AZ-500 Secure networking Practice Test 2 — 15 Questions

Question 1

A company is setting up a site-to-site VPN between an on-premises network and an Azure virtual network using an Azure VPN gateway. The security policy mandates that the VPN tunnel must use the strongest available encryption and authentication. Which IPsec/IKE parameter combination should they configure on both sides?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

IKEv2 with AES256. IKEv2 is the most secure and modern IPsec/IKE protocol, supporting stronger encryption algorithms like AES256. AES256 provides the highest level of encryption strength among the options, meeting the mandate for the strongest available encryption and authentication. IKEv2 also offers improved resilience and security features over IKEv1, such as built-in NAT traversal and mobility support.

Answer

IKEv1 with DES

Answer

IKEv2 with 3DES

Answer

IKEv1 with AES128

Question 2

A company has an Azure virtual network with a subnet that hosts a public web application. They want to allow inbound HTTPS traffic (port 443) only from the source IP range 203.0.113.0/24, and block all other inbound traffic. They associate a network security group (NSG) with the subnet. What is the minimum number of inbound security rules required in the NSG to achieve this?

Accepted Answer

1. NSGs include default inbound rules that already block all inbound traffic not explicitly allowed. By adding a single inbound rule to allow HTTPS (port 443) from the source IP range 203.0.113.0/24, all other inbound traffic is implicitly denied by the default deny-all rule (rule 65000). No explicit deny rule is needed, and no additional rules for Azure Load Balancer health probes are required unless the application is behind a load balancer, which is not specified in the scenario.

Answer

0 (no additional rules needed because the default rules block all inbound traffic)

Answer

2 (one allow rule for HTTPS and one deny rule for all other traffic)

Answer

3 (one allow HTTPS, one allow for Azure Load Balancer health probes, and one deny all)

Question 3

A virtual network has a Frontend subnet (web servers) and a Backend subnet (Azure SQL Database). The security team requires that no internet traffic can reach the Backend subnet directly, but the Frontend subnet must be able to communicate with the Backend subnet on port 1433. Which solution should they implement?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct solution because they provide stateful, layer-3/4 traffic filtering at the subnet or NIC level. By applying an NSG to the Backend subnet with a rule that denies all inbound internet traffic (deny all from Internet) and a higher-priority rule that allows inbound traffic from the Frontend subnet on TCP port 1433, you enforce the required isolation while permitting necessary SQL communication.

Answer

Azure Firewall with a routing table

Answer

Service Endpoints

Answer

Virtual Network Peering

Question 4

A company has virtual networks in East US and West US connected via global VNet peering. The security policy requires that all traffic between the peered VNets be encrypted using IPsec. Which action should the company take to meet this requirement?

Accepted Answer

Deploy an Azure VPN Gateway in each VNet and create a site-to-site VPN connection between them.. VNet peering does not encrypt traffic between peered virtual networks by default; it relies on the Microsoft backbone network. To enforce IPsec encryption for all traffic between the peered VNets, you must deploy an Azure VPN Gateway in each VNet and configure a site-to-site VPN connection between them. This creates an encrypted tunnel using IPsec/IKE protocols, satisfying the security policy requirement.

Answer

Enable the 'Allow gateway transit' setting on the VNet peering.

Answer

Enable 'Use remote gateways' on the VNet peering.

Answer

Configure Azure Firewall to encrypt the traffic between the VNets.

Question 5

A company has several critical applications deployed in an Azure virtual network. The security team wants to protect the virtual network against Distributed Denial-of-Service (DDoS) attacks by enabling automatic attack mitigation, adaptive tuning, and access to DDoS Rapid Response Support. Which DDoS Protection tier should they enable for the virtual network?

Accepted Answer

DDoS Protection Standard. DDoS Protection Standard is the correct tier because it provides automatic attack mitigation, adaptive tuning based on traffic patterns, and access to DDoS Rapid Response Support (DRRS) for Azure virtual networks. The Basic tier only offers always-on traffic monitoring and basic mitigation without adaptive tuning or DRRS, while Premium and Advanced are not valid Azure DDoS Protection tiers.

Answer

DDoS Protection Basic (Free)

Answer

DDoS Protection Premium

Answer

DDoS Protection Advanced

Question 6

A company has multiple Azure virtual networks connected via VNet peering. They want to ensure that all traffic between the peered VNets is encrypted and that no traffic can bypass the encryption. Which configuration is required?

Accepted Answer

Use VPN Gateway with IPsec between VNets. VNet peering does not encrypt traffic between virtual networks by default. To enforce encryption for all traffic, you must use a VPN Gateway with IPsec/IKE policy configured between the peered VNets. This ensures that all traffic crossing the peering is encrypted and that no unencrypted path exists, meeting the requirement that no traffic can bypass encryption.

Answer

Enable Service Endpoint Policies

Answer

VNet peering does not support encryption; use Global VNet peering

Answer

Enable Azure Firewall

Question 7

A company has an Azure virtual network with multiple subnets hosting different tiers of an application. The security team requires inspection of all traffic between subnets for malicious patterns and the ability to allow or deny traffic based on fully qualified domain names (FQDNs). Which Azure networking service should they implement?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides full Layer 3–7 inspection and can filter traffic based on FQDNs in network and application rules. It can inspect all traffic between subnets in a virtual network (via forced tunneling or routing) and supports threat intelligence-based filtering for malicious patterns, making it the correct choice for this requirement.

