AZ-500 Secure networking Practice Test 17 — 15 Questions

Question 1

Your company has deployed Azure Kubernetes Service (AKS) in a virtual network. The AKS cluster needs to pull images from a private Azure Container Registry (ACR) that has a private endpoint configured. The virtual network where AKS is deployed is peered to the ACR's virtual network. You have configured the AKS cluster to use managed identity for authentication to ACR. However, the AKS cluster is unable to pull images from the ACR. You need to resolve the connectivity issue without exposing the ACR to the internet. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Link the private DNS zone of the ACR private endpoint to the AKS virtual network.. The AKS cluster cannot pull images from the private ACR because the private endpoint's DNS resolution is not propagated to the AKS virtual network. By linking the private DNS zone of the ACR private endpoint to the AKS virtual network, the AKS nodes can resolve the ACR's private FQDN to the private IP address of the endpoint, enabling connectivity without exposing the ACR to the internet.

Answer

Update the AKS cluster's DNS server to use a custom DNS that can resolve the private endpoint.

Answer

Delete the private endpoint and configure ACR firewall rules to allow the AKS subnet.

Answer

Recreate the AKS cluster with a different managed identity that has ACR pull permissions.

Question 2

A company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. The security team wants to ensure that all outbound internet traffic from VMs in the spokes flows through the Azure Firewall. What should be configured?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. To force all outbound internet traffic from spoke VNets through the Azure Firewall, you must create a route table with a default route (0.0.0.0/0) that has the Azure Firewall's private IP as the next hop, and associate that route table with the subnets in the spoke VNets. This overrides the default system route and sends all internet-bound traffic to the firewall. Option B is wrong because forced tunneling on a VPN gateway is used to route on-premises traffic, not to direct spoke traffic through the firewall. Option C is wrong because the route table should be associated with spoke subnets, not the hub subnet. Option D is wrong because NSGs do not support next-hop routing; they filter traffic, not direct it.

Answer

Configure forced tunneling on the VPN gateway to route all traffic through the Azure Firewall.

Answer

Create a route table with a default route to the VPN gateway and associate it with the hub subnet.

Answer

Configure an NSG on the spoke subnets with a rule that sends traffic to the Azure Firewall.

Question 3

A company uses Azure Front Door (AFD) with WAF policy in front of a web application. The security team notices that some requests from a specific IP range are being blocked incorrectly. The WAF policy uses custom rules. The team wants to allow a specific IP range while still having the WAF inspect other traffic. What is the most efficient way to configure this?

Accepted Answer

Create a custom rule with priority 1, action 'Allow', and match condition for the source IP range.. The correct option is B: create a custom rule with priority 1, action 'Allow', and a match condition for the source IP range. In Azure Front Door WAF, custom rules are evaluated in priority order (lower numbers first), and an Allow rule matched early short-circuits the remaining WAF evaluation, so the trusted IP range bypasses blocking while all other traffic continues to be inspected by the managed and custom rules. Option A is wrong because a Block rule for that IP range would continue blocking the traffic the team wants to permit. Option C is wrong because a rate-limit rule controls request volume, not allow-listing, and would not reliably exempt the range from other WAF blocks. Option D is wrong because managed rule sets cannot be selectively disabled per IP range via a geo-match condition; exclusions apply to specific rule/request attributes, not source IP ranges in that manner.

Answer

Add a custom rule with priority 100, action 'Block', and match condition for the IP range.

Answer

Add a rate limit rule that allows traffic from the IP range.

Answer

Disable the managed rule sets for the specific IP range using a geo-match condition.

Question 4

You are designing network security for a multi-tier application. The web tier must be accessible from the internet, but the database tier must only be accessible from the web tier. Both tiers are in the same virtual network. Which Azure service should you use to restrict traffic between the tiers?

Accepted Answer

Network Security Group (NSG). Network Security Groups (NSGs) are used to filter network traffic to and from Azure resources within a virtual network. They contain security rules that allow or deny inbound and outbound traffic based on source/destination IP, port, and protocol. By applying NSGs to the subnets or NICs of the web and database tiers, you can restrict database access to only the web tier.

Answer

Route table

Answer

Azure Firewall

Answer

Application Security Groups (ASGs)

Question 5

A company is deploying Azure Bastion to provide secure RDP/SSH access to VMs in a virtual network. The security requirement is that all administrative access must be logged and audited. What additional configuration is needed to meet this requirement?

