AZ-500 Secure networking Practice Test 15 — 15 Questions

Question 1

You need to provide secure remote access to Azure virtual machines without assigning them public IP addresses. Which Azure service should you use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure virtual machines directly in the Azure portal over TLS, without exposing public IP addresses. It uses a hardened, fully managed platform as a service (PaaS) that sits inside your virtual network, eliminating the need for a jump box or public-facing endpoints.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Front Door

Question 2

Your organization uses Azure Virtual Network Manager (AVNM) to manage network groups. You need to ensure that all virtual networks in a network group are automatically peered with a hub VNet. Which AVNM configuration should you use?

Accepted Answer

Create a connectivity configuration with Hub and Spoke topology. To automatically peer all virtual networks in a network group with a hub VNet, you need a connectivity configuration with Hub and Spoke topology. AVNM's connectivity configuration defines the network topology (e.g., hub-and-spoke or mesh) and automatically creates the necessary VNet peering connections between the hub and all spoke VNets in the assigned network group, without manual peering setup.

Answer

Create a network group and assign it to a connectivity configuration

Answer

Create a security admin configuration

Answer

Use Azure Policy to enforce peering

Question 3

You need to distribute incoming internet traffic across multiple Azure virtual machines in the same region. The solution must provide layer 7 load balancing and SSL offloading. Which Azure service should you use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple Azure virtual machines in the same region. It supports SSL termination (offloading), which offloads the decryption work from the backend VMs, and provides advanced routing based on URL path, host headers, or other HTTP attributes.

Answer

Azure Traffic Manager

Answer

Azure Load Balancer

Answer

Azure Front Door

Question 4

You are designing a network security solution for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must be isolated. Which TWO configurations should you implement?

Accepted Answer

Use network security groups (NSGs) on each subnet. Option C is correct because placing each tier in its own subnet provides the network segmentation needed to isolate the application and database tiers from the internet-facing web tier, allowing you to apply distinct security rules per tier. Option A is correct because network security groups (NSGs) applied to each subnet let you enforce inbound and outbound rules that permit internet traffic only to the web tier while restricting the app and database tiers to internal traffic. Together, separate subnets plus per-subnet NSGs deliver the required multi-tier isolation. Option B is not needed because separate VNets add complexity and require peering for tier-to-tier communication, which is unnecessary for isolation. Option D is incorrect because VNet peering connects VNets rather than isolating tiers within a single VNet. Option E is incorrect because placing all VMs in one subnet removes the segmentation boundary needed to isolate the app and database tiers.

Answer

Deploy each tier in a separate VNet

Answer

Use VNet peering to connect the tiers

Answer

Place all VMs in the same subnet

Question 5

You need to secure traffic between an on-premises network and Azure using a VPN connection. Which TWO configurations are required?

Accepted Answer

Create a virtual network gateway (VPN). Option A is correct because a virtual network gateway of type VPN is the Azure-side endpoint that terminates the IPsec/IKE tunnel and is mandatory for any site-to-site VPN connection. Option E is correct because the local network gateway is the Azure resource that represents the on-premises VPN device, holding its public IP address and address spaces so Azure knows how to route traffic to the remote network. Together, the virtual network gateway and local network gateway form the two required endpoints for a site-to-site VPN. Option B is not required because Azure Firewall provides traffic filtering and security policies, not the VPN tunnel itself. Option C is not required because the public IP is assigned to the on-premises VPN device (or referenced in the local network gateway), not to the local network gateway resource itself. Option D is not required because ExpressRoute is a separate dedicated private connectivity service, not a VPN solution.

Answer

Deploy Azure Firewall

Answer

Assign a public IP to the local network gateway

Answer

Provision an ExpressRoute circuit

Question 6

You are designing a hub-spoke network topology in Azure. You need to ensure that all traffic between spokes is inspected by a network virtual appliance (NVA) deployed in the hub. What should you configure?

Accepted Answer

Create user-defined routes (UDRs) in each spoke pointing to the NVA's IP address.. To force all inter-spoke traffic through a network virtual appliance (NVA) in the hub, you must create user-defined routes (UDRs) in each spoke's subnet that direct traffic destined for other spoke address spaces to the NVA's private IP address. This overrides the default system route that would otherwise allow direct communication over VNet peering, ensuring the NVA inspects every packet.

