Secure networking

AZ-500 · 71 questions

• A lock-chamber VM sits on a subnet that already has an NSG, and operators also pinned a second NSG to the NIC. Inbound SSH from the harbor-pilot jump host still fails. What should the security engineer understand about effective rules?
• A grain-elevator NSG has an Allow on TCP 443 at priority 400 and a Deny on TCP 443 at priority 200. Operators argue the Allow should win because it was added last. Which rule takes effect?
• A water-lab subnet must reach Azure Storage on the Microsoft backbone and must not be opened to the whole Internet. How should the NSG destination be expressed?
• Tugboat-app VMs are added and removed weekly, and the NSG that lets the web tier talk to the API tier keeps breaking because someone edits IP prefixes. What should the security engineer use instead?
• Compost-lab front-end VMs must reach only the mid-tier VMs on TCP 8443, not every NIC covered by the VirtualNetwork service tag. What NSG design should the security engineer apply?
• A canal authority wants FQDN filtering, threat-intelligence-based deny, and SNAT for many spokes. A contractor proposes adding more NSG rules. What should the security engineer choose?
• A spoke team allowed RDP from the Internet on their subnet NSG. The central security engineer must close that path on every spoke without chasing each NSG. What should they deploy?
• Night-shift monitoring must reach every lock VM on TCP 443 from a jump subnet, but app teams keep adding Deny rules that break the probes. Which Azure Virtual Network Manager action should the security engineer use?
• Production lock VNets across three subscriptions must share one network security baseline, while a sandbox VNet must stay out. Where should the security engineer apply the Azure Virtual Network Manager security admin configuration?
• A water-lab engineer saved a security admin configuration that denies inbound Internet to a network group, then opened a test VM and found the port still reachable. What step is missing?
• Spoke subnets still go straight to the Internet and bypass the hub Azure Firewall. What user-defined route should the security engineer attach?
• A retired partner prefix must not leave the compost-lab subnet at all, even toward the hub firewall. Which user-defined route next hop should the security engineer configure for that prefix?
• A lock-app subnet has a default system route to Internet, but the security engineer needs PaaS-bound traffic to take the firewall path instead. What routing behavior should they rely on?
• Spoke A and spoke B each peer to the hub. A harbor-pilot VM in A cannot reach a water-lab VM in B. What should the security engineer conclude?
• Only the hub has a VPN gateway to the grain elevator. Spokes must use that hybrid path without each deploying a gateway. Which peering settings should the security engineer enable?
• A credit-union reviewer asks for “encryption on the peering” between two Azure regions. How should the security engineer respond?
• A municipal yard has no ExpressRoute and must send lock telemetry into a hub VNet over the Internet. Which connectivity path should the security engineer plan?
• The canal authority is moving from a DIY hub-spoke to Virtual WAN and still needs a central inspect-and-deny point. What should the security engineer implement?
• Branch and spoke traffic in Virtual WAN can skip the hub firewall if routing is left at defaults. What control should the security engineer set so inspection is mandatory?
• A municipality has many branches, many regions, and a requirement for a managed any-to-any hub with integrated firewall. What architecture should the security engineer recommend?
• A grain-elevator auditor rejects the VPN gateway’s default IPsec/IKE proposal as a legacy cipher set. What should the security engineer apply on the site-to-site connection?
• Harbor contractors on laptops must reach a VNet without a site-to-site appliance at their desks. How should the security engineer configure point-to-site authentication?
• A lock-operator shop has no Entra-joined laptops but can issue device certificates from its CA for VPN clients. Which point-to-site authentication method fits that shop?
• A botanical garden needs the whole on-premises yard always connected to Azure, and a few traveling inspectors also need laptop tunnels. How should the security engineer split the VPN patterns?
• A canal reviewer treats ExpressRoute private peering as encrypted because the path is private. What should the security engineer state first?
• The canal authority has ExpressRoute Direct and a regulator who wants Layer-2 encryption on the physical ports toward Microsoft. What should the security engineer enable?
• They have a standard ExpressRoute circuit (not Direct) and still need network-layer encryption from the yard to the VNet. Which approach meets that need?
• A water-quality archive storage account is reachable from any Internet IP. Which resource firewall change should the security engineer make first?
• An Azure SQL Database accepts clients from the whole office because Allow Azure services is checked and a 0.0.0.0–255.255.255.255 firewall rule exists. What network control should the security engineer tighten?
• A storage account must accept writes from an Azure Backup vault without opening the Internet to all networks. What should the security engineer use on the storage firewall?
• A tugboat VM cannot reach an API VM on TCP 8443, and the night shift needs to know which NSG rule is to blame. Which Network Watcher check should they run first?
• The security lead needs multi-day visibility into which spokes still talk to the Internet and which NSG rules are hit. What should the engineer enable?
• A lock subnet was supposed to send 0.0.0.0/0 to Azure Firewall, but a VM still egresses directly to the Internet. How should the security engineer prove the routing miss?
• A water-lab subnet must reach Storage on the Azure backbone, and a reviewer asks whether a Service Endpoint makes the account private. What should the security engineer explain?
• After Microsoft.Storage is enabled on a grain-elevator subnet, every regional storage account becomes reachable from that subnet. How should the engineer allow only the elevator’s account?
