AZ-500 practice questions 451–460

1. Question 451 · 496 in bank

   You have an Azure subscription that contains the subnets shown in the following table.

   

   The subscription contains an Azure web app named WebApp1 that has the following configurations: • Region: West US • Virtual network: VNet1 • VNet integration: Enabled • Outbound subnet: Subnet11 • Windows plan (West US): ASP1 You plan to deploy an Azure web app named WebApp2 that will have the following settings: • Region: West US • VNet integration: Enabled • Windows plan (West US): ASP1 To which subnets can you integrate WebApp2?

   • ASubnet11 only
   • BSubnet12 only
   • CSubnet11 or Subnet12 only
   • DSubnet12 or Subnet21 only
   • ESubnet11, Subnet12, or Subnet21

   Show answer

   Answer: D

   Explanation

   Answer is D. Check this link: https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#limitations 1- The feature requires an unused subnet that's an IPv4 /28 block or larger in an Azure Resource Manager virtual network. 2- The app and the virtual network must be in the same region. 3- You can't have more than two virtual network integrations per Windows App Service plan. You can't have more than one virtual network integration per Linux App Service plan. - - All VNETs are in the same region (matching rule 2) - However, subnet11 already has webapp deployed in it, hence, we can't use it (matching rule 1). - We can use VNet1/Subnet12 and VNet2/Subnet21 as this is a windows plan which support up to two virtual networks per App service plan (matching rule 3). So, the correct answer is Subnet12 or Subnet21

   Source: Adapted from community discussion — Feraso

   References

   • Microsoft Learn

   Next question

2. Question 452 · 496 in bank

   You have an Azure subscription. You need to deploy an Azure virtual WAN to meet the following requirements: • Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions. • Ensure that security rules sync between the regions. What should you use?

   • AAzure Virtual Network Manager
   • BAzure Front Door
   • CAzure Network Function Manager
   • DAzure Firewall Manager

   Show answer

   Answer: D

   Explanation

   I think this is the reason why the answer in examtopics is "D" https://learn.microsoft.com/en-us/azure/firewall-manager/secured-virtual-hub Create a secured virtual hub Using Firewall Manager in the Azure portal, you can either create a new secured virtual hub, or convert an existing virtual hub that you previously created using Azure Virtual WAN. You may configure Virtual WAN to enable inter-region security use cases in the hub by configuring routing intent. For more information on routing intent, see Routing Intent documentation. If i have to chose, i will go with D. Virtual network manager is not designed for security.

   Source: Adapted from community discussion — erffre

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 453 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   VNet1 connects to a remote site by using a Site-to-Site (S2S) VPN that uses forced tunneling. VNet1 contains the subnets shown in the following table.

   

   The SQL subnet contains SQL1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1- Yes To restrict inbound traffic to SQL1, you must modify an access rule in NSG1 as the NSG controls the traffic. 2- To enable VM1 to access storage1 by using the Microsoft backbone network, you must enable a service endpoint on the Default subnet. Yes: Service endpoints provide secure and direct connectivity to Azure services over the Microsoft Azure backbone network. Enabling a service endpoint for Microsoft.Storage on the Default subnet would ensure that traffic from VM1 to storage1 stays on the Microsoft backbone network. 3- You can deploy an App Service Environment to the Default subnet. No: Typically, an App Service Environment requires a dedicated subnet without any other resources deployed to it. The Default subnet may already contain other resources, and it's not dedicated solely to the App Service Environment. https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

   Source: Adapted from community discussion — femzy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 454 · 496 in bank

   You have an Azure subscription that contains an Azure web app named App1 and a virtual machine named VM1. VM1 runs Microsoft SQL Server and is connected to a virtual network named VNet1. App1, VM1, and VNet1 are in the US Central Azure region. You need to ensure that App1 can connect to VM1. The solution must minimize costs. What should you include in the solution?

   • Aregional virtual network integration
   • Bgateway-required virtual network integration
   • CAzure Front Door
   • DAzure Application Gateway integration
   • ENAT gateway integration

   Show answer

   Answer: A

   Explanation

   Virtual network integration is used only to make outbound calls from your app into your virtual network. Virtual network integration gives your app access to resources in your virtual network, but it doesn’t grant inbound private access to your app from the virtual network. The VNet integration feature behaves differently when it’s used with virtual networks in the same region and with virtual networks in other regions. The VNet integration feature has two variations: • Regional virtual network integration: When you connect to virtual networks in the same region, you must have a dedicated subnet in the virtual network you’re integrating with. • Gateway-required virtual network integration: When you connect directly to virtual networks in other regions or to a classic virtual network in the same region, you need an Azure Virtual Network gateway created in the target virtual network. https://learnwithankit.medium.com/azure-app-service-networking-vnet-integration-and-access-restriction-de5fdbdddd14

   Source: Adapted from community discussion — OrangeSG

   Next question

5. Question 455 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table.

   

   The subscription contains the subnets shown in the following table.

