AZ-500 Secure networking Practice Test 16 — 15 Questions

Question 1

You are troubleshooting connectivity between two Azure VMs in the same virtual network. VM1 can ping VM2, but VM1's application cannot connect to VM2's application on port 8080. Both VMs have NSGs that allow inbound traffic on port 8080. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The guest OS firewall on VM2 is blocking inbound port 8080.. Since ICMP (ping) succeeds between the VMs, the network path is functional at Layer 3, and the NSGs are allowing traffic (as stated). The application failure on a specific port (8080) while ICMP works strongly indicates a host-level firewall blocking the TCP connection. The guest OS firewall (e.g., Windows Firewall or iptables) on VM2 is the most likely cause because it operates independently of Azure NSGs and can filter traffic by port and protocol, even when NSGs permit it.

Answer

The VNet is peered with another VNet that has a conflicting address space.

Answer

An Azure Load Balancer is directing traffic away from VM2.

Answer

The NSG on VM2's subnet has a deny rule for port 8080.

Question 2

Your organization needs to securely connect an on-premises data center to Azure for disaster recovery. The connection must be encrypted and use the public internet. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway.. Azure VPN Gateway is the correct choice because it provides encrypted site-to-site IPsec/IKE VPN tunnels over the public internet, enabling secure connectivity between an on-premises data center and Azure for disaster recovery. This meets the requirement for encryption and use of the public internet, as VPN Gateway leverages standard protocols like IKEv2 and IPsec to protect data in transit.

Answer

Azure Front Door.

Answer

Azure ExpressRoute with private peering.

Answer

Azure DNS.

Question 3

You need to allow inbound HTTP traffic from the internet to a specific VM in a VNet. The VM is in a subnet with an NSG. What is the correct way to configure access?

Accepted Answer

Add an inbound security rule in the NSG to allow HTTP traffic.. Network Security Groups (NSGs) operate at the subnet or NIC level and act as a stateful firewall for traffic entering or leaving Azure resources. To allow inbound HTTP (TCP port 80) traffic from the internet to a specific VM, you must add an inbound security rule to the NSG associated with the VM's subnet or NIC, specifying the source as 'Internet', destination port 80, and protocol TCP. This is the direct and correct method for controlling traffic to a VM within a VNet.

Answer

Add a rule in Azure Firewall to allow HTTP traffic to the VM.

Answer

Enable Azure DDoS Protection on the VNet.

Answer

Configure Azure Traffic Manager to route traffic to the VM.

Question 4

Which TWO actions should you take to secure a virtual network in Azure? (Choose two.)

Accepted Answer

Apply network security groups (NSGs) to subnets.. Network security groups (NSGs) are a fundamental Azure security control that filter traffic at the subnet or network interface level. Applying an NSG to a subnet allows you to define inbound and outbound security rules based on source/destination IP, port, and protocol, effectively segmenting and protecting the virtual network from unauthorized access.

Answer

Configure Azure DNS zones.

Answer

Deploy Azure Bastion for VM access.

Answer

Set up Azure Monitor alerts.

Question 5

Which TWO components are required to implement a secure hybrid network that connects on-premises to Azure using ExpressRoute? (Choose two.)

Accepted Answer

Virtual network gateway in Azure.. Option A is correct because an ExpressRoute connection terminates on a virtual network gateway of type 'ExpressRoute' (ExpressRouteGateway) deployed in the Azure virtual network's GatewaySubnet, which is the mandatory Azure-side endpoint that peers with the ExpressRoute circuit. Option B is correct because the ExpressRoute circuit is the connectivity resource provisioned through a connectivity provider (or ExpressRoute Direct) that establishes the private Layer 3 connection between on-premises and Microsoft's edge, and it is the fundamental component required for any ExpressRoute-based hybrid network. Option C is not required for the connectivity itself; Azure Firewall is an optional security service for traffic inspection and does not establish the ExpressRoute link. Option D is not required because a VPN Gateway is only an optional failover path (or a separate S2S VPN design), not a mandatory component of an ExpressRoute implementation. Option E is not required because Azure Front Door is a global Layer 7 HTTP/HTTPS load balancer and CDN service, unrelated to private ExpressRoute hybrid connectivity.

Answer

Azure Firewall.

Answer

Azure VPN Gateway for failover.

Answer

Azure Front Door.

Question 6

You are the security engineer for a financial services company that has multiple Azure subscriptions. The company uses Azure Virtual WAN with a secured hub containing Azure Firewall. Recently, the compliance team identified that traffic between two spoke virtual networks (SpokeA and SpokeB) is bypassing the firewall. Investigation shows that SpokeA and SpokeB are directly peered and have not been routed through the hub. The requirement is that all inter-spoke traffic must be inspected by Azure Firewall. You need to enforce this without disrupting existing applications. Also, the company uses Azure Firewall Manager for policy management and wants to use Azure Policy to prevent future direct peering. What should you do first?

