AZ-500 Secure networking Practice Test 3 — 15 Questions

Question 1

A company uses Azure Front Door to accelerate and secure its public web application. The security team wants to limit the number of requests from a single client IP address to 100 per minute to prevent a single user from overwhelming the backend. Which configuration should they add to the Web Application Firewall (WAF) policy associated with the Front Door?

Accepted Answer

Add a custom rule with a rate limit condition.. Option A is correct because Azure Front Door's WAF supports custom rate limit rules that can restrict the number of requests from a single client IP address within a specified time window. By creating a custom rule with a rate limit condition set to 100 requests per minute, the security team can prevent a single client from overwhelming the backend while allowing legitimate traffic. This is the only option that directly addresses the requirement to limit requests per client IP.

Answer

Enable a managed rule set for the WAF policy.

Answer

Configure a bot protection rule set.

Answer

Set a geolocation filter to block all traffic except from allowed countries.

Question 2

A company has an Azure virtual network with a subnet that hosts a web application. They want to allow inbound HTTPS traffic from any source on the internet (0.0.0.0/0) and block all other inbound traffic. They associate a network security group (NSG) with the subnet. What is the minimum number of inbound security rules required to achieve this?

Accepted Answer

One inbound rule allowing HTTPS from Internet.. Option B is correct because an NSG includes a set of default security rules that already block all inbound traffic not explicitly allowed. By adding a single inbound rule that allows HTTPS (TCP port 443) from the Internet (0.0.0.0/0), the default deny rule (DenyAllInbound) will block all other inbound traffic. Therefore, only one custom inbound rule is required to achieve the stated goal.

Answer

One inbound rule allowing HTTPS from Internet, and one inbound rule DenyAllInbound.

Answer

Two inbound rules: one allowing HTTPS from Internet, one allowing HTTP from Internet.

Answer

Two inbound rules: one allowing HTTPS from Internet, one allowing RDP from Internet.

Question 3

A company has Azure virtual machines that need to download updates from specific external websites (e.g., *.microsoft.com and *.windowsupdate.com). The security team wants to centrally manage and allow outbound HTTPS traffic only to these FQDNs, while blocking all other outbound internet access. Which Azure networking service should they deploy to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-native network security service that can centrally enforce outbound FQDN-based rules. It allows you to create application rules that permit HTTPS traffic to specific FQDNs (e.g., *.microsoft.com) while blocking all other outbound internet access, meeting the security team's requirement for granular, centralized control.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 4

You have an Azure virtual machine that hosts a web application on port 443 and a management interface on port 8443. You need to allow inbound HTTPS traffic from the internet to port 443, and allow inbound traffic on port 8443 only from the company's office public IP range (203.0.113.0/24). You want to use a managed service that provides basic DDoS protection at no additional cost. What should you use?

Accepted Answer

Network Security Group (NSG). A Network Security Group (NSG) is the correct choice because it is a free, managed Azure service that provides basic DDoS protection at no additional cost. NSGs allow you to define inbound security rules to permit HTTPS traffic (port 443) from any source and restrict management traffic (port 8443) to a specific public IP range (203.113.0.0/24). This meets all requirements without incurring extra charges for advanced services.

Answer

Azure Application Gateway with WAF

Answer

Azure Front Door

Answer

Azure Firewall

Question 5

A company deploys Azure Firewall to inspect and control outbound traffic from a virtual network. The security team wants to allow outbound HTTPS traffic only to specific FQDNs such as *.microsoft.com and *.windowsupdate.com, while blocking all other outbound internet access. Which type of rule should they configure in Azure Firewall to achieve this filtering?

Accepted Answer

Application Rule. Azure Firewall uses Application Rules to filter outbound traffic based on fully qualified domain names (FQDNs) for HTTP/HTTPS protocols. Since the requirement is to allow HTTPS traffic to specific FQDNs like *.microsoft.com and *.windowsupdate.com, an Application Rule is the correct choice because it can inspect the TLS Server Name Indication (SNI) extension to match the target FQDN, enabling granular allow/deny decisions for web traffic.

