AZ-500 Secure networking Practice Test 2 — 15 Questions

Question 1

An Azure SQL Database must be accessed privately from workloads in a VNet and should not allow public network access. Which two configurations are required?

Accepted Answer

Create a Private Endpoint for the SQL server. A Private Endpoint assigns a private IP address from your VNet to the Azure SQL Database logical server, enabling traffic to reach the database entirely over the Microsoft backbone network without traversing the public internet. This is a fundamental requirement for private connectivity from workloads inside a VNet.

Answer

Enable service endpoint only and leave public access open

Answer

Create an inbound NAT rule on Azure Load Balancer

Question 2

A hub-and-spoke Azure network uses Azure Firewall for egress inspection. Which two settings are typically required on spoke workloads?

Accepted Answer

UDRs that send default traffic to the firewall next hop. In a hub-and-spoke topology with Azure Firewall for egress inspection, spoke workloads must not be able to bypass the firewall. A User Defined Route (UDR) with address prefix 0.0.0.0/0 and next hop type VirtualAppliance pointing to the firewall's private IP forces all outbound traffic through the firewall. Additionally, DNS and routing design must prevent direct internet access—for example, by using Azure Private DNS zones or custom DNS servers that resolve only internal names, ensuring that no traffic can exit the spoke without firewall inspection.

Answer

Public IP addresses on every VM

Answer

NSG rules that allow all inbound internet traffic

Question 3

You are planning a network security strategy for a multi-tier application deployed on Azure virtual machines. You need to ensure that traffic between the web tier and the application tier is encrypted and that the application tier is not directly accessible from the internet. Which three of the following should you implement? (Choose three.)

Accepted Answer

Enable end-to-end TLS encryption between the web tier and the application tier using certificates.. The requirements are to encrypt traffic between the web tier and application tier, and to prevent direct internet access to the application tier. Enabling end-to-end TLS between the tiers satisfies the encryption requirement. Configuring an NSG on the app tier subnet to deny inbound internet traffic satisfies the access restriction. Azure Application Gateway with SSL/TLS termination is placed in front of the web tier and primarily handles client-to-web traffic; it does not enforce encryption or access control between web and app tiers. Therefore, it should not be selected as a required action for these specific requirements.

Answer

Use Azure Front Door to route traffic between the web tier and the application tier.

Answer

Assign public IP addresses to the application tier virtual machines for monitoring purposes.

Answer

Configure a site-to-site VPN between the web tier and the application tier subnets.

Question 4

Your company has deployed an Azure Firewall in a hub virtual network to inspect traffic from spoke virtual networks. You need to ensure that all outbound traffic from a spoke virtual network to the internet is forced through the Azure Firewall. Which three of the following actions are required? (Choose three.)

Accepted Answer

Associate the route table to the subnets in the spoke virtual network that need to send traffic through the firewall.. To force all outbound traffic from a spoke virtual network through Azure Firewall, you must create a route table in the spoke with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop. This route table must be associated with the subnets in the spoke that need to send traffic through the firewall. Additionally, you must configure the Azure Firewall policy with appropriate network and application rules to allow or deny outbound traffic, as the firewall itself does not automatically permit traffic without explicit rules.

Answer

Deploy a Network Virtual Appliance (NVA) in the spoke virtual network to handle outbound traffic.

Answer

Set the Azure Firewall to 'Drop' mode for all outbound traffic by default.

Answer

Enable forced tunneling on the Azure Firewall to route traffic through an on-premises network.

Question 5

You are designing a secure hybrid network that connects an on-premises datacenter to Azure. The solution must provide high availability and encrypt all traffic between the two sites. Which three of the following should you consider? (Choose three.)

Accepted Answer

Deploy two or more Azure VPN Gateway instances in an active-active configuration.. Deploying two or more Azure VPN Gateway instances in an active-active configuration provides high availability by ensuring that if one gateway instance fails, traffic continues to flow through the other. Using IPsec/IKE policy with strong encryption parameters (e.g., AES256, SHA256, DH Group 14 or higher) ensures all traffic between the on-premises datacenter and Azure is encrypted to meet security compliance. Configuring a second VPN tunnel from the on-premises device to a different Azure region adds geographic redundancy, protecting against a regional Azure outage.

Answer

Use Azure Front Door to load balance traffic between the on-premises network and Azure.

Answer

Set up a point-to-site VPN for all on-premises users to access Azure resources.

Answer

Implement Azure ExpressRoute with Microsoft peering as the primary connectivity.

