AZ-500 Secure networking Practice Test 12 — 15 Questions

Question 1

You are a security engineer for a large enterprise. The company uses Azure Firewall Premium to inspect traffic. You need to enable TLS inspection for outbound HTTPS traffic from a subnet containing line-of-business applications. Which TWO configurations are required to accomplish this? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Upload a trusted root certificate authority (CA) certificate to Azure Firewall.. Azure Firewall Premium requires a trusted root CA certificate to be uploaded in order to decrypt outbound HTTPS traffic, re-encrypt it, and present a certificate signed by that CA to the client. Without a trusted root CA, the firewall cannot generate valid certificates for the intercepted connections, and clients will receive certificate errors.

Answer

Enable the TLS inspection feature in the Azure Firewall configuration.

Answer

Configure a custom DNS server on the Azure Firewall.

Answer

Disable SNAT on the Azure Firewall for the application subnet.

Question 2

Your company has deployed Azure Kubernetes Service (AKS) in a virtual network. The AKS cluster needs to pull images from a private Azure Container Registry (ACR) that has a private endpoint configured. The virtual network where AKS is deployed is peered to the ACR's virtual network. You have configured the AKS cluster to use managed identity for authentication to ACR. However, the AKS cluster is unable to pull images from the ACR. You need to resolve the connectivity issue without exposing the ACR to the internet. What should you do?

Accepted Answer

Link the private DNS zone of the ACR private endpoint to the AKS virtual network.. The AKS cluster cannot pull images from the private ACR because the private endpoint's DNS resolution is not propagated to the AKS virtual network. By linking the private DNS zone of the ACR private endpoint to the AKS virtual network, the AKS nodes can resolve the ACR's private FQDN to the private IP address of the endpoint, enabling connectivity without exposing the ACR to the internet.

Answer

Update the AKS cluster's DNS server to use a custom DNS that can resolve the private endpoint.

Answer

Delete the private endpoint and configure ACR firewall rules to allow the AKS subnet.

Answer

Recreate the AKS cluster with a different managed identity that has ACR pull permissions.

Question 3

Your organization uses Microsoft Sentinel for security monitoring. You have configured data connectors to collect logs from Azure Firewall and Windows Event logs from virtual machines. You need to ensure that network traffic from a specific subnet is not sent to Microsoft Sentinel due to privacy regulations. What should you do?

Accepted Answer

Modify the Azure Firewall data connector settings to exclude the subnet IP range.. The Azure Firewall data connector in Microsoft Sentinel allows you to filter logs by IP address ranges during configuration. By excluding the specific subnet IP range from the connector's settings, you prevent logs from that subnet from being ingested into Sentinel, ensuring compliance with privacy regulations without affecting other data sources.

Answer

Create an analytics rule to delete events from the subnet after ingestion.

Answer

Configure a network security group (NSG) to block traffic from the subnet to Microsoft Sentinel.

Answer

Create a workbook in Microsoft Sentinel that filters out the subnet data.

Question 4

You are a security architect for a global company. The company uses Azure Front Door to publish web applications. You need to ensure that only traffic from Azure Front Door's backend IP ranges can reach the origin servers. The origin servers are behind Azure Application Gateway. You have already configured Access Restrictions on the Application Gateway to allow only Azure Front Door's backend IP ranges. However, you discover that the Application Gateway is still receiving traffic from other sources. You need to implement a defense-in-depth approach to ensure only Azure Front Door traffic reaches the origin. What should you do?

Accepted Answer

Configure Azure Front Door Premium with Private Link origin to the Application Gateway.. Azure Front Door Premium supports Private Link origins, which allows traffic to reach the Application Gateway over a private endpoint. This ensures that only traffic originating from the Front Door service can reach the origin, bypassing public IP-based restrictions and providing a defense-in-depth layer that IP-based access restrictions alone cannot guarantee.

Answer

Enable Web Application Firewall (WAF) on the Application Gateway to block non-Front Door traffic.

Answer

Add a network security group (NSG) on the Application Gateway subnet to deny all traffic except from Front Door's IP ranges.

Answer

Use Azure Front Door geo-filtering to block all countries except the home country.

