AZ-500 Secure networking Practice Test 15 — 15 Questions

Question 1

A company runs a public-facing web application on Azure App Service in the West US region. They want to protect against network-layer (Layer 3/4) DDoS attacks and have a single web application. Which Azure DDoS Protection tier should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DDoS Protection Basic (default). DDoS Protection Basic is automatically enabled for all Azure resources at no additional cost, providing always-on traffic monitoring and real-time mitigation of common network-layer (Layer 3/4) attacks, such as SYN floods, UDP floods, and reflection attacks. Since the company has a single web application and only needs protection against Layer 3/4 DDoS attacks, the Basic tier is sufficient and requires no configuration or extra cost.

Answer

DDoS Protection Standard

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Front Door with DDoS Protection Standard

Question 2

A company deploys a web application on Azure VMs behind an Azure Load Balancer (Standard SKU). They want to protect the application from common web attacks like SQL injection and cross-site scripting. Which Azure service should they enable?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) policy.. Azure Application Gateway with a Web Application Firewall (WAF) policy is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and provides centralized, inbound protection against common web attacks such as SQL injection and cross-site scripting (XSS). The WAF policy uses OWASP Core Rule Sets (CRS) to inspect HTTP request payloads and headers, blocking malicious traffic before it reaches the backend VMs behind the Load Balancer.

Answer

Azure Firewall.

Answer

Network Security Groups on the VM subnet.

Answer

Azure DDoS Protection.

Question 3

You are securing an Azure Kubernetes Service (AKS) cluster. You need to restrict network traffic between pods and to external services using Azure network policies. Which three of the following options are valid considerations or steps? (Choose three.)

Accepted Answer

Enable the Azure Network Policy Manager (Azure NPM) when creating the AKS cluster.. Azure Network Policy Manager (Azure NPM) is a required add-on for enforcing Kubernetes NetworkPolicy objects in an AKS cluster. It translates Kubernetes network policies into Azure-specific configurations to filter pod-to-pod traffic. Without enabling Azure NPM (or an alternative like Calico), standard Kubernetes NetworkPolicy objects will not be enforced by Azure.

Answer

Assign public IP addresses to each pod for direct internet access without a load balancer.

Answer

Set the AKS cluster to use Calico network policies instead of Azure NPM for better performance.

Answer

Configure an NSG directly on the AKS node subnet to filter pod-to-pod traffic.

Question 4

Drag and drop the steps to create an Azure Key Vault firewall rule to allow access from a specific virtual network into the correct order.

Accepted Answer

1. Navigate to the Key Vault in the Azure portal. 2. Under Settings, select Networking. 3. In the Firewalls and virtual networks tab, add the desired virtual network. 4. Click Save.. The firewall configuration is under networking, and you must add the virtual network to allow traffic.

Answer

1. Navigate to the Key Vault. 2. Click Save. 3. Then go to Networking. 4. Add virtual network.

Answer

1. Navigate to the Key Vault. 2. Select Networking. 3. Save the current firewall settings. 4. Then add virtual network.

Answer

1. Navigate to the Key Vault. 2. Add virtual network. 3. Select Networking. 4. Save.

Question 5

Drag and drop the steps to configure Azure AD Conditional Access policy to require MFA for all users into the correct order.

Accepted Answer

Assign users and groups, then assign cloud apps, then configure access controls, then enable policy.. Conditional Access policies require defining users and access controls before enabling.

Answer

Assign users and groups, then configure access controls, then assign cloud apps, then enable policy.

Answer

Configure access controls, then assign users and groups, then assign cloud apps, then enable policy.

Answer

Assign users and groups, then assign cloud apps, then enable policy, then configure access controls.

Question 6

Your organization has multiple Azure subscriptions connected via a hub-spoke topology using Azure Firewall in the hub. You need to ensure that traffic between spoke VNets is routed through the firewall for inspection. You configure user-defined routes (UDRs) on the spoke subnets. However, traffic between spokes is still bypassing the firewall. What is the most likely reason?