Question 6

You are a security engineer for a company that uses Azure. You need to secure network connectivity between on-premises resources and Azure virtual networks (VNets) while minimizing exposure to the public internet. Which four of the following options are valid methods to achieve this? (Choose all that apply. There are four correct answers.)

Accepted Answer

Azure VPN Gateway with site-to-site (S2S) IPsec/IKE VPN tunnel.. All four selected options provide private or encrypted connectivity between on-premises and Azure VNets, minimizing exposure to the public internet. Azure VPN Gateway S2S creates an encrypted tunnel over the internet; ExpressRoute with private peering provides a dedicated private connection; P2S VPN allows individual devices to connect securely; Azure Front Door with Private Link origin uses Microsoft's backbone network to route traffic privately. In contrast, Application Gateway with a public frontend IP and Load Balancer with public IP on backend pool are public-facing services that do not establish private connectivity between on-premises and Azure.

Answer

Azure Application Gateway with public frontend IP only.

Answer

Azure Load Balancer with a public IP assigned to the backend pool.

Question 7

Drag and drop the steps to configure network security group (NSG) flow logs for a virtual network into the correct order.

Accepted Answer

Navigate to Network Watcher → Select the NSG → Create a storage account → Enable flow logs and configure retention.. The correct sequence for configuring NSG flow logs in the Azure portal is: Navigate to Network Watcher → Select the NSG → Create a storage account (or choose an existing one) → Enable flow logs and configure retention. This order matches the portal workflow where you initiate the flow log setup, choose the NSG, then configure storage and retention. Option C accurately reflects this.

Answer

Create a storage account → Navigate to Network Watcher → Select the NSG → Enable flow logs and configure retention.

Answer

Navigate to Network Watcher → Create a storage account → Select the NSG → Enable flow logs and configure retention.

Answer

Create a storage account → Select the NSG → Navigate to Network Watcher → Enable flow logs and configure retention.

Question 8

Match each Azure policy effect to its behavior.

Accepted Answer

Deny: Denies the resource creation or update request.. Policy effects in Azure Policy enforce compliance. Deny blocks non-compliant requests, Audit logs them, Append adds fields, and DeployIfNotExists automatically deploys missing resources. Common confusions involve swapping Deny and Audit behaviors.

Answer

Deny: Logs a warning event in the activity log but allows the request.

Answer

Audit: Denies the resource creation or update request.

Question 9

Match each Azure network security component to its function.

Accepted Answer

Network Security Group (NSG): A security rule set that filters traffic at the subnet or network interface level.. Correct matches: NSG filters at subnet/NIC; Azure Firewall is a managed service; DDoS Protection mitigates DDoS; Application Gateway with WAF protects web apps. Common confusions: swapping NSG and Azure Firewall definitions.

Answer

Network Security Group (NSG): A managed firewall service that provides threat protection for virtual networks.

Answer

Azure Firewall: A security rule set that filters traffic at the subnet or NIC level.

Question 10

Match each Azure Sentinel feature to its purpose.

Accepted Answer

Incidents: A security event that indicates a possible breach.. Correct matches: Incidents as security events, Hunting queries as proactive searches. Common confusions involve swapping definitions of Workbooks, Analytics rules, Playbooks, and Hunting queries.

Answer

Workbooks: Automated response actions.

Answer

Analytics rules: Customizable dashboards.

Answer

Playbooks: Rules that generate alerts.

Question 11

Your company has an Azure subscription with multiple virtual networks (VNets) connected via VNet peering. You need to filter traffic between VNets based on source IP addresses and ports. You want a managed solution that provides stateful inspection and centralized logging. Which TWO solutions meet the requirements?

Accepted Answer

Azure Firewall. Azure Firewall (A) is correct because it is a fully managed, cloud-native network security service that performs stateful inspection and supports filtering rules based on source IP addresses, ports, and protocols, while also providing centralized logging through Azure Monitor and Log Analytics. A Network Virtual Appliance (NVA) from a partner (D) is also correct because partner NVAs are managed third-party firewall/routing appliances available in Azure Marketplace that can perform stateful inspection and centralized logging, and they can be deployed to filter traffic between peered VNets. Network Security Groups (B) are not correct because, although they filter traffic by IP and port, they are stateless (not stateful inspection) and their flow logs are not a centralized managed logging solution in the same sense. Azure VPN Gateway (C) is not correct because it provides encrypted connectivity between networks, not traffic filtering or stateful inspection. Azure Front Door (E) is not correct because it is a global HTTP/HTTPS application delivery and web application firewall service for web workloads, not a general VNet-to-VNet traffic filtering solution.