Question 5

A company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. The security team wants to ensure that all outbound internet traffic from VMs in the spokes flows through the Azure Firewall. What should be configured?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. To force all outbound internet traffic from spoke VNets through the Azure Firewall, you must create a route table with a default route (0.0.0.0/0) that has the Azure Firewall's private IP as the next hop, and associate that route table with the subnets in the spoke VNets. This overrides the default system route and sends all internet-bound traffic to the firewall. Option B is wrong because forced tunneling on a VPN gateway is used to route on-premises traffic, not to direct spoke traffic through the firewall. Option C is wrong because the route table should be associated with spoke subnets, not the hub subnet. Option D is wrong because NSGs do not support next-hop routing; they filter traffic, not direct it.

Answer

Configure forced tunneling on the VPN gateway to route all traffic through the Azure Firewall.

Answer

Create a route table with a default route to the VPN gateway and associate it with the hub subnet.

Answer

Configure an NSG on the spoke subnets with a rule that sends traffic to the Azure Firewall.

Question 6

A company uses Azure Front Door (AFD) with WAF policy in front of a web application. The security team notices that some requests from a specific IP range are being blocked incorrectly. The WAF policy uses custom rules. The team wants to allow a specific IP range while still having the WAF inspect other traffic. What is the most efficient way to configure this?

Accepted Answer

Create a custom rule with priority 1, action 'Allow', and match condition for the source IP range.. Custom rules with priority 1 are evaluated before all other rules, including managed rule sets. By setting action 'Allow' and matching the source IP range, those requests bypass further inspection. Option A is wrong because a priority 100 rule with 'Block' would block the IP range, not allow it. Option C is wrong because rate limit rules control request rates, not allow traffic from a specific IP range. Option D is wrong because geo-match conditions filter by geography, not by IP address range.

Answer

Add a custom rule with priority 100, action 'Block', and match condition for the IP range.

Answer

Add a rate limit rule that allows traffic from the IP range.

Answer

Disable the managed rule sets for the specific IP range using a geo-match condition.

Question 7

You are designing network security for a multi-tier application. The web tier must be accessible from the internet, but the database tier must only be accessible from the web tier. Both tiers are in the same virtual network. Which Azure service should you use to restrict traffic between the tiers?

Accepted Answer

Network Security Group (NSG). A Network Security Group (NSG) can be associated with the subnet or NIC of the database tier to allow only inbound traffic from the web tier's private IP addresses or subnet. Option A is wrong because a route table controls routing, not traffic filtering. Option C is wrong because Azure Firewall is a managed firewall, but it's overkill and costlier than an NSG for simple subnet-to-subnet filtering. Option D is wrong because Application Security Groups (ASGs) are used to group VMs but still require NSG rules to enforce traffic restrictions.

Answer

Route table

Answer

Azure Firewall

Answer

Application Security Groups (ASGs)

Question 8

A company is deploying Azure Bastion to provide secure RDP/SSH access to VMs in a virtual network. The security requirement is that all administrative access must be logged and audited. What additional configuration is needed to meet this requirement?

Accepted Answer

Enable diagnostic settings on Azure Bastion to send logs to a Log Analytics workspace.. Enabling diagnostic settings on Azure Bastion allows capturing logs of all RDP/SSH connections, including who connected, from where, and session duration. These logs can be sent to a Log Analytics workspace for auditing and analysis. Option A is incorrect because NSG flow logs capture network traffic flows, not Bastion session metadata. Option C is incorrect because the Azure Activity Log records management plane operations (e.g., creating or deleting Bastion resources), not the data plane RDP/SSH sessions. Option D is incorrect because diagnostic settings on the target VMs capture OS-level logs, but since Bastion proxies the connection, the VM logs do not include the Bastion-specific connection metadata required for auditing.

Answer

Enable NSG flow logs on the subnet containing the target VMs.

Answer

Enable Azure Activity Log for the Bastion resource.

Answer

Configure diagnostic settings on the target VMs to send logs to Log Analytics.

