AZ-500 Secure networking Practice Test 11 — 15 Questions

Question 1

You have an Azure subscription with a virtual network (VNet1) that hosts a SQL Managed Instance. You need to connect from an on-premises application to the SQL Managed Instance using a private IP address, with minimal latency and without traversing the public internet. The on-premises network has a high-speed ExpressRoute connection to Microsoft. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Connect the on-premises network to Azure via ExpressRoute private peering and ensure the SQL Managed Instance subnet is reachable.. ExpressRoute private peering establishes a Layer 3 connection between on-premises and Azure, ensuring traffic to the SQL Managed Instance subnet traverses the Microsoft backbone network without touching the public internet. This provides the lowest latency and highest security for private IP connectivity, as the managed instance's private IP is directly routable over the ExpressRoute circuit.

Answer

Configure a public endpoint on the SQL Managed Instance and allow the on-premises public IP.

Answer

Use Azure Private Link Service and connect via a VPN.

Answer

Create a site-to-site VPN connection and enable forced tunneling.

Question 2

You are designing a secure network architecture for a multi-region application. You need to ensure that traffic between virtual networks in different Azure regions is encrypted and uses the Microsoft backbone network, and you must minimize latency. Which TWO configurations should you implement?

Accepted Answer

Configure VNet peering between the virtual networks.. VNet peering (option B) encrypts all traffic between peered virtual networks using the Microsoft backbone network, ensuring low latency as traffic stays within Microsoft's infrastructure. For multi-region connectivity, global VNet peering is used. ExpressRoute with Microsoft peering (option C) also provides connectivity over the Microsoft backbone and can be encrypted, meeting the requirement. However, it typically requires additional routing configuration and is not as straightforward as peering, but it is a valid configuration for cross-region encrypted traffic. The combination of these two ensures redundancy and high availability, satisfying the need for two configurations.

Answer

Enable 'Gateway transit' on the peering to use a VPN gateway if needed, but not required for encryption.

Answer

Deploy Azure VPN Gateway in each region and connect them via site-to-site VPN.

Answer

Place an Azure Firewall in each region to inspect cross-region traffic.

Question 3

You have an Azure virtual network that hosts a critical application. You need to protect the virtual network from DDoS attacks. Which THREE actions should you take to implement a defense-in-depth approach?

Accepted Answer

Configure network security groups (NSGs) with deny-all inbound rules by default, then allow only necessary traffic.. Network security groups (NSGs) with deny-all inbound rules by default enforce a least-privilege model, which is a foundational layer of defense-in-depth. By explicitly allowing only necessary traffic, you reduce the attack surface and mitigate the impact of DDoS attacks by blocking unwanted traffic at the subnet or NIC level before it reaches the application.

Answer

Use Azure Private Endpoints for all Azure services to remove public endpoints.

Answer

Deploy Azure Firewall with threat intelligence-based filtering.

Question 4

You are planning a migration of on-premises servers to Azure. You need to ensure that the Azure virtual network can communicate with the on-premises network securely and with high bandwidth. The on-premises network has a 1 Gbps internet connection. Which TWO options meet the requirements?

Accepted Answer

Site-to-site VPN over the internet.. A Site-to-Site VPN over the internet (Option A) is correct because it creates an encrypted tunnel between the on-premises VPN device and the Azure VPN gateway, using IPsec/IKE protocols. This provides secure connectivity over the public internet and can support up to 1 Gbps throughput with multiple tunnels (S2S connections), meeting the high-bandwidth requirement. ExpressRoute with private peering (Option E) is also correct because it offers a dedicated, private connection that bypasses the internet, delivering consistent, high-bandwidth throughput (up to 10 Gbps or more) with lower latency and enhanced security.

Answer

Point-to-site VPN from on-premises to Azure.

Answer

Azure Firewall with forced tunneling.

Answer

VNet peering between on-premises and Azure.

Question 5

Refer to the exhibit. You are evaluating an Azure Policy definition. What is the effect of this policy when assigned to a subscription?

Accepted Answer

It denies the creation of any virtual network because it always has subnets.. The policy definition uses the 'deny' effect with a condition that checks if the 'Microsoft.Network/virtualNetworks/subnets' property exists. Since every virtual network must have at least one subnet at creation, this condition always evaluates to true, causing the policy to deny the creation of any virtual network. This is why option B is correct.

