AZ-500 Secure networking Practice Test 11 — 15 Questions

Question 1

Your company has multiple Azure subscriptions managed through Azure Firewall Manager. You need to deploy Azure Firewall policies that apply to all subscriptions in a region. What is the most efficient way to manage this?

Accepted Answer

Use Azure Firewall Manager to create a parent policy and assign it to all firewalls. Option D is correct because Azure Firewall Manager allows creating policy-based firewalls that can be applied across multiple subscriptions. Option A is wrong because each firewall has its own policy; you would need to duplicate. Option B is wrong because Azure Policy can enforce compliance but not directly manage firewall rules. Option C is wrong because NSGs are per-subnet, not cross-subscription.

Answer

Create a separate firewall policy for each subscription

Answer

Use Azure Policy to enforce firewall rules across subscriptions

Answer

Deploy a single network security group (NSG) to all VNets

Question 2

You need to block inbound traffic from the internet to a specific subnet except for TCP port 443. Which Azure service should you use?

Accepted Answer

Network security group (NSG). Option A is correct because NSGs can have inbound rules to allow or deny traffic by port. Option B is wrong because Azure Firewall is a network/application firewall but NSGs are simpler for subnet-level filtering. Option C is wrong because WAF is for HTTP/HTTPS at the application layer. Option D is wrong because DDoS Protection does not filter by port.

Answer

Azure Web Application Firewall (WAF)

Answer

Azure Firewall

Answer

Azure DDoS Protection

Question 3

Your organization has a hybrid network with an Azure VPN gateway connecting to an on-premises site. You need to ensure that traffic between Azure and on-premises is encrypted and authenticated. Which protocol should the VPN gateway use?

Accepted Answer

IPsec. Option B is correct because IPsec is the standard for VPN encryption and authentication. Option A is wrong because SSL/TLS is for web traffic, not site-to-site VPN. Option C is wrong because SSH is for remote administration. Option D is wrong because HTTPS is application layer, not for network tunneling.

Answer

SSL/TLS

Answer

SSH

Answer

HTTPS

Question 4

You have an Azure application that uses a private endpoint for Azure SQL Database. Users report intermittent connectivity failures. You need to diagnose whether the private endpoint DNS resolution is working correctly. Which tool should you use?

Accepted Answer

nslookup. Option B is correct because nslookup queries DNS servers and can verify if the private endpoint FQDN resolves to a private IP. Option A is wrong because ping tests ICMP, which may be blocked. Option C is wrong because tracert shows the route but not DNS. Option D is wrong because netstat shows active connections, not resolution.

Answer

tracert

Answer

netstat

Answer

ping

Question 5

You need to restrict access to an Azure Storage account so that only traffic from a specific virtual network is allowed. What should you configure?

Accepted Answer

Storage account firewall and virtual network settings. Option C is correct because Azure Storage firewalls and virtual networks allow you to restrict access to specific VNets. Option A is wrong because NSGs apply to subnets, not to storage accounts directly. Option B is wrong because Azure Firewall is for network traffic filtering, not for storage access control. Option D is wrong because private endpoints provide private connectivity but do not restrict access by default.

Answer

Azure Firewall application rule

Answer

Private endpoint connection

Answer

Network security group (NSG) on the subnet

Question 6

Your company deploys a web application in an Azure App Service that needs to securely connect to an Azure SQL Database. You want to avoid exposing the database to the public internet. What is the recommended approach?

Accepted Answer

Use a private endpoint for the SQL database and VNet integration for the App Service. Option D is correct because a private endpoint assigns a private IP to the database within the VNet, and the App Service can connect via VNet integration. Option A is wrong because NSGs on the database subnet do not prevent internet exposure if the database has a public endpoint. Option B is wrong because Azure Firewall can filter but the database still has a public endpoint. Option C is wrong because the SQL firewall allows public IPs but is less secure.

Answer

Configure the SQL database firewall to allow only the App Service outbound IP

Answer

Use Azure Firewall to block outbound traffic to the database

Answer

Create an NSG on the database subnet to deny internet traffic

Question 7

You have an Azure Kubernetes Service (AKS) cluster that needs to communicate with an on-premises database over a site-to-site VPN. The AKS cluster is in a spoke VNet, and the VPN gateway is in the hub VNet. You configure VNet peering between hub and spoke. However, pods cannot reach the on-premises database. What is the most likely cause?

Accepted Answer

The pod subnet does not have a route to the on-premises network via the VPN gateway. Option B is correct because AKS pods use a different IP range than the VNet, and user-defined routes (UDRs) are needed to route pod traffic through the VPN gateway. Option A is wrong because peering is configured. Option C is wrong because Azure CNI uses pod IPs from the VNet, but routing still needs UDRs. Option D is wrong because NSGs can block but are not the likely cause here.

Answer

The VNet peering is not established correctly

Answer

The network security group on the pod subnet blocks outbound traffic

Answer

The AKS cluster is using kubenet network plugin

Question 8

Which TWO Azure services can be used to filter inbound internet traffic to a virtual network? (Choose two.)

