AZ-500 Secure networking Practice Test 4 — 15 Questions

Question 1

Your organization has multiple Azure subscriptions that need to connect to a shared on-premises data center via ExpressRoute. You plan to use Azure Virtual WAN with secured hubs. Each subscription contains VNets that must communicate with on-premises and with each other through the hub. You need to ensure that traffic between VNets in different subscriptions is routed through the Azure Firewall. What configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Connect each VNet to the same Virtual WAN hub and enable inter-hub routing with Azure Firewall inspection.. Azure Virtual WAN with a secured hub allows you to connect VNets from different subscriptions to the same hub and enforce traffic inspection through Azure Firewall. By enabling inter-hub routing and configuring Azure Firewall as the inspection point, all traffic between VNets is forced through the firewall, meeting the requirement for centralized security and routing.

Answer

Establish VNet peering between VNets in different subscriptions and use NSGs to filter traffic.

Answer

Create a site-to-site VPN between the VNets and force traffic through a VPN Gateway.

Answer

Use Azure Firewall Manager to deploy firewalls in each VNet and route traffic between VNets through them.

Question 2

Which TWO configurations are required to enable Azure Bastion to connect to a virtual machine without a public IP address?

Accepted Answer

The virtual network must have a subnet named AzureBastionSubnet.. Option B is correct because Azure Bastion requires a dedicated subnet named exactly AzureBastionSubnet in the same virtual network as the target VM; this subnet must be at least /26 (or /27 for some SKUs) and is where the Bastion host resources are deployed. Option E is correct because Azure Bastion connects to the VM over its private IP address within the virtual network, so the VM must have a private IP (typically from its NIC's subnet) and does not need any public IP. Option A is incorrect because the whole purpose of Bastion is to reach VMs that have no public IP address. Option C is incorrect because, although the Bastion host itself is provisioned with a public IP for inbound client connectivity, that is not a configuration requirement on the VM side to enable the connection. Option D is incorrect because Azure Bastion does not require an NSG rule allowing RDP/SSH from the Bastion subnet; Bastion communicates with the VM over the Azure fabric using the private IP, and such NSG rules are not a prerequisite for Bastion connectivity.

Answer

The virtual machine must have a public IP address.

Answer

The Bastion host must have a public IP address assigned.

Answer

The virtual machine must be in a subnet with an NSG that allows RDP/SSH from the Bastion subnet.

Question 3

Which THREE benefits does Azure DDoS Protection Standard provide over Basic?

Accepted Answer

Adaptive tuning based on application traffic patterns.. Option B is correct because DDoS Protection Standard learns your application's normal traffic patterns over time and applies adaptive tuning to distinguish legitimate traffic from attack traffic, whereas Basic uses static, generic thresholds. Option C is correct because Standard includes cost protection, which provides service credits for resource scaling and data-transfer costs incurred as a result of a documented DDoS attack, a benefit Basic does not offer. Option E is correct because Standard grants access to the DDoS Rapid Response (DRR) team, which can assist with active attack investigation and mitigation, while Basic provides no such expert support. Option A is not exclusive to Standard, since both Basic and Standard provide always-on monitoring and mitigation of layer 3/4 volumetric attacks. Option D is also not a differentiator, because both tiers leverage Azure's global network capacity for mitigation.

Answer

Always-on monitoring and mitigation of layer 3/4 attacks.

Answer

Mitigation of attacks using Azure's global network capacity.

Question 4

You need to allow an Azure VM to access an on-premises SQL Server database securely. The on-premises network is connected to Azure via a site-to-site VPN. You want to minimize latency and avoid traversing the internet. What should you use?

Accepted Answer

Site-to-site VPN connection.. The on-premises SQL Server is already connected to Azure via a site-to-site VPN, and the Azure VM is in the same virtual network. By using the existing site-to-site VPN connection, traffic between the VM and the on-premises SQL Server stays within the encrypted VPN tunnel, minimizing latency and avoiding internet traversal. No additional Azure services are needed since the VPN provides secure, private connectivity.

Answer

Service endpoint for SQL.

Answer

Azure Private Link.

Answer

VNet peering.

Question 5

You are designing a network security solution for a multi-tier application running in Azure. The front-end VMs must only accept traffic from Azure Front Door. Back-end VMs must only accept traffic from the front-end tier. You plan to use NSGs and ASGs. Which configuration should you use to meet these requirements with minimal administrative overhead?

Accepted Answer

Place front-end VMs in an ASG, back-end VMs in another ASG. Configure NSG rules referencing these ASGs.. Application Security Groups (ASGs) allow you to group VMs logically and reference them in NSG rules, enabling dynamic traffic control without hardcoding IP addresses. By placing front-end VMs in one ASG and back-end VMs in another, you can create an NSG rule on the back-end subnet that allows inbound traffic only from the front-end ASG. This approach minimizes administrative overhead because IP changes are automatically handled as VMs are added or removed from the ASG.

