AZ-500 Secure networking Practice Test 7 — 15 Questions

Question 1

You are reviewing an NSG rule as shown in the exhibit. This rule is applied to a subnet containing web servers. What is the security implication of this rule?

Accepted Answer

It allows all inbound traffic, creating a security risk.. Option B is correct because the rule allows all inbound traffic from any source to any destination port and IP, which is overly permissive and exposes the subnet to potential attacks. Option A is wrong because the rule allows all traffic, not just HTTP. Option C is wrong because the rule allows inbound traffic, not outbound. Option D is wrong because the rule does not specify a protocol; 'Any' includes all protocols.

Answer

It restricts inbound traffic to TCP only.

Answer

It blocks all inbound traffic except HTTP.

Answer

It restricts inbound traffic to HTTP only.

Question 2

You need to provide secure remote administration access to Azure virtual machines in a production environment. You want to eliminate public RDP/SSH endpoints and provide just-in-time access. Which Azure service should you use?

Accepted Answer

Just-in-time VM access in Microsoft Defender for Cloud. Option A is correct because Microsoft Defender for Cloud's just-in-time (JIT) VM access allows you to lock down inbound traffic to VMs and provide time-limited access. Option B is wrong because Azure Bastion provides secure RDP/SSH through the portal but does not provide JIT access. Option C is wrong because NSGs are used for filtering, not JIT access. Option D is wrong because Azure Firewall can be used for JIT-like scenarios but is not the primary service for JIT VM access.

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Answer

Azure Bastion

Question 3

You have an Azure Kubernetes Service (AKS) cluster that needs to restrict egress traffic to specific Azure services (e.g., Azure Container Registry, Azure Monitor). You want a managed solution that allows you to define FQDN-based rules. Which Azure service should you use?

Accepted Answer

Azure Firewall. Option B is correct because Azure Firewall supports FQDN-based rules for outbound traffic, which can be used to restrict egress from AKS. Option A is wrong because NSGs only support IP-based rules, not FQDNs. Option C is wrong because Azure Application Gateway is for inbound traffic. Option D is wrong because Azure Front Door is for global load balancing.

Answer

Azure Application Gateway

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Question 4

You are configuring a site-to-site VPN connection between your on-premises network and Azure. You need to ensure that traffic between the networks is encrypted and authenticated. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Option B is correct because Azure VPN Gateway provides encrypted and authenticated site-to-site VPN connections using IPsec. Option A is wrong because Azure ExpressRoute provides private connectivity but does not encrypt traffic by default. Option C is wrong because Azure Firewall is a network firewall, not a VPN gateway. Option D is wrong because Azure Virtual WAN can include VPN capabilities but is a broader service.

Answer

Azure Virtual WAN

Answer

Azure ExpressRoute

Answer

Azure Firewall

Question 5

A company uses Azure Firewall to filter outbound traffic from a virtual network. The security team notices that traffic to a specific external IP address is being allowed despite a deny rule. What is the most likely cause?

Accepted Answer

An application rule allows the traffic, which overrides the network deny rule.. Application rules take precedence over network rules when both match the traffic. If an application rule allows the traffic, it will be permitted even if a network rule denies it.

Answer

The Azure Firewall policy is not associated with the correct virtual network.

Answer

A network rule with a higher priority allows the traffic.

Answer

The deny rule is configured with the wrong protocol (UDP instead of TCP).

Question 6

Your organization has deployed Azure Front Door Premium with Web Application Firewall (WAF) policy in front of an Azure App Service. You need to ensure that only traffic from Azure Front Door is allowed to reach the App Service, and all other traffic is blocked. Which configuration should you implement?

Accepted Answer

Configure IP restrictions on the App Service to allow only the Azure Front Door service tag AzureFrontDoor.Backend.. Restricting App Service access to only Azure Front Door's backend IP addresses using service tags (AzureFrontDoor.Backend) is the recommended approach. Additionally, configuring Azure Front Door to send the X-Azure-FDID header and validating it in the App Service provides an extra layer of security against spoofed traffic.

Answer

Configure the App Service to require client certificates and configure Azure Front Door to present a certificate.

Answer

Set the App Service access restrictions to deny all and then add a rule to allow the Azure Front Door service tag AzureFrontDoor.Frontend.

Answer

Configure a WAF policy to block all requests that do not contain the X-Azure-FDID header.

Question 7

You need to securely connect an on-premises network to an Azure virtual network. The connection must use the internet and provide authenticated and encrypted communication. Which Azure service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway provides site-to-site VPN connections over the internet with IPsec/IKE encryption, meeting the requirements for authenticated and encrypted communication.

Answer

Azure ExpressRoute

Answer

Azure Application Gateway

Answer

Azure Virtual WAN

Question 8

A company has deployed Azure Firewall in a hub virtual network with forced tunneling enabled. Spoke virtual networks are peered to the hub. The security team reports that outbound traffic from the spoke VMs is bypassing the firewall. What is the most likely reason?

