AZ-500 Secure networking Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. The JSON shows an Azure Policy initiative assignment. You have a subnet that needs to allow private endpoints. You created a Private Endpoint but it fails to provision. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The subnet's privateEndpointNetworkPolicies property is set to 'Enabled' (default). The most likely reason the Private Endpoint fails to provision is that the subnet's `privateEndpointNetworkPolicies` property is set to 'Enabled' (the default). When this property is enabled, the subnet blocks the creation of Private Endpoints because it enforces network policies (like NSG flow logs or route tables) that interfere with the Private Endpoint's required network configuration. To allow Private Endpoints, this property must be explicitly set to 'Disabled' on the subnet, which removes those policy restrictions.

Answer

The Private Endpoint requires a service endpoint to be configured

Answer

The policy is disabled

Answer

The policy is not assigned to the correct subscription

Question 2

You need to monitor and log network traffic between Azure VMs for security analysis. Which THREE components should you enable?

Accepted Answer

Azure Monitor Logs (Log Analytics workspace). NSG flow logs (C) are correct because they record allowed and denied IP traffic flowing through a network security group, capturing 5-tuple flow data (source/destination IP, port, protocol) that is essential for security analysis of traffic between Azure VMs. Traffic Analytics (D) is correct because it processes those flow logs and provides enriched insights such as malicious traffic detection, open ports, and traffic visualization, adding the analytical layer needed for security monitoring. Azure Monitor Logs / Log Analytics workspace (A) is correct because it is the destination where NSG flow logs and Traffic Analytics data are stored, queried with KQL, and correlated with other security signals for alerting and investigation. Azure Firewall logs (B) do not apply here because the scenario involves traffic between VMs, not traffic traversing an Azure Firewall, and no firewall is specified. VNet flow logs (E) are not among the marked answers; while they are a newer capability, the question's correct set relies on NSG flow logs plus Traffic Analytics and Log Analytics for this monitoring scenario.

Answer

Azure Firewall logs

Answer

VNet flow logs

Question 3

Your organization uses Azure Private Link to access Azure SQL Database privately from a VNet. You need to ensure that only your VNet can access the private endpoint. What should you configure?

Accepted Answer

Set the subnet's privateEndpointNetworkPolicies property to 'Disabled'. Setting the subnet's privateEndpointNetworkPolicies property to 'Disabled' is necessary because, by default, this property is set to 'Enabled', which allows network policies such as NSGs and UDRs to be applied to the private endpoint's network interface. However, applying these policies can interfere with the private endpoint's ability to properly route traffic. Disabling this property bypasses these policies, ensuring that only traffic from the connected VNet can reach the private endpoint.

Answer

Associate a network security group to the private endpoint

Answer

Enable service endpoints on the subnet

Answer

Configure an application security group on the private endpoint

Question 4

Refer to the exhibit. The JSON shows an Azure Policy initiative assignment. You have a subnet that needs to allow private endpoints. You created a Private Endpoint but it fails to provision. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'DenyInternetInbound' rule blocks all internet traffic. The 'DenyInternetInbound' rule with priority 4096 explicitly denies all inbound traffic from the internet. NSG rules are evaluated in priority order (lowest number first, meaning highest priority). Since this deny rule has a priority of 4096, it is evaluated before the 'AllowVNetInbound' rule (priority 65000). The 'AllowVNetInbound' rule only allows traffic from the virtual network, not from the internet. Therefore, the deny rule blocks the HTTPS traffic from the internet, preventing connectivity to the web server on port 443.

Answer

There is no rule allowing HTTPS traffic

Answer

The 'AllowVNetInbound' rule allows traffic from the internet

Answer

The 'DenyInternetInbound' rule has a lower priority than 'AllowVNetInbound'

Question 5

Your organization has an Azure virtual network with a subnet hosting a SQL Managed Instance. You need to ensure that only traffic from Azure services (like Azure Data Factory) can reach the SQL Managed Instance, but you must not allow any public internet traffic. What is the most secure configuration?

Accepted Answer

Create a private endpoint for the SQL Managed Instance.. A private endpoint for SQL Managed Instance allows traffic only from within the virtual network (including Azure Data Factory if integrated with the VNet) and blocks all public internet traffic. This is the most secure configuration for SQL Managed Instance as it does not support service endpoints. Option A is wrong because service endpoints for Microsoft.Sql are not supported for SQL Managed Instance; they are only for Azure SQL Database. Option C is wrong because using NSGs with IP ranges is less secure and Azure Data Factory IP ranges may change. Option D is wrong because Azure Firewall adds complexity but still relies on IP-based rules, whereas a private endpoint provides network-level isolation.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet.

Answer

Configure a network security group (NSG) with a deny-all inbound rule and an allow rule for the Azure Data Factory IP range.

Answer

Deploy Azure Firewall and create a rule to allow traffic from Azure Data Factory.

Question 6

Your company uses Azure Front Door to globally distribute traffic to a web app. You need to ensure that only traffic from Front Door can reach the web app, and all other traffic is blocked. The web app is behind an Azure Application Gateway. What is the most secure and reliable configuration?