Answer

Deploy Azure Firewall in the hub.

Answer

Configure VNet peering between all spokes.

Answer

Use a VPN gateway to route traffic through the hub.

Question 7

Which THREE of the following are required to enable network traffic flow between two peered Azure virtual networks in different Azure regions?

Accepted Answer

Both VNets must have the Allow virtual network access setting enabled for the peering.. Option A is correct because each side of a VNet peering link has an 'Allow virtual network access' setting that must be enabled so the peered VNet's address space is reachable; if it is disabled, traffic to that VNet is blocked even though the peering exists. Option B is correct because when traffic is routed through a network virtual appliance in the peered VNet, the receiving peering must have 'Allow forwarded traffic' enabled, otherwise traffic not originating from the peered VNet's own address space is dropped. Option E is correct because VNet peering requires the address spaces of the two VNets to be non-overlapping; overlapping prefixes make routing ambiguous and the peering cannot be created. Option C is not required: gateway transit only matters when sharing a VPN/ExpressRoute gateway, not for basic VNet-to-VNet traffic flow. Option D is not required: NSGs are optional security filters, and peering itself does not depend on an NSG rule allowing traffic.

Answer

Gateway transit must be enabled in at least one VNet.

Answer

An NSG rule must allow traffic between the VNets.

Question 8

Which TWO of the following are supported ways to connect an on-premises network to Azure?

Accepted Answer

Azure ExpressRoute. Azure ExpressRoute (B) is correct because it provides a private, dedicated connection between an on-premises network and Azure through a connectivity provider, bypassing the public internet. Site-to-Site VPN (D) is correct because it establishes an IPsec/IKE VPN tunnel over the public internet between an on-premises VPN device and an Azure VPN gateway, connecting entire networks. Azure Bastion (A) is not a network-to-network connection method; it provides secure RDP/SSH access to VMs through the Azure portal over TLS. Point-to-Site VPN (C) connects an individual client computer to an Azure virtual network, not an on-premises network as a whole. Azure Front Door (E) is a global HTTP/HTTPS application delivery and load-balancing service, not a site-to-site connectivity solution.

Answer

Azure Bastion

Answer

Point-to-Site VPN

Answer

Azure Front Door

Question 9

Refer to the exhibit. You have an Azure Application Gateway WAF policy with the above JSON configuration. A user from IP address 10.1.2.3 reports they cannot access the web application. What is the most likely cause?

Accepted Answer

The custom rule blocks all private IP addresses.. The custom rule in the WAF policy explicitly blocks all traffic from IP addresses in the 10.0.0.0/8 private range. Since the user's IP address (10.1.2.3) falls within this range, the rule matches and blocks the request. The WAF policy is in prevention mode, so the rule actively blocks the request rather than just logging it.

Answer

The WAF policy is in prevention mode and detected a SQL injection.

Answer

The WAF policy is set to detection mode and logs the request.

Answer

The custom rule is disabled due to a syntax error.

Question 10

Refer to the exhibit. You run the PowerShell command above and get the output: Access: Allow, SourceAddressPrefix: *, DestinationAddressPrefix: VirtualNetwork, DestinationPortRange: 22, Protocol: TCP, Priority: 100. A security audit requires that SSH access be restricted to only the management subnet (10.0.1.0/24). What should you do?

Accepted Answer

Change the SourceAddressPrefix to '10.0.1.0/24'.. The existing rule allows SSH (TCP port 22) from any source (*) to the virtual network. To restrict SSH access to only the management subnet (10.0.1.0/24), you must change the SourceAddressPrefix from '*' to '10.0.1.0/24'. This ensures only traffic originating from the management subnet is permitted, meeting the security audit requirement.

Answer

Change the DestinationAddressPrefix to '10.0.1.0/24'.

Answer

Change the Access to Deny and create a new rule to allow SSH from management subnet.

Answer

Change the SourceAddressPrefix to 'VirtualNetwork'.

