AZ-500 Secure networking Practice Test 13 — 15 Questions

Question 1

You are configuring Azure DDoS Network Protection for your VNet. Which TWO benefits does enabling DDoS Protection Standard provide?

Accepted Answer

Adaptive tuning to baseline traffic patterns.. Option B is correct because Azure DDoS Protection Standard continuously monitors traffic and uses adaptive tuning to learn your application's normal traffic patterns, then automatically adjusts mitigation thresholds to match that baseline, enabling accurate detection of anomalies. Option E is correct because DDoS Protection Standard includes cost protection, which provides service credits for resource costs (such as scaled-out VM instances) incurred as a result of a documented DDoS attack. Option A is incorrect because DDoS Protection Standard does not perform packet inspection through Azure Firewall integration; it operates at Layers 3/4 within the Azure network fabric. Option C is incorrect because Layer 7 application protection is provided by Azure Web Application Firewall (WAF) on Application Gateway or Front Door, not by DDoS Protection Standard itself. Option D is incorrect because vulnerability scanning is not a DDoS Protection Standard feature; it is offered through separate services such as Microsoft Defender for Cloud.

Answer

Integration with Azure Firewall for packet inspection.

Answer

Application-layer (Layer 7) protection via integrated WAF.

Answer

Vulnerability scanning for web applications.

Question 2

You are designing network security for a multi-tier application deployed in Azure. The application consists of a front-end web tier, a middle-tier API, and a back-end database. All tiers must be isolated from the internet except the front-end, which must accept HTTPS traffic from the internet. You need to ensure that no traffic can bypass the network security controls. What should you implement?

Accepted Answer

Deploy Azure Firewall in a hub virtual network and route all traffic between tiers through the firewall for inspection.. Deploying Azure Firewall in a hub virtual network and routing all traffic between tiers through the firewall for inspection ensures that no traffic can bypass network security controls. This design enforces a forced tunneling architecture where all inter-tier traffic (e.g., from front-end to API to database) must traverse the firewall, allowing centralized inspection, logging, and filtering. This meets the requirement for complete isolation and control, as NSGs alone cannot prevent traffic from bypassing inspection if routes are not explicitly forced.

Answer

Place all tiers in the same virtual network and use Azure Front Door with WAF for the web tier, and rely on NSGs for internal traffic.

Answer

Deploy Network Security Groups (NSGs) on each subnet and allow only necessary traffic between tiers.

Answer

Use Azure Application Gateway with Web Application Firewall (WAF) in front of the web tier, and use NSGs for the other tiers.

Question 3

You are configuring Azure Private Link for a SQL Database. You want to ensure that all traffic from your virtual network to the SQL Database stays within the Microsoft Azure backbone network. What is the primary benefit of using Azure Private Link over a service endpoint?

Accepted Answer

Private Link assigns a private IP address to the SQL Database within your virtual network, preventing exposure to the public internet.. Azure Private Link exposes the SQL Database as a private endpoint within your virtual network, assigning it a private IP address from your VNet's address space. This ensures that all traffic to the database stays on the Microsoft backbone network and never traverses the public internet, which is the primary benefit over a service endpoint. Service endpoints still route traffic to the public endpoint of the SQL Database, even though the source traffic originates from the VNet.

Answer

Private Link provides higher throughput than service endpoints.

Answer

Private Link enables access to the SQL Database from on-premises via VPN/ExpressRoute without traversing the internet.

Answer

Private Link allows you to use NSGs to filter traffic to the SQL Database.

Question 4

You have an Azure Application Gateway v2 with WAF policy in prevention mode to protect a web app. Users report that legitimate requests are being blocked. You review the WAF logs and see many false positives. You need to resolve this while maintaining security. What should you do?

Accepted Answer

Use managed rule sets with custom rules to allow the legitimate traffic that is being falsely blocked.. Azure Application Gateway WAF allows you to use managed rule sets (e.g., OWASP 3.2) and then add custom rules to explicitly allow traffic that is being falsely blocked. This approach maintains the WAF in prevention mode, ensuring that true threats are still blocked, while overriding false positives for specific request patterns (e.g., based on URI, headers, or source IP). Custom rules are evaluated before managed rules, so you can create an 'allow' rule with a higher priority to bypass the false positive detection.

Answer

Add a custom rule to block all requests that do not match a known pattern.

Answer

Disable the WAF and rely on NSGs.

Answer

Switch the WAF policy to detection mode.

Question 5

You need to allow a specific IP address (203.0.113.5) to access an Azure Storage account over the internet. All other internet traffic must be denied. You have enabled the storage account firewall. What should you configure?

