AZ-500 Secure networking Practice Test 12 — 15 Questions

Question 1

You need to provide secure remote administration access to Azure virtual machines in a production environment. You want to eliminate public RDP/SSH endpoints and provide just-in-time access. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Just-in-time (JIT) VM access in Microsoft Defender for Cloud is the correct choice because it specifically provides time-bound, policy-controlled access to Azure VMs via RDP/SSH while eliminating permanent public endpoints. JIT dynamically opens NSG rules for a specified duration only when an authorized user requests access, then automatically closes them, enforcing the principle of least privilege for remote administration.

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Answer

Azure Bastion

Question 2

You have an Azure Kubernetes Service (AKS) cluster that needs to restrict egress traffic to specific Azure services (e.g., Azure Container Registry, Azure Monitor). You want a managed solution that allows you to define FQDN-based rules. Which Azure service should you use?

Accepted Answer

Azure Firewall. Azure Firewall is the correct choice because it is a managed, cloud-native network security service that provides FQDN-based rules to control outbound (egress) traffic. It allows you to define application rules using fully qualified domain names (FQDNs) to restrict egress traffic to specific Azure services like Azure Container Registry and Azure Monitor, without needing to manage underlying infrastructure.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Question 3

You are configuring a site-to-site VPN connection between your on-premises network and Azure. You need to ensure that traffic between the networks is encrypted and authenticated. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct service because it provides encrypted and authenticated site-to-site VPN connections using IPsec/IKE protocols. It establishes a secure tunnel between your on-premises VPN device and the Azure VPN gateway, ensuring confidentiality and integrity of traffic across the public internet.

Answer

Azure Virtual WAN

Answer

Azure ExpressRoute

Answer

Azure Firewall

Question 4

Your organization has deployed Azure Front Door Premium with Web Application Firewall (WAF) policy in front of an Azure App Service. You need to ensure that only traffic from Azure Front Door is allowed to reach the App Service, and all other traffic is blocked. Which configuration should you implement?

Accepted Answer

Configure IP restrictions on the App Service to allow only the Azure Front Door service tag AzureFrontDoor.Backend.. The Azure Front Door Premium service tag 'AzureFrontDoor.Backend' represents the backend IP address range used by Azure Front Door to forward traffic to the origin. By configuring IP restrictions on the App Service to allow only this service tag, you ensure that only traffic originating from Azure Front Door can reach the App Service, effectively blocking all other traffic.

Answer

Configure the App Service to require client certificates and configure Azure Front Door to present a certificate.

Answer

Set the App Service access restrictions to deny all and then add a rule to allow the Azure Front Door service tag AzureFrontDoor.Frontend.

Answer

Configure a WAF policy to block all requests that do not contain the X-Azure-FDID header.

Question 5

You need to securely connect an on-premises network to an Azure virtual network. The connection must use the internet and provide authenticated and encrypted communication. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct choice because it creates an encrypted site-to-site VPN connection over the internet using IPsec/IKE protocols. This meets the requirement for authenticated and encrypted communication between an on-premises network and an Azure virtual network without needing a dedicated private link.

Answer

Azure ExpressRoute

Answer

Azure Application Gateway

Answer

Azure Virtual WAN

Question 6

A company has deployed Azure Firewall in a hub virtual network with forced tunneling enabled. Spoke virtual networks are peered to the hub. The security team reports that outbound traffic from the spoke VMs is bypassing the firewall. What is the most likely reason?

Accepted Answer

The spoke subnets do not have a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall.. Forced tunneling on Azure Firewall requires that all outbound traffic from spoke VMs is routed to the firewall via a user-defined route (UDR) with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop. Without this route, traffic from spoke subnets will use the default system route and bypass the firewall, even if the firewall itself is configured with forced tunneling.

Answer

The Azure Firewall policy has an allow-all network rule.

Answer

Azure Firewall is deployed in the same virtual network as the spoke VMs.

Answer

The spoke virtual networks are not peered to the hub.

Question 7

You are designing a network security strategy for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure solution should you use to isolate the tiers?