   

   You plan to create an Azure web app named WebApp2 that will have the following configurations: • Region: East US • VNet integration: Enabled • Scale out: Autoscale to up to 10 instances For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   N,Y,N 1: N because Subnet11 contains a VM (The feature requires an unused subnet that's an IPv4 /28 block or larger in an Azure Resource Manager virtual network. https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#limitations 2: YES subnet has an unused /27 ip block, both app and subnet2 are in the same region. 3: No Subnet2 already integrated with another app and also located in a different region

   Source: Adapted from community discussion — Alexbz

   References

   • Microsoft Learn

   

   Next question

6. Question 456 · 496 in bank

   DRAG DROP - You have an Azure subscription. You plan to implement Azure DDoS Protection. The solution must meet the following requirements: • Provide access to DDoS rapid response support during active attacks. • Protect Basic SKU public IP addresses. You need to recommend which type of DDoS Protection to use for each requirement. What should you recommend? To answer, drag the appropriate DDoS Protection types to the correct requirements. Each DDoS Protection type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   DDOS IP protection covers DDoS rapid response support - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview DDOS Network Protection covers Basic Public IP tier - https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-sku-comparison

   Source: Adapted from community discussion — duffrice

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 457 · 496 in bank

   Select 3

   You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a single subnet. The subscription contains a virtual machine named VM1 that is connected to VNet1. You plan to deploy an Azure SQL managed instance named SQL1. You need to ensure that VM1 can access SQL1. Which three components should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aa subnet
   • Ba network security perimeter
   • Ca virtual network gateway
   • Da network security group (NSG)
   • Ea route table

   Show answer

   Answer: ADE

   Explanation

   Dedicated subnet: The subnet SQL Managed Instance can be delegated only to the SQL Managed Instance service. Network security group: A network security group must be associated with the SQL Managed Instance subnet. Route table: A route table must be associated with the SQL Managed Instance subnet.

   Source: Adapted from community discussion — husam421

   References

   • Microsoft Learn

   Next question

8. Question 458 · 496 in bank

   HOTSPOT - You need to ensure that the Azure AD application registration and consent configurations meet the identity and access requirements. What should you use in the Azure portal? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/manage-apps/configure-user-consent

   Source: Adapted from community discussion — Muaamar_Alsayyad

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 459 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual machines shown in the following table.

   

   Subnet1 and Subnet2 have a network security group (NSG). The NSG has an outbound rule that has the following configurations: • Port: Any • Source: Any • Priority: 100 • Action: Deny • Protocol: Any • Destination: Storage The subscription contains a storage account named storage1. You create a private endpoint named Private1 that has the following settings: • Resource type: Microsoft.Storage/storageAccounts • Resource: storage1 • Target sub-resource: blob • Virtual network: VNet1 • Subnet: Subnet1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. From VM2 you can create a container in storage1? No 2. From VM1 you can upload data to the blob storage of storage1? Yes 3. From VM2, you can upload data to the blob storage of storage1? No Let's break down the reasoning: NSG rule: The outbound rule in the NSG denies all traffic to storage accounts (destination: Storage). This rule applies to both VM1 and VM2 as they are both in the VNets (VNet1/Subnet1 and VNet1/Subnet2) associated with the NSG. Private endpoint: The private endpoint (Private1) allows VM1 in Subnet1 to access the blob storage (target sub-resource: blob) of storage1. This creates a private connection that bypasses the NSG rule for VM1. However, VM2 is not in Subnet1 and doesn't have access through the private endpoint. Therefore, VM1 can leverage the private endpoint to access storage1 while VM2 is restricted by the NSG rule.

   Source: Adapted from community discussion — JaridB

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation

   

   Next question

10. Question 460 · 496 in bank

    HOTSPOT - You are implementing an Azure Application Gateway web application firewall (WAF) named WAF1. You have the following Bicep code snippet.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    I believe answer is YNY. WAF is in Detection mode, which means it won't take any action. https://learn.microsoft.com/en-us/azure/web-application-firewall/cdn/cdn-overview#waf-modes As far as the file upload limit, I only found 1 article indicating the limit is 2GB. https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/waf-engine

    Source: Adapted from community discussion — Mnguyen0503

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 451. 496 questions available.