AZ-500 Secure networking Practice Test 6 — 15 Questions

Question 1

You have an Azure Application Gateway v2 with WAF policy in prevention mode to protect a web app. Users report that legitimate requests are being blocked. You review the WAF logs and see many false positives. You need to resolve this while maintaining security. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use managed rule sets with custom rules to allow the legitimate traffic that is being falsely blocked.. Azure Application Gateway WAF allows you to use managed rule sets (e.g., OWASP 3.2) and then add custom rules to explicitly allow traffic that is being falsely blocked. This approach maintains the WAF in prevention mode, ensuring that true threats are still blocked, while overriding false positives for specific request patterns (e.g., based on URI, headers, or source IP). Custom rules are evaluated before managed rules, so you can create an 'allow' rule with a higher priority to bypass the false positive detection.

Answer

Add a custom rule to block all requests that do not match a known pattern.

Answer

Disable the WAF and rely on NSGs.

Answer

Switch the WAF policy to detection mode.

Question 2

Your organization has multiple Azure subscriptions that need to connect to a shared on-premises data center via ExpressRoute. You plan to use Azure Virtual WAN with secured hubs. Each subscription contains VNets that must communicate with on-premises and with each other through the hub. You need to ensure that traffic between VNets in different subscriptions is routed through the Azure Firewall. What configuration is required?

Accepted Answer

Connect each VNet to the same Virtual WAN hub and enable inter-hub routing with Azure Firewall inspection.. Azure Virtual WAN with a secured hub allows you to connect VNets from different subscriptions to the same hub and enforce traffic inspection through Azure Firewall. By enabling inter-hub routing and configuring Azure Firewall as the inspection point, all traffic between VNets is forced through the firewall, meeting the requirement for centralized security and routing.

Answer

Establish VNet peering between VNets in different subscriptions and use NSGs to filter traffic.

Answer

Create a site-to-site VPN between the VNets and force traffic through a VPN Gateway.

Answer

Use Azure Firewall Manager to deploy firewalls in each VNet and route traffic between VNets through them.

Question 3

You need to allow a specific IP address (203.0.113.5) to access an Azure Storage account over the internet. All other internet traffic must be denied. You have enabled the storage account firewall. What should you configure?

Accepted Answer

Add the IP address to the firewall rules of the storage account.. The Azure Storage account firewall allows you to configure IP-based access control rules. By adding the specific IP address 203.0.113.5 to the firewall rules, you explicitly permit traffic from that IP while denying all other internet traffic, as the default rule is to deny when the firewall is enabled.

Answer

Create a private endpoint for the storage account.

Answer

Configure an NSG on the subnet to allow the IP address.

Answer

Add a service endpoint for Microsoft.Storage to the subnet.

Question 4

Which TWO configurations are required to enable Azure Bastion to connect to a virtual machine without a public IP address?

Accepted Answer

The virtual network must have a subnet named AzureBastionSubnet.. Azure Bastion requires a dedicated subnet named AzureBastionSubnet within the virtual network to provision the Bastion host. This subnet hosts the Bastion service and must have a minimum prefix of /26. Additionally, the target virtual machine must have a private IP address because Bastion connects to VMs over the private network using RDP/SSH, eliminating the need for a public IP on the VM.

Answer

The virtual machine must have a public IP address.

Answer

The Bastion host must have a public IP address assigned.

Answer

The virtual machine must be in a subnet with an NSG that allows RDP/SSH from the Bastion subnet.

Question 5

Which THREE benefits does Azure DDoS Protection Standard provide over Basic?

Accepted Answer

Adaptive tuning based on application traffic patterns.. Options B, C, and E are correct because Azure DDoS Protection Standard provides adaptive tuning (B) that learns application traffic patterns to adjust mitigation thresholds dynamically, unlike Basic's static thresholds. Option C is correct because Standard offers cost protection: if an attack triggers auto-scaling, Azure covers the costs incurred from scaled resources during the attack, which Basic does not. Option E is correct because Standard includes access to the DDoS Rapid Response (DRR) team, a dedicated expert support team available 24/7 during an attack, which is not available with Basic. Options A and D are incorrect because always-on monitoring and mitigation of layer 3/4 attacks (A) and mitigation using Azure's global network capacity (D) are features shared by both Standard and Basic tiers.

