AZ-500 Secure networking Practice Test 10 — 15 Questions

Question 1

You are troubleshooting connectivity issues from an Azure VM to an on-premises server. The VM is in a VNet that uses a custom DNS server. The on-premises network is connected via ExpressRoute. You can ping the on-premises server by IP address but not by name. What is the most likely cause?

Accepted Answer

The custom DNS server does not have a conditional forwarder to the on-premises DNS.. Option B is correct because the custom DNS server is likely not configured to resolve on-premises hostnames. Option A is wrong because ExpressRoute circuits do not have DNS settings. Option C is wrong because Azure Private DNS zones are for Azure resources, not on-premises. Option D is wrong because NSG rules block traffic by IP or port, not by name resolution.

Answer

The ExpressRoute circuit is not configured for DNS forwarding.

Answer

The Azure Private DNS zone does not include the on-premises hostname.

Answer

An NSG rule is blocking DNS traffic.

Question 2

You need to secure traffic between two VNets in different Azure regions. The VNets contain virtual machines that must communicate over private IP addresses. Which Azure service should you use?

Accepted Answer

VNet peering. Option C is correct because VNet peering enables connectivity between VNets over the Microsoft backbone network using private IP addresses. Option A is wrong because Azure VPN Gateway provides encrypted tunnels but uses public IPs for the gateway. Option B is wrong because ExpressRoute connects on-premises to Azure, not VNet-to-VNet. Option D is wrong because Azure Firewall is a security service, not a connectivity service.

Answer

Azure Firewall

Answer

Azure VPN Gateway

Answer

ExpressRoute

Question 3

Your company has an Azure subscription with several VNets. You deploy Azure Firewall in a hub VNet. You need to ensure that all traffic from spoke VNets to the internet goes through the firewall. What should you configure?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. Option A is correct because a User-Defined Route (UDR) with next hop type VirtualAppliance and the firewall's private IP forces traffic to the firewall. Option B is wrong because forced tunneling is a VPN configuration. Option C is wrong because Azure Firewall policies define rules, not routing. Option D is wrong because VNet peering does not route traffic; it provides connectivity.

Answer

Configure forced tunneling on the spoke VNet gateways.

Answer

Enable VNet peering to the hub VNet.

Answer

Apply an Azure Firewall policy that denies internet access for spoke VNets.

Question 4

You are designing a network security strategy for an Azure Kubernetes Service (AKS) cluster. You need to restrict egress traffic from the cluster to only allow connections to specific Azure services (e.g., Microsoft Container Registry, Azure Key Vault). The solution must minimize administrative overhead. What should you use?

Accepted Answer

Deploy Azure Firewall and use FQDN tags to allow traffic to Azure services.. Option D is correct because Azure Firewall with FQDN tags can allow traffic to Azure services by tag, simplifying management. Option A is wrong because NSGs do not support allowlisting by FQDN. Option B is wrong because AKS does not natively support network policies for egress to Azure services. Option C is wrong because Azure Policy can audit but not enforce egress rules.

Answer

Configure Azure Policy to deny egress to non-approved destinations.

Answer

Use Kubernetes network policies for egress.

Answer

Define NSG rules to allow outbound traffic to the service IP ranges.

Question 5

You need to provide secure remote access to Azure virtual machines for developers without exposing public IP addresses. The solution must authenticate users via Microsoft Entra ID and support multifactor authentication. Which service should you use?

Accepted Answer

Azure Bastion. Option A is correct because Azure Bastion provides secure RDP/SSH access to VMs over TLS, with Microsoft Entra ID authentication and MFA support. Option B is wrong because Azure Front Door is a global load balancer. Option C is wrong because VPN Gateway requires public IPs and client VPN software. Option D is wrong because Azure Firewall does not provide remote access to VMs.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure Firewall

Question 6

You have an Azure subscription with multiple VNets connected via VNet peering. You need to ensure that traffic between VNets is encrypted. What should you do?

Accepted Answer

No additional configuration is needed; VNet peering traffic is encrypted by default.. Option C is correct because VNet peering traffic over the Microsoft backbone is encrypted by default using MACsec. Option A is wrong because VPN gateways are not needed for VNet peering. Option B is wrong because NSGs do not encrypt traffic. Option D is wrong because Azure Firewall does not encrypt traffic between VNets.

Answer

Configure Azure Firewall to enforce encryption.

Answer

Apply NSGs to block unencrypted traffic.

Answer

Deploy a VPN gateway in each VNet and configure site-to-site VPN connections.

Question 7

You are troubleshooting connectivity from an on-premises network to an Azure VM. The connection uses a site-to-site VPN. The VM can be pinged from on-premises, but an application running on the VM cannot connect to an on-premises database server. The database server's firewall is configured to allow connections from the Azure VPN gateway public IP. What is the most likely cause of the issue?

Accepted Answer

The on-premises firewall is allowing the wrong IP address. The Azure VPN gateway's private IP should be allowed.. Option C is correct because traffic from Azure to on-premises uses the VPN gateway's private IP from the gateway subnet, not its public IP. The on-premises firewall should allow the VPN gateway's private IP address range. Option A is wrong because the VPN tunnel is established. Option B is wrong because NSG rules affect traffic within Azure, not outbound to on-premises. Option D is wrong because route tables could affect routing but the database is on-premises.

Answer

An NSG on the VM's subnet is blocking outbound traffic.

Answer

The VPN tunnel is not established.

Answer

The effective routes on the VM are misconfigured.

