AZ-500 practice questions 461–470

1. Question 461 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table.

   

   NSG1 and NSG2 both have default rules only. The subscription contains the virtual machines shown in the following table.

   

   The subscription contains the web apps shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Should be YNN. VNET integration is for outbound traffic only, thus NSG won't apply here, at least not for inbound traffic. "Virtual network integration gives your app access to resources in your virtual network, but it doesn't grant inbound private access to your app from the virtual network. " https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options?tabs=azure-cli#virtual-network-integration

   Source: Adapted from community discussion — Mnguyen0503

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 462 · 496 in bank

   DRAG DROP - You have an Azure subscription. You create an Azure Firewall policy that has the rules shown in the following table.

   

   In which order should the rules be processed? To answer, move all rules from the list of rules to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NAT rules take precedence over Network rules, which, in turn, take precedence over Application rules. Therefore, Rule 2 and Rule 4 will be processed first. Considering the priority, the lower number is assigned to Rule 2, thus it will be executed before Rule 4. The same logic applies to Network rules and Application rules. Thus, the final result will be: 1: Rule 2, 2: Rule 4, 3: Rule 3, 4: Rule 5, and 5: Rule 1.

   Source: Adapted from community discussion — saptati

   References

   • Microsoft Learn

   

   Next question

3. Question 463 · 496 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You create an Azure DDoS Protection plan named DDoS1 in the West US Azure region. Which resources can you add to DDoS1?

   • AVNetl1only
   • BWebApp1 only
   • CVNet1 and VNet2 only
   • DVNet1 and WebApp1 only
   • EVNet1, VNet2, and WebApp1

   Show answer

   Answer: C

   Explanation

   Answer E: is correct Note Although DDoS Protection Plan resources needs to be associated with a region, users can enable DDoS protection on Virtual Networks in different regions and across multiple subscriptions under a single Microsoft Entra tenant. Reference: https://learn.microsoft.com/en-us/azure/ddos-protection/manage-ddos-protection https://learn.microsoft.com/en-us/answers/questions/951433/how-to-protect-azure-webapp-from-denial-of-service https://www.examtopics.com/exams/microsoft/az-500/view/29/#

   Source: Adapted from community discussion — chiquito

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 464 · 496 in bank

   DRAG DROP - You have an Azure subscription that contains the resources shown in the following table.

   

   You need to configure network connectivity to meet the following requirements: • Communication from VM1 to storage1 must traverse an optimized Microsoft backbone network. • All the outbound traffic from VM1 to the internet must be denied. • The solution must minimize costs and administrative effort. What should you configure for VNet1 and NSG1? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The answer can be found here. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview Pricing and limits There's no extra charge for using service endpoints. The current pricing model for Azure services (Azure Storage, Azure SQL Database, etc.) applies as-is today. There's no limit on the total number of service endpoints in a virtual network. Certain Azure services, such as Azure Storage Accounts, may enforce limits on the number of subnets used for securing the resource. Refer to the documentation for various services in the Next steps section for details. https://learn.microsoft.com/en-us/dynamics365/business-central/dev-itpro/security/security-service-tags An Azure service tag represents a group of IP addresses from/to which traffic from a specific service may come, which allows you to set up firewalls for a specific service to allow only traffic from certain services. Answer = VNET = Service Endpoint NSG = Service Tag

   Source: Adapted from community discussion — ITFranz

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 465 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure firewall named AzFW1. AzFW1 has a firewall policy named FWPolicy1. You need to add rule collections to FWPolicy1 to meet the following requirements: • Allow traffic based on the FQDN of the destination. • Allow TCP traffic. Which types of rule collections should you add for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answers: https://learn.microsoft.com/en-us/azure/firewall/fqdn-filtering-network-rules Differences in application rules vs. network rules If the protocol is HTTP/S or MSSQL, use application rules for FQDN filtering. For services like AzureBackup, HDInsight, etc., use application rules with FQDN tags. For any other protocols, you can use network rules for FQDN filtering. Answer can be found for TCP https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets#rule-collection-groups Answer = 1. Application only 2. Network or DNAT

   Source: Adapted from community discussion — ITFranz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 466 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table.

   

   The subscription contains the virtual machines shown in the following table.

   

   All the virtual machines have only private IP addresses. You deploy Azure Bastion to VNet1 as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To support the answers. https://learn.microsoft.com/en-us/azure/bastion/bastion-overview The chart contains answer 1(Y) and 2 (Y) Answer three should be (Y) According to the Achitecture. The Bastion host is deployed in the virtual network that contains the AzureBastionSubnet subnet that has a minimum /26 prefix. The user connects to the Azure portal using any HTML5 browser. The user selects the virtual machine to connect to. With a single click, the RDP/SSH session opens in the browser. No public IP is required on the Azure VM. Answer = YYY

   Source: Adapted from community discussion — ITFranz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 467 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to use service endpoints and service endpoint policies. Which resources can be accessed by using a service endpoint, and which resources support service endpoint policies? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   provided answers are correct service endpoint supports: Azure storage and Azure app service service endpoint policy: only for azure storage https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

   Source: Adapted from community discussion — Abdullah14

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 468 · 496 in bank

   HOTSPOT - You have an Azure App Service web app named App1 as shown in the following exhibit.

   

   Subnet 2 contains a virtual machine named VM1. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   An NSG is used to control inbound and outbound traffic to and from network resources in Azure, such as VMs in a subnet. Gateway-required VNet integration allows an Azure App Service to connect to VNets in different regions using a VPN Gateway. https://learn.microsoft.com/en-us/azure/app-service/configure-gateway-required-vnet-integration

   Source: Adapted from community discussion — Djonzi

   References

   • Microsoft Learn

   

   Next question

9. Question 469 · 496 in bank

   HOTSPOT - You have an Azure subscription that contains a virtual machine named VM1. You have a network security group (NSG) named NSG1 that is associated to the network interface of VM1 and is configured as shown in the following exhibit.

   

   Just-in-time (JIT) VM access is enabled on VM1 and has the following configurations: • Management ports: 3389, 22 • Maximum time range: 3 hours • Allowed source IP addresses: Any You activate the JIT rule and connect to VM1 by using SSH. For each of the following statements, select Yes if the statement is true, otherwise select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   For #1, If other rules already exist for the selected ports, then those existing rules take priority over the new "deny all inbound traffic" rules. If there are no existing rules on the selected ports, then the new rules take top priority in the NSG and Azure Firewall. Source https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks Answer : Yes

   Source: Adapted from community discussion — Viggy1212

   References

   • Microsoft Learn

   

   Next question

10. Question 470 · 496 in bank

    HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

    

    VNet1 contains the subnets shown in the following table.

    

    You plan to use the Azure portal to deploy an Azure firewall named AzFW1 to VNet1. Which resource group and subnet can you use to deploy AzFW1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Tested on my Lab. Firewall must be on the same RG as the AzureFirewallSubnet, which is RG2. If I select RG1 or RG3, Azure gives an error.

    Source: Adapted from community discussion — DatBroNZ

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-500 practice, question 461. 496 questions available.