Answer

Always-on monitoring and mitigation of layer 3/4 attacks.

Answer

Mitigation of attacks using Azure's global network capacity.

Question 6

Which TWO actions can be taken using Azure Network Watcher?

Accepted Answer

Diagnose whether a security rule is blocking traffic to a VM.. Azure Network Watcher provides IP flow verify, which checks if a security rule (NSG) is allowing or denying traffic to a VM based on source/destination IP, port, and protocol. This directly diagnoses whether a security rule is blocking traffic (Option A). Additionally, Network Watcher's Next hop feature allows you to determine the next hop from a specific VM and IP address, showing the route taken by traffic and identifying the next hop type (e.g., Internet, VirtualAppliance, VirtualNetworkGateway). This makes Option D also correct.

Answer

Create and manage private endpoints.

Answer

Configure WAF policies on Application Gateway.

Answer

Configure Azure Firewall rules.

Question 7

You need to design a network security solution for a hub-spoke topology. The hub contains Azure Firewall and Azure Bastion. Spoke VNets contain application workloads. You need to ensure that all traffic from the spokes to the internet is routed through the Azure Firewall. What should you configure?

Accepted Answer

Add a user-defined route (UDR) on the spoke subnets with 0.0.0.0/0 next hop to the Azure Firewall private IP.. A user-defined route (UDR) with 0.0.0.0/0 and next hop set to the Azure Firewall's private IP forces all internet-bound traffic from spoke subnets to be routed through the firewall. This ensures traffic inspection and control by the firewall, which is a key requirement in a hub-spoke topology for centralized security.

Answer

Use service endpoints for internet-bound traffic.

Answer

Enable BGP on the spoke VNets and advertise a default route from the hub.

Answer

Configure the Azure Firewall to have a default route to the internet.

Question 8

Your company uses Azure Firewall Premium with TLS inspection to filter outbound traffic from Azure VMs. Users report that some websites are not loading. You have configured the firewall to inspect traffic to *.microsoft.com. What is the most likely cause of the issue?

Accepted Answer

The client does not trust the certificate presented by the firewall during TLS inspection.. Azure Firewall Premium with TLS inspection acts as a man-in-the-middle (MITM) proxy. It decrypts outbound HTTPS traffic, inspects it, then re-encrypts it using a certificate signed by an internal CA. If the client VM does not trust the firewall's internal CA certificate (e.g., it is not installed in the Trusted Root Certification Authorities store), the browser will reject the connection, causing websites to fail to load even though the firewall rule is correctly configured.

Answer

The firewall rule for *.microsoft.com is misconfigured.

Answer

The firewall cannot inspect HTTPS traffic.

Answer

The firewall is blocking HTTP traffic.

Question 9

You need to allow an Azure VM to access an on-premises SQL Server database securely. The on-premises network is connected to Azure via a site-to-site VPN. You want to minimize latency and avoid traversing the internet. What should you use?

Accepted Answer

Site-to-site VPN connection.. The on-premises SQL Server is already connected to Azure via a site-to-site VPN, and the Azure VM is in the same virtual network. By using the existing site-to-site VPN connection, traffic between the VM and the on-premises SQL Server stays within the encrypted VPN tunnel, minimizing latency and avoiding internet traversal. No additional Azure services are needed since the VPN provides secure, private connectivity.

Answer

Service endpoint for SQL.

Answer

Azure Private Link.

Answer

VNet peering.

Question 10

You are designing a network security solution for a multi-tier application running in Azure. The front-end VMs must only accept traffic from Azure Front Door. Back-end VMs must only accept traffic from the front-end tier. You plan to use NSGs and ASGs. Which configuration should you use to meet these requirements with minimal administrative overhead?

