AZ-500 Secure networking Practice Test 5 — 15 Questions

Question 1

A company deploys a web application on Azure VMs behind an Azure Load Balancer (Standard SKU). They want to protect the application from common web attacks like SQL injection and cross-site scripting. Which Azure service should they enable?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) policy.. Azure Application Gateway with a Web Application Firewall (WAF) policy is the correct choice because it operates at Layer 7 (HTTP/HTTPS) and provides centralized, inbound protection against common web attacks such as SQL injection and cross-site scripting (XSS). The WAF policy uses OWASP Core Rule Sets (CRS) to inspect HTTP request payloads and headers, blocking malicious traffic before it reaches the backend VMs behind the Load Balancer.

Answer

Azure Firewall.

Answer

Network Security Groups on the VM subnet.

Answer

Azure DDoS Protection.

Question 2

A storage account should be reachable only from a specific subnet over the Microsoft backbone, while keeping the public endpoint firewall restricted. Which feature should be used?

Accepted Answer

Service endpoint for Microsoft.Storage with storage firewall rules. A service endpoint for Microsoft.Storage extends your virtual network private address space and the identity of your VNet to the Azure Storage service over the Microsoft backbone. By combining the service endpoint with a storage firewall rule that restricts access to only that specific subnet, you ensure the storage account is reachable only from that subnet while keeping the public endpoint firewall restricted to deny all other traffic.

Answer

Application Security Group

Answer

Azure Bastion

Answer

Public IP prefix

Question 3

A web app uses Azure App Service and must access Azure SQL over a private IP without exposing SQL to the public internet. Which two components are required?

Accepted Answer

Private Endpoint for Azure SQL. A is correct because a Private Endpoint for Azure SQL assigns a private IP from your virtual network to the Azure SQL logical server, allowing the App Service to connect over a private IP without exposing the database to the public internet. This is the core component that brings the Azure SQL service into your virtual network privately.

Answer

Inbound NAT rule on Azure Load Balancer

Answer

DDoS Protection Basic only

Question 4

Traffic from a spoke VNet must reach the internet through a firewall in the hub VNet. What routing configuration is required on the spoke subnets?

Accepted Answer

A default route to the Azure Firewall private IP or virtual appliance next hop. To force spoke traffic to the internet through a firewall in the hub VNet, you must create a user-defined route (UDR) on the spoke subnet with an address prefix of 0.0.0.0/0 and a next hop of the Azure Firewall's private IP or the virtual appliance's IP. This overrides the default system route that would otherwise send internet-bound traffic directly out via Azure's edge, ensuring all egress traffic is inspected and controlled by the firewall.

Answer

A route to Internet with next hop Internet

Answer

An NSG deny rule for 0.0.0.0/0

Answer

A service endpoint policy

Question 5

An Application Gateway WAF blocks legitimate requests because a managed rule detects a known false positive. The team wants to keep the rule set enabled. What should they configure?

Accepted Answer

A narrowly scoped WAF exclusion for the affected variable or rule. A narrowly scoped WAF exclusion is the correct approach because it allows the team to keep the managed rule set enabled while preventing false positives. By configuring an exclusion for the specific variable (e.g., RequestHeaderNames, RequestCookieNames, RequestArgNames) or rule ID that triggers the false positive, the WAF will skip inspection on that particular element without weakening the overall security posture. This maintains protection against other threats while resolving the blocking of legitimate traffic.

Answer

Disable WAF prevention mode for the entire gateway

Answer

Remove TLS from the listener

Answer

Move the application behind an internal load balancer only

Question 6

An Azure SQL Database must be accessed privately from workloads in a VNet and should not allow public network access. Which two configurations are required?

Accepted Answer

Create a Private Endpoint for the SQL server. A Private Endpoint assigns a private IP address from your VNet to the Azure SQL Database logical server, enabling traffic to reach the database entirely over the Microsoft backbone network without traversing the public internet. This is a fundamental requirement for private connectivity from workloads inside a VNet.

Answer

Enable service endpoint only and leave public access open

Answer

Create an inbound NAT rule on Azure Load Balancer

Question 7

A hub-and-spoke Azure network uses Azure Firewall for egress inspection. Which two settings are typically required on spoke workloads?

Accepted Answer

UDRs that send default traffic to the firewall next hop. In a hub-and-spoke topology with Azure Firewall for egress inspection, spoke workloads must not be able to bypass the firewall. A User Defined Route (UDR) with address prefix 0.0.0.0/0 and next hop type VirtualAppliance pointing to the firewall's private IP forces all outbound traffic through the firewall. Additionally, DNS and routing design must prevent direct internet access—for example, by using Azure Private DNS zones or custom DNS servers that resolve only internal names, ensuring that no traffic can exit the spoke without firewall inspection.

Answer

Public IP addresses on every VM

Answer

NSG rules that allow all inbound internet traffic

Question 8

A public web application should be protected from OWASP-style attacks and network-layer DDoS attacks. Which two Azure services are most relevant?

Accepted Answer

Application Gateway WAF or Azure Front Door WAF. Option A is correct because both Azure Application Gateway WAF and Azure Front Door WAF provide managed rule sets (e.g., OWASP Core Rule Set 3.2) that protect against common web vulnerabilities such as SQL injection and cross-site scripting. Option C is correct because Azure DDoS Protection, when enabled on the virtual network hosting the application, mitigates network-layer DDoS attacks (e.g., SYN floods, UDP floods) by leveraging Azure's global infrastructure to absorb and scrub attack traffic.