Question 11

You need to securely connect two Azure virtual networks in the same region to allow VM-to-VM communication using private IP addresses. The solution must minimize latency and administrative overhead. What should you use?

Accepted Answer

VNet peering. VNet peering is the correct choice because it connects two Azure virtual networks in the same region using the Microsoft backbone infrastructure, enabling VM-to-VM communication over private IP addresses with near-zero latency and no intermediate hops. It requires no additional gateways or bandwidth charges within the same region, minimizing administrative overhead as it is a simple, one-time configuration.

Answer

Azure VPN Gateway

Answer

Azure Front Door

Answer

ExpressRoute

Question 12

Your organization uses Azure Virtual WAN. You need to secure traffic between a spoke VNet and an on-premises site that connects via a Virtual WAN VPN gateway. What is the best way to inspect traffic?

Accepted Answer

Use Azure Firewall Manager to deploy a secured virtual hub.. Azure Firewall Manager enables you to deploy a secured virtual hub, which centrally manages and routes traffic between Virtual WAN spokes and on-premises sites through Azure Firewall for inspection. This is the best approach because it provides a scalable, hub-and-spoke architecture with forced tunneling and routing policies that ensure all traffic between the spoke VNet and the on-premises site is inspected without requiring additional NVAs or complex user-defined routes.

Answer

Deploy Azure Firewall in the spoke VNet.

Answer

Deploy a third-party NVA in the spoke VNet.

Answer

Apply NSG rules on the spoke subnet.

Question 13

You have an Azure subscription with multiple VNets connected via VNet peering. You need to audit all network traffic between two specific VNets for compliance. The solution must capture traffic metadata (source/destination IP, ports, protocol) without affecting performance. What should you use?

Accepted Answer

Enable NSG flow logs and use Network Watcher traffic analytics.. NSG flow logs capture metadata (source/destination IP, port, protocol) for traffic traversing a Network Security Group, and Network Watcher traffic analytics provides aggregated visibility into inter-VNet flows without inline inspection. This meets the compliance requirement for auditing metadata without performance impact, as flow logs are collected asynchronously and do not alter the data path.

Answer

Route all traffic through Azure Firewall and enable logs.

Answer

Use Network Watcher packet capture on the VMs.

Answer

Enable Azure Monitor metrics on the VNet peering.

Question 14

You are designing a network security solution for a multi-tier application in Azure. The web tier must be accessible from the internet, the application tier only from the web tier, and the database tier only from the application tier. All tiers are in different subnets of the same VNet. What is the minimum configuration?

Accepted Answer

Configure NSGs on each subnet with appropriate allow rules.. Network Security Groups (NSGs) applied to each subnet can enforce least-privilege network access: allow inbound from Internet to the web tier subnet, allow inbound only from the web tier subnet to the application tier subnet, and allow inbound only from the application tier subnet to the database tier subnet. This is the minimum configuration as it uses built-in, no-cost Azure constructs without additional services or complex routing.

Answer

Use service endpoints for each tier.

Answer

Create separate VNets for each tier and use VNet peering.

Answer

Deploy Azure Firewall in the VNet and route all traffic through it.

Question 15

A company has a hub-spoke network topology in Azure. The hub virtual network contains an Azure Firewall. Spoke virtual networks are peered to the hub. The security team wants to inspect all traffic between virtual machines in different spoke virtual networks. What is the minimum configuration required?

Accepted Answer

Define user-defined routes (UDRs) in each spoke that direct inter-spoke traffic to the Azure Firewall in the hub.. User-defined routes (UDRs) in each spoke subnet are required to force inter-spoke traffic through the Azure Firewall in the hub. Without UDRs, traffic between peered spokes would flow directly over the VNet peering connections, bypassing the firewall. The UDRs must have the Azure Firewall's private IP as the next hop to ensure all inter-spoke traffic is inspected.

Answer

Enable VNet peering gateway transit and allow forwarded traffic.

Answer

Deploy a VPN gateway in each spoke and configure site-to-site VPNs to the hub.

Answer

Configure network security groups (NSGs) on each spoke subnet.