Accepted Answer

The 'Use remote gateway' setting is disabled on the spoke VNet peering.. In a hub-spoke topology with Azure Firewall, the 'Use remote gateway' setting on the spoke VNet peering must be disabled. This setting is only for using a VPN or ExpressRoute gateway in the hub; it does not enable routing through Azure Firewall. With this setting disabled, the configured UDRs on the spoke subnets can direct spoke-to-spoke traffic to the firewall for inspection.

Answer

Azure Firewall does not support traffic between spoke VNets.

Answer

The UDR on the firewall subnet does not include the spoke address spaces.

Answer

The 'Allow gateway transit' setting is disabled on the spoke peering.

Question 7

Your organization has deployed Azure Front Door Premium with Web Application Firewall (WAF) policy in front of an Azure App Service. You need to ensure that only traffic from Azure Front Door is allowed to reach the App Service, and all other traffic is blocked. Which configuration should you implement?

Accepted Answer

Configure IP restrictions on the App Service to allow only the Azure Front Door service tag AzureFrontDoor.Backend.. The Azure Front Door Premium service tag 'AzureFrontDoor.Backend' represents the backend IP address range used by Azure Front Door to forward traffic to the origin. By configuring IP restrictions on the App Service to allow only this service tag, you ensure that only traffic originating from Azure Front Door can reach the App Service, effectively blocking all other traffic.

Answer

Configure the App Service to require client certificates and configure Azure Front Door to present a certificate.

Answer

Set the App Service access restrictions to deny all and then add a rule to allow the Azure Front Door service tag AzureFrontDoor.Frontend.

Answer

Configure a WAF policy to block all requests that do not contain the X-Azure-FDID header.

Question 8

A company has deployed Azure Firewall in a hub virtual network with forced tunneling enabled. Spoke virtual networks are peered to the hub. The security team reports that outbound traffic from the spoke VMs is bypassing the firewall. What is the most likely reason?

Accepted Answer

The spoke subnets do not have a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall.. Forced tunneling on Azure Firewall requires that all outbound traffic from spoke VMs is routed to the firewall via a user-defined route (UDR) with a default route (0.0.0.0/0) pointing to the firewall's private IP as the next hop. Without this route, traffic from spoke subnets will use the default system route and bypass the firewall, even if the firewall itself is configured with forced tunneling.

Answer

The Azure Firewall policy has an allow-all network rule.

Answer

Azure Firewall is deployed in the same virtual network as the spoke VMs.

Answer

The spoke virtual networks are not peered to the hub.

Question 9

Which TWO Azure services can be used to distribute incoming traffic across multiple virtual machines in a backend pool while providing layer 7 load balancing? (Choose two.)

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a layer 7 load balancer that can distribute incoming traffic across multiple virtual machines in a backend pool based on HTTP/HTTPS attributes such as URL path, host headers, and cookies. It also provides SSL termination, Web Application Firewall (WAF), and session affinity, making it suitable for web application traffic.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure VPN Gateway

Question 10

Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?

Accepted Answer

The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.. When an NSG is associated with both a subnet and a NIC, effective security rules are evaluated in order of priority, and subnet-level NSG rules are evaluated before NIC-level NSG rules. If the subnet has a default outbound allow rule (or a higher-priority allow rule), it will permit outbound TCP traffic to the Internet on ports 80 and 443, overriding the deny rule applied at the NIC level. The VM can still access websites because the subnet NSG's default outbound allow rule takes precedence over the NIC-level deny rule.

Answer

The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.

Answer

The NSG is not associated with the NIC because the command did not specify the NIC correctly.

Answer

The NSG rule should be an inbound rule to block outbound traffic.

Question 11

You need to block outbound internet access from all VMs in a VNet except for specific allowed destinations (e.g., Microsoft updates). You cannot use a third-party NVA. Which Azure service should you use to meet this requirement?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that can filter outbound traffic from VMs in a VNet based on fully qualified domain names (FQDNs), IP addresses, and port/protocol rules. It supports application rules (e.g., allow *.update.microsoft.com) and network rules, enabling you to block all outbound internet access except for specific allowed destinations like Microsoft Updates. Unlike NSGs, Azure Firewall provides stateful inspection and centralized logging, making it the correct choice for this requirement without a third-party NVA.