Answer

It audits virtual networks to ensure they have a network security group attached.

Answer

It denies virtual networks that have any subnet with a service endpoint.

Answer

It denies the creation of virtual networks that do not have subnets.

Question 6

Refer to the exhibit. You ran the PowerShell command shown. Which statement about the network interface is true?

Accepted Answer

The network interface is attached to a virtual machine that is not accessible from the internet.. The PowerShell command `Get-AzNetworkInterface` retrieves the properties of a network interface. The output shows `PublicIpAddress : {}`, indicating no public IP is directly associated with the NIC. However, this does not prove that the attached virtual machine is not accessible from the internet, as it could be behind a public load balancer, Azure Firewall, or NAT gateway. Therefore, none of the provided statements can be definitively concluded as true based solely on this output.

Answer

The network interface is part of an availability set.

Answer

The network interface is associated with a public IP address.

Answer

The network interface is configured with application security groups.

Question 7

Your company, Contoso Ltd., has a hybrid network with an on-premises data center in Chicago and an Azure subscription with a single virtual network (VNet1) in the East US region. VNet1 has multiple subnets: Web, App, and Data. The Web subnet hosts a load-balanced web application accessible from the internet via a public IP. The App subnet contains application servers that communicate with an on-premises database server in Chicago. The Data subnet contains Azure SQL databases. You have an ExpressRoute circuit connecting Chicago to East US with private peering. Recently, the security team discovered that some traffic from the App subnet to the on-premises database is bypassing the ExpressRoute and traversing the internet, causing latency and security concerns. You must ensure all traffic between VNet1 and the on-premises network uses the ExpressRoute connection. Additionally, you need to restrict inbound internet traffic to only the Web subnet, and all outbound internet traffic from the App and Data subnets must be inspected by an Azure Firewall deployed in a new subnet called AzureFirewallSubnet in VNet1. You have the following requirements: 1. All traffic to/from on-premises must use ExpressRoute. 2. Only the Web subnet should be directly accessible from the internet. 3. Outbound internet traffic from App and Data subnets must be routed through Azure Firewall. 4. Minimize management overhead. Which of the following is the most appropriate course of action?

Accepted Answer

Add a user-defined route (UDR) to the App and Data subnets with destination 0.0.0.0/0 and next hop set to the Azure Firewall private IP. Ensure the route to on-premises via ExpressRoute is present (system route or UDR).. It addresses both requirements: (1) Ensure traffic to/from on-premises uses ExpressRoute – system routes automatically provide a route for the on-premises prefix via ExpressRoute (especially with BGP), so no additional configuration is needed. (2) Force outbound internet traffic from App/Data subnets through Azure Firewall – a UDR with destination 0.0.0.0/0 and next hop set to the Azure Firewall private IP overrides the default system route for internet traffic. Option A: A firewall policy alone does not force traffic through the firewall; it only filters traffic that already reaches the firewall. Option C: Removing the default 0.0.0.0/0 route would break outbound internet connectivity entirely, not force ExpressRoute usage. Option D: Deploying a VPN Gateway with forced tunneling sends all traffic (including VNet-to-VNet and to Azure services) to on-premises, increasing cost and complexity, and does not specifically enforce ExpressRoute for on-premises traffic.

Answer

Create a new Azure Firewall policy that blocks all outbound traffic except through ExpressRoute.

Answer

Remove the default 0.0.0.0/0 route from all subnets and add a route for on-premises via ExpressRoute.

Answer

Deploy a VPN Gateway and configure forced tunneling to send all traffic to on-premises for inspection.

Question 8

You are a security engineer at Fabrikam Inc. The company has an Azure subscription with a single virtual network (VNet1) that contains a production workload. The network is connected to an on-premises data center via a site-to-site VPN. The security team requires that all Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines in VNet1 must be brokered through Azure Bastion. Additionally, the team wants to ensure that no public IP addresses are assigned to any virtual machines in the production environment. Currently, there are several VMs with public IPs. You need to implement the requirements with minimal downtime. The solution must also ensure that administrators can access the VMs using Azure Bastion without any additional client software. What should you do?

Accepted Answer

Deploy Azure Bastion in the virtual network and then remove the public IP addresses from all VMs.. Azure Bastion provides RDP/SSH access via the Azure portal without public IPs. To minimize downtime, you should deploy Bastion first, then remove public IPs from VMs. The other options either cause downtime (disassociate first) or don't meet the requirement (JIT still needs public IPs).

