AZ-500 Secure networking Practice Test 3 — 15 Questions

Question 1

A company uses Azure Firewall to filter outbound traffic from a virtual network. The security team notices that traffic to a specific external IP address is being allowed despite a deny rule. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A network rule with a higher priority allows the traffic.. In Azure Firewall, rule processing order is NAT rules, then network rules, then application rules. If a network deny rule matches traffic, it is applied and application rules are not evaluated. The most likely cause of traffic being allowed despite a deny rule is a network rule with a higher priority (lower priority number) that allows the traffic.

Answer

The Azure Firewall policy is not associated with the correct virtual network.

Answer

An application rule allows the traffic, which overrides the network deny rule.

Answer

The deny rule is configured with the wrong protocol (UDP instead of TCP).

Question 2

You need to filter inbound internet traffic to an Azure web application based on source IP address and geographic location. Which Azure service should you use?

Accepted Answer

Azure Web Application Firewall (WAF) on Azure Front Door. Azure Web Application Firewall (WAF) on Azure Front Door provides geo-filtering and source IP-based access control at the edge, allowing you to block or allow traffic based on geographic location and source IP address before it reaches your web application. This is the only service among the options that combines both capabilities for inbound internet traffic to a web application.

Answer

Network Security Group

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 3

Which TWO actions should you take to secure traffic between Azure virtual networks using VNet peering? (Choose two.)

Accepted Answer

Apply network security groups (NSGs) to subnets to control traffic between the VNets.. Option A is correct because network security groups (NSGs) can be associated with subnets in peered VNets and used to allow or deny traffic based on source/destination IP, port, and protocol, giving granular control over east-west traffic between the VNets. Option B is correct because Azure Firewall can be deployed in a hub VNet and, with user-defined routes (UDRs) forcing traffic through the firewall, inspect and filter traffic flowing between peered VNets, including FQDN and threat-intelligence-based rules. Option C is not correct because VNet peering traffic already travels over the Microsoft backbone and does not require a VPN Gateway; a VPN Gateway is used for encrypted tunnels over the public internet (site-to-site or VNet-to-VNet), not for peering. Option D is not correct because VNet peering does not have a built-in 'block all by default' setting with per-subnet allow lists; traffic control is achieved through NSGs, UDRs, or Azure Firewall. Option E is not correct because service endpoints restrict subnet access to specific Azure PaaS services (such as Storage or SQL Database) and do not secure or filter traffic between two peered VNets.

Answer

Use Azure VPN Gateway to create an encrypted tunnel between the VNets.

Answer

Configure the peering to block all traffic by default and allow only specific subnets.

Answer

Enable service endpoints on the subnets to restrict traffic to Azure services.

Question 4

Which THREE components are required to implement Azure Virtual WAN with secured virtual hub? (Choose three.)

Accepted Answer

Azure Firewall deployed in the virtual hub. Azure Virtual WAN secured hub includes a virtual hub, Azure Firewall (for security), and VPN gateway (for connectivity). A Network Virtual Appliance (NVA) is not required as Azure Firewall is the native security service. ExpressRoute gateway is optional and not required for baseline secured hub.

Answer

ExpressRoute gateway in the virtual hub

Answer

Network Virtual Appliance (NVA)

Question 5

Which TWO Azure services can be used to distribute incoming traffic across multiple virtual machines in a backend pool while providing layer 7 load balancing? (Choose two.)

Accepted Answer

Azure Application Gateway. Azure Application Gateway (B) is correct because it is a layer 7 (HTTP/HTTPS) load balancer that distributes incoming traffic to virtual machines in a backend pool, supporting URL-path-based routing, host-based routing, and TLS termination. Azure Front Door (E) is also correct because it is a global layer 7 load balancer that routes HTTP/HTTPS traffic to backend pools (including VMs) and provides features like URL-based routing, SSL offload, and acceleration. Azure Load Balancer (A) is incorrect because it operates at layer 4 (TCP/UDP) and does not provide layer 7 routing. Azure Traffic Manager (C) is incorrect because it is a DNS-based global traffic distributor that works at the DNS layer, not a layer 7 load balancer for backend pools. Azure VPN Gateway (D) is incorrect because it provides encrypted site-to-site or point-to-site connectivity, not traffic distribution or load balancing.

