AZ-500 Secure networking Practice Test 15 — 15 Questions

Question 1

You need to provide secure remote access to Azure virtual machines for administrators without exposing them to the public internet. The solution must use a single entry point and support Azure Active Directory (now Microsoft Entra ID) authentication. Which Azure service should you use?

Accepted Answer

Azure Bastion.. Option A is correct because Azure Bastion provides secure RDP/SSH access to VMs directly from the Azure portal, without public IPs, and supports Entra ID authentication. The other options either expose VMs or don't provide a single entry point.

Answer

Just-in-time (JIT) VM access with Microsoft Defender for Cloud.

Answer

Azure Front Door with private endpoints.

Answer

Azure VPN Gateway with point-to-site VPN.

Question 2

You have an Azure subscription with a virtual network (VNet1) that hosts a SQL Managed Instance. You need to connect from an on-premises application to the SQL Managed Instance using a private IP address, with minimal latency and without traversing the public internet. The on-premises network has a high-speed ExpressRoute connection to Microsoft. What should you configure?

Accepted Answer

Connect the on-premises network to Azure via ExpressRoute private peering and ensure the SQL Managed Instance subnet is reachable.. Option D is correct because SQL Managed Instance is deployed in a dedicated subnet and requires a private endpoint or direct connectivity. ExpressRoute with private peering is the best option for low latency and private connectivity.

Answer

Configure a public endpoint on the SQL Managed Instance and allow the on-premises public IP.

Answer

Use Azure Private Link Service and connect via a VPN.

Answer

Create a site-to-site VPN connection and enable forced tunneling.

Question 3

You are designing a secure network architecture for a multi-region application. You need to ensure that traffic between virtual networks in different Azure regions is encrypted and uses the Microsoft backbone network, and you must minimize latency. Which TWO configurations should you implement?

Accepted Answer

Configure VNet peering between the virtual networks.. Options A and B are correct. VNet peering uses Microsoft backbone and supports encryption. Global VNet peering connects across regions. Azure VPN Gateway would route over the internet, and ExpressRoute is an alternative but not required. Azure Firewall is for inspection, not connectivity.

Answer

Enable 'Gateway transit' on the peering to use a VPN gateway if needed, but not required for encryption.

Answer

Use Azure ExpressRoute with Microsoft peering.

Answer

Deploy Azure VPN Gateway in each region and connect them via site-to-site VPN.

Answer

Place an Azure Firewall in each region to inspect cross-region traffic.

Question 4

You have an Azure virtual network that hosts a critical application. You need to protect the virtual network from DDoS attacks. Which THREE actions should you take to implement a defense-in-depth approach?

Accepted Answer

Configure network security groups (NSGs) with deny-all inbound rules by default, then allow only necessary traffic.. Options A, C, and D are correct. Azure DDoS Network Protection provides mitigation at the network layer. NSGs filter unwanted traffic, and WAF protects web applications. Azure Firewall is for general traffic inspection, not specifically DDoS. Private endpoints help with exposure but not DDoS.

Answer

Use Azure Private Endpoints for all Azure services to remove public endpoints.

Answer

Deploy Azure Firewall with threat intelligence-based filtering.

Question 5

You are planning a migration of on-premises servers to Azure. You need to ensure that the Azure virtual network can communicate with the on-premises network securely and with high bandwidth. The on-premises network has a 1 Gbps internet connection. Which TWO options meet the requirements?

Accepted Answer

Site-to-site VPN over the internet.. Options A and D are correct. ExpressRoute provides high bandwidth and private connectivity. Site-to-site VPN over the internet is secure but limited by internet bandwidth. Point-to-site is for individual clients. VNet peering is Azure-to-Azure. Azure Firewall is not a connectivity method.

Answer

Point-to-site VPN from on-premises to Azure.

Answer

Azure Firewall with forced tunneling.

Answer

VNet peering between on-premises and Azure.

Question 6

Refer to the exhibit. You are evaluating an Azure Policy definition. What is the effect of this policy when assigned to a subscription?

Accepted Answer

It denies the creation of any virtual network because it always has subnets.. The policy denies any virtual network that has any subnet defined. It checks if the 'subnets' field exists and denies if true. It does not check for specific subnet configurations like NSGs or service endpoints.

Answer

It audits virtual networks to ensure they have a network security group attached.

Answer

It denies virtual networks that have any subnet with a service endpoint.

Answer

It denies the creation of virtual networks that do not have subnets.

Question 7

Refer to the exhibit. You ran the PowerShell command shown. Which statement about the network interface is true?

Accepted Answer

The network interface is attached to a virtual machine that is not accessible from the internet.. The output shows an empty PublicIpAddress field and no application security groups or load balancer pools. The NIC is in subnet 'web' with private IP 10.0.1.4. It is not associated with a public IP.

Answer

The network interface is part of an availability set.

Answer

The network interface is associated with a public IP address.

Answer

The network interface is configured with application security groups.