Accepted Answer

Remove the VNet peering between SpokeA and SpokeB.. The immediate problem is the existing VNet peering between SpokeA and SpokeB that bypasses Azure Firewall. The first step must address this existing peering. Removing the peering removes the direct path, forcing inter-spoke traffic to route through the Virtual WAN hub where Azure Firewall inspects it. Option C (Azure Policy) is a preventive measure for future peerings but does not resolve the current violation. Option D (UDR) is ineffective because VNet peering has higher precedence than user-defined routes. Option B is unrelated to the peering issue. Therefore, the correct first action is to remove the VNet peering.

Answer

Disable 'Use remote virtual network gateways' on both spokes.

Answer

Create an Azure Policy to deny VNet peering between spokes.

Answer

Add a user-defined route in SpokeA and SpokeB pointing to the Azure Firewall for inter-spoke traffic.

Question 7

You are deploying a web application in Azure that must be accessible only from your corporate network via HTTPS. You have an Azure Application Gateway with a Web Application Firewall (WAF) policy. Your corporate network uses public IP addresses from a specific range. Which configuration should you use to restrict access?

Accepted Answer

Configure a WAF policy with a custom rule to allow traffic only from the corporate IP range and deny all other traffic.. Azure Application Gateway's WAF policy supports custom rules that can inspect source IP addresses and allow or deny traffic based on them. By creating a custom rule with a condition matching the corporate public IP range and setting the action to 'Allow', then adding a default 'Deny' rule, you restrict access exclusively to that range over HTTPS. This approach works at the application layer (Layer 7) and is independent of network-level controls, making it the most direct and supported method for IP-based restriction on the gateway itself.

Answer

Create a network security group (NSG) on the subnet hosting the application gateway and allow only the corporate IP range.

Answer

Use Azure Front Door with a WAF policy and geo-filtering to allow only your country.

Answer

Set up a private endpoint for the application gateway and disable public access.

Question 8

You manage a multi-tier application in Azure with a web tier, application tier, and database tier. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure networking feature should you use to isolate the tiers?

Accepted Answer

Network security groups (NSGs) on each subnet.. Network security groups (NSGs) allow you to define inbound and outbound security rules that filter traffic at the subnet or NIC level. By placing each tier in its own subnet and applying an NSG to the web tier subnet that allows inbound traffic from the internet, and NSGs to the application and database tier subnets that only allow inbound traffic from the web tier subnet (using the source IP address range or the virtual network tag), you can effectively isolate the tiers while permitting necessary east-west traffic.

Answer

Virtual network peering between tiers.

Answer

Azure Firewall with application rules.

Answer

Application security groups (ASGs) within the same subnet.

Question 9

You have an Azure subscription with multiple virtual networks. You need to centrally manage and enforce security policies for all outbound traffic from virtual machines to the internet. The solution must be able to inspect traffic and log all connections. What should you deploy?

Accepted Answer

Azure Firewall in a hub virtual network.. Azure Firewall is a managed, cloud-native network security service that provides centralized outbound traffic inspection and logging. It can be deployed in a hub virtual network to enforce security policies across all spoke VMs, inspecting all outbound connections using application (FQDN) and network (IP/port) rules, and logging all traffic to Azure Monitor or Storage. This meets the requirements for central management, traffic inspection, and full connection logging.

Answer

Network security groups (NSGs) on all subnets.

Answer

Azure Application Gateway with WAF.

Answer

Azure VPN Gateway with forced tunneling.

Question 10

You need to provide secure remote access to Azure virtual machines for administrators without exposing them to the public internet. The solution must use a single entry point and support Azure Active Directory (now Microsoft Entra ID) authentication. Which Azure service should you use?

Accepted Answer

Azure Bastion.. Azure Bastion provides secure, seamless RDP/SSH connectivity to Azure VMs directly from the Azure portal over TLS, without exposing public IP addresses. It uses a single entry point (the Bastion host) and supports Microsoft Entra ID authentication for login, meeting both requirements.

Answer

Just-in-time (JIT) VM access with Microsoft Defender for Cloud.

Answer

Azure Front Door with private endpoints.

Answer

Azure VPN Gateway with point-to-site VPN.

Question 11

You have an Azure subscription with a virtual network (VNet1) that hosts a SQL Managed Instance. You need to connect from an on-premises application to the SQL Managed Instance using a private IP address, with minimal latency and without traversing the public internet. The on-premises network has a high-speed ExpressRoute connection to Microsoft. What should you configure?

Accepted Answer

Connect the on-premises network to Azure via ExpressRoute private peering and ensure the SQL Managed Instance subnet is reachable.. ExpressRoute private peering establishes a Layer 3 connection between on-premises and Azure, ensuring traffic to the SQL Managed Instance subnet traverses the Microsoft backbone network without touching the public internet. This provides the lowest latency and highest security for private IP connectivity, as the managed instance's private IP is directly routable over the ExpressRoute circuit.

Answer

Configure a public endpoint on the SQL Managed Instance and allow the on-premises public IP.

Answer

Use Azure Private Link Service and connect via a VPN.

Answer

Create a site-to-site VPN connection and enable forced tunneling.

Question 12

You are designing a secure network architecture for a multi-region application. You need to ensure that traffic between virtual networks in different Azure regions is encrypted and uses the Microsoft backbone network, and you must minimize latency. Which TWO configurations should you implement?