Answer

Azure Load Balancer

Answer

Azure Traffic Manager

Answer

Azure VPN Gateway

Question 6

Refer to the exhibit. You are reviewing an Azure Firewall policy rule. The rule is intended to allow traffic from the 10.0.0.0/16 network to *.contoso.com on HTTPS. However, the rule is not working as expected. What is the most likely issue?

Accepted Answer

Application rules cannot have both targetFqdns and destinationAddresses; destinationAddresses should be removed.. Azure Firewall application rules cannot combine both targetFqdns and destinationAddresses in the same rule collection. When using targetFqdns, the destinationAddresses field must be empty; otherwise, the rule becomes invalid and traffic is not matched. Removing destinationAddresses allows the rule to properly inspect HTTPS traffic destined for *.contoso.com.

Answer

The source address range is too broad and should be more specific.

Answer

The protocol should be Http, not Https.

Answer

The rule should be a network rule, not an application rule.

Question 7

Refer to the exhibit. A security administrator runs the Azure CLI commands to create a VM with a single NIC and applies an NSG rule to deny outbound TCP traffic to the Internet on ports 80 and 443. However, the VM can still access websites on the Internet. What is the most likely reason?

Accepted Answer

The NSG rule is applied at the NIC level, but the subnet's NSG (if any) has a default outbound allow rule that takes precedence.. When an NSG is associated with both a subnet and a NIC, effective security rules are evaluated in order of priority, and subnet-level NSG rules are evaluated before NIC-level NSG rules. If the subnet has a default outbound allow rule (or a higher-priority allow rule), it will permit outbound TCP traffic to the Internet on ports 80 and 443, overriding the deny rule applied at the NIC level. The VM can still access websites because the subnet NSG's default outbound allow rule takes precedence over the NIC-level deny rule.

Answer

The NSG rule uses the 'Internet' service tag incorrectly; it should specify an IP range.

Answer

The NSG is not associated with the NIC because the command did not specify the NIC correctly.

Answer

The NSG rule should be an inbound rule to block outbound traffic.

Question 8

Refer to the exhibit. You run the KQL query in Microsoft Sentinel to investigate denied application rule traffic through Azure Firewall. The query returns no results, but you know that application rules are being applied and some traffic is being denied. What is the most likely cause?

Accepted Answer

The query filters on the wrong OperationName; denied hits use 'AzureFirewallApplicationRuleDeny'.. The KQL query in the exhibit filters on OperationName 'AzureFirewallApplicationRuleHit', which logs allowed traffic. Denied application rule traffic is logged with the OperationName 'AzureFirewallApplicationRuleDeny'. Since the query filters for 'Hit' instead of 'Deny', it returns no results even though denied traffic is occurring.

Answer

The time range is too short and the denied events are older.

Answer

The firewall is not configured to log denied traffic.

Answer

The query should use the 'AzureFirewallNetworkRule' category for denied traffic.

Question 9

Your organization is deploying a multi-region application using Azure Front Door to distribute traffic. You need to ensure that only traffic from Azure Front Door can reach the backend origins (App Services) and that no direct internet traffic bypasses Front Door. What combination of steps should you take?

Accepted Answer

Configure App Service Access Restrictions to allow only the Azure Front Door backend IP ranges and validate the X-Azure-FDID header.. Combine App Service Access Restrictions with X-Azure-FDID header validation. You can restrict access by allowing only the AzureFrontDoor.Backend service tag (or the documented Azure Front Door backend IP ranges) and then validate the X-Azure-FDID header. This ensures that only requests from your specific Azure Front Door instance are accepted, preventing direct internet traffic from bypassing Front Door. The service tag alone (as in option C) is not sufficient because it does not validate the X-Azure-FDID header, allowing any Front Door backend to reach the app.

Answer

Configure App Service Access Restrictions to deny all public traffic and enable Azure Front Door private link.

Answer

Configure Azure Front Door to use a custom domain and enable Azure WAF on Front Door.