Question 8

You are designing network security for a three-tier application. You need to isolate each tier (web, application, data) and control traffic between them. Which TWO Azure services should you use to achieve this? (Choose two.)

Accepted Answer

Network Security Groups (NSGs). Options A and C are correct. NSGs provide traffic filtering at the subnet or NIC level. ASGs allow grouping of VMs and referencing them in NSG rules. Option B is wrong because Azure Firewall is a centralized firewall, but for simple tier isolation, NSGs and ASGs suffice. Option D is wrong because VNet peering connects VNets, not tiers within a VNet. Option E is wrong because Azure Policy does not enforce network traffic rules.

Answer

VNet peering

Answer

Azure Policy

Answer

Azure Firewall

Question 9

You need to monitor network traffic to detect anomalies and potential security threats. Which THREE Azure services can you use to achieve this? (Choose three.)

Accepted Answer

Microsoft Sentinel. Options A, B, and D are correct. Network Watcher provides traffic capture and flow logs. Azure Sentinel (now Microsoft Sentinel) can ingest network logs for threat detection. Azure Firewall logs can be used for monitoring. Option C is wrong because Azure Policy is for compliance, not monitoring. Option E is wrong because Azure Monitor Metrics can monitor performance, not network traffic anomalies.

Answer

Azure Monitor Metrics

Answer

Azure Policy

Question 10

You are designing a hub-and-spoke network topology with Azure Firewall in the hub VNet. Which TWO components are essential for routing traffic from spoke VNets through the firewall? (Choose two.)

Accepted Answer

VNet peering between spoke and hub VNets. Options B and C are correct. VNet peering connects spoke VNets to the hub. User-Defined Routes (UDRs) direct traffic to the firewall's private IP. Option A is wrong because a VPN gateway is not required for hub-and-spoke. Option D is wrong because Azure Bastion is for remote access. Option E is wrong because Azure DNS is for name resolution, not routing.

Answer

Azure Private DNS zones

Answer

Azure Bastion host in the hub VNet

Answer

VPN gateway in each spoke VNet

Question 11

Refer to the exhibit. You are reviewing an NSG rule configuration for a subnet. The source subnet is 10.0.0.0/24 and the destination subnet is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

Allows inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.. Option A is correct because the rule allows inbound TCP traffic on port 22 from source range 10.0.0.0/24 to destination range 10.0.1.0/24. Option B is wrong because the rule allows inbound, not outbound. Option C is wrong because the rule allows SSH, not blocks. Option D is wrong because the rule is specific to port 22.

Answer

Allows outbound SSH traffic from 10.0.1.0/24 to 10.0.0.0/24.

Answer

Blocks inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.

Answer

Allows all inbound traffic from 10.0.0.0/24 to 10.0.1.0/24.

Question 12

Refer to the exhibit. You have an Azure Firewall policy with the shown rules. Traffic from 10.0.0.0/8 to www.google.com on HTTPS (443) is being blocked. What is the most likely reason?

Accepted Answer

The network rule collection with priority 100 denies all traffic, and it is evaluated before the application rule collection.. Option A is correct because network rules are evaluated before application rules, and the network rule collection with priority 100 denies all traffic. The application rule collection with priority 200 is never evaluated because the network rule denies first. Option B is wrong because the application rule allows *.google.com, but it is not reached. Option C is wrong because the rule action is Allow, not Deny. Option D is wrong because the source address includes 10.0.0.0/8.

Answer

The application rule collection has an action of Deny.

Answer

The source address 10.0.0.0/8 is not included in the application rule.

Answer

The application rule collection does not allow *.google.com.

Question 13

Refer to the exhibit. You have a VNet with two subnets, each with a different NSG. Both NSGs have default rules. What is the default connectivity between VMs in subnetA and subnetB?

Accepted Answer

Traffic is allowed by default.. Option B is correct because by default, NSGs allow all traffic within a VNet, including between subnets. Option A is wrong because there is no default block. Option C is wrong because default rules allow traffic. Option D is wrong because default rules allow traffic.

Answer

Traffic is blocked by default.

Answer

Traffic is allowed only if the VNet has peering.

Answer

Traffic is allowed only if the subnets are in the same region.

Question 14

Your company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. You need to ensure that all outbound traffic from spoke VMs to the internet is routed through the Azure Firewall. What should you configure on the spoke virtual networks?

Accepted Answer

Create a route table with a route for 0.0.0.0/0 pointing to the Azure Firewall private IP, and associate it with the spoke subnets. Option C is correct because adding a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall as the next hop forces all outbound traffic through the firewall. Option A is wrong because VNet peering does not automatically route internet traffic through a firewall. Option B is wrong because NSGs can control inbound/outbound rules but cannot route traffic. Option D is wrong because the firewall itself doesn't need a route table change.

Answer

Apply a network security group (NSG) to the spoke subnets with a deny rule for internet traffic

Answer

Configure VNet peering with 'Use remote gateway' enabled

Answer

Configure the Azure Firewall to use forced tunneling

Question 15

You are designing a secure network architecture for a three-tier application. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. Which Azure service should you use to isolate the tiers most securely?

Accepted Answer

Network security groups (NSGs) on subnets. Option A is correct because NSGs with subnet-level rules can restrict traffic between tiers. Option B is wrong because Azure Firewall is a centralized firewall, but for simple tier isolation, NSGs are more appropriate and cost-effective. Option C is wrong because VNet peering connects networks, not isolates tiers. Option D is wrong because Azure Front Door is for global load balancing, not tier isolation.

Answer

Azure Firewall with application rules

Answer

Azure Front Door with Web Application Firewall

Answer

VNet peering between tiers