Accepted Answer

Configure VNet peering between the virtual networks.. Option B (Configure VNet peering between the virtual networks) is correct because Azure VNet peering routes traffic directly over the Microsoft backbone network, keeping it off the public internet and providing the lowest-latency path between VNets in different regions (global VNet peering). Option C is incorrect because ExpressRoute with Microsoft peering is used to reach Microsoft public services such as Microsoft 365 and Azure PaaS, not to connect virtual networks to each other, and ExpressRoute does not encrypt traffic by default. Option A is not required because gateway transit only lets a peered VNet share a VPN/ExpressRoute gateway; it does not itself provide encryption for VNet-to-VNet traffic. Option D is not the best choice because site-to-site VPN traffic traverses the public internet and typically adds latency compared with backbone-based peering. Option E is incorrect because Azure Firewall inspects and filters traffic but does not encrypt cross-region traffic or optimize latency.

Answer

Enable 'Gateway transit' on the peering to use a VPN gateway if needed, but not required for encryption.

Answer

Use Azure ExpressRoute with Microsoft peering.

Answer

Deploy Azure VPN Gateway in each region and connect them via site-to-site VPN.

Answer

Place an Azure Firewall in each region to inspect cross-region traffic.

Question 13

You are a security engineer at Fabrikam Inc. The company has an Azure subscription with a single virtual network (VNet1) that contains a production workload. The network is connected to an on-premises data center via a site-to-site VPN. The security team requires that all Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines in VNet1 must be brokered through Azure Bastion. Additionally, the team wants to ensure that no public IP addresses are assigned to any virtual machines in the production environment. Currently, there are several VMs with public IPs. You need to implement the requirements with minimal downtime. The solution must also ensure that administrators can access the VMs using Azure Bastion without any additional client software. What should you do?

Accepted Answer

Deploy Azure Bastion in the virtual network and then remove the public IP addresses from all VMs.. Option D is correct because Azure Bastion must be deployed in the same virtual network as the target VMs (or a peered VNet) before public IPs are removed, since Bastion provides RDP/SSH connectivity over TLS port 443 through the Azure portal without requiring any client software or public IPs on the VMs. Deploying Bastion first ensures administrators retain access while the public IPs are disassociated, minimizing downtime. Option A is wrong because a point-to-site VPN does not broker RDP/SSH through Bastion and does not satisfy the no-public-IP requirement by itself. Option B is wrong because JIT VM access is a Microsoft Defender for Cloud feature that reduces exposure but does not replace Bastion or eliminate the need for public IPs. Option C is wrong because removing public IPs before Bastion is deployed would cut off RDP/SSH access and cause downtime.

Answer

Create a point-to-site VPN for administrators and remove public IPs from VMs.

Answer

Deploy Azure Bastion in the virtual network, then configure Just-In-Time (JIT) VM access for all VMs.

Answer

Disassociate public IPs from all VMs, then deploy Azure Bastion in the same virtual network.

Question 14

You are a security engineer for Contoso. The company uses Azure Firewall for all inbound and outbound traffic. To prevent misconfiguration, you assign the Azure Policy shown in the exhibit at the management group scope. After assignment, a network administrator reports that they cannot create a new subnet in an existing virtual network. The subnet creation fails with a 'deny' policy error. You need to allow subnet creation while still blocking NSG rule changes. What should you do?

Accepted Answer

Modify the policy rule to remove the subnet condition from the anyOf array.. The policy rule uses an `anyOf` array that includes conditions for both NSG rule changes and subnet creation. By removing the subnet condition from the `anyOf` array, the policy will no longer evaluate subnet creation against the deny effect, allowing subnets to be created while still blocking NSG rule modifications. This directly addresses the administrator's issue without weakening the security posture for NSG changes.

Answer

Change the effect to 'audit' instead of 'deny'.

Answer

Add an exemption for the virtual network resource group.

Answer

Remove the policy assignment and create a custom role to block subnet creation.

Question 15

Your organization has a Microsoft Entra ID tenant and uses Azure Virtual Desktop (AVD). You need to ensure that AVD session hosts in a virtual network can access on-premises resources securely without exposing the session hosts to the internet. The on-premises network is connected to Azure via ExpressRoute. All AVD traffic should be routed through the ExpressRoute connection. You have already deployed a reverse connect transport for AVD. What else should you configure to meet the requirements?

Accepted Answer

Add a user-defined route (UDR) in the AVD subnet for the on-premises IP prefixes with next hop to the ExpressRoute gateway.. Adding a user-defined route (UDR) in the AVD subnet for on-premises IP prefixes with the next hop set to the ExpressRoute gateway forces all traffic destined for on-premises resources to traverse the ExpressRoute connection. This ensures secure, private connectivity without exposing session hosts to the internet, while the reverse connect transport already handles AVD control plane traffic securely.

Answer

Configure VNet peering between the AVD virtual network and the on-premises network.

Answer

Disable reverse connect transport and allow inbound RDP traffic from the internet.

Answer

Create a private endpoint for the AVD control plane.