Accepted Answer

Network security groups (NSGs) on each subnet. Network security groups (NSGs) on each subnet are the correct solution because they provide stateful, layer-3/layer-4 traffic filtering at the subnet level. By placing the web tier in a subnet with an NSG that allows inbound HTTP/HTTPS from the internet, and placing the application and database tiers in separate subnets with NSGs that only allow inbound traffic from the web tier subnet (using source IP ranges or service tags), you effectively isolate the tiers while permitting the required east-west traffic.

Answer

Azure DDoS Protection

Answer

Azure Firewall with application rules

Answer

Azure Private Link

Question 8

A company uses Azure Bastion to provide secure RDP and SSH access to Azure VMs without public IPs. Recently, a security audit recommended logging all connections to Bastion. What should you enable?

Accepted Answer

Diagnostic settings on the Bastion resource to stream Bastion logs to a Log Analytics workspace. Azure Bastion does not support Network Security Group flow logs or Azure Activity Logs for capturing connection-level details like source IP, target VM, or session duration. Diagnostic settings on the Bastion resource must be enabled to stream Bastion logs (e.g., BastionAuditLogs) to a Log Analytics workspace, which records all RDP/SSH connection attempts and session metadata. This is the only way to meet the audit requirement for logging all connections to Bastion.

Answer

Azure Monitor alerts for Bastion resource health

Answer

Azure Activity Logs for the Bastion resource

Answer

Network Security Group flow logs on the subnet containing Bastion

Question 9

Your organization has multiple Azure subscriptions and wants to centrally manage Azure Firewall policies across all subscriptions. What should you use?

Accepted Answer

Azure Firewall Manager. Azure Firewall Manager is the correct choice because it provides a centralized platform to create, manage, and enforce firewall policies across multiple Azure subscriptions and regions. It allows you to define a parent policy that child firewall instances inherit, ensuring consistent security rules without manual per-firewall configuration. This aligns directly with the requirement for central management of Azure Firewall policies.

Answer

Azure Policy to enforce firewall rules

Answer

Azure Resource Manager templates

Answer

Azure Network Watcher

Question 10

A company plans to use Azure Private Endpoint to securely connect to an Azure SQL Database from an on-premises network via ExpressRoute. The private endpoint is deployed in a hub virtual network. The on-premises network is connected to the hub via ExpressRoute. What additional configuration is needed to ensure on-premises clients can resolve the private endpoint's DNS name?

Accepted Answer

Configure a DNS forwarder on-premises to forward the private link domain to Azure DNS.. Azure Private Endpoint requires DNS resolution to map the private endpoint's private IP address to the fully qualified domain name (FQDN) of the Azure SQL Database. On-premises clients connected via ExpressRoute cannot resolve the private link domain (e.g., `*.database.windows.net`) to the private IP unless a DNS forwarder is configured on-premises to forward queries for the `privatelink.database.windows.net` zone to Azure DNS (168.63.129.16). This ensures that DNS queries from on-premises resolve to the private endpoint IP instead of the public IP of the SQL Database.

Answer

Configure a network security group to allow inbound traffic from on-premises to the private endpoint.

Answer

Deploy a VPN gateway in the hub VNet for additional encryption.

Answer

Add a public DNS record for the SQL Database pointing to the private endpoint IP.

Question 11

A company uses Azure Firewall to inspect traffic between a spoke VNet hosting a web application and a hub VNet hosting a SQL database. The web application fails to connect to the database after a recent network topology change. You verify that the Azure Firewall rules allow the traffic. Which Azure Network Watcher feature should you use to identify the root cause?

Accepted Answer

Connection troubleshoot. Connection troubleshoot (Option A) is the correct choice because it performs an end-to-end connectivity test from the source VM to the destination, evaluating the actual path, including Azure Firewall rules, NSGs, and route tables. Since the firewall rules are confirmed to allow the traffic, Connection troubleshoot can identify if a UDR misrouting or an NSG on the source or destination subnet is blocking the connection. IP flow verify only checks NSG rules at a single network interface and does not evaluate route tables or the entire path.