Answer

Configure App Service Access Restrictions to allow only the 'AzureFrontDoor.Backend' service tag.

Question 10

You are designing a hub-spoke network topology in Azure. The hub VNet contains Azure Firewall and a VPN gateway. Spoke VNets need to communicate with each other and with on-premises network through the hub. Which peering configuration is required to allow spoke-to-spoke communication via the hub?

Accepted Answer

Enable 'Allow gateway transit' on the hub-to-spoke peering and configure spoke subnets with a default route pointing to the Azure Firewall private IP.. To route spoke-to-spoke traffic through the hub firewall, you must establish regular VNet peering between the hub and each spoke. Then, configure UDRs on spoke subnets with 0.0.0.0/0 pointing to the Azure Firewall private IP as the next hop. The 'Allow gateway transit' and 'Use remote gateway' peering settings are specifically for enabling access to a virtual network gateway (VPN or ExpressRoute) in the hub, not for an Azure Firewall NVA. Therefore, the correct configuration is not listed among the options.

Answer

Configure spoke VNets with a route table that has a default route to the hub VNet IP address.

Answer

Enable 'Use remote gateway' on the spoke-to-hub peering and 'Allow gateway transit' on the hub-to-spoke peering.

Answer

Enable 'Use remote gateway' on the hub-to-spoke peering and configure spoke subnets with a default route pointing to the hub VPN gateway.

Question 11

You deploy Azure Private Link for an Azure SQL Database. You create a private endpoint in VNet1 and configure a private DNS zone 'privatelink.database.windows.net' linked to VNet1. Clients in VNet2 (peered to VNet1) can resolve the SQL server FQDN to the private IP, but connections fail. What is the most likely cause?

Accepted Answer

The private DNS zone is not linked to VNet2.. The private DNS zone 'privatelink.database.windows.net' is linked only to VNet1. For clients in VNet2 (which is peered to VNet1) to resolve the SQL server FQDN to the private IP, the DNS zone must also be linked to VNet2. Without this link, VNet2 clients will resolve the FQDN to the public IP instead, causing connection failures because traffic does not flow through the private endpoint.

Answer

Private endpoint is in a 'Failed' provisioning state.

Answer

VNet2 does not have a route to the private endpoint's subnet.

Answer

Azure SQL Database's firewall rules block traffic from the private endpoint.

Question 12

You have a hub-spoke network with Azure Firewall in the hub. Spoke VNet1 contains a VM that needs to communicate with a VM in Spoke VNet2. Both spoke VNets are peered to the hub. You configure Azure Firewall DNAT rules to forward traffic to specific VMs, but the communication fails. You verify that the firewall rules allow the traffic and that the VMs can reach each other's private IPs if the firewall is bypassed. What is the most likely issue?

Accepted Answer

The firewall's Outbound SNAT is disabled for the spoke VNet ranges.. When Azure Firewall DNAT rules forward traffic to spoke VMs, the firewall performs Destination Network Address Translation (DNAT) to change the destination IP to the VM's private IP. However, by default, Azure Firewall also performs Source Network Address Translation (SNAT) on outbound traffic from the firewall to the destination. If Outbound SNAT is disabled for the spoke VNet ranges (e.g., via a DNAT rule's 'Translate to IP' or by disabling SNAT for private IP ranges), the firewall sends traffic with the original source IP of the source VM. Since the spoke VNets are peered to the hub but not directly peered to each other, the destination VM's network interface expects traffic from the firewall's private IP (after SNAT) to route back through the hub. Without SNAT, return traffic from the destination VM goes directly to the source VM's private IP via the peering, bypassing the firewall and breaking stateful inspection, causing asymmetric routing and communication failure.

Answer

The spoke VNets have overlapping IP address spaces.

Answer

The firewall's Threat Intelligence mode is blocking the traffic.

Answer

Azure Firewall does not support DNAT between spoke VNets.

Question 13

You are designing network security for a multi-tier application with web, app, and data tiers. The web tier must be accessible from the internet, the app tier only from the web tier, and the data tier only from the app tier. You plan to use Azure Firewall in a hub VNet and peer the application VNet to the hub. Which TWO configurations are necessary to achieve this segmentation?