Accepted Answer

Enable diagnostic settings on Azure Bastion to send logs to a Log Analytics workspace.. The correct option is B: enabling diagnostic settings on Azure Bastion to send logs to a Log Analytics workspace. Azure Bastion emits session-level audit logs (such as BastionAuditLogs) that record who connected, to which VM, and when; routing these to Log Analytics makes them queryable and auditable, which directly satisfies the logging and auditing requirement. Option A does not fit because NSG flow logs capture network traffic metadata, not the administrative session identity or command context needed for Bastion access auditing. Option C is insufficient because the Azure Activity Log records control-plane operations on the Bastion resource, not the RDP/SSH session activity. Option D is also wrong because diagnostic settings on the target VMs do not capture the Bastion-mediated administrative access events required here.

Answer

Enable NSG flow logs on the subnet containing the target VMs.

Answer

Enable Azure Activity Log for the Bastion resource.

Answer

Configure diagnostic settings on the target VMs to send logs to Log Analytics.

Question 6

You are a security engineer for a company that uses Azure Virtual Networks and Azure Private Endpoints. You have a storage account with a private endpoint in VNet1. You need to ensure that all DNS queries for the storage account's private endpoint resolve to the private IP address from any virtual machine in VNet1. The virtual machines use the default Azure-provided DNS servers. What should you do?

Accepted Answer

Create a private DNS zone named privatelink.blob.core.windows.net and link it to VNet1.. Private Endpoints require DNS resolution to the private IP. Azure Private DNS zones with names like privatelink.blob.core.windows.net are the standard method. Linking the zone to the virtual network enables Azure-provided DNS to resolve the private endpoint FQDN correctly. Other options either misuse features or do not provide the required DNS resolution.

Answer

Enable Azure DNS Private Resolver in VNet1 and configure a forwarding rule to the storage account's private IP.

Answer

Add a DNS record for the storage account's public FQDN pointing to the private IP address in the VNet's DNS settings.

Answer

Configure a conditional forwarder on the Azure-provided DNS servers to forward queries for the storage account to an on-premises DNS server.

Question 7

You are a security engineer at Fabrikam. The company has an Azure virtual network that contains a subnet named WebSubnet with a network security group (NSG) named NSG1. You need to ensure that inbound HTTP traffic from the internet is allowed to the web servers in WebSubnet, but only when the traffic originates from a specific set of public IP addresses used by a partner company. The partner's IP addresses are 203.0.113.0/24 and 198.51.100.10. What should you configure in NSG1?

Accepted Answer

Create an inbound security rule with source set to the two partner IP addresses, destination port 80, protocol TCP, and action Allow. Set a lower priority number than any deny rule.. Network security groups evaluate rules by priority, with lower numbers processed first. To allow inbound HTTP only from specific partner IP addresses, you create an Allow rule with those source addresses and a priority lower than any Deny rule that might block other traffic. This ensures the partner traffic is permitted while other internet traffic can be denied by a later, higher-numbered rule.

Answer

Create an outbound security rule with source set to the two partner IP addresses, destination port 80, and action Allow, and apply it to WebSubnet.

Answer

Create an inbound security rule with source set to the two partner IP addresses, destination port 80, protocol TCP, and action Deny, and then create a lower-priority Allow rule for all other traffic.

Answer

Configure a service tag named Internet as the source and use an application security group (ASG) as the destination, with an Allow rule for port 80.

Question 8

You are a security engineer at Northwind Traders. The company has an Azure subscription with a virtual network named VNet1. You need to ensure that all outbound internet traffic from VNet1 is inspected by a central security appliance before leaving the network. You also need to log all traffic for auditing. The solution must minimize administrative effort and support scaling. What should you deploy?

Accepted Answer

Azure Firewall in a hub virtual network, with user-defined routes (UDRs) in VNet1 pointing to the firewall's private IP address as the next hop for 0.0.0.0/0.. Azure Firewall is a managed, cloud-native network security service that provides central inspection, logging, and scalability. By deploying it in a hub and using user-defined routes in VNet1 to direct all outbound traffic (0.0.0.0/0) to the firewall's private IP, you ensure every packet is inspected and logged. This design minimizes administrative effort because Azure manages the firewall infrastructure and scaling.

Answer

Network security groups (NSGs) on each subnet with rules to allow only required outbound traffic, and enable NSG flow logs.

Answer

Azure VPN Gateway with forced tunneling configured to route all traffic through an on-premises firewall.

Answer

Azure Application Gateway with Web Application Firewall (WAF) and configure custom routing rules to send all outbound traffic to the gateway.