Answer

Create NSG rules that allow traffic from the Front Door service tag and from the front-end VM IP addresses.

Answer

Use service tags for Azure Front Door and for the front-end subnet.

Answer

Use VNet peering between the front-end and back-end subnets, and configure route tables.

Question 6

Your company has an Azure subscription with multiple VNets. You need to securely connect an on-premises data center to Azure using a site-to-site VPN. The on-premises VPN device does not support IKEv2. Which VPN gateway SKU should you select to ensure compatibility?

Accepted Answer

Basic. The Basic SKU is the only VPN gateway SKU that supports IKEv1, which is required for compatibility with on-premises VPN devices that do not support IKEv2. All other SKUs (VpnGw1, VpnGw2, VpnGw3) exclusively support IKEv2, making them incompatible with such devices.

Answer

VpnGw2

Answer

VpnGw1

Answer

VpnGw3

Question 7

You are designing a network security strategy for an Azure Kubernetes Service (AKS) cluster. You need to restrict egress traffic from the cluster to only allow connections to specific Azure services (e.g., Microsoft Container Registry, Azure Key Vault). The solution must minimize administrative overhead. What should you use?

Accepted Answer

Deploy Azure Firewall and use FQDN tags to allow traffic to Azure services.. Azure Firewall with FQDN tags allows you to define outbound network rules based on fully qualified domain names (FQDNs) for Azure services like Microsoft Container Registry and Azure Key Vault. This approach minimizes administrative overhead because FQDN tags are automatically updated as Azure service IP ranges change, eliminating the need for manual IP maintenance. It provides a centralized, managed firewall solution that integrates natively with AKS for egress filtering.

Answer

Configure Azure Policy to deny egress to non-approved destinations.

Answer

Use Kubernetes network policies for egress.

Answer

Define NSG rules to allow outbound traffic to the service IP ranges.

Question 8

You have an Azure subscription with multiple VNets connected via VNet peering. You need to ensure that traffic between VNets is encrypted. What should you do?

Accepted Answer

No additional configuration is needed; VNet peering traffic is encrypted by default.. VNet peering traffic between Azure virtual networks is automatically encrypted using Microsoft's data-link layer MACsec encryption, as per Azure's default security posture. No additional configuration is required because Azure ensures that all traffic within the Microsoft backbone network, including peered VNets, is encrypted at the physical layer. This is a fundamental design of Azure networking, making option C correct.

Answer

Configure Azure Firewall to enforce encryption.

Answer

Apply NSGs to block unencrypted traffic.

Answer

Deploy a VPN gateway in each VNet and configure site-to-site VPN connections.

Question 9

You are troubleshooting connectivity from an on-premises network to an Azure VM. The connection uses a site-to-site VPN. The VM can be pinged from on-premises, but an application running on the VM cannot connect to an on-premises database server. The database server's firewall is configured to allow connections from the Azure VPN gateway public IP. What is the most likely cause of the issue?

Accepted Answer

The on-premises firewall is allowing the wrong IP address. The Azure VPN gateway's private IP should be allowed.. The on-premises database server's firewall is configured to allow connections from the Azure VPN gateway's public IP. However, traffic from the Azure VM to the on-premises database server traverses the site-to-site VPN tunnel, which uses the VPN gateway's private IP (from the gateway subnet) as the source IP, not the public IP. Therefore, the firewall must allow the private IP of the Azure VPN gateway, not its public IP. Since the VM can be pinged (ICMP is allowed), the VPN tunnel is up, but the application's TCP connection is blocked at the database firewall because the source IP does not match the allowed public IP.

Answer

An NSG on the VM's subnet is blocking outbound traffic.

Answer

The VPN tunnel is not established.

Answer

The effective routes on the VM are misconfigured.

Question 10

Refer to the exhibit. You have an Azure Firewall policy with the shown rules. Traffic from 10.0.0.0/8 to www.google.com on HTTPS (443) is being blocked. What is the most likely reason?

Accepted Answer

The network rule collection with priority 100 denies all traffic, and it is evaluated before the application rule collection.. Azure Firewall policy rule collections are evaluated in order of priority, with lower numbers evaluated first. The network rule collection with priority 100 denies all traffic, and since network rules are evaluated before application rules, this deny rule matches the HTTPS traffic from 10.0.0.0/8 to www.google.com before the application rule collection (which would allow it) is ever reached. Therefore, the traffic is blocked by the higher-priority network rule.

Answer

The application rule collection has an action of Deny.

Answer

The source address 10.0.0.0/8 is not included in the application rule.

Answer

The application rule collection does not allow *.google.com.

