AZ-500 Secure networking Practice Test 10 — 15 Questions

Question 1

You are designing a secure network for a three-tier application. The web tier must be accessible from the internet on port 443. The application tier should only be reachable from the web tier. The database tier should only be reachable from the application tier. Which Azure service should you use to enforce these restrictions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network security groups (NSGs) on each subnet.. Network security groups (NSGs) allow you to define inbound and outbound security rules at the subnet or NIC level. By placing each tier in its own subnet and applying NSG rules, you can restrict traffic so that only the web tier (port 443) is exposed to the internet, the application tier accepts traffic only from the web tier subnet, and the database tier accepts traffic only from the application tier subnet. This provides granular, stateful filtering that directly enforces the required east-west and north-south restrictions.

Answer

Azure VPN Gateway.

Answer

Azure Front Door.

Answer

Azure Firewall in the hub.

Question 2

A company uses Azure Virtual WAN with secured virtual hubs. The security team wants to ensure that all traffic from branch offices to Azure resources is inspected by the Azure Firewall in the secured hub. What configuration is needed?

Accepted Answer

Enable 'Inter-hub' and 'Branch-to-branch' traffic routing in the Virtual WAN settings.. In Azure Virtual WAN, enabling 'Inter-hub' and 'Branch-to-branch' routing ensures that all branch-to-branch and branch-to-VNet traffic is routed through the secured virtual hub, where Azure Firewall inspects it. This setting forces traffic to flow via the hub's default route (0.0.0.0/0) propagated to branches and spokes, ensuring inspection without requiring manual UDRs or forced tunneling.

Answer

Add user-defined routes in each spoke pointing to the Azure Firewall.

Answer

Configure forced tunneling on the branch VPN devices to send all traffic to the hub.

Answer

Create a firewall policy in Azure Firewall Manager and associate it with the virtual hub.

Question 3

You are troubleshooting connectivity between two Azure VMs in the same virtual network. VM1 can ping VM2, but VM1's application cannot connect to VM2's application on port 8080. Both VMs have NSGs that allow inbound traffic on port 8080. What is the most likely cause?

Accepted Answer

The guest OS firewall on VM2 is blocking inbound port 8080.. Since ICMP (ping) succeeds between the VMs, the network path is functional at Layer 3, and the NSGs are allowing traffic (as stated). The application failure on a specific port (8080) while ICMP works strongly indicates a host-level firewall blocking the TCP connection. The guest OS firewall (e.g., Windows Firewall or iptables) on VM2 is the most likely cause because it operates independently of Azure NSGs and can filter traffic by port and protocol, even when NSGs permit it.

Answer

The VNet is peered with another VNet that has a conflicting address space.

Answer

An Azure Load Balancer is directing traffic away from VM2.

Answer

The NSG on VM2's subnet has a deny rule for port 8080.

Question 4

Your organization needs to securely connect an on-premises data center to Azure for disaster recovery. The connection must be encrypted and use the public internet. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway.. Azure VPN Gateway is the correct choice because it provides encrypted site-to-site IPsec/IKE VPN tunnels over the public internet, enabling secure connectivity between an on-premises data center and Azure for disaster recovery. This meets the requirement for encryption and use of the public internet, as VPN Gateway leverages standard protocols like IKEv2 and IPsec to protect data in transit.

Answer

Azure Front Door.

Answer

Azure ExpressRoute with private peering.

Answer

Azure DNS.

Question 5

You manage multiple Azure subscriptions with VNets that need to communicate with each other. You want to centrally manage and enforce security policies across all VNets. Which Azure service should you use?

Accepted Answer

Azure Firewall Manager.. Azure Firewall Manager is the correct choice because it provides a centralized platform to manage and enforce security policies across multiple Azure subscriptions and VNets. It enables you to create, apply, and monitor firewall policies (including network and application rules) globally, ensuring consistent security posture for all VNets in a hub-and-spoke topology.

Answer

Azure Network Watcher.

Answer

Azure Policy.

Answer

Azure Blueprints.

Question 6

A company uses Azure Kubernetes Service (AKS) with a private cluster. Developers need to access the Kubernetes API server from their on-premises workstations without exposing it to the internet. What is the most secure solution?

