Microsoft Azure Security Technologies496 questions across 50 pages are complete and free, with no account or card.
496 questions in this bank
Free access · progress saved on this device
You have an on-premises network. You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy a Site-to-Site (S2S) VPN between the on-premises network and VNet1. You need to recommend an Azure VPN Gateway SKU that meets the following requirements: • Supports 1-Gbps throughput • Minimizes costs What should you recommend?
Answer: B
HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains the subnets shown in the following table.
The subscription contains the virtual machines shown in the following table.
VM3 contains a service that listens for connections on port 8080. For VM1, you configure just-in-time (JIT) VM access as shown in the following exhibit.
For each of the following statement, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
For #1, JIT is set for Vm1, Question is connecting to Vm3 from VM1. Vm3 is not having JIT rule. so Time Rule is applied for VM3. Ans : No For #2, Establishing a RDP Connection from VM2 to Vm1. VM2 is not allowed as per source IP Settings. We dont know anything about NSG rules. Going by the default NSG rules, connection will not be allowed. Ans : No For #3, We can establish a RDP connection from Vm3 to VM1, as per source IP settings, it is allowed. But without requesting access, it is not possible. Hence Answeris no Ans : No, No, No Please correct if I missed anything.
Source: Adapted from community discussion — Viggy1212
You have an Azure subscription that contains a storage account named storage1 and a virtual machine named VM1. VM1 is connected to a virtual network named VNet1 that contains one subnet and uses Azure DNS. You need to ensure that VM1 connects to storage1 by using a private IP address. The solution must minimize administrative effort. What should you do?
Answer: C
You have an Azure subscription that contains a web app named App1. App1 provides users with product images and videos. Users access App1 by using a URL of HTTPS://app1.contoso.com. You deploy two server pools named Pool1 and Pool2. Pool1 hosts product images. Pool2 hosts product videos. You need to optimize the performance of App1. The solution must meet the following requirements: • Minimize the performance impact of TLS connections on Pool1 and Pool2. • Route user requests to the server pools based on the requested URL path. What should you include in the solution?
Answer: D
I have been working with AppGW, AFD and CDN for about 4 years now... for this specific requirement of TLS unburdening, I will definitely go with AppGW. AFD is more used for it's global and priority balancing qualities, but AppGW here would be the chosen option and what I would recommend to a customer to go with for good TLS performance. https://learn.microsoft.com/en-us/azure/application-gateway/features#url-based-routing URL-based routing URL Path Based Routing allows you to route traffic to backend server pools based on URL Paths of the request. One of the scenarios is to route requests for different content types to different pool. For example, requests for http://contoso.com/video/* are routed to VideoServerPool, and http://contoso.com/images/* are routed to ImageServerPool. DefaultServerPool is selected if none of the path patterns match.
Source: Adapted from community discussion — cris_exam
HOTSPOT - You have an Azure subscription that is linked to an Azure AD tenant and contains the virtual machines shown in the following table.
The subnets of the virtual networks have the service endpoints shown in the following table.
You create the resources shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
THEY ARE REFERENCING A SERVICE ENDPOINT, NOT A PRIVATE ENDPOINT. THE ANSWERS ARE : N, Y, Y connections from VM1 to STORAGE 1 will always use PUBLIC IP connection from VM2 to VAULT 1 will always use PUBLIC IP authentication from VM3 to TENANT can use either PRIVATE or PUBLIC because it has no SERVICE ENDPOINT. Knew this already but the diagram here outlines it perfectly: https://stackoverflow.com/questions/73769449/azure-difference-between-service-endpoint-and-private-endpoint-in-simple-terms
Source: Adapted from community discussion — heatfan900
You have an Azure subscription that contains an instance of Azure Firewall Standard named AzFW1. You need to identify whether you can use the following features with AzFW1: • TLS inspection • Threat intelligence • The network intrusion detection and prevention systems (IDPS) What can you use?
Answer: B
Azure Firewall Standard includes the following features: Built-in high availability Availability Zones Unrestricted cloud scalability Application FQDN filtering rules Network traffic filtering rules FQDN tags Service tags Threat intelligence DNS proxy Custom DNS FQDN in network rules Deployment without public IP address in Forced Tunnel Mode Outbound SNAT support Inbound DNAT support Multiple public IP addresses Azure Monitor logging Forced tunneling Web categories Certifications
Source: Adapted from community discussion — billo79152718
SIMULATION - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Azure Username: User1-28681041@ExamUsers.com Azure Password: Gp0Ae4@!Dg - If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 28681041 - You need to configure Azure to allow RDP connections from the Internet to a virtual machine named VM1. The solution must minimize the attack surface of VM1. To complete this task, sign in to the Azure portal.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
It should JIT or bastion but JIT allow to reduce the attack surface more than Azure Bastion. Creating just a network rules which allow inbound RDP from internet does not reduce the attack surface
Source: Adapted from community discussion — Strive_for_greatness_kc
SIMULATION - You need to ensure that only devices connected to a 131.107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account. To complete this task, sign in to the Azure portal.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
ign in to the Azure portal. Navigate to your rg1lod28681041 Azure Storage account. In the left-hand menu, under Security + networking, click on Firewalls and virtual networks. In the Firewalls and virtual networks pane, select the Selected networks option under Allow access from. Under Virtual networks, click on Add existing virtual network. Select the virtual network that contains your 131.107.0.0/16 subnet. In the Subnet section, select your 131.107.0.0/16 subnet and then click Add. Click Save at the top of the Firewalls and virtual networks pane to apply your changes.
Source: Adapted from community discussion — mrt007
HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.
You create a shared access token as shown in the following exhibit.
Which resources can you access by using the shared access token and Key1? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
CORRECT. THE SAS TOKEN ARE CREATED AGAINST THE STORAGE ACCT'S KEY. -FOR THIS EXAMPLE ONLY CONTAINER 1 N FILE SHARE 1 IS HOSTED IN THE SA. --STILL, THE SAS IS BEING CREATED FOR THE CONTAINER WHICH WILL NOT INCLUDE THE FILE SHARE, THEREFORE, THE SAS WILL ONLY ALLOW ACCESS TO THE CONTAINER. THE KEY WILL ALLOW YOU TO ACCESS ANY TYPE OF STORAGE IN THE SA. THIS INCLUDES BOTH THE CONTAINERS N FILE SHARES. SO CON1 N FS1 CAN BE ACCESSED WITH KEY1. THE OTHER ITEMS BELONG TO ANOTHER SA ENTIRELY.
Source: Adapted from community discussion — heatfan900
You need to recommend which virtual machines to use to host App1. The solution must meet the technical requirements for KeyVault1. Which virtual machines should you use?
Answer: B
It's B guys. All VMs can access KV1 through private endpoint in VNET1/Subnet1. All VNETs are peered, so all the traffic traverse Microsoft backbone network without any exposure to public Internet. The private endpoint can be reached from the same virtual network, regionally peered VNets, globally peered VNets and on premises using private VPN or ExpressRoute connections. https://docs.microsoft.com/en-us/azure/private-link/private-link-service-overview The traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure. Like traffic between virtual machines in the same network, traffic is routed through Microsoft's private network only. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview
Source: Adapted from community discussion — kjloc
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
AZ-500 practice, question 471. 496 questions available.
Version 1.0.0. How we source questions