Answer

Network Rule

Answer

NAT Rule

Answer

DNAT Rule

Question 6

A company deploys Azure virtual machines in a virtual network. A security policy requires that only Remote Desktop Protocol (RDP) traffic from the corporate VPN's public IP address (203.0.113.0/26) is allowed. All other inbound RDP traffic must be denied. Which configuration should be applied to the network security group (NSG) associated with the VM subnet?

Accepted Answer

Add an inbound rule to allow RDP from the corporate IP range, and add a default deny rule for all other inbound RDP traffic.. Option C is correct because the requirement is to allow RDP (TCP port 3389) only from the corporate VPN's public IP range (203.0.113.0/26) and deny all other inbound RDP traffic. An NSG processes rules in priority order; by adding an inbound allow rule for the corporate IP range with a high priority (e.g., 100) and relying on the default deny rule (which denies all inbound traffic not explicitly allowed), only RDP from the specified range is permitted. This matches the security policy precisely.

Answer

Add an inbound rule to allow RDP from the Internet and a deny rule for RDP from the corporate IP.

Answer

Add an inbound rule to deny RDP from the corporate IP and a default deny all inbound.

Answer

No additional rules are needed because the default NSG rules already deny RDP.

Question 7

A security administrator is troubleshooting network connectivity to an Azure virtual machine. The VM is behind a network security group (NSG) that has a deny-all inbound rule as the default. The administrator wants to quickly verify whether a specific TCP packet on port 3389 from their client IP (203.0.113.50) would be allowed or blocked by the NSG. Which Azure Network Watcher tool should they use?

Accepted Answer

IP flow verify.. IP flow verify is the correct tool because it tests whether a specific packet (source IP, destination IP, protocol, port) is allowed or denied by an NSG or virtual network (VNet) route. In this scenario, the administrator needs to quickly validate inbound TCP traffic on port 3389 from client IP 203.0.113.50 to the VM, and IP flow verify provides a pass/fail result along with the exact rule that caused the outcome.

Answer

Network Performance Monitor.

Answer

Next hop.

Answer

NSG diagnostics (flow logs).

Question 8

A security team needs to analyze network traffic to and from Azure virtual machines to investigate a potential security incident. They want to capture information such as source IP, destination IP, port, and protocol. Which Azure service should they enable on the network security groups (NSGs) associated with the virtual machine subnets?

Accepted Answer

Network Watcher NSG flow logs. Network Watcher NSG flow logs capture IP traffic flowing through Network Security Groups, recording source IP, destination IP, port, and protocol for each flow. This directly meets the requirement to analyze network traffic to and from Azure VMs for security incident investigation.

Answer

Azure Monitor logs

Answer

Traffic Analytics

Answer

Azure Firewall logs

Question 9

A company has an Azure virtual network with multiple subnets hosting different application tiers. They need to inspect and filter all outbound traffic from VMs to the internet, and they must be able to allow or deny traffic based on fully qualified domain names (FQDNs). Which Azure networking service should they deploy?

Accepted Answer

Azure Firewall.. Azure Firewall is a managed, cloud-based network security service that can inspect and filter outbound traffic from Azure virtual networks to the internet. It supports application rules based on fully qualified domain names (FQDNs), allowing or denying traffic by FQDN, which directly meets the requirement. Unlike simpler filtering options, Azure Firewall provides stateful inspection and integrates with Azure Monitor for logging.

Answer

Network Security Groups (NSGs).

Answer

Azure Application Gateway.

Answer

Azure VPN Gateway.

Question 10

A company is setting up a site-to-site VPN between an on-premises network and an Azure virtual network using an Azure VPN gateway. The security policy mandates that the VPN tunnel must use the strongest available encryption and authentication. Which IPsec/IKE parameter combination should they configure on both sides?

Accepted Answer

IKEv2 with AES256. Option A is correct because IKEv2 is the most secure and modern IPsec/IKE protocol, supporting stronger encryption algorithms like AES256. AES256 provides the highest level of encryption strength among the options, meeting the mandate for the strongest available encryption and authentication. IKEv2 also offers improved resilience and security features over IKEv1, such as built-in NAT traversal and mobility support.