Accepted Answer

Azure Firewall. Options A and C are correct. NSGs filter traffic at the subnet/NIC level. Azure Firewall provides centralized filtering. Option B is wrong because Azure Front Door is a global load balancer. Option D is wrong because VPN gateway encrypts traffic but does not filter. Option E is wrong because Azure Bastion is a jump server.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

VPN gateway

Question 9

Which THREE are best practices for securing network traffic in Azure? (Choose three.)

Accepted Answer

Use private endpoints for Azure services. Private endpoints assign a private IP address from your virtual network to an Azure service (e.g., Azure Storage, SQL Database), effectively bringing the service into your VNet. This ensures traffic to the service traverses the Microsoft backbone network rather than the public internet, eliminating data exposure to the public endpoint and reducing the attack surface. It is a core network segmentation best practice for securing PaaS resources.

Answer

Assign public IP addresses to every VM

Answer

Allow direct outbound internet access from VMs

Question 10

Which TWO are valid connection methods for Azure VPN Gateway? (Choose two.)

Accepted Answer

Point-to-Site. Point-to-Site (P2S) is a valid connection method for Azure VPN Gateway because it allows individual client computers to connect securely to an Azure virtual network from anywhere using the SSTP, IKEv2, or OpenVPN protocols. This method is ideal for remote workers who need encrypted access without requiring a site-level VPN device.

Answer

VNet-to-VNet

Answer

Azure Bastion

Answer

ExpressRoute

Question 11

You need to restrict access to a web app hosted on Azure App Service so that only traffic from a specific virtual network (VNet) is allowed. Which Azure service should you configure?

Accepted Answer

App Service access restrictions. Option B is correct because Azure App Service access restrictions allow you to block or allow traffic based on source IP addresses or VNet service endpoints. Option A is wrong because Azure Front Door is a global load balancer, not a network restriction feature for App Service. Option C is wrong because Azure Firewall is a managed firewall service, but not directly used to restrict App Service access; it would be an intermediary. Option D is wrong because Azure Application Gateway is a layer 7 load balancer that can provide WAF but not native App Service access restrictions.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Firewall

Question 12

Your company has a hub-spoke network topology in Azure. The hub VNet contains an Azure Firewall. Spoke VNets are peered to the hub. You need to ensure that all outbound traffic from virtual machines in a spoke VNet passes through the Azure Firewall for inspection. Which two configurations are required? (Choose two.)

Accepted Answer

Configure an application rule or network rule on Azure Firewall to allow outbound traffic. Option B is correct because a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP must be associated with the spoke subnet. Option D is correct because the firewall must be configured to allow or deny outbound traffic. Option A is wrong because VNet peering is already in place; no additional peering is needed. Option C is wrong because Azure Firewall doesn't require a public IP for outbound inspection if using private IP; also NAT rules are for inbound. Option E is wrong because forced tunneling is a different concept; the route table handles this.

Answer

Configure a DNAT rule on Azure Firewall to translate outbound traffic

Answer

Create a new VNet peering between the spoke and hub

Answer

Enable forced tunneling on the spoke VNet

Question 13

Refer to the exhibit. The JSON snippet shows a network rule from an Azure Firewall policy. You have a subnet with IP range 10.0.1.0/24 that needs to connect to Azure SQL Database in Southeast Asia. However, connections are failing. What is the most likely reason?

Accepted Answer

Network rules do not support service tags as destination addresses. Option A is correct because the destination address 'AzureCloud.southeastasia' is a service tag, but Azure Firewall network rules require an IP address or CIDR, not service tags. Service tags are only supported in application rules (FQDN filtering) or when using Azure Firewall Premium with IDPS. Option B is wrong because the protocol TCP is correct for SQL. Option C is wrong because the port 1433 is correct. Option D is wrong because the priority 100 is fine.

Answer

The protocol should be UDP instead of TCP

Answer

The destination port should be 1434 instead of 1433

Answer

The rule priority is too low and may be overridden

Question 14

You need to securely connect an on-premises network to Azure over the internet with encrypted traffic. The connection must be site-to-site and use IPsec. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Option C is correct because Azure VPN Gateway supports site-to-site IPsec VPN connections. Option A is wrong because Azure ExpressRoute is a private dedicated connection, not over the internet. Option B is wrong because Azure Virtual WAN is a networking service that can include VPN but is more complex than needed. Option D is wrong because Azure Bastion is for RDP/SSH to VMs without public IP.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 15

Your company uses Azure Firewall Premium. You need to inspect outbound traffic for malware using signature-based detection. Which feature should you enable?

Accepted Answer

Intrusion Detection and Prevention System (IDPS). Option D is correct because Azure Firewall Premium includes IDPS with signature-based detection for malware. Option A is wrong because threat intelligence filtering is for known malicious IPs/domains, not file-based malware. Option B is wrong because URL filtering is for categorizing URLs. Option C is wrong because web categories are for content filtering.

Answer

Web categories

Answer

URL filtering

Answer

Threat intelligence-based filtering