Answer

Azure Network Security Group (NSG)

Answer

Azure Application Gateway

Answer

Azure VPN Gateway

Question 8

An organization has deployed Azure Firewall and wants to inspect all outbound traffic from a virtual network (VNet) to the internet. The VNet already contains subnets with workloads. What is the required networking configuration to force traffic through Azure Firewall?

Accepted Answer

Configure a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP and associate it with the subnets.. Azure Firewall requires a route table with a default route (0.0.0.0/0) that has the Azure Firewall's private IP as the next hop, associated with each subnet whose traffic must be inspected. This forces all outbound traffic from those subnets to be routed through the firewall, enabling inspection and logging. Without this explicit route, traffic would use the default system route and bypass the firewall.

Answer

Add a Network Security Group (NSG) rule that allows all outbound traffic and associate it with the subnets.

Answer

Deploy an Application Gateway with Web Application Firewall (WAF) in front of the subnets.

Answer

Enable Azure DDoS Protection Standard on the VNet.

Question 9

A company uses a hub-spoke network topology in Azure. They need to inspect and filter all traffic flowing between spoke virtual networks for security compliance. Which Azure-native service should be deployed in the hub virtual network to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a fully managed, stateful firewall-as-a-service that can inspect and filter traffic between spoke virtual networks when deployed in the hub VNet. It supports application (FQDN) and network (IP/port/protocol) rules, and can enforce security compliance by logging and blocking non-compliant traffic. Unlike a Network Virtual Appliance (NVA), Azure Firewall is a native PaaS service with built-in high availability and auto-scaling, making it the recommended choice for hub-spoke traffic inspection.

Answer

Network Virtual Appliance (NVA)

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Question 10

A company has established a site-to-site VPN connection between its on-premises network and an Azure virtual network using an Azure VPN gateway. The security team wants to confirm that all traffic crossing the VPN tunnel is encrypted. Which protocol does the Azure VPN gateway use to encrypt the data?

Accepted Answer

IPSec (Internet Protocol Security). Azure VPN gateways use IPsec (Internet Protocol Security) in tunnel mode to encrypt all data traversing the site-to-site VPN tunnel. IPsec provides confidentiality, integrity, and authentication at the IP layer, ensuring that all traffic between the on-premises network and Azure virtual network is encrypted and secure.

Answer

SSL (Secure Sockets Layer) / TLS (Transport Layer Security)

Answer

SSH (Secure Shell)

Answer

PGP (Pretty Good Privacy)

Question 11

A storage account should be reachable only from a specific subnet over the Microsoft backbone, while keeping the public endpoint firewall restricted. Which feature should be used?

Accepted Answer

Service endpoint for Microsoft.Storage with storage firewall rules. A service endpoint for Microsoft.Storage extends your virtual network private address space and the identity of your VNet to the Azure Storage service over the Microsoft backbone. By combining the service endpoint with a storage firewall rule that restricts access to only that specific subnet, you ensure the storage account is reachable only from that subnet while keeping the public endpoint firewall restricted to deny all other traffic.

Answer

Application Security Group

Answer

Azure Bastion

Answer

Public IP prefix

Question 12

A web app uses Azure App Service and must access Azure SQL over a private IP without exposing SQL to the public internet. Which two components are required?

Accepted Answer

Private Endpoint for Azure SQL. A is correct because a Private Endpoint for Azure SQL assigns a private IP from your virtual network to the Azure SQL logical server, allowing the App Service to connect over a private IP without exposing the database to the public internet. This is the core component that brings the Azure SQL service into your virtual network privately.

Answer

Inbound NAT rule on Azure Load Balancer

Answer

DDoS Protection Basic only

Question 13

Traffic from a spoke VNet must reach the internet through a firewall in the hub VNet. What routing configuration is required on the spoke subnets?

Accepted Answer

A default route to the Azure Firewall private IP or virtual appliance next hop. To force spoke traffic to the internet through a firewall in the hub VNet, you must create a user-defined route (UDR) on the spoke subnet with an address prefix of 0.0.0.0/0 and a next hop of the Azure Firewall's private IP or the virtual appliance's IP. This overrides the default system route that would otherwise send internet-bound traffic directly out via Azure's edge, ensuring all egress traffic is inspected and controlled by the firewall.

Answer

A route to Internet with next hop Internet

Answer

An NSG deny rule for 0.0.0.0/0

Answer

A service endpoint policy

Question 14

An Application Gateway WAF blocks legitimate requests because a managed rule detects a known false positive. The team wants to keep the rule set enabled. What should they configure?

Accepted Answer

A narrowly scoped WAF exclusion for the affected variable or rule. A narrowly scoped WAF exclusion is the correct approach because it allows the team to keep the managed rule set enabled while preventing false positives. By configuring an exclusion for the specific variable (e.g., RequestHeaderNames, RequestCookieNames, RequestArgNames) or rule ID that triggers the false positive, the WAF will skip inspection on that particular element without weakening the overall security posture. This maintains protection against other threats while resolving the blocking of legitimate traffic.

Answer

Disable WAF prevention mode for the entire gateway

Answer

Remove TLS from the listener

Answer

Move the application behind an internal load balancer only

Question 15

An Azure SQL Database must be accessed privately from workloads in a VNet and should not allow public network access. Which two configurations are required?

Accepted Answer

Create a Private Endpoint for the SQL server. A Private Endpoint assigns a private IP address from your VNet to the Azure SQL Database logical server, enabling traffic to reach the database entirely over the Microsoft backbone network without traversing the public internet. This is a fundamental requirement for private connectivity from workloads inside a VNet.

Answer

Enable service endpoint only and leave public access open

Answer

Create an inbound NAT rule on Azure Load Balancer