Question 9

A company uses Azure Firewall Premium to inspect outbound traffic. They want to deploy a web application that must comply with the Payment Card Industry Data Security Standard (PCI DSS). Which TWO capabilities should be enabled to meet PCI DSS requirements for network security?

Accepted Answer

Intrusion Detection and Prevention System (IDPS). Options A and B are correct. IDPS (Intrusion Detection and Prevention System) provides signature-based detection and prevention of network threats, which is required by PCI DSS to protect cardholder data. TLS inspection allows the firewall to decrypt and inspect HTTPS traffic, ensuring that encrypted traffic is also inspected for malicious content, a key PCI DSS requirement. Option C is wrong because URL filtering is a web content filtering feature, not specifically mandated by PCI DSS. Option D is wrong because DNS proxy is a name resolution feature, not a security compliance requirement. Option E is wrong because SNAT is used for outbound connectivity translation, not for security inspection.

Answer

URL filtering

Answer

DNS proxy

Answer

Source Network Address Translation (SNAT)

Question 10

Refer to the exhibit. An Azure Firewall Policy snippet is shown. A security administrator deploys this policy to the Azure Firewall. However, they receive reports that some VMs can still access the internet. What is the most likely reason?

Accepted Answer

There is another rule collection with a higher priority that allows traffic.. In Azure Firewall Policy, rule collections within a rule collection group are evaluated in priority order (lower number = higher priority). The depicted snippet shows a rule with action 'Deny', but there may be another rule collection with a higher priority (e.g., priority 100 vs. 200) that contains an allow rule. That allow rule would be evaluated first, permitting the traffic before the deny rule is reached. Option A is incorrect because 'Internet' is a valid service tag in Azure Firewall; it is not required to use '*'. Option B is incorrect because the action 'Deny' is correctly spelled. Option C is incorrect because '*' is supported for sourceAddresses in outbound rules; it represents all source IPs.

Answer

The destination "Internet" is not a valid service tag; it should be "*" for all destinations.

Answer

The action type "Deny" is misspelled; it should be "Deny".

Answer

The sourceAddresses field uses "*" which is not supported for outbound rules.

Question 11

You are a security engineer for a large enterprise that uses Azure Virtual WAN with multiple ExpressRoute circuits connecting on-premises data centers to Azure. The company has recently acquired a subsidiary that uses a different Azure tenant. The subsidiary has its own virtual networks and wants to connect to the parent company's Azure Virtual WAN to share resources. The security requirement is that traffic must be encrypted over the public internet, and the connection must be established without any on-premises hardware. You need to recommend a solution to securely connect the subsidiary's Azure virtual network to the parent's Virtual WAN. The solution should minimize administrative overhead and use Azure-native services.

Accepted Answer

Deploy a VPN gateway in the subsidiary's virtual network and connect it to the parent's Virtual WAN VPN gateway using site-to-site VPN.. Deploying a VPN gateway in the subsidiary's virtual network and connecting it to the parent's Virtual WAN VPN gateway via site-to-site VPN (IPsec) provides encrypted connectivity over the public internet without any on-premises hardware, meeting the security requirement and minimizing administrative overhead with Azure-native services.

Option B is incorrect: Azure Bastion is designed for secure RDP/SSH access to virtual machines, not for routing network traffic between VNets.

Option C is incorrect: While Virtual WAN supports transitive routing through VNet peering, peering alone does not enforce encryption, and cross-tenant peering is complex; a VPN gateway is required for encrypted transit over the internet.

Option D is incorrect: ExpressRoute provides a private connection but requires on-premises equipment and does not traverse the public internet, contradicting the requirement for encryption over the public internet.

Answer

Deploy Azure Bastion in both VNets and use it to route traffic between them.

Answer

Use Virtual WAN's built-in VNet-to-VNet transitive routing by peering the subsidiary's VNet to the parent's VNet.

Answer

Establish an ExpressRoute circuit from the subsidiary's Azure region to the parent's region.

Question 12

Your company has an Azure subscription with a hub-spoke network topology. The hub contains an Azure Firewall and a VPN gateway for on-premises connectivity. The spoke virtual network hosts a critical application. You need to ensure that all outbound traffic from the spoke to the internet and on-premises networks flows through the Azure Firewall. You configure a user-defined route (UDR) on the spoke subnet with the default route (0.0.0.0/0) pointing to the Azure Firewall private IP. However, traffic to on-premises still bypasses the firewall. What is the most likely cause?