Question 9

You are a security engineer at Adventure Works. The company has an Azure Kubernetes Service (AKS) cluster that uses the Azure CNI network plugin. The cluster's pods must access an Azure SQL Database securely without traversing the public internet. You need to configure private connectivity from the AKS cluster to the Azure SQL server. What should you implement?

Accepted Answer

Create an Azure Private Endpoint for the Azure SQL server in a subnet within the AKS virtual network, and configure private DNS integration.. Azure Private Endpoint creates a network interface with a private IP address from your virtual network subnet for the Azure SQL server. Combined with private DNS zone integration, the SQL server's name resolves to that private IP, ensuring all traffic from AKS pods remains on the Microsoft backbone. This provides secure, private connectivity without exposing traffic to the public internet.

Answer

Deploy an Azure Firewall in the AKS virtual network and configure DNAT rules to forward SQL traffic to the Azure SQL server's public endpoint.

Answer

Enable Azure Private Link service on the AKS cluster and create a private endpoint for the SQL server in the AKS subnet.

Answer

Configure a service endpoint for Microsoft.Sql on the AKS subnet and restrict the Azure SQL server firewall to that subnet.

Question 10

You are a security engineer at Litware. The company has an Azure virtual network named VNet1 with a subnet named Subnet1 that hosts several virtual machines. You need to restrict outbound internet access from Subnet1 to only allow traffic to specific FQDNs, such as *.microsoft.com and *.azure.com, while blocking all other outbound internet traffic. You also need to log allowed and denied traffic. Which two actions should you perform? (Choose two.)

Accepted Answer

Create a user-defined route (UDR) in Subnet1 that directs all outbound traffic (0.0.0.0/0) to the Azure Firewall's private IP address as the next hop.. To restrict outbound internet access to specific FQDNs and log traffic, you need Azure Firewall with application rules that allow the desired FQDNs and deny everything else. You also need a user-defined route in Subnet1 that sends all outbound traffic (0.0.0.0/0) to the firewall's private IP. This combination ensures traffic is forced through the firewall and filtered by FQDN, with logging of allowed and denied flows.

Answer

Enable Azure DDoS Protection Standard on VNet1 to filter outbound traffic based on domain names.

Answer

Configure a network security group (NSG) on Subnet1 with outbound rules that allow traffic to the FQDNs and deny all other outbound traffic.

Answer

Deploy an Azure Application Gateway with WAF and configure custom rules to allow the FQDNs for outbound traffic.

Question 11

You are a security engineer for Adventure Works. The company has an Azure subscription with a virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 hosts an Azure App Service Environment (ASE) and several Azure virtual machines. You need to inspect all traffic between Subnet1 and the internet for malicious content and generate alerts for suspicious activity. You also need to ensure that the solution can decrypt and inspect HTTPS traffic. What should you do?

Accepted Answer

Deploy Azure Firewall Premium in VNet1. Enable TLS inspection and configure the firewall to use a certificate stored in Azure Key Vault. Create a user-defined route to direct traffic from Subnet1 to the firewall's private IP address.. To inspect all traffic between Subnet1 and the internet, including HTTPS, deploy Azure Firewall Premium and enable TLS inspection. This allows the firewall to decrypt and inspect encrypted traffic. You must also configure a user-defined route to force traffic from Subnet1 through the firewall's private IP address. This ensures all outbound traffic is inspected and alerts can be generated for suspicious activity.

Answer

Configure Azure Application Gateway with Web Application Firewall (WAF) in VNet1. Create a user-defined route to direct traffic from Subnet1 to the Application Gateway.

Answer

Configure Azure Firewall in VNet1. Create application rules to allow outbound traffic and enable threat intelligence in alert mode. Configure the VMs and ASE to use Azure Firewall as the default gateway.

Answer

Deploy a network virtual appliance (NVA) from Azure Marketplace that supports TLS inspection. Configure a user-defined route to direct traffic from Subnet1 to the NVA.

Question 12

You are a security engineer at Contoso. The company has an Azure virtual network named VNet1 with a subnet named WebSubnet that hosts internet-facing Linux VMs. You need to restrict inbound traffic to WebSubnet so that only HTTP (TCP 80) and HTTPS (TCP 443) from the internet are allowed, and all other inbound traffic is denied. The VMs must remain reachable over SSH from a jump host in another subnet for management. What should you configure?