Accepted Answer

Deploy Azure Bastion in the AKS VNet and use a jump box VM to access the API server.. Azure Bastion provides secure RDP/SSH access to VMs without public IPs, and can be used to access a jump box that can reach the API server. Option A is wrong because Azure Front Door with Private Link is designed for web applications, not for direct Kubernetes API access. Option B is wrong because enabling the public endpoint defeats the purpose of a private cluster, even with IP restrictions. Option D is wrong because a site-to-site VPN would expose the API server to the on-premises network, reducing security compared to using a jump box via Bastion.

Answer

Use Azure Front Door with Private Link to access the API server.

Answer

Enable the API server public endpoint and restrict access to the on-premises public IP.

Answer

Create a site-to-site VPN from on-premises to the AKS VNet and allow access from the on-premises IP range.

Question 7

You need to allow inbound HTTP traffic from the internet to a specific VM in a VNet. The VM is in a subnet with an NSG. What is the correct way to configure access?

Accepted Answer

Add an inbound security rule in the NSG to allow HTTP traffic.. Network Security Groups (NSGs) operate at the subnet or NIC level and act as a stateful firewall for traffic entering or leaving Azure resources. To allow inbound HTTP (TCP port 80) traffic from the internet to a specific VM, you must add an inbound security rule to the NSG associated with the VM's subnet or NIC, specifying the source as 'Internet', destination port 80, and protocol TCP. This is the direct and correct method for controlling traffic to a VM within a VNet.

Answer

Add a rule in Azure Firewall to allow HTTP traffic to the VM.

Answer

Enable Azure DDoS Protection on the VNet.

Answer

Configure Azure Traffic Manager to route traffic to the VM.

Question 8

Which TWO actions should you take to secure a virtual network in Azure? (Choose two.)

Accepted Answer

Apply network security groups (NSGs) to subnets.. Network security groups (NSGs) are a fundamental Azure security control that filter traffic at the subnet or network interface level. Applying an NSG to a subnet allows you to define inbound and outbound security rules based on source/destination IP, port, and protocol, effectively segmenting and protecting the virtual network from unauthorized access.

Answer

Configure Azure DNS zones.

Answer

Deploy Azure Bastion for VM access.

Answer

Set up Azure Monitor alerts.

Question 9

Which TWO components are required to implement a secure hybrid network that connects on-premises to Azure using ExpressRoute? (Choose two.)

Accepted Answer

Virtual network gateway in Azure.. A virtual network gateway in Azure and an ExpressRoute circuit are the only required components to establish a secure hybrid network using ExpressRoute. The virtual network gateway serves as the termination point for the ExpressRoute circuit in Azure, enabling routing between on-premises and Azure virtual networks. The ExpressRoute circuit provides the dedicated private connection. The Azure VPN Gateway is optional and used for failover, but not a required component for ExpressRoute itself.

Answer

Azure Firewall.

Answer

Azure VPN Gateway for failover.

Answer

Azure Front Door.

Question 10

Which TWO services can be used to filter traffic between virtual networks in Azure? (Choose two.)

Accepted Answer

Azure Firewall.. Azure Firewall is a managed, cloud-based network security service that can filter both inbound and outbound traffic between virtual networks (VNets) using stateful inspection, application rules, and network rules. It can be deployed in a hub VNet and enforce traffic filtering between spoke VNets via forced tunneling or routing, making it a correct choice for filtering inter-VNet traffic.

Answer

Azure Front Door.

Answer

Azure VPN Gateway.

Answer

Azure Traffic Manager.

Question 11

Your organization has deployed a multi-region web application using Azure Front Door with WAF policies. The backend origins are Azure App Services in two regions. Recently, a security audit revealed that the WAF is not blocking certain SQL injection attacks. You have identified that the WAF policy is configured in 'Detection' mode instead of 'Prevention' mode. However, the application team is concerned that changing to 'Prevention' mode might block legitimate traffic. You need to switch to 'Prevention' mode while minimizing false positives. Additionally, you want to ensure that any blocked requests are logged for analysis. What should you do?