Answer

IKEv1 with DES

Answer

IKEv2 with 3DES

Answer

IKEv1 with AES128

Question 11

A company has an Azure virtual network with a subnet that hosts a public web application. They want to allow inbound HTTPS traffic (port 443) only from the source IP range 203.0.113.0/24, and block all other inbound traffic. They associate a network security group (NSG) with the subnet. What is the minimum number of inbound security rules required in the NSG to achieve this?

Accepted Answer

1. Option B is correct because NSGs include default inbound rules that already block all inbound traffic not explicitly allowed. By adding a single inbound rule to allow HTTPS (port 443) from the source IP range 203.0.113.0/24, all other inbound traffic is implicitly denied by the default deny-all rule (rule 65000). No explicit deny rule is needed, and no additional rules for Azure Load Balancer health probes are required unless the application is behind a load balancer, which is not specified in the scenario.

Answer

0 (no additional rules needed because the default rules block all inbound traffic)

Answer

2 (one allow rule for HTTPS and one deny rule for all other traffic)

Answer

3 (one allow HTTPS, one allow for Azure Load Balancer health probes, and one deny all)

Question 12

A virtual network has a Frontend subnet (web servers) and a Backend subnet (Azure SQL Database). The security team requires that no internet traffic can reach the Backend subnet directly, but the Frontend subnet must be able to communicate with the Backend subnet on port 1433. Which solution should they implement?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct solution because they provide stateful, layer-3/4 traffic filtering at the subnet or NIC level. By applying an NSG to the Backend subnet with a rule that denies all inbound internet traffic (deny all from Internet) and a higher-priority rule that allows inbound traffic from the Frontend subnet on TCP port 1433, you enforce the required isolation while permitting necessary SQL communication.

Answer

Azure Firewall with a routing table

Answer

Service Endpoints

Answer

Virtual Network Peering

Question 13

A company has virtual networks in East US and West US connected via global VNet peering. The security policy requires that all traffic between the peered VNets be encrypted using IPsec. Which action should the company take to meet this requirement?

Accepted Answer

Deploy an Azure VPN Gateway in each VNet and create a site-to-site VPN connection between them.. VNet peering does not encrypt traffic between peered virtual networks by default; it relies on the Microsoft backbone network. To enforce IPsec encryption for all traffic between the peered VNets, you must deploy an Azure VPN Gateway in each VNet and configure a site-to-site VPN connection between them. This creates an encrypted tunnel using IPsec/IKE protocols, satisfying the security policy requirement.

Answer

Enable the 'Allow gateway transit' setting on the VNet peering.

Answer

Enable 'Use remote gateways' on the VNet peering.

Answer

Configure Azure Firewall to encrypt the traffic between the VNets.

Question 14

A company has several critical applications deployed in an Azure virtual network. The security team wants to protect the virtual network against Distributed Denial-of-Service (DDoS) attacks by enabling automatic attack mitigation, adaptive tuning, and access to DDoS Rapid Response Support. Which DDoS Protection tier should they enable for the virtual network?

Accepted Answer

DDoS Protection Standard. DDoS Protection Standard is the correct tier because it provides automatic attack mitigation, adaptive tuning based on traffic patterns, and access to DDoS Rapid Response Support (DRRS) for Azure virtual networks. The Basic tier only offers always-on traffic monitoring and basic mitigation without adaptive tuning or DRRS, while Premium and Advanced are not valid Azure DDoS Protection tiers.

Answer

DDoS Protection Basic (Free)

Answer

DDoS Protection Premium

Answer

DDoS Protection Advanced

Question 15

A company has two Azure virtual networks in different Azure regions that need to communicate with each other. The security policy mandates that all inter-region traffic must be encrypted over the public internet. Which connectivity solution should the company implement to meet this requirement?

Accepted Answer

Azure VPN Gateway (site-to-site connection). Azure VPN Gateway with a site-to-site (S2S) connection is the correct solution because it establishes an encrypted IPSec tunnel over the public internet between the two virtual networks. This meets the security mandate for encryption of inter-region traffic traversing the public internet, as IPSec provides confidentiality, integrity, and authentication at the network layer.

Answer

VNet peering

Answer

Azure ExpressRoute

Answer

Azure Firewall