Accepted Answer

Create a network security group (NSG) and associate it with WebSubnet. Add inbound rules allowing TCP 80 and 443 from source Internet, allowing TCP 22 from the jump host subnet, and a final rule denying all other inbound traffic with a higher priority number.. A network security group attached to WebSubnet enforces inbound rules at the subnet boundary. Allowing TCP 80 and 443 from Internet, allowing TCP 22 from the jump host subnet, and placing a deny-all rule at a higher priority number blocks all other inbound traffic. This satisfies both the internet restriction and the management requirement without extra routing changes.

Answer

Create a user-defined route (UDR) on WebSubnet that sends all traffic to a virtual network gateway, and configure the gateway to allow only TCP 80 and 443.

Answer

Configure a service endpoint for Microsoft.Storage on WebSubnet and create a storage account firewall rule that allows only HTTP and HTTPS.

Answer

Create an Azure Firewall in a GatewaySubnet and configure DNAT rules to forward TCP 80 and 443 to the web VMs, and network rules to deny all other inbound traffic.

Question 13

You are a security engineer for Litware. The company has an Azure virtual network named VNet1 that contains an Azure Bastion host and several VMs. The VMs have public IP addresses, but the security team wants to eliminate all public IP exposure while still allowing administrators to connect via RDP and SSH from the internet. You need to recommend a solution that meets these requirements with the least administrative effort. What should you do?

Accepted Answer

Remove the public IP addresses from the VMs and configure Azure Bastion in VNet1. Administrators connect to the VMs through the Azure portal using the Bastion host.. Azure Bastion offers secure RDP and SSH access from the Azure portal without public IPs on VMs. Deploying Bastion in VNet1 and removing VM public IPs meets the security requirement with minimal administrative effort, as administrators use the portal directly and no VPN or firewall configuration is needed.

Answer

Remove the public IP addresses from the VMs and create a site-to-site VPN connection from each administrator's workstation to VNet1.

Answer

Keep the public IP addresses but restrict inbound RDP and SSH to the administrators' source IP addresses using a network security group on the VM subnet.

Answer

Remove the public IP addresses from the VMs and deploy an Azure Firewall with DNAT rules to forward RDP and SSH traffic to the VMs.

Question 14

You are a security engineer at Adatum. The company has an Azure subscription with a virtual network named VNet1 that contains an Azure Firewall in a subnet named AzureFirewallSubnet. You need to ensure that all outbound traffic from a subnet named AppSubnet is inspected by the firewall, including traffic to other subnets in VNet1 and to the internet. What should you configure?

Accepted Answer

Create a user-defined route (UDR) on AppSubnet with a default route (0.0.0.0/0) that has a next hop type of Virtual appliance and points to the private IP address of the Azure Firewall.. Azure Firewall inspects traffic only when it is in the data path. A user-defined route on AppSubnet with a default route using next hop Virtual appliance and the firewall's private IP ensures all outbound traffic, including to other subnets and the internet, is sent to the firewall. Without this UDR, traffic would bypass the firewall.

Answer

Enable Azure Firewall forced tunneling by configuring a UDR with a next hop type of Virtual network gateway on AppSubnet.

Answer

Associate a network security group (NSG) with AppSubnet that denies all outbound traffic except to the firewall's private IP address.

Answer

Configure Azure Firewall to use DNS proxy and set the DNS servers on AppSubnet to the firewall's private IP address.

Question 15

You are a security engineer for Fabrikam. The company has an Azure virtual network named VNet1 that contains a subnet named Subnet1 with several VMs. You need to ensure that all traffic from Subnet1 to the internet is inspected by Azure Firewall, and that the VMs can resolve external DNS names using Azure-provided DNS. The firewall is deployed in a subnet named AzureFirewallSubnet. Which two actions should you perform? (Choose two.)

Accepted Answer

Configure the Azure Firewall to use DNS proxy, and set the DNS servers on Subnet1 to the private IP address of the Azure Firewall.. To inspect all internet-bound traffic from Subnet1 with Azure Firewall, a user-defined route must direct that traffic to the firewall's private IP. To allow VMs to resolve external names, enable DNS proxy on the firewall and point Subnet1's DNS settings to the firewall's private IP. Together, these actions meet both requirements.

Answer

Create a service endpoint for Microsoft.Storage on Subnet1 to allow VMs to resolve external DNS names.

Answer

Deploy an Azure Bastion host in VNet1 and configure the VMs to use it as a DNS forwarder.

Answer

Associate a network security group with Subnet1 that allows outbound traffic only to the Azure Firewall's private IP address.