AZ-500 Secure networking Practice Test 14 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an NSG rule configuration for a subnet. The source subnet is 10.0.0.0/24 and the destination subnet is 10.0.1.0/24. What is the effect of this rule?

Accepted Answer

Allows inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.. The rule shown in the exhibit is an inbound security rule with source 10.0.0.0/24, destination 10.0.1.0/24, protocol TCP, destination port 22 (SSH), and action Allow. This explicitly permits inbound SSH traffic from the source subnet to the destination subnet. Therefore, option D is correct.

Answer

Allows outbound SSH traffic from 10.0.1.0/24 to 10.0.0.0/24.

Answer

Blocks inbound SSH traffic from 10.0.0.0/24 to 10.0.1.0/24.

Answer

Allows all inbound traffic from 10.0.0.0/24 to 10.0.1.0/24.

Question 2

Refer to the exhibit. You have a VNet with two subnets, each with a different NSG. Both NSGs have default rules. What is the default connectivity between VMs in subnetA and subnetB?

Accepted Answer

Traffic is allowed by default.. By default, Network Security Groups (NSGs) include an inbound rule named 'AllowVNetInBound' that permits traffic from any virtual network (including peered VNets) to any destination within the VNet. Since subnetA and subnetB are both part of the same VNet, this default rule allows all traffic between VMs in these subnets, regardless of the separate NSG assignments. No additional configuration like peering is required because the subnets share the same virtual network boundary.

Answer

Traffic is blocked by default.

Answer

Traffic is allowed only if the VNet has peering.

Answer

Traffic is allowed only if the subnets are in the same region.

Question 3

You are designing a secure network architecture for a three-tier application. The web tier must be accessible from the internet, while the application and database tiers must only be accessible from the web tier. Which Azure service should you use to isolate the tiers most securely?

Accepted Answer

Network security groups (NSGs) on subnets. Network security groups (NSGs) on subnets are the correct choice because they provide stateful, layer-3/layer-4 traffic filtering at the subnet level, allowing you to explicitly deny all inbound traffic to the application and database subnets except from the web tier's subnet or private IP range. This creates a micro-segmentation boundary that enforces the principle of least privilege without introducing additional latency or routing complexity.

Answer

Azure Firewall with application rules

Answer

Azure Front Door with Web Application Firewall

Answer

VNet peering between tiers

Question 4

Your company has multiple Azure subscriptions managed through Azure Firewall Manager. You need to deploy Azure Firewall policies that apply to all subscriptions in a region. What is the most efficient way to manage this?

Accepted Answer

Use Azure Firewall Manager to create a parent policy and assign it to all firewalls. Azure Firewall Manager provides a centralized management plane for firewall policies across multiple subscriptions and regions. By creating a parent policy and assigning it to all firewalls, you ensure consistent rule enforcement without duplicating effort. This approach is the most efficient because it leverages inheritance, where child policies can override specific rules while inheriting the parent's base configuration.

Answer

Create a separate firewall policy for each subscription

Answer

Use Azure Policy to enforce firewall rules across subscriptions

Answer

Deploy a single network security group (NSG) to all VNets

Question 5

You need to block inbound traffic from the internet to a specific subnet except for TCP port 443. Which Azure service should you use?

Accepted Answer

Network security group (NSG). Network security groups (NSGs) are the correct choice because they provide stateful filtering of inbound and outbound traffic at the subnet or NIC level. By creating an inbound security rule that denies all traffic from the Internet (source 'Internet' service tag) and a higher-priority allow rule for TCP port 443, you can precisely block all inbound internet traffic except HTTPS. NSGs are the native Azure service for granular subnet-level access control lists (ACLs).

Answer

Azure Web Application Firewall (WAF)

Answer

Azure Firewall

Answer

Azure DDoS Protection

Question 6

Your organization has a hybrid network with an Azure VPN gateway connecting to an on-premises site. You need to ensure that traffic between Azure and on-premises is encrypted and authenticated. Which protocol should the VPN gateway use?

Accepted Answer

IPsec. Azure VPN gateways use IPsec (Internet Protocol Security) to establish secure site-to-site tunnels between Azure and on-premises networks. IPsec provides both encryption (via protocols like AES) and authentication (via IKEv2 or IKEv1) for all traffic traversing the VPN tunnel, ensuring confidentiality and integrity. This is the required protocol for Azure VPN gateway connections as defined in Microsoft documentation.

Answer

SSL/TLS

Answer

SSH

Answer

HTTPS

Question 7

You have an Azure application that uses a private endpoint for Azure SQL Database. Users report intermittent connectivity failures. You need to diagnose whether the private endpoint DNS resolution is working correctly. Which tool should you use?

Accepted Answer

nslookup. When using a private endpoint for Azure SQL Database, connectivity relies on DNS resolution returning the private IP address of the endpoint rather than the public IP. `nslookup` queries the DNS server directly and shows the resolved IP address, allowing you to verify that the private endpoint's private IP is being returned. If it returns the public IP or fails, DNS configuration is incorrect.

Answer

tracert

Answer

netstat

Answer

ping

Question 8

You need to restrict access to an Azure Storage account so that only traffic from a specific virtual network is allowed. What should you configure?

