account access key

Answer

Azure RBAC role assignment

Question 15

Your organization is using Azure Database for MySQL. You need to ensure that only traffic from Azure services and specific client IP addresses can connect to the database. What should you configure?

Accepted Answer

Firewall rules with 'Allow access to Azure services' enabled and specific IP rules. Option C is correct because Azure Database for MySQL uses firewall rules to allow specific IP ranges and an option to allow Azure services. Option A is wrong because NSGs are for virtual networks, not Azure PaaS databases directly. Option B is wrong because Azure AD authentication is for identity, not network access. Option D is wrong because VNet service endpoints are a more complex configuration, and the question doesn't specify a VNet.

Answer

Azure Active Directory authentication

Answer

Virtual Network service endpoints

Answer

Network Security Group (NSG) rules on the subnet