• A lock-app subnet in East US still cannot use the Service Endpoint path to Storage until the service is opted in. What must the security engineer configure?
• The compost-lab storage account must be reachable only at an IP inside the VNet. Which control should the security engineer implement?
• A Private Endpoint for Blob is up, but lock-app VMs still resolve .blob.core.windows.net to a public IP and fail after public access is disabled. What DNS fix is required?
• A partner subscription created a Private Endpoint toward the canal authority’s SQL logical server, and the connection sits at Pending. What should the data-plane owner do?
• A water-quality storage account has a working Private Endpoint, but public network access is still Enabled from all networks. What judgment should the security engineer apply?
• The canal authority wants to publish an internal lock-scheduling API behind a Standard load balancer so another tenant can reach it without VNet peering, a public IP, or site-to-site VPN. What should they create?
• Sister subscriptions in the same tenant should connect to a Private Link service without a ticket, while everyone else must wait for approval. What should the engineer configure?
• A botanical-garden subscription in another Microsoft Entra tenant needs the lock-scheduling API exposed by a Private Link service. What consumer path should the security engineer describe?
• A lock-status App Service must call a VM and a Private Endpoint SQL NIC inside the VNet, while inbound Internet to the app must stay closed. How should networking be split?
• An App Service still egresses to public Storage even though VNet integration is on, so traffic misses the hub Azure Firewall. What should the security engineer enable?
• A consumption-plan Azure Function that posts canal lock telemetry still cannot reach a VNet-injected internal API. The Function already has the same outbound-versus-inbound split pattern as App Service documented for private access. What should the security engineer change first?
• Canal-operations web apps must not receive a public inbound VIP. Which App Service Environment design meets that inbound-isolation requirement?
• An ASE v3 deployment fails management connectivity after an engineer strips the ASE subnet NSG and points 0.0.0.0/0 at an NVA without the documented ASE exceptions. What should the security engineer restore?
• A public botanical-garden site runs on an External App Service Environment. What inbound-security conclusion should the security engineer draw?
• A new Azure SQL Managed Instance will store lock telemetry and must stay off the public Internet. Which network placement and endpoint setting should the security engineer use?
• After someone deleted platform NSG rules and forced all MI subnet traffic through a firewall without documented exceptions, the Managed Instance lost management connectivity. What should the security engineer restore, and which port applies if a public endpoint is truly required?
• A reviewer checklist treats “disable MI public endpoint,” “enable TDE,” and “set a Microsoft Entra admin” as one networking task. Which items belong in the Domain 2 network-security configuration for Azure SQL Managed Instance?
• The public lock-status App Service still answers HTTP and accepts TLS 1.0. What should the security engineer configure on App Service?
• locks.canal.example must present a trusted certificate to browsers on App Service. What should the security engineer implement for TLS on the app?
• The public API Management gateway still serves only the default .azure-api.net host and allows a weak TLS version. What should the security engineer configure?
• The hub Azure Firewall must allow a spoke VM to login.microsoftonline.com over HTTPS, allow TCP 1433 to a known SQL IP, and publish an internal RDP host to one operator IP. How should those be mapped to firewall rule kinds?
• The canal authority wants Azure Firewall to drop traffic to or from known malicious IPs and domains, not only log them. Which threat-intelligence mode should the security engineer set?
• Every hub firewall must share a baseline (deny Internet RDP, threat intel on) while each region adds its own FQDNs. What should the security engineer use?
• Outbound HTTPS from spokes must be opened, inspected for malware, and evaluated with an intrusion-detection signature set. Which Azure Firewall choice meets that requirement?
• A night-shift design review stacks NSG, Azure Firewall, and Application Gateway on the same flow without clear roles. How should the security engineer assign jobs?
• A lock-booking web app in one region needs path-based routing, a private backend pool of VMs, and a single public HTTPS listener. Which service should the security engineer choose?
• Browsers reach Application Gateway over HTTPS, but the gateway opens HTTP to backend VMs on the VNet. Auditors require encryption all the way to the backends. What should the security engineer configure?
• The water-lab portal must use Layer-7 routing but must not have a public IP. What Application Gateway frontend design should the security engineer deploy?
• The lock-booking site now has users on two continents and needs anycast HTTPS at the edge with a single global hostname. Which entry-point choice should the security engineer make?
• Clients must enter at Azure Front Door while the origin (internal App Service, Storage static website, or ILB) must not be on the public Internet. What should the security engineer implement?
• A Front Door/CDN rule caches /api/lock-status and a harbor contractor sees another operator’s payload. What cache behavior should the security engineer set?
• A new OWASP managed-rule pack is about to go live on the lock-booking site’s WAF. How should the security engineer introduce the policy mode?
• One site is regional-only behind Application Gateway; another is global behind Front Door. Where should the security engineer attach WAF policies?
• A legitimate lock-form POST trips a managed SQL-injection rule, and a contractor wants the entire WAF policy disabled. What should the security engineer do?
• A reviewer says Azure already includes DDoS protection so nothing more is needed for a public Application Gateway and a public Azure Firewall. What distinction should the security engineer make?
• A canal authority’s production public IPs sit in front of Application Gateway and Azure Firewall, and a past flood exhausted scale-out without anyone being paged. When should the security engineer recommend Azure DDoS Protection Standard?