Answer

Create a point-to-site VPN for administrators and remove public IPs from VMs.

Answer

Deploy Azure Bastion in the virtual network, then configure Just-In-Time (JIT) VM access for all VMs.

Answer

Disassociate public IPs from all VMs, then deploy Azure Bastion in the same virtual network.

Question 9

You have an Azure virtual network (VNet1) with two subnets: SubnetA and SubnetB. SubnetA hosts web servers that must be accessible from the internet. SubnetB hosts application servers that should only be accessible from SubnetA. You need to configure network security groups (NSGs) to enforce this traffic flow. The solution must allow HTTP and HTTPS traffic from the internet to SubnetA, and allow only traffic from SubnetA to SubnetB. All other inbound traffic should be denied. What is the most efficient way to configure the NSGs?

Accepted Answer

Apply an NSG to SubnetA with inbound rules allowing HTTP/HTTPS from Internet, and apply a separate NSG to SubnetB with inbound rules allowing only traffic from SubnetA.. Apply an NSG to SubnetA with inbound rules allowing HTTP and HTTPS from the Internet, and deny all other inbound traffic. Apply a separate NSG to SubnetB with an inbound rule allowing traffic only from SubnetA, and deny all other inbound traffic. This efficiently meets the requirements by using NSGs at the subnet level to control traffic flow. Option B is incorrect because applying one NSG to both subnets would not allow different rules per subnet; NSGs are associated per subnet or per NIC. Option C is incorrect because ASGs are used to group VMs by application roles but still require NSGs to enforce rules; ASGs alone do not filter traffic. Option D is incorrect because Azure Firewall is a managed firewall service that is more complex and costly than needed for this scenario; NSGs are sufficient and more efficient.

Answer

Apply one NSG to both subnets with rules allowing HTTP/HTTPS from internet, and allow traffic from SubnetA to SubnetB.

Answer

Use application security groups (ASGs) on the web servers and application servers, and configure NSG rules referencing the ASGs.

Answer

Deploy Azure Firewall in the virtual network and configure application rules to allow HTTP/HTTPS to SubnetA and traffic to SubnetB.

Question 10

You are a security engineer for Contoso. The company uses Azure Firewall for all inbound and outbound traffic. To prevent misconfiguration, you assign the Azure Policy shown in the exhibit at the management group scope. After assignment, a network administrator reports that they cannot create a new subnet in an existing virtual network. The subnet creation fails with a 'deny' policy error. You need to allow subnet creation while still blocking NSG rule changes. What should you do?

Accepted Answer

Modify the policy rule to remove the subnet condition from the anyOf array.. The policy rule uses an `anyOf` array that includes conditions for both NSG rule changes and subnet creation. By removing the subnet condition from the `anyOf` array, the policy will no longer evaluate subnet creation against the deny effect, allowing subnets to be created while still blocking NSG rule modifications. This directly addresses the administrator's issue without weakening the security posture for NSG changes.

Answer

Change the effect to 'audit' instead of 'deny'.

Answer

Add an exemption for the virtual network resource group.

Answer

Remove the policy assignment and create a custom role to block subnet creation.

Question 11

Your organization has deployed Azure Firewall in a hub-and-spoke network topology. You have configured forced tunneling so that all internet-bound traffic from the spoke virtual networks is routed through the Azure Firewall. Recently, a critical application in a spoke virtual network is experiencing intermittent connectivity failures to an external partner service. The partner service requires that traffic originate from a specific public IP address. You have configured Azure Firewall with a public IP address and have set up DNAT rules to allow inbound traffic. However, the outbound traffic from the application is still using the spoke's default outbound access via SNAT. You need to ensure that all outbound traffic from the application uses the Azure Firewall's public IP address. What should you do?

Accepted Answer

Add a user-defined route (UDR) on the application's subnet with 0.0.0.0/0 next hop to Azure Firewall.. The spoke's outbound traffic is using its default outbound access (SNAT) instead of the Azure Firewall's public IP because there is no user-defined route (UDR) on the application's subnet forcing internet-bound traffic to the Azure Firewall. Adding a UDR with 0.0.0.0/0 and next hop set to the Azure Firewall's private IP ensures all outbound traffic from that subnet is routed through the firewall, which then performs SNAT using its public IP. This satisfies the partner's requirement for a specific source IP.