Accepted Answer

Place front-end VMs in an ASG, back-end VMs in another ASG. Configure NSG rules referencing these ASGs.. Application Security Groups (ASGs) allow you to group VMs logically and reference them in NSG rules, enabling dynamic traffic control without hardcoding IP addresses. By placing front-end VMs in one ASG and back-end VMs in another, you can create an NSG rule on the back-end subnet that allows inbound traffic only from the front-end ASG. This approach minimizes administrative overhead because IP changes are automatically handled as VMs are added or removed from the ASG.

Answer

Create NSG rules that allow traffic from the Front Door service tag and from the front-end VM IP addresses.

Answer

Use service tags for Azure Front Door and for the front-end subnet.

Answer

Use VNet peering between the front-end and back-end subnets, and configure route tables.

Question 11

Your company has an Azure subscription with multiple VNets. You need to securely connect an on-premises data center to Azure using a site-to-site VPN. The on-premises VPN device does not support IKEv2. Which VPN gateway SKU should you select to ensure compatibility?

Accepted Answer

Basic. The Basic SKU is the only VPN gateway SKU that supports IKEv1, which is required for compatibility with on-premises VPN devices that do not support IKEv2. All other SKUs (VpnGw1, VpnGw2, VpnGw3) exclusively support IKEv2, making them incompatible with such devices.

Answer

VpnGw2

Answer

VpnGw1

Answer

VpnGw3

Question 12

You are troubleshooting connectivity issues from an Azure VM to an on-premises server. The VM is in a VNet that uses a custom DNS server. The on-premises network is connected via ExpressRoute. You can ping the on-premises server by IP address but not by name. What is the most likely cause?

Accepted Answer

The custom DNS server does not have a conditional forwarder to the on-premises DNS.. The custom DNS server in the Azure VNet is authoritative for the VNet's DNS resolution. When the VM tries to resolve the on-premises server's name, the custom DNS server does not know how to forward the query to the on-premises DNS infrastructure. A conditional forwarder must be configured on the custom DNS server to send queries for the on-premises domain to the on-premises DNS server, which is reachable via ExpressRoute. Without this forwarder, name resolution fails even though IP connectivity (ping) works.

Answer

The ExpressRoute circuit is not configured for DNS forwarding.

Answer

The Azure Private DNS zone does not include the on-premises hostname.

Answer

An NSG rule is blocking DNS traffic.

Question 13

You need to secure traffic between two VNets in different Azure regions. The VNets contain virtual machines that must communicate over private IP addresses. Which Azure service should you use?

Accepted Answer

VNet peering. VNet peering enables direct, private IP connectivity between two VNets in different Azure regions (global VNet peering). Traffic flows over the Microsoft backbone network, not the public internet, ensuring low-latency and secure communication between virtual machines using private IP addresses without requiring a gateway or additional appliance.

Answer

Azure Firewall

Answer

Azure VPN Gateway

Answer

ExpressRoute

Question 14

Your company has an Azure subscription with several VNets. You deploy Azure Firewall in a hub VNet. You need to ensure that all traffic from spoke VNets to the internet goes through the firewall. What should you configure?

Accepted Answer

Create a route table with a default route (0.0.0.0/0) to the Azure Firewall private IP and associate it with the spoke subnets.. To force all internet-bound traffic from spoke VNets through Azure Firewall, you must create a user-defined route (UDR) with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP address as the next hop. This route table must be associated with the subnets in the spoke VNets, ensuring that any traffic destined for the internet is redirected to the firewall for inspection and policy enforcement.

Answer

Configure forced tunneling on the spoke VNet gateways.

Answer

Enable VNet peering to the hub VNet.

Answer

Apply an Azure Firewall policy that denies internet access for spoke VNets.

Question 15

You need to provide secure remote access to Azure virtual machines for developers without exposing public IP addresses. The solution must authenticate users via Microsoft Entra ID and support multifactor authentication. Which service should you use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure RDP/SSH connectivity to Azure virtual machines directly from the Azure portal over TLS, without exposing public IP addresses. It integrates with Microsoft Entra ID for authentication and supports multifactor authentication (MFA) when combined with Conditional Access policies, meeting all requirements.

Answer

Azure Front Door

Answer

Azure VPN Gateway

Answer

Azure Firewall