Question 11

Your company has a hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall and a VPN gateway. Spoke virtual networks are peered to the hub. You need to ensure that all outbound traffic from spoke VMs to the internet is routed through the Azure Firewall. What should you configure on the spoke virtual networks?

Accepted Answer

Create a route table with a route for 0.0.0.0/0 pointing to the Azure Firewall private IP, and associate it with the spoke subnets. Creating a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP and associating it with the spoke subnets forces all outbound internet traffic from spoke VMs to be forwarded to the firewall for inspection. This is the standard method for implementing forced tunneling in a hub-and-spoke topology, ensuring traffic flows through the central security appliance.

Answer

Apply a network security group (NSG) to the spoke subnets with a deny rule for internet traffic

Answer

Configure VNet peering with 'Use remote gateway' enabled

Answer

Configure the Azure Firewall to use forced tunneling

Question 12

You have an Azure Kubernetes Service (AKS) cluster that needs to communicate with an on-premises database over a site-to-site VPN. The AKS cluster is in a spoke VNet, and the VPN gateway is in the hub VNet. You configure VNet peering between hub and spoke. However, pods cannot reach the on-premises database. What is the most likely cause?

Accepted Answer

The pod subnet does not have a route to the on-premises network via the VPN gateway. VNet peering does not automatically propagate routes from the hub VPN gateway to the spoke. Even with peering established, the pod subnet in the spoke VNet lacks a user-defined route (UDR) pointing on-premises traffic to the VPN gateway in the hub. Without this route, pods cannot reach the on-premises database over the site-to-site VPN.

Answer

The VNet peering is not established correctly

Answer

The network security group on the pod subnet blocks outbound traffic

Answer

The AKS cluster is using kubenet network plugin

Question 13

Your company has a hub-spoke network topology in Azure. The hub VNet contains an Azure Firewall. Spoke VNets are peered to the hub. You need to ensure that all outbound traffic from virtual machines in a spoke VNet passes through the Azure Firewall for inspection. Which two configurations are required? (Choose two.)

Accepted Answer

Configure an application rule or network rule on Azure Firewall to allow outbound traffic. Option E is correct because user-defined routes (UDRs) are the mechanism that overrides Azure's default system routes: adding a route table to the spoke subnet with a 0.0.0.0/0 route whose next hop is the Azure Firewall's private IP forces all outbound traffic from the spoke VMs to be sent to the firewall for inspection. Option C is correct because the Azure Firewall must have a matching network rule or application rule that permits the outbound traffic; without an allow rule, the firewall's default deny behavior would drop the traffic even though routing sends it there. Option A is incorrect because DNAT rules are for inbound traffic translation (publishing internal services to the internet), not for steering outbound traffic. Option B is incorrect because the spoke VNets are already peered to the hub, so creating a new peering is unnecessary. Option D is incorrect because forced tunneling refers to directing internet-bound traffic to on-premises via a site-to-site VPN or ExpressRoute, not to routing traffic through an Azure Firewall in a hub VNet.

Answer

Configure a DNAT rule on Azure Firewall to translate outbound traffic

Answer

Create a new VNet peering between the spoke and hub

Answer

Enable forced tunneling on the spoke VNet

Question 14

Refer to the exhibit. The JSON snippet shows a network rule from an Azure Firewall policy. You have a subnet with IP range 10.0.1.0/24 that needs to connect to Azure SQL Database in Southeast Asia. However, connections are failing. What is the most likely reason?

Accepted Answer

Network rules do not support service tags as destination addresses. Azure Firewall policy network rules do not support service tags as destination addresses. Service tags can only be used in Azure Firewall classic rules or in network security group (NSG) rules, not in Azure Firewall policy network rules. To allow connectivity to Azure SQL Database, you must specify the destination IP address or use an FQDN tag in application rules instead.

Answer

The protocol should be UDP instead of TCP

Answer

The destination port should be 1434 instead of 1433

Answer

The rule priority is too low and may be overridden

Question 15

Refer to the exhibit. The JSON shows an NSG associated with a subnet. The subnet contains a web server. Users report they cannot access the web server on port 443 (HTTPS). What is the most likely cause?

Accepted Answer

The AllowHTTPS rule uses 'Internet' as source address prefix, which may not include all client IPs. The AllowHTTPS rule uses 'Internet' as the source address prefix, which in Azure NSGs is a service tag that represents traffic from outside the Azure region but does not include all possible client IPs, such as those from on-premises networks or specific remote clients not covered by the tag. Users cannot access the web server on port 443 because the rule's source scope is too restrictive, causing legitimate traffic to be evaluated against the DenyAll rule and blocked.

Answer

The AllowHTTPS rule uses destination port 443, which is incorrect for HTTPS

Answer

The DenyAll rule blocks all inbound traffic

Answer

The DenyAll rule has a higher priority than the AllowHTTPS rule