Answer

Azure Bastion

Answer

Network Security Groups (NSGs)

Answer

Azure Virtual Network NAT

Question 12

You have an Azure Web Application Firewall (WAF) policy associated with an Azure Front Door instance. You want to block requests from a specific country (e.g., Country X) unless the request includes a valid API key. How should you configure this?

Accepted Answer

Use a geo-match custom rule to block Country X, and create a separate custom rule with higher priority to allow traffic from Country X if the request contains the API key header.. Azure WAF custom rules are evaluated in priority order, and a higher-priority 'allow' rule can override a lower-priority 'block' rule. By creating a geo-match rule to block Country X, and then a separate custom rule with a higher priority (lower numeric value) that allows requests from Country X if they contain a valid API key header, you achieve the conditional access requirement. This leverages WAF's ability to inspect request headers and apply logic based on multiple conditions within a single policy.

Answer

Use a geo-match custom rule to allow all countries except Country X, and use a rate limit rule to block Country X.

Answer

Configure IP restriction on the origin to block Country X IPs.

Answer

Configure the WAF policy to use 'Prevention' mode and add a managed rule set that includes the country block.

Question 13

You configure Azure Bastion to allow secure RDP access to VMs in a VNet. However, users report that they cannot connect to a specific VM, while other VMs in the same VNet are accessible. The VM is running and has a public IP. What is the most likely cause?

Accepted Answer

The NSG on the VM's subnet does not allow inbound RDP from the AzureBastionSubnet.. Azure Bastion provides secure RDP/SSH connectivity to VMs in a peered VNet without exposing public IPs. For Bastion to reach a VM, the Network Security Group (NSG) on the VM's subnet must allow inbound TCP traffic on port 3389 from the AzureBastionSubnet (which uses the Azure Bastion service's private IP range). If the NSG blocks this traffic, Bastion cannot establish the RDP session even though the VM is running and has a public IP. The correct answer is B because the NSG misconfiguration is the most likely cause when other VMs in the same VNet are accessible.

Answer

The user does not have 'Reader' role on the VM.

Answer

The VM is located in a different region than the Bastion host.

Answer

The VM has a public IP assigned, which interferes with Bastion connectivity.

Question 14

You are designing network security for a multi-tier application deployed in Azure. The application consists of a front-end web tier, a middle-tier API, and a back-end database. All tiers must be isolated from the internet except the front-end, which must accept HTTPS traffic from the internet. You need to ensure that no traffic can bypass the network security controls. What should you implement?

Accepted Answer

Deploy Azure Firewall in a hub virtual network and route all traffic between tiers through the firewall for inspection.. Deploying Azure Firewall in a hub virtual network and routing all traffic between tiers through the firewall for inspection ensures that no traffic can bypass network security controls. This design enforces a forced tunneling architecture where all inter-tier traffic (e.g., from front-end to API to database) must traverse the firewall, allowing centralized inspection, logging, and filtering. This meets the requirement for complete isolation and control, as NSGs alone cannot prevent traffic from bypassing inspection if routes are not explicitly forced.

Answer

Place all tiers in the same virtual network and use Azure Front Door with WAF for the web tier, and rely on NSGs for internal traffic.

Answer

Deploy Network Security Groups (NSGs) on each subnet and allow only necessary traffic between tiers.

Answer

Use Azure Application Gateway with Web Application Firewall (WAF) in front of the web tier, and use NSGs for the other tiers.

Question 15

You are configuring Azure Private Link for a SQL Database. You want to ensure that all traffic from your virtual network to the SQL Database stays within the Microsoft Azure backbone network. What is the primary benefit of using Azure Private Link over a service endpoint?

Accepted Answer

Private Link assigns a private IP address to the SQL Database within your virtual network, preventing exposure to the public internet.. Azure Private Link exposes the SQL Database as a private endpoint within your virtual network, assigning it a private IP address from your VNet's address space. This ensures that all traffic to the database stays on the Microsoft backbone network and never traverses the public internet, which is the primary benefit over a service endpoint. Service endpoints still route traffic to the public endpoint of the SQL Database, even though the source traffic originates from the VNet.

Answer

Private Link provides higher throughput than service endpoints.

Answer

Private Link enables access to the SQL Database from on-premises via VPN/ExpressRoute without traversing the internet.

Answer

Private Link allows you to use NSGs to filter traffic to the SQL Database.