Accepted Answer

Add the IP address to the firewall rules of the storage account.. The Azure Storage account firewall allows you to configure IP-based access control rules. By adding the specific IP address 203.0.113.5 to the firewall rules, you explicitly permit traffic from that IP while denying all other internet traffic, as the default rule is to deny when the firewall is enabled.

Answer

Create a private endpoint for the storage account.

Answer

Configure an NSG on the subnet to allow the IP address.

Answer

Add a service endpoint for Microsoft.Storage to the subnet.

Question 6

Which TWO actions can be taken using Azure Network Watcher?

Accepted Answer

Diagnose whether a security rule is blocking traffic to a VM.. Azure Network Watcher includes the IP flow verify capability, which checks whether a packet is allowed or denied to or from a VM and identifies the specific security rule (NSG rule) responsible, so option A is correct. It also includes the Next hop capability, which determines the next hop type and IP address for traffic originating from a VM, validating routing behavior, so option D is correct. Options B, C, and E are incorrect because private endpoints, Application Gateway WAF policies, and Azure Firewall rules are configured through their respective services (Private Link, Application Gateway, and Azure Firewall), not through Network Watcher.

Answer

Create and manage private endpoints.

Answer

Configure WAF policies on Application Gateway.

Answer

Configure Azure Firewall rules.

Question 7

You need to design a network security solution for a hub-spoke topology. The hub contains Azure Firewall and Azure Bastion. Spoke VNets contain application workloads. You need to ensure that all traffic from the spokes to the internet is routed through the Azure Firewall. What should you configure?

Accepted Answer

Add a user-defined route (UDR) on the spoke subnets with 0.0.0.0/0 next hop to the Azure Firewall private IP.. A user-defined route (UDR) with 0.0.0.0/0 and next hop set to the Azure Firewall's private IP forces all internet-bound traffic from spoke subnets to be routed through the firewall. This ensures traffic inspection and control by the firewall, which is a key requirement in a hub-spoke topology for centralized security.

Answer

Use service endpoints for internet-bound traffic.

Answer

Enable BGP on the spoke VNets and advertise a default route from the hub.

Answer

Configure the Azure Firewall to have a default route to the internet.

Question 8

Your company uses Azure Firewall Premium with TLS inspection to filter outbound traffic from Azure VMs. Users report that some websites are not loading. You have configured the firewall to inspect traffic to *.microsoft.com. What is the most likely cause of the issue?

Accepted Answer

The client does not trust the certificate presented by the firewall during TLS inspection.. Azure Firewall Premium with TLS inspection acts as a man-in-the-middle (MITM) proxy. It decrypts outbound HTTPS traffic, inspects it, then re-encrypts it using a certificate signed by an internal CA. If the client VM does not trust the firewall's internal CA certificate (e.g., it is not installed in the Trusted Root Certification Authorities store), the browser will reject the connection, causing websites to fail to load even though the firewall rule is correctly configured.

Answer

The firewall rule for *.microsoft.com is misconfigured.

Answer

The firewall cannot inspect HTTPS traffic.

Answer

The firewall is blocking HTTP traffic.

Question 9

You are troubleshooting connectivity issues from an Azure VM to an on-premises server. The VM is in a VNet that uses a custom DNS server. The on-premises network is connected via ExpressRoute. You can ping the on-premises server by IP address but not by name. What is the most likely cause?

Accepted Answer

The custom DNS server does not have a conditional forwarder to the on-premises DNS.. The custom DNS server in the Azure VNet is authoritative for the VNet's DNS resolution. When the VM tries to resolve the on-premises server's name, the custom DNS server does not know how to forward the query to the on-premises DNS infrastructure. A conditional forwarder must be configured on the custom DNS server to send queries for the on-premises domain to the on-premises DNS server, which is reachable via ExpressRoute. Without this forwarder, name resolution fails even though IP connectivity (ping) works.

Answer

The ExpressRoute circuit is not configured for DNS forwarding.

Answer

The Azure Private DNS zone does not include the on-premises hostname.

Answer

An NSG rule is blocking DNS traffic.

Question 10

You need to secure traffic between two VNets in different Azure regions. The VNets contain virtual machines that must communicate over private IP addresses. Which Azure service should you use?

Accepted Answer

VNet peering. VNet peering enables direct, private IP connectivity between two VNets in different Azure regions (global VNet peering). Traffic flows over the Microsoft backbone network, not the public internet, ensuring low-latency and secure communication between virtual machines using private IP addresses without requiring a gateway or additional appliance.