Answer

Network Security Groups (NSGs)

Answer

Azure VPN Gateway

Answer

Azure Front Door

Question 12

You are troubleshooting connectivity between two Azure virtual machines in different VNets that are peered. VM1 (10.0.1.4) cannot reach VM2 (10.0.2.4) on port 80. Both VNets have NSGs allowing HTTP traffic from each other's IP ranges. The VNet peering is in 'Connected' state. You verify that the VMs' operating system firewalls allow HTTP. What is the most likely cause of the connectivity issue?

Accepted Answer

The NSG on VM2's subnet does not allow inbound traffic from VM1's VNet address space.. The NSG on VM2's subnet is explicitly configured to allow inbound HTTP traffic from VM1's IP address (10.0.1.4) or its VNet address space (10.0.1.0/24). Without this rule, the NSG will drop the inbound TCP SYN packet on port 80, even though the VNet peering is connected and the VM's OS firewall permits the traffic. NSGs are stateful only for flows they allow; if no inbound rule matches, the packet is silently discarded.

Answer

NSGs are not stateful and require explicit outbound rules.

Answer

The VNet peering status is disconnected.

Answer

Azure Firewall is blocking traffic between the VNets.

Question 13

You are configuring network security for a multi-tier application in Azure. The web tier must accept HTTPS traffic from the internet. The application tier should only accept traffic from the web tier. The data tier should only accept traffic from the application tier. Which THREE Azure features should you use to implement this?

Accepted Answer

Azure Firewall. Azure Firewall (A) is correct because it provides centralized, stateful Layer 3–7 filtering with FQDN and threat-intelligence rules, allowing you to control the inbound HTTPS (TCP 443) traffic from the internet to the web tier and enforce egress policies between tiers. Application Security Groups (B) are correct because they let you group VMs by workload role (web, app, data) and reference those groups as source/destination in NSG rules, so the app tier can accept traffic only from the web ASG and the data tier only from the app ASG without managing individual IP addresses. Network Security Groups (E) are correct because they are the actual stateful packet-filtering rules (priority-based, allow/deny, 5-tuple plus ASG references) attached to subnets or NICs that enforce the tier-to-tier isolation. Azure Front Door (C) is a global Layer 7 HTTP/HTTPS load balancer and CDN/WAF, not a mechanism for restricting east-west traffic between internal tiers, and Azure Traffic Manager (D) is a DNS-based global traffic distributor that cannot filter or segment traffic between application tiers.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Question 14

Your organization has multiple Azure subscriptions connected via a hub-spoke topology using Azure Firewall in the hub. You need to ensure that traffic between spoke VNets is routed through the firewall for inspection. You configure user-defined routes (UDRs) on the spoke subnets. However, traffic between spokes is still bypassing the firewall. What is the most likely reason?

Accepted Answer

The 'Use remote gateway' setting is disabled on the spoke VNet peering.. In a hub-spoke topology with Azure Firewall, the 'Use remote gateway' setting on the spoke VNet peering must be disabled. This setting is only for using a VPN or ExpressRoute gateway in the hub; it does not enable routing through Azure Firewall. With this setting disabled, the configured UDRs on the spoke subnets can direct spoke-to-spoke traffic to the firewall for inspection.

Answer

Azure Firewall does not support traffic between spoke VNets.

Answer

The UDR on the firewall subnet does not include the spoke address spaces.

Answer

The 'Allow gateway transit' setting is disabled on the spoke peering.

Question 15

You are troubleshooting an Azure virtual machine that cannot access the internet. The VM is in a subnet with a route table that has a default route (0.0.0.0/0) with next hop 'Virtual appliance' pointing to the private IP of an Azure Firewall. The Azure Firewall has a DNAT rule to allow outbound traffic. You verify that the VM's NSG allows outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The Azure Firewall does not have an allow rule for outbound internet traffic.. The Azure Firewall requires an explicit allow rule (typically an application or network rule) for outbound internet traffic. Even though a DNAT rule exists for outbound traffic, DNAT only translates the destination IP/port; it does not inherently permit the traffic. Without a corresponding allow rule, the firewall drops the outbound packets, preventing internet access.

Answer

Azure Firewall does not support SNAT for outbound traffic.

Answer

The route table does not have a default route.

Answer

The VM's NSG is blocking outbound traffic.