Answer

Disable SNAT on the Azure Firewall for the application's public IP range.

Answer

Modify the Azure Firewall policy to enable forced tunneling.

Answer

Configure Azure Firewall as a next hop for the virtual network gateway in the hub.

Question 12

You are responsible for securing a multi-region Azure environment. The environment includes virtual networks in three regions: East US, West Europe, and Southeast Asia. You need to ensure that all traffic between these virtual networks is encrypted and travels over the Microsoft backbone network. Additionally, you must minimize latency for cross-region traffic. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Enable global VNet peering on the peering connections.. Global VNet peering (Option A) connects virtual networks across Azure regions, encrypting all traffic between them using the Azure backbone network without requiring a VPN gateway or public internet. This minimizes latency because traffic stays within Microsoft's high-speed backbone rather than traversing the internet or third-party networks. VNet peering (Option E) is the underlying mechanism that enables direct, private connectivity between VNets, and when combined with global peering, it satisfies both the encryption and backbone routing requirements.

Answer

Set up ExpressRoute circuits from each region to Microsoft.

Answer

Deploy Azure Firewall in each virtual network and route traffic through it.

Answer

Deploy Azure VPN Gateway in each virtual network and configure site-to-site VPN connections.

Question 13

Your company has a single Azure subscription with a hub-and-spoke network topology. The hub virtual network contains Azure Firewall and a VPN gateway for hybrid connectivity. You need to ensure that all traffic from the spoke virtual networks to on-premises is inspected by the Azure Firewall. Which THREE actions should you take? (Choose three.)

Accepted Answer

Configure Azure Firewall with a route to the VPN gateway for on-premises traffic.. Azure Firewall must have a route to the VPN gateway to forward on-premises traffic (B). Spoke subnets need UDRs to send all traffic through the firewall (D). For the spoke to use the hub's VPN gateway, the spoke peering must have 'Use remote gateways' enabled, not 'Gateway transit'. Since that option is missing, the valid choices are B and D.

Answer

Enable BGP on the Azure VPN gateway and advertise routes to the on-premises network.

Answer

In the hub virtual network, set 'Use remote gateways' on the peering connection to the spoke.

Answer

In the spoke virtual network, set 'Gateway transit' on the peering connection to the hub.

Question 14

You are designing a network security strategy for a new application that will be hosted on Azure Virtual Machines. The application must be accessible from the internet on TCP port 443. You need to minimize the attack surface and ensure that only legitimate traffic reaches the virtual machines. Which Azure service should you deploy in front of the virtual machines?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF).. Azure Application Gateway with WAF is the correct choice because it provides Layer 7 (HTTP/HTTPS) load balancing and web application firewall capabilities, allowing you to inspect and filter incoming traffic on TCP port 443. This minimizes the attack surface by blocking common web exploits (e.g., SQL injection, cross-site scripting) before traffic reaches the virtual machines, while also enabling SSL termination and path-based routing.

Answer

Azure Front Door with WAF.

Answer

Azure Firewall.

Answer

Network Security Group (NSG) on the subnet.

Question 15

Your organization has a Microsoft Entra ID tenant and uses Azure Virtual Desktop (AVD). You need to ensure that AVD session hosts in a virtual network can access on-premises resources securely without exposing the session hosts to the internet. The on-premises network is connected to Azure via ExpressRoute. All AVD traffic should be routed through the ExpressRoute connection. You have already deployed a reverse connect transport for AVD. What else should you configure to meet the requirements?

Accepted Answer

Add a user-defined route (UDR) in the AVD subnet for the on-premises IP prefixes with next hop to the ExpressRoute gateway.. Adding a user-defined route (UDR) in the AVD subnet for on-premises IP prefixes with the next hop set to the ExpressRoute gateway forces all traffic destined for on-premises resources to traverse the ExpressRoute connection. This ensures secure, private connectivity without exposing session hosts to the internet, while the reverse connect transport already handles AVD control plane traffic securely.

Answer

Configure VNet peering between the AVD virtual network and the on-premises network.

Answer

Disable reverse connect transport and allow inbound RDP traffic from the internet.

Answer

Create a private endpoint for the AVD control plane.