Accepted Answer

Storage account firewall and virtual network settings. Azure Storage accounts have a built-in firewall that can be configured to restrict access based on source IP addresses or virtual network (VNet) rules. By enabling the storage account firewall and adding a rule that allows traffic only from a specific VNet/subnet, you effectively block all other traffic, including internet traffic, while permitting requests from the designated VNet. This is the native Azure method for network-level access control to storage accounts.

Answer

Azure Firewall application rule

Answer

Private endpoint connection

Answer

Network security group (NSG) on the subnet

Question 9

Your company deploys a web application in an Azure App Service that needs to securely connect to an Azure SQL Database. You want to avoid exposing the database to the public internet. What is the recommended approach?

Accepted Answer

Use a private endpoint for the SQL database and VNet integration for the App Service. It uses Azure Private Endpoint to place the Azure SQL Database on a virtual network, removing its public endpoint, and combines it with VNet integration for the App Service to route traffic through the same VNet. This ensures the database is never exposed to the public internet, meeting the security requirement without relying on IP-based firewall rules that can change or be spoofed.

Answer

Configure the SQL database firewall to allow only the App Service outbound IP

Answer

Use Azure Firewall to block outbound traffic to the database

Answer

Create an NSG on the database subnet to deny internet traffic

Question 10

Which TWO Azure services can be used to filter inbound internet traffic to a virtual network? (Choose two.)

Accepted Answer

Azure Firewall. Both Azure Firewall and Network Security Groups (NSGs) can filter inbound internet traffic to a virtual network. Azure Firewall provides centralized, stateful filtering at Layers 3-7 with features like threat intelligence and application rules. NSGs are distributed, stateful packet filters that apply to subnets or NICs, filtering traffic based on source/destination IP, port, and protocol rules, and are commonly used to block inbound internet traffic at the subnet boundary.

Answer

Azure Bastion

Answer

Azure Front Door

Answer

VPN gateway

Question 11

Which THREE are best practices for securing network traffic in Azure? (Choose three.)

Accepted Answer

Use private endpoints for Azure services. Option A is correct because private endpoints assign a private IP address from your VNet to an Azure PaaS service via Azure Private Link, keeping traffic on the Microsoft backbone and eliminating exposure to the public internet. Option D is correct because just-in-time (JIT) VM access in Microsoft Defender for Cloud opens NSG rules only on demand for a limited time and from approved source IPs, reducing the attack surface of management ports like RDP 3389 and SSH 22. Option E is correct because service tags in NSG rules let you allow or deny traffic to specific Azure services (for example, Storage or Sql) by Microsoft-managed IP ranges, avoiding broad 0.0.0.0/0 or Internet rules and simplifying maintenance. Option B is not a best practice because assigning public IP addresses to every VM directly exposes them to internet scanning and brute-force attacks; VMs should generally be reached via Bastion, VPN, or private endpoints. Option C is not a best practice because allowing direct outbound internet access from VMs bypasses inspection and enables data exfiltration and command-and-control traffic; outbound traffic should be routed through Azure Firewall, NAT Gateway, or a user-defined route to a controlled egress point.

Answer

Assign public IP addresses to every VM

Answer

Allow direct outbound internet access from VMs

Question 12

Which TWO are valid connection methods for Azure VPN Gateway? (Choose two.)

Accepted Answer

Point-to-Site. Point-to-Site (P2S) is a valid connection method for Azure VPN Gateway because it allows individual client computers to connect securely to an Azure virtual network from anywhere using the SSTP, IKEv2, or OpenVPN protocols. This method is ideal for remote workers who need encrypted access without requiring a site-level VPN device.

Answer

VNet-to-VNet

Answer

Azure Bastion

Answer

ExpressRoute

Question 13

You need to restrict access to a web app hosted on Azure App Service so that only traffic from a specific virtual network (VNet) is allowed. Which Azure service should you configure?

Accepted Answer

App Service access restrictions. App Service access restrictions allow you to define an allow/deny list of IP addresses or virtual network (VNet) sources directly at the App Service level. By configuring a VNet integration and a service endpoint or private endpoint, you can restrict inbound traffic to only originate from a specific VNet, without needing an additional network appliance.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure Firewall

Question 14

You need to securely connect an on-premises network to Azure over the internet with encrypted traffic. The connection must be site-to-site and use IPsec. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway supports site-to-site (S2S) VPN connections over the internet using IPsec/IKE (IKEv1 or IKEv2) to encrypt traffic between an on-premises VPN device and Azure. This matches the requirement for an encrypted, internet-based site-to-site connection. ExpressRoute bypasses the internet entirely, Virtual WAN is a higher-level orchestration service that still relies on VPN Gateway for S2S IPsec, and Bastion is for RDP/SSH access to VMs without public IPs.

Answer

Azure ExpressRoute

Answer

Azure Virtual WAN

Answer

Azure Bastion

Question 15

Your company uses Azure Firewall Premium. You need to inspect outbound traffic for malware using signature-based detection. Which feature should you enable?

Accepted Answer

Intrusion Detection and Prevention System (IDPS). Intrusion Detection and Prevention System (IDPS) on Azure Firewall Premium uses signature-based detection to inspect outbound traffic for known malware patterns. It can alert or block traffic matching malicious signatures, making it the correct feature for this requirement.

Answer

Web categories

Answer

URL filtering

Answer

Threat intelligence-based filtering