Accepted Answer

Configure an NSG on the Application Gateway subnet to allow traffic only from the Front Door backend IP ranges.. Azure Front Door uses a set of backend IP ranges that are documented and change over time. By configuring an NSG on the Application Gateway subnet to allow traffic only from these specific IP ranges, you ensure that only Front Door-originated traffic reaches the Application Gateway, while all other traffic is blocked. This approach is reliable because it uses network-layer filtering that the Application Gateway subnet enforces, and it avoids the complexity of private endpoints or service tags that may not apply to the Front Door-to-Application Gateway path.

Answer

Place the web app behind a private endpoint and connect Front Door via private link.

Answer

Use an NSG on the Application Gateway subnet with a deny-all rule and allow the AzureFrontDoor.Backend service tag.

Answer

Restrict the Application Gateway to only accept traffic from the Front Door frontend IP.

Question 7

Which TWO of the following are valid methods to secure outbound traffic from an Azure virtual network to the internet?

Accepted Answer

Azure Firewall. Azure Firewall (A) is correct because it is a managed, stateful network security service that can inspect and filter outbound traffic from a virtual network to the internet using network and application rules, including FQDN filtering and threat intelligence. Azure NAT Gateway (B) is correct because it provides SNAT for outbound internet connectivity, ensuring that outbound traffic uses a predictable public IP address and does not expose the virtual machines' private IPs directly, which is a valid method to secure and control outbound traffic. Private endpoints (C) are incorrect because they provide private connectivity to Azure PaaS services over a private IP address within the virtual network, not outbound internet security. Service endpoints (D) are incorrect because they extend the virtual network's identity to Azure services over the Azure backbone, but they do not secure general outbound internet traffic. Azure VPN Gateway (E) is incorrect because it provides encrypted connectivity between on-premises networks and Azure, not outbound internet security for a virtual network.

Answer

Private endpoints

Answer

Service endpoints

Answer

Azure VPN Gateway

Question 8

Refer to the exhibit. You deploy the Azure Firewall using the ARM template snippet above. A user from the 10.0.1.0/24 subnet reports they cannot access https://portal.azure.com. All other internet access is blocked. What is the most likely reason?

Accepted Answer

The subnet does not have a route to the Azure Firewall.. The correct answer is C: the subnet does not have a route to the Azure Firewall. Azure Firewall only inspects traffic that is actually routed to its private IP; if the 10.0.1.0/24 subnet's effective route table lacks a user-defined route with next hop type VirtualAppliance pointing to the firewall, the traffic bypasses the firewall and the allow rule never applies. Since all other internet access is blocked, the firewall is enforcing policy, but this specific subnet's traffic is not reaching it as intended. Option A is wrong because a low-priority allow rule would still be evaluated unless a higher-priority deny explicitly matched, and the scenario doesn't indicate that. Option B is wrong because an FQDN wildcard mismatch would affect the rule's matching, not the fundamental reachability of the firewall. Option D is wrong because the user is accessing an HTTPS URL, so the protocol mismatch described does not apply.

Answer

The rule priority is too low and is overridden by a deny-all rule.

Answer

The targetFqdns uses a wildcard that does not match the exact FQDN.

Answer

The protocol is set to HTTPS but the user is using HTTP.

Question 9

Your company has a hub-spoke network in Azure. The hub contains an Azure Firewall. Spoke VNets have a route table with a default route (0.0.0.0/0) pointing to the firewall. You need to ensure that traffic from the spokes to an Azure SQL Database (with service endpoint enabled) bypasses the firewall for lower latency. What should you do?

Accepted Answer

Add a route in the spoke route table for the SQL service tag with next hop 'Internet'.. Adding a route for the Azure SQL service tag with next hop 'Internet' in the spoke route table overrides the default route (0.0.0.0/0) for SQL traffic. Since the SQL database has a service endpoint enabled, traffic to the SQL service tag is routed directly to the Microsoft backbone via the Internet next hop, bypassing the Azure Firewall and reducing latency. This leverages the service endpoint's ability to route traffic from the spoke VNet to the SQL service without going through the hub firewall.

Answer

Add a firewall rule to allow SQL traffic and change the spoke route to use a VPN gateway.

Answer

Deploy a private endpoint for SQL in each spoke.

Answer

Disable the firewall rule for SQL and rely on NSG.

Question 10

You have an Azure Kubernetes Service (AKS) cluster with Azure CNI networking. You need to restrict egress traffic from pods to only allow connections to specific Azure services (e.g., Azure Container Registry). The cluster does not use Azure Firewall. What is the most efficient method?

Accepted Answer

Use Azure Policy to apply a network policy that restricts egress traffic from pods.. Azure Kubernetes Service (AKS) with Azure CNI supports Kubernetes Network Policies, which can be enforced natively to restrict pod-level egress traffic. By applying a NetworkPolicy resource that specifies allowed egress destinations (e.g., Azure Container Registry's IP or FQDN), you can achieve granular, pod-specific egress control without requiring a firewall or additional infrastructure. This is the most efficient method as it leverages built-in Kubernetes capabilities and avoids the overhead of managing UDRs or NSGs at the subnet level.