Answer

Azure Automation State Configuration

Answer

Azure Files premium tier

Question 9

You are planning a network security strategy for a multi-tier application deployed on Azure virtual machines. You need to ensure that traffic between the web tier and the application tier is encrypted and that the application tier is not directly accessible from the internet. Which three of the following should you implement? (Choose three.)

Accepted Answer

Deploy an Azure Application Gateway with SSL/TLS termination in front of the web tier.. Deploying an Azure Application Gateway with SSL/TLS termination in front of the web tier ensures that incoming client traffic is encrypted at the edge, and the gateway can then forward traffic to the web tier. Configuring an NSG on the application tier subnet to deny all inbound traffic from the internet directly protects the application tier from external access. Enabling end-to-end TLS encryption between the web tier and the application tier using certificates ensures that traffic within the virtual network remains encrypted, meeting the requirement for encrypted inter-tier communication.

Answer

Configure a site-to-site VPN between the web tier and the application tier subnets.

Answer

Use Azure Front Door to route traffic between the web tier and the application tier.

Answer

Assign public IP addresses to the application tier virtual machines for monitoring purposes.

Question 10

Your company has deployed an Azure Firewall in a hub virtual network to inspect traffic from spoke virtual networks. You need to ensure that all outbound traffic from a spoke virtual network to the internet is forced through the Azure Firewall. Which three of the following actions are required? (Choose three.)

Accepted Answer

Create a route table in the spoke virtual network with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP as the next hop.. To force all outbound traffic from a spoke virtual network through Azure Firewall, you must create a route table in the spoke with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP as the next hop. This route table must be associated with the subnets in the spoke that need to send traffic through the firewall. Additionally, you must configure the Azure Firewall policy with appropriate network and application rules to allow or deny outbound traffic, as the firewall itself does not automatically permit traffic without explicit rules.

Answer

Enable forced tunneling on the Azure Firewall to route traffic through an on-premises network.

Answer

Deploy a Network Virtual Appliance (NVA) in the spoke virtual network to handle outbound traffic.

Answer

Set the Azure Firewall to 'Drop' mode for all outbound traffic by default.

Question 11

You are designing a secure hybrid network that connects an on-premises datacenter to Azure. The solution must provide high availability and encrypt all traffic between the two sites. Which three of the following should you consider? (Choose three.)

Accepted Answer

Deploy two or more Azure VPN Gateway instances in an active-active configuration.. Deploying two or more Azure VPN Gateway instances in an active-active configuration provides high availability by ensuring that if one gateway instance fails, traffic continues to flow through the other. Using IPsec/IKE policy with strong encryption parameters (e.g., AES256, SHA256, DH Group 14 or higher) ensures all traffic between the on-premises datacenter and Azure is encrypted to meet security compliance. Configuring a second VPN tunnel from the on-premises device to a different Azure region adds geographic redundancy, protecting against a regional Azure outage.

Answer

Implement Azure ExpressRoute with Microsoft peering as the primary connectivity.

Answer

Use Azure Front Door to load balance traffic between the on-premises network and Azure.

Answer

Set up a point-to-site VPN for all on-premises users to access Azure resources.

Question 12

You are securing an Azure Kubernetes Service (AKS) cluster. You need to restrict network traffic between pods and to external services using Azure network policies. Which three of the following options are valid considerations or steps? (Choose three.)

Accepted Answer

Enable the Azure Network Policy Manager (Azure NPM) when creating the AKS cluster.. Azure Network Policy Manager (Azure NPM) is a required add-on for enforcing Kubernetes NetworkPolicy objects in an AKS cluster. It translates Kubernetes network policies into Azure-specific configurations to filter pod-to-pod traffic. Without enabling Azure NPM (or an alternative like Calico), standard Kubernetes NetworkPolicy objects will not be enforced by Azure.

Answer

Configure an NSG directly on the AKS node subnet to filter pod-to-pod traffic.

Answer

Set the AKS cluster to use Calico network policies instead of Azure NPM for better performance.

Answer

Assign public IP addresses to each pod for direct internet access without a load balancer.

Question 13

You are a security engineer for a company that uses Azure. You need to secure network connectivity between on-premises resources and Azure virtual networks (VNets) while minimizing exposure to the public internet. Which four of the following options are valid methods to achieve this? (Choose all that apply. There are four correct answers.)

Accepted Answer

Azure VPN Gateway with site-to-site (S2S) IPsec/IKE VPN tunnel.. Azure VPN Gateway with site-to-site (S2S) IPsec/IKE VPN tunnel is correct because it establishes an encrypted tunnel between on-premises and Azure VNets over the public internet, using industry-standard IPsec/IKE protocols. This method secures connectivity while minimizing exposure by encrypting all traffic, though it does traverse the public internet.

Answer

Azure Application Gateway with public frontend IP only.

Answer

Azure Load Balancer with a public IP assigned to the backend pool.

Question 14

Drag and drop the steps to create an Azure Key Vault firewall rule to allow access from a specific virtual network into the correct order.

Question 15

Drag and drop the steps to configure Azure AD Conditional Access policy to require MFA for all users into the correct order.