Plan and Implement Advanced Security for Compute AZ-500 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of deploying Azure Bastion in a virtual network?

   • ATo filter inbound and outbound network traffic to VMs using network security groups
   • BTo provide secure RDP and SSH access to VMs without exposing them to the public internet
   • CTo load balance traffic across multiple virtual machines
   • DTo provide a site-to-site VPN connection between on-premises networks and Azure
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An organization wants to provide secure RDP and SSH access to Azure VMs without assigning public IP addresses to the VMs. Which Azure service should be deployed to meet this requirement?

   • AAzure VPN Gateway
   • BAzure Application Gateway
   • CAzure Front Door
   • DAzure Bastion
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In Azure Kubernetes Service (AKS), which resource is used to define rules that control traffic between pods?

   • AAzure Active Directory pod identity
   • BNetwork policy
   • CIngress controller
   • DPod security policy
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   Your company exposes a public API through Azure API Management (APIM). You need to protect the API from DDoS attacks and from unauthorized access. You also want to restrict access to the APIM endpoint to only the company's partner organizations. What should you do?

   • AEnable DDoS Protection on the APIM VNet and configure IP-based access restriction policies on the API.
   • BUse APIM's built-in rate limiting and quota policies to prevent abuse.
   • CConfigure APIM to require