Answer

Next hop

Answer

Network Performance Monitor

Answer

IP flow verify

Question 12

Your company uses Azure Virtual WAN with a secured virtual hub (Azure Firewall). You have branch offices connected via ExpressRoute. You need to ensure that traffic from a branch to a VNet in the same region is inspected by the firewall. You configure the default route (0.0.0.0/0) advertisement from the hub to the branch, but the traffic is not being inspected. What is the most likely reason?

Accepted Answer

Routing intent for private traffic is not enabled.. Routing intent for private traffic must be enabled on the Virtual WAN hub to ensure that inter-VNet and branch-to-VNet traffic (private IP ranges) is routed through the Azure Firewall. Without routing intent, only internet-bound traffic (0.0.0.0/0) is forced through the firewall by the default route, while private traffic between branches and VNets bypasses inspection. Enabling routing intent for private traffic overrides the default behavior and injects the firewall as the next hop for all private traffic.

Answer

The 'Inter-hub' setting is disabled.

Answer

The branch does not have a route table associated with the connection.

Answer

The VNet has a network virtual appliance (NVA) that overrides the firewall.

Question 13

You need to block outbound internet access from all VMs in a VNet except for specific allowed destinations (e.g., Microsoft updates). You cannot use a third-party NVA. Which Azure service should you use to meet this requirement?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that can filter outbound traffic from VMs in a VNet based on fully qualified domain names (FQDNs), IP addresses, and port/protocol rules. It supports application rules (e.g., allow *.update.microsoft.com) and network rules, enabling you to block all outbound internet access except for specific allowed destinations like Microsoft Updates. Unlike NSGs, Azure Firewall provides stateful inspection and centralized logging, making it the correct choice for this requirement without a third-party NVA.

Answer

Azure Bastion

Answer

Network Security Groups (NSGs)

Answer

Azure Virtual Network NAT

Question 14

You have an Azure Web Application Firewall (WAF) policy associated with an Azure Front Door instance. You want to block requests from a specific country (e.g., Country X) unless the request includes a valid API key. How should you configure this?

Accepted Answer

Use a geo-match custom rule to block Country X, and create a separate custom rule with higher priority to allow traffic from Country X if the request contains the API key header.. Azure WAF custom rules are evaluated in priority order, and a higher-priority 'allow' rule can override a lower-priority 'block' rule. By creating a geo-match rule to block Country X, and then a separate custom rule with a higher priority (lower numeric value) that allows requests from Country X if they contain a valid API key header, you achieve the conditional access requirement. This leverages WAF's ability to inspect request headers and apply logic based on multiple conditions within a single policy.

Answer

Use a geo-match custom rule to allow all countries except Country X, and use a rate limit rule to block Country X.

Answer

Configure IP restriction on the origin to block Country X IPs.

Answer

Configure the WAF policy to use 'Prevention' mode and add a managed rule set that includes the country block.

Question 15

You configure Azure Bastion to allow secure RDP access to VMs in a VNet. However, users report that they cannot connect to a specific VM, while other VMs in the same VNet are accessible. The VM is running and has a public IP. What is the most likely cause?

Accepted Answer

The NSG on the VM's subnet does not allow inbound RDP from the AzureBastionSubnet.. Azure Bastion provides secure RDP/SSH connectivity to VMs in a peered VNet without exposing public IPs. For Bastion to reach a VM, the Network Security Group (NSG) on the VM's subnet must allow inbound TCP traffic on port 3389 from the AzureBastionSubnet (which uses the Azure Bastion service's private IP range). If the NSG blocks this traffic, Bastion cannot establish the RDP session even though the VM is running and has a public IP. The correct answer is B because the NSG misconfiguration is the most likely cause when other VMs in the same VNet are accessible.

Answer

The user does not have 'Reader' role on the VM.

Answer

The VM is located in a different region than the Bastion host.

Answer

The VM has a public IP assigned, which interferes with Bastion connectivity.