Accepted Answer

Configure User-Defined Routes (UDRs) on each tier subnet to send inter-tier traffic through the Azure Firewall.. Option A is correct because Azure Firewall in a peered hub VNet does not automatically inspect traffic that flows directly between subnets within the application VNet; User-Defined Routes (UDRs) with the virtual appliance IP as the next hop must be applied to each tier subnet so that inter-tier traffic is forced through the firewall for inspection and control. Option D is correct because Network Security Groups (NSGs) on each subnet provide the stateful, subnet-level allow/deny enforcement that restricts the web tier to internet-facing traffic, the app tier to inbound traffic only from the web tier, and the data tier to inbound traffic only from the app tier, which is the core segmentation mechanism. Option B is incorrect because placing all VMs in a single subnet removes subnet-level boundaries and NSG segmentation, and application-layer security alone cannot provide the required network isolation. Option C is incorrect because disabling the default route 0.0.0.0/0 on the app and data tiers is not required for tier-to-tier segmentation and would affect internet egress rather than inter-tier traffic. Option E is incorrect because Azure Firewall application rules filter FQDN-based outbound HTTP/HTTPS traffic and are not the mechanism that enforces the required inbound tier-to-tier segmentation.

Answer

Place all VMs in the same subnet and rely on application-layer security.

Answer

Disable the default route (0.0.0.0/0) on the app and data tiers.

Answer

Configure Azure Firewall application rules to allow HTTP/HTTPS from web to app.

Question 14

Your company uses ExpressRoute to connect on-premises to Azure. You need to ensure that only traffic from the on-premises network can reach a specific Azure App Service, and all other internet traffic to that App Service must be blocked. You also want to avoid exposing the App Service's public endpoint. Which THREE actions should you take?

Accepted Answer

Configure an IP restriction on the App Service to allow only the on-premises public IP range.. Option A is correct because IP restrictions on the App Service allow you to whitelist only the on-premises public IP range, blocking all other internet traffic at the App Service's front end. Option B is correct because a Private Endpoint assigns a private IP from your VNet to the App Service, letting on-premises clients reach it over ExpressRoute without using the public endpoint. Option E is correct because setting 'Public network access' to 'Disabled' removes all public internet access to the App Service, ensuring only private/VNet-routed traffic (including via the Private Endpoint) can reach it. Option C is not correct because Service Endpoints secure traffic from a VNet subnet to Azure services but do not provide a private IP for the App Service nor block its public endpoint, and they are not the mechanism for on-premises-only access over ExpressRoute. Option D is not correct because client certificate authentication verifies client identity but does not restrict traffic by network origin or hide the public endpoint, so it does not meet the requirement to block all other internet traffic.

Answer

Configure a Service Endpoint for App Service on the on-premises-connected subnet.

Answer

Upload a trusted root certificate to App Service to enforce client certificate authentication for on-premises clients.

Question 15

Your company has deployed Azure Virtual WAN with secured virtual hubs. You need to enforce that all traffic between on-premises sites and Azure virtual networks (VNets) passes through the Azure Firewall in the hub. You have configured routing accordingly. However, traffic from an on-premises site to a VNet is still bypassing the firewall. What is the most likely cause?

Accepted Answer

The virtual network (spoke) is propagating the default route (0.0.0.0/0) learned from the hub via BGP, causing traffic to be sent directly to the on-premises network.. For traffic from on-premises to a VNet to go through Azure Firewall, the virtual hub must have routing intent configured with a private routing policy that sends inter-site traffic to the firewall. Without this, the hub forwards on-premises traffic directly to the VNet connection. The spoke VNet propagating a default route from the hub is irrelevant to inbound on-premises traffic and would only affect outbound VNet traffic, causing asymmetric routing if responses bypass the firewall.

Answer

The on-premises site has forced tunneling enabled.

Answer

The Azure Firewall is deployed in a separate spoke VNet instead of the hub.

Answer

The Azure Firewall is not in the same virtual hub as the VPN gateway.