Accepted Answer

The spoke subnets do not have a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall.. Forced tunneling (default route 0.0.0.0/0 to the firewall) must be set on the spoke subnets' route tables. If the spoke VMs' subnet does not have a route forcing traffic to the firewall, outbound traffic will use the default internet route instead.

Answer

The Azure Firewall policy has an allow-all network rule.

Answer

Azure Firewall is deployed in the same virtual network as the spoke VMs.

Answer

The spoke virtual networks are not peered to the hub.

Question 9

You are designing a network security strategy for a multi-tier application. The web tier must be accessible from the internet, but the application and database tiers must only be accessible from the web tier. Which Azure solution should you use to isolate the tiers?

Accepted Answer

Network security groups (NSGs) on each subnet. Network security groups (NSGs) applied to subnets can control traffic between tiers by allowing only inbound traffic from the web tier subnet to the application tier subnet, and similarly between app and DB tiers. This provides network segmentation.

Answer

Azure DDoS Protection

Answer

Azure Firewall with application rules

Answer

Azure Private Link

Question 10

A company uses Azure Bastion to provide secure RDP and SSH access to Azure VMs without public IPs. Recently, a security audit recommended logging all connections to Bastion. What should you enable?

Accepted Answer

Diagnostic settings on the Bastion resource to stream Bastion logs to a Log Analytics workspace. Azure Bastion integrates with Azure Diagnostic Logs to capture connection logs. Enabling diagnostic settings on the Bastion resource sends logs to a Log Analytics workspace, Storage account, or Event Hub.

Answer

Azure Monitor alerts for Bastion resource health

Answer

Azure Activity Logs for the Bastion resource

Answer

Network Security Group flow logs on the subnet containing Bastion

Question 11

Your organization has multiple Azure subscriptions and wants to centrally manage Azure Firewall policies across all subscriptions. What should you use?

Accepted Answer

Azure Firewall Manager. Azure Firewall Manager provides a centralized place to manage firewall policies across multiple subscriptions and regions. It supports hierarchical policies and can be applied to multiple Azure Firewall instances.

Answer

Azure Policy to enforce firewall rules

Answer

Azure Resource Manager templates

Answer

Azure Network Watcher

Question 12

A company plans to use Azure Private Endpoint to securely connect to an Azure SQL Database from an on-premises network via ExpressRoute. The private endpoint is deployed in a hub virtual network. The on-premises network is connected to the hub via ExpressRoute. What additional configuration is needed to ensure on-premises clients can resolve the private endpoint's DNS name?

Accepted Answer

Configure a DNS forwarder on-premises to forward the private link domain to Azure DNS.. Private endpoints require DNS configuration to resolve the private IP address. Azure Private DNS zones can be linked to the hub VNet, and on-premises DNS servers must forward queries for the private endpoint's domain (e.g., privatelink.database.windows.net) to Azure or use a custom DNS server that resolves the private IP.

Answer

Configure a network security group to allow inbound traffic from on-premises to the private endpoint.

Answer

Deploy a VPN gateway in the hub VNet for additional encryption.

Answer

Add a public DNS record for the SQL Database pointing to the private endpoint IP.

Question 13

You need to filter inbound internet traffic to an Azure web application based on source IP address and geographic location. Which Azure service should you use?

Accepted Answer

Azure Web Application Firewall (WAF) on Azure Front Door. Azure Web Application Firewall (WAF) on Azure Front Door or Application Gateway can filter traffic based on source IP and geo-location using custom rules. WAF provides layer 7 protection.

Answer

Network Security Group

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 14

Which TWO actions should you take to secure traffic between Azure virtual networks using VNet peering? (Choose two.)

Accepted Answer

Apply network security groups (NSGs) to subnets to control traffic between the VNets.. Configuring network security groups (NSGs) on subnets controls traffic between peered VNets by allowing or denying specific traffic. Using VPN Gateway for encrypted peering (over the internet) is not correct because VNet peering traffic is private and encrypted by default within the Azure backbone; additional encryption is not required and VPN Gateway is not used for peering.

Answer

Use Azure VPN Gateway to create an encrypted tunnel between the VNets.

Answer

Configure the peering to block all traffic by default and allow only specific subnets.

Answer

Enable service endpoints on the subnets to restrict traffic to Azure services.

Question 15

Which THREE components are required to implement Azure Virtual WAN with secured virtual hub? (Choose three.)

Accepted Answer

Azure Firewall deployed in the virtual hub. Azure Virtual WAN secured hub includes a virtual hub, Azure Firewall (for security), and VPN gateway (for connectivity). A Network Virtual Appliance (NVA) is not required as Azure Firewall is the native security service. ExpressRoute gateway is optional and not required for baseline secured hub.

Answer

ExpressRoute gateway in the virtual hub

Answer

Network Virtual Appliance (NVA)

AZ-500 Secure networking Practice Test 7 — 15 Questions

Exhibit

AZ-500 Secure networking Practice Test 7 — 15 Questions

Exhibit