Question 8

Your company, Contoso Ltd., has a hybrid network with an on-premises data center in Chicago and an Azure subscription with a single virtual network (VNet1) in the East US region. VNet1 has multiple subnets: Web, App, and Data. The Web subnet hosts a load-balanced web application accessible from the internet via a public IP. The App subnet contains application servers that communicate with an on-premises database server in Chicago. The Data subnet contains Azure SQL databases. You have an ExpressRoute circuit connecting Chicago to East US with private peering. Recently, the security team discovered that some traffic from the App subnet to the on-premises database is bypassing the ExpressRoute and traversing the internet, causing latency and security concerns. You must ensure all traffic between VNet1 and the on-premises network uses the ExpressRoute connection. Additionally, you need to restrict inbound internet traffic to only the Web subnet, and all outbound internet traffic from the App and Data subnets must be inspected by an Azure Firewall deployed in a new subnet called AzureFirewallSubnet in VNet1. You have the following requirements: 1. All traffic to/from on-premises must use ExpressRoute. 2. Only the Web subnet should be directly accessible from the internet. 3. Outbound internet traffic from App and Data subnets must be routed through Azure Firewall. 4. Minimize management overhead. Which of the following is the most appropriate course of action?

Accepted Answer

Add a user-defined route (UDR) to the App and Data subnets with destination 0.0.0.0/0 and next hop set to the Azure Firewall private IP. Ensure the route to on-premises via ExpressRoute is present (system route or UDR).. Option B is correct because system routes already have a 0.0.0.0/0 route to the internet, and a route to the on-premises network via ExpressRoute. To force all outbound internet traffic through Azure Firewall, you need a UDR on the App and Data subnets with next hop to the firewall. For on-premises traffic, the system route via ExpressRoute should be sufficient, but if traffic is bypassing, you may need to propagate more specific routes. Option A is wrong because removing the 0.0.0.0/0 system route is not allowed. Option C is wrong because VPN Gateway adds complexity and cost. Option D is wrong because Azure Firewall alone does not enforce ExpressRoute usage.

Answer

Create a new Azure Firewall policy that blocks all outbound traffic except through ExpressRoute.

Answer

Remove the default 0.0.0.0/0 route from all subnets and add a route for on-premises via ExpressRoute.

Answer

Deploy a VPN Gateway and configure forced tunneling to send all traffic to on-premises for inspection.

Question 9

You are a security engineer at Fabrikam Inc. The company has an Azure subscription with a single virtual network (VNet1) that contains a production workload. The network is connected to an on-premises data center via a site-to-site VPN. The security team requires that all Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines in VNet1 must be brokered through Azure Bastion. Additionally, the team wants to ensure that no public IP addresses are assigned to any virtual machines in the production environment. Currently, there are several VMs with public IPs. You need to implement the requirements with minimal downtime. The solution must also ensure that administrators can access the VMs using Azure Bastion without any additional client software. What should you do?

Accepted Answer

Deploy Azure Bastion in the virtual network and then remove the public IP addresses from all VMs.. Option C is correct. Azure Bastion provides RDP/SSH access via the Azure portal without public IPs. To minimize downtime, you should deploy Bastion first, then remove public IPs from VMs. The other options either cause downtime (disassociate first) or don't meet the requirement (JIT still needs public IPs).

Answer

Create a point-to-site VPN for administrators and remove public IPs from VMs.

Answer

Deploy Azure Bastion in the virtual network, then configure Just-In-Time (JIT) VM access for all VMs.

Answer

Disassociate public IPs from all VMs, then deploy Azure Bastion in the same virtual network.

Question 10

You have an Azure virtual network (VNet1) with two subnets: SubnetA and SubnetB. SubnetA hosts web servers that must be accessible from the internet. SubnetB hosts application servers that should only be accessible from SubnetA. You need to configure network security groups (NSGs) to enforce this traffic flow. The solution must allow HTTP and HTTPS traffic from the internet to SubnetA, and allow only traffic from SubnetA to SubnetB. All other inbound traffic should be denied. What is the most efficient way to configure the NSGs?

Accepted Answer

Apply an NSG to SubnetA with inbound rules allowing HTTP/HTTPS from Internet, and apply a separate NSG to SubnetB with inbound rules allowing only traffic from SubnetA.. Option B is correct. Apply an NSG to SubnetA with rules allowing HTTP/HTTPS from internet and deny all other inbound. Apply an NSG to SubnetB with a rule allowing traffic from SubnetA and deny all other inbound. This is efficient and meets requirements. Option A is inefficient because rules on SubnetB would still allow traffic from internet if not denied. Option C is incorrect because ASGs alone don't filter traffic. Option D is incorrect because Azure Firewall is overkill.

Answer

Apply one NSG to both subnets with rules allowing HTTP/HTTPS from internet, and allow traffic from SubnetA to SubnetB.

Answer

Use application security groups (ASGs) on the web servers and application servers, and configure NSG rules referencing the ASGs.

Answer

Deploy Azure Firewall in the virtual network and configure application rules to allow HTTP/HTTPS to SubnetA and traffic to SubnetB.

Question 11

You are a security engineer for Contoso. The company uses Azure Firewall for all inbound and outbound traffic. To prevent misconfiguration, you assign the Azure Policy shown in the exhibit at the management group scope. After assignment, a network administrator reports that they cannot create a new subnet in an existing virtual network. The subnet creation fails with a 'deny' policy error. You need to allow subnet creation while still blocking NSG rule changes. What should you do?