Accepted Answer

Create a custom WAF policy with SQL injection rules in Prevention mode, and enable diagnostic logs.. Creating a custom WAF policy with SQL injection rules in Prevention mode allows for fine-tuning of rules to minimize false positives, and enabling diagnostic logs ensures blocked requests are logged for analysis. Option A is incorrect because simply switching to Prevention mode without custom rules may block legitimate traffic, and enabling logging alone does not address the false positive concern. Option B is incorrect because Bot Protection rule set is designed for bot mitigation, not SQL injection attacks. Option C is incorrect because rate limiting helps against DDoS but does not prevent SQL injection attacks.

Answer

Change the WAF policy to Prevention mode and enable logging.

Answer

Use the WAF policy's Bot Protection rule set and Prevention mode.

Answer

Enable rate limiting in the WAF policy and switch to Prevention mode.

Question 12

Your on-premises network is connected to Azure via a Site-to-Site VPN. You have a production virtual network (VNet1) and a development VNet (VNet2) in the same region. VNet1 has a network virtual appliance (NVA) from the Azure Marketplace. You need to ensure that traffic from VNet2 to an on-premises server is inspected by the NVA in VNet1. Which routing configuration should you implement?

Accepted Answer

Add a user-defined route (UDR) to the gateway subnet of VNet2 with destination 0.0.0.0/0 and next hop set to the private IP of the NVA in VNet1.. To route traffic from VNet2 to on-premises through the NVA in VNet1, you must first ensure VNet1 and VNet2 are peered, and configure the peering so VNet2 can use VNet1's VPN gateway (gateway transit on VNet1, use remote gateways on VNet2). Then create a UDR on each workload subnet in VNet2 (not the gateway subnet) with the on-premises IP prefix as the destination and the private IP of the NVA as the next hop. The NVA must have IP forwarding enabled and a route to the VPN gateway. Option A's use of the gateway subnet and 0.0.0.0/0 is wrong; none of the listed options are fully correct.

Answer

Configure Azure Route Server on VNet1 and enable VNet peering between VNet1 and VNet2.

Answer

Create a forced tunneling configuration on the VPN gateway to send all traffic to the NVA.

Answer

Peer VNet1 and VNet2 and use Azure Firewall in VNet1 as the next hop for all traffic.

Question 13

You have an Azure subscription with multiple virtual networks. You need to centrally manage and enforce security policies for all outbound traffic from virtual machines to the internet. The solution must be able to inspect traffic and log all connections. What should you deploy?

Accepted Answer

Azure Firewall in a hub virtual network.. Azure Firewall is a managed, cloud-native network security service that provides centralized outbound traffic inspection and logging. It can be deployed in a hub virtual network to enforce security policies across all spoke VMs, inspecting all outbound connections using application (FQDN) and network (IP/port) rules, and logging all traffic to Azure Monitor or Storage. This meets the requirements for central management, traffic inspection, and full connection logging.

Answer

Network security groups (NSGs) on all subnets.

Answer

Azure Application Gateway with WAF.

Answer

Azure VPN Gateway with forced tunneling.

Question 14

Your company has a hub-and-spoke network topology in Azure. The hub contains an Azure Firewall, and spokes are peered to the hub. You need to ensure that all traffic from spoke virtual machines to the internet goes through the Azure Firewall. You configured the firewall as a next hop in user-defined routes (UDRs) on the spoke subnets. However, some traffic is bypassing the firewall. What is the most likely cause?

Accepted Answer

The spokes are using service endpoints that bypass the firewall.. Service endpoints add system routes for the Azure service's IP range that are more specific than the 0.0.0.0/0 route to the Azure Firewall, so traffic to services like Storage or SQL bypasses the firewall. The setting in option C is not a standard Azure VNet setting.

Answer

The Azure Firewall is not in the same region as the spokes.

Answer

The Azure Firewall is not in the same subscription.

Answer

The 'PrivateLink to bypass Azure Firewall' setting is enabled in the spoke virtual network.

Question 15

You need to provide secure remote access to Azure virtual machines for administrators without exposing them to the public internet. The solution must use a single entry point and support Azure Active Directory (now Microsoft Entra ID) authentication. Which Azure service should you use?

Accepted Answer

Azure Bastion.. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing public IP addresses. It uses a single entry point (the Bastion host) and supports Azure AD authentication for login, meeting both requirements.

Answer

Just-in-time (JIT) VM access with Microsoft Defender for Cloud.

Answer

Azure Front Door with private endpoints.

Answer

Azure VPN Gateway with point-to-site VPN.