Accepted Answer

The on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the UDR. The most likely cause is that the on-premises traffic uses a more specific route learned via BGP from the VPN gateway, which overrides the user-defined route (UDR). In Azure, when a UDR and a BGP-propagated route both match traffic, the route with the most specific prefix (longest prefix match) wins. Since on-premises networks are typically advertised with specific IP prefixes (e.g., 10.0.0.0/16) rather than 0.0.0.0/0, the BGP-learned routes take precedence, causing traffic to bypass the Azure Firewall.

Answer

The UDR must be applied to the subnet that hosts the Azure Firewall

Answer

The spoke subnet does not have 'GatewaySubnet' route propagation enabled

Answer

The Azure Firewall is not configured with a route to the on-premises network

Question 13

A company has a hub-spoke network topology with Azure Firewall deployed in the hub virtual network. Spoke virtual networks are peered to the hub. The security team needs to ensure that all outbound internet traffic from virtual machines in a spoke subnet goes through the Azure Firewall. They have configured a route table on the spoke subnet with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP address. However, traffic from spoke VMs is still bypassing the firewall and going directly to the internet. What is the most likely reason?

Accepted Answer

The route table is not associated with the spoke subnet.. The most likely reason is that the route table containing the default route (0.0.0.0/0) pointing to the Azure Firewall private IP has not been associated with the spoke subnet. Without this association, the subnet continues to use system routes, which include a default route to the internet via the Azure default gateway, allowing traffic to bypass the firewall. Associating the route table with the subnet is a required step to override the system default route.

Answer

Azure Firewall is not configured with DNAT rules for outbound traffic.

Answer

The spoke VNet peering does not allow gateway transit.

Answer

The route table has a higher priority than system routes.

Question 14

A company has two Azure virtual networks, VNet-A (hub) and VNet-B (spoke), connected via VNet peering. They deploy a network virtual appliance (NVA) in a subnet in VNet-A to inspect all traffic between the VNets. They configure a user-defined route (UDR) on the subnet in VNet-B with the destination address space of VNet-A (10.0.0.0/16) and the next hop set to the private IP of the NVA. However, traffic from VNet-B to VNet-A still bypasses the NVA and takes a direct path. What is the most likely cause?

Accepted Answer

The NVA network interface does not have IP forwarding enabled. A network virtual appliance (NVA) requires IP forwarding to be enabled on its network interface to forward traffic not destined for itself. Without this setting, the NVA drops packets that arrive with a destination IP other than its own, causing the traffic to bypass the NVA and follow the default VNet peering route. Enabling IP forwarding allows the NVA to act as a router and forward traffic between VNets as specified by the user-defined route.

Answer

The NVA's private IP address is not reachable from VNet-B

Answer

VNet peering system routes override user-defined routes

Answer

The UDR must be applied to the gateway subnet of VNet-B

Question 15

A company has two Azure virtual networks, VNet-A and VNet-B, connected via VNet peering. They want all traffic between the VNets to be inspected by a network virtual appliance (NVA) deployed in a subnet in VNet-A. They have configured a user-defined route (UDR) on the subnet in VNet-B that points the destination address space of VNet-A to the private IP of the NVA. However, traffic between the VNets is still not passing through the NVA. What is the most likely cause?

Accepted Answer

The NVA's network interface (NIC) does not have IP forwarding enabled.. The most likely cause is that the NVA's network interface (NIC) does not have IP forwarding enabled. Even with a correctly configured UDR on VNet-B pointing traffic to the NVA's private IP, the NVA will drop any traffic not destined for its own IP unless IP forwarding is enabled on its NIC. This setting allows the NVA to accept packets with a destination other than itself and forward them based on its routing table, which is essential for traffic inspection scenarios.

Answer

The UDR is not associated with the subnet in VNet-B.

Answer

The VNet peering connection is not in a 'Connected' state.

Answer

The NVA is deployed in the same subnet as the source VMs.