Accepted Answer

Modify the policy rule to remove the subnet condition from the anyOf array.. The policy currently denies both NSG rule changes and subnet creation because the if condition uses anyOf. To allow subnet creation, you need to remove the subnet condition from the policy rule. Option A correctly updates the policy rule to only check for NSG security rules. Option B would still deny subnet creation because the condition remains unchanged. Option C does not address the subnet issue. Option D removes the entire policy, which is too permissive.

Answer

Change the effect to 'audit' instead of 'deny'.

Answer

Add an exemption for the virtual network resource group.

Answer

Remove the policy assignment and create a custom role to block subnet creation.

Question 12

Your organization has deployed Azure Firewall in a hub-and-spoke network topology. You have configured forced tunneling so that all internet-bound traffic from the spoke virtual networks is routed through the Azure Firewall. Recently, a critical application in a spoke virtual network is experiencing intermittent connectivity failures to an external partner service. The partner service requires that traffic originate from a specific public IP address. You have configured Azure Firewall with a public IP address and have set up DNAT rules to allow inbound traffic. However, the outbound traffic from the application is still using the spoke's default outbound access via SNAT. You need to ensure that all outbound traffic from the application uses the Azure Firewall's public IP address. What should you do?

Accepted Answer

Add a user-defined route (UDR) on the application's subnet with 0.0.0.0/0 next hop to Azure Firewall.. Forced tunneling ensures that all internet-bound traffic is routed through the firewall. Option A is correct because a user-defined route (UDR) on the application's subnet with 0.0.0.0/0 next hop to Azure Firewall enforces that traffic goes through the firewall, thus using its public IP. Option B configures Azure Firewall as a next hop for the spoke gateway, which is not needed. Option C is not directly related to routing. Option D incorrectly suggests disabling SNAT, which would cause traffic to use the spoke's original IP, not the firewall's.

Answer

Disable SNAT on the Azure Firewall for the application's public IP range.

Answer

Modify the Azure Firewall policy to enable forced tunneling.

Answer

Configure Azure Firewall as a next hop for the virtual network gateway in the hub.

Question 13

You are responsible for securing a multi-region Azure environment. The environment includes virtual networks in three regions: East US, West Europe, and Southeast Asia. You need to ensure that all traffic between these virtual networks is encrypted and travels over the Microsoft backbone network. Additionally, you must minimize latency for cross-region traffic. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Enable global VNet peering on the peering connections.. Option A is correct: VNet peering connects virtual networks over the Microsoft backbone. Option D is correct: Global VNet peering allows peering across regions and uses the Microsoft backbone. Option B is incorrect because Azure VPN Gateway encrypts traffic but does not use the Microsoft backbone (it uses the internet). Option C is incorrect because ExpressRoute connects on-premises, not VNets. Option E is incorrect because Azure Firewall does not provide cross-region connectivity.

Answer

Set up ExpressRoute circuits from each region to Microsoft.

Answer

Deploy Azure Firewall in each virtual network and route traffic through it.

Answer

Deploy Azure VPN Gateway in each virtual network and configure site-to-site VPN connections.

Question 14

Your company has a single Azure subscription with a hub-and-spoke network topology. The hub virtual network contains Azure Firewall and a VPN gateway for hybrid connectivity. You need to ensure that all traffic from the spoke virtual networks to on-premises is inspected by the Azure Firewall. Which THREE actions should you take? (Choose three.)

Accepted Answer

Configure Azure Firewall with a route to the VPN gateway for on-premises traffic.. Option A is correct: UDRs force spoke traffic to the firewall. Option B is correct: The firewall must be configured to route traffic to the VPN gateway. Option C is correct: Propagating gateway routes ensures the route table includes routes from the VPN gateway. Option D is incorrect because VNet peering does not inspect traffic. Option E is incorrect because BGP does not force traffic through the firewall.

Answer

Enable BGP on the Azure VPN gateway and advertise routes to the on-premises network.

Answer

In the hub virtual network, set 'Use remote gateways' on the peering connection to the spoke.

Question 15

You are designing a network security strategy for a new application that will be hosted on Azure Virtual Machines. The application must be accessible from the internet on TCP port 443. You need to minimize the attack surface and ensure that only legitimate traffic reaches the virtual machines. Which Azure service should you deploy in front of the virtual machines?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF).. Option A is correct: Azure Application Gateway with Web Application Firewall (WAF) provides Layer 7 load balancing and WAF capabilities to protect against web attacks. Option B is incorrect because Network Security Groups are not deployed in front of VMs as a service; they are applied at the subnet or NIC level. Option C is incorrect because Azure Firewall is a stateful firewall but lacks WAF capabilities for web-specific threats. Option D is incorrect because Azure Front Door is a global load balancer, but for a single region, Application Gateway is more appropriate for minimizing attack surface with WAF.

Answer

Azure Front Door with WAF.

Answer

Azure Firewall.

Answer

Network Security Group (NSG) on the subnet.