Answer

Azure Firewall

Answer

Azure VPN Gateway

Answer

ExpressRoute

Question 11

Your company has an Azure subscription with several VNets. You deploy Azure Firewall in a hub VNet. You need to ensure that all traffic from spoke VNets to the internet goes through the firewall. What should you configure?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. To force all internet-bound traffic from spoke VNets through Azure Firewall, you must create a user-defined route (UDR) with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. This route table must be associated with the subnets in the spoke VNets, ensuring that any traffic destined for the internet is redirected to the firewall for inspection and policy enforcement.

Answer

Configure forced tunneling on the spoke VNet gateways.

Answer

Enable VNet peering to the hub VNet.

Answer

Apply an Azure Firewall policy that denies internet access for spoke VNets.

Question 12

You need to provide secure remote access to Azure virtual machines for developers without exposing public IP addresses. The solution must authenticate users via Microsoft Entra ID and support multifactor authentication. Which service should you use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure RDP/SSH connectivity to Azure virtual machines directly from the Azure portal over TLS, without exposing public IP addresses. It integrates with Microsoft Entra ID for authentication and supports multifactor authentication (MFA) when combined with Conditional Access policies, meeting all requirements.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure Firewall

Question 13

You are designing network security for a three-tier application. You need to isolate each tier (web, application, data) and control traffic between them. Which TWO Azure services should you use to achieve this? (Choose two.)

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are correct because they let you define inbound and outbound security rules (by IP, port, and protocol) that filter traffic to and from subnets or NICs, which is exactly how you enforce isolation and control traffic between the web, application, and data tiers. Application Security Groups (ASGs) are correct because they let you group VMs by workload role (for example, web, app, or data) and then reference those groups as sources/destinations in NSG rules, so you can control tier-to-tier traffic without hardcoding individual IP addresses. Together, NSGs provide the filtering mechanism and ASGs provide the logical grouping that makes tier-based rules scalable and maintainable. VNet peering only connects virtual networks for private IP communication and does not itself filter or isolate tier traffic. Azure Policy is a governance/compliance tool for enforcing resource configurations, not a runtime traffic filter. Azure Firewall is a centralized, stateful network security service, but it is not the service used to isolate individual tiers within a VNet via subnet/NIC-level rules and workload grouping.

Answer

VNet peering

Answer

Azure Policy

Answer

Azure Firewall

Question 14

You need to monitor network traffic to detect anomalies and potential security threats. Which THREE Azure services can you use to achieve this? (Choose three.)

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel (A) is correct because it is a cloud-native SIEM/SOAR platform that ingests network telemetry and logs, applies analytics rules and machine learning to detect anomalies and security threats, and supports investigation and automated response. Azure Firewall logs (C) are correct because the firewall's network, application, and threat-intelligence logs capture allowed/denied traffic and malicious activity that can be analyzed for anomalies and threats. Azure Network Watcher (E) is correct because it provides network monitoring and diagnostic tools such as NSG flow logs, Traffic Analytics, packet capture, and connection monitor that reveal traffic patterns and anomalies. Azure Monitor Metrics (B) is not correct here because it stores numeric time-series metrics rather than detailed traffic/log data needed for threat detection. Azure Policy (D) is not correct because it is a governance service that enforces and audits resource configurations, not a network traffic monitoring or threat detection tool.

Answer

Azure Monitor Metrics

Answer

Azure Policy

Question 15

You are designing a hub-and-spoke network topology with Azure Firewall in the hub VNet. Which TWO components are essential for routing traffic from spoke VNets through the firewall? (Choose two.)

Accepted Answer

VNet peering between spoke and hub VNets. Option D is correct because VNet peering between each spoke and the hub VNet is the foundational connectivity that allows traffic to flow from spokes to the hub where Azure Firewall resides; without peering (or another connectivity method), spoke traffic cannot reach the firewall at all. Option E is correct because even with peering, Azure's default system routes would send internet-bound traffic directly out of the spoke, so user-defined routes (UDRs) in a route table must set 0.0.0.0/0 (and typically spoke-to-spoke prefixes) with a next hop of the Azure Firewall's private IP to force traffic through the firewall for inspection. Option A is incorrect because Azure Private DNS zones provide name resolution for private endpoints and are unrelated to traffic routing through a firewall. Option B is incorrect because Azure Bastion provides secure RDP/SSH access to VMs and does not influence packet routing between VNets. Option C is incorrect because a VPN gateway in each spoke is not required for hub-and-spoke firewall routing; VNet peering is the standard mechanism, and gateways are only needed for hybrid/on-premises connectivity, typically deployed in the hub.

Answer

Azure Private DNS zones

Answer

Azure Bastion host in the hub VNet

Answer

VPN gateway in each spoke VNet