Answer

Create UDRs to force egress traffic through a firewall.

Answer

Configure NSG rules on the AKS subnet to block egress.

Answer

Enable service endpoints for the required services on the AKS subnet.

Question 11

Your organization uses Azure Front Door (AFD) with WAF policy to protect a web application. Recently, a DDoS attack targeted the application endpoint. You need to mitigate the attack while minimizing latency for legitimate users. What should you do?

Accepted Answer

Enable Azure DDoS Network Protection on the AFD origin and configure DDoS protection on AFD.. Azure Front Door (AFD) integrates with Azure DDoS Network Protection to provide always-on traffic monitoring and automatic mitigation of volumetric DDoS attacks at the network layer (L3/L4). Enabling DDoS Network Protection on the AFD origin and configuring DDoS protection on AFD itself defends the application without introducing additional latency for legitimate users, as the mitigation is applied at the Azure edge before traffic reaches the origin.

Answer

Increase the rate limit threshold in the WAF policy.

Answer

Migrate the application to Azure Application Gateway with WAF.

Answer

Disable caching in AFD to reduce resource consumption.

Question 12

You are designing a secure network for a three-tier application. The web tier must be accessible from the internet on port 443. The application tier should only be reachable from the web tier. The database tier should only be reachable from the application tier. Which Azure service should you use to enforce these restrictions?

Accepted Answer

Network security groups (NSGs) on each subnet.. Network security groups (NSGs) allow you to define inbound and outbound security rules at the subnet or NIC level. By placing each tier in its own subnet and applying NSG rules, you can restrict traffic so that only the web tier (port 443) is exposed to the internet, the application tier accepts traffic only from the web tier subnet, and the database tier accepts traffic only from the application tier subnet. This provides granular, stateful filtering that directly enforces the required east-west and north-south restrictions.

Answer

Azure VPN Gateway.

Answer

Azure Front Door.

Answer

Azure Firewall in the hub.

Question 13

A company uses Azure Virtual WAN with secured virtual hubs. The security team wants to ensure that all traffic from branch offices to Azure resources is inspected by the Azure Firewall in the secured hub. What configuration is needed?

Accepted Answer

Enable 'Inter-hub' and 'Branch-to-branch' traffic routing in the Virtual WAN settings.. In Azure Virtual WAN, enabling 'Inter-hub' and 'Branch-to-branch' routing ensures that all branch-to-branch and branch-to-VNet traffic is routed through the secured virtual hub, where Azure Firewall inspects it. This setting forces traffic to flow via the hub's default route (0.0.0.0/0) propagated to branches and spokes, ensuring inspection without requiring manual UDRs or forced tunneling.

Answer

Add user-defined routes in each spoke pointing to the Azure Firewall.

Answer

Configure forced tunneling on the branch VPN devices to send all traffic to the hub.

Answer

Create a firewall policy in Azure Firewall Manager and associate it with the virtual hub.

Question 14

You manage multiple Azure subscriptions with VNets that need to communicate with each other. You want to centrally manage and enforce security policies across all VNets. Which Azure service should you use?

Accepted Answer

Azure Firewall Manager.. Azure Firewall Manager is the correct choice because it provides a centralized platform to manage and enforce security policies across multiple Azure subscriptions and VNets. It enables you to create, apply, and monitor firewall policies (including network and application rules) globally, ensuring consistent security posture for all VNets in a hub-and-spoke topology.

Answer

Azure Network Watcher.

Answer

Azure Policy.

Answer

Azure Blueprints.

Question 15

A company uses Azure Kubernetes Service (AKS) with a private cluster. Developers need to access the Kubernetes API server from their on-premises workstations without exposing it to the internet. What is the most secure solution?

Accepted Answer

Deploy Azure Bastion in the AKS VNet and use a jump box VM to access the API server.. The correct option is C: Deploy Azure Bastion in the AKS VNet and use a jump box VM to access the API server. For a private AKS cluster, the API server has no public endpoint and only a private IP in the cluster VNet, so access from on-premises workstations must traverse a host inside that VNet; Azure Bastion provides secure RDP/SSH connectivity to a jump box VM over TLS port 443 without exposing the VM to the internet, and from that VM the developer can reach the private API server endpoint. Option A is wrong because Azure Front Door is an HTTP/HTTPS Layer 7 ingress service and cannot proxy the Kubernetes API server's mTLS-authenticated traffic to a private endpoint in this manner. Option B defeats the requirement by re-enabling the public API server endpoint, and IP allow-listing still exposes the endpoint to the internet. Option D is insufficient by itself because a site-to-site VPN provides network reachability but does not give the workstation a secure, managed access path to the private API server without additional configuration and exposure.

Answer

Use Azure Front Door with Private Link to access the API server.

Answer

Enable the API server public endpoint and restrict access to the on-premises public IP.

Answer

Create a site-to-site VPN from on-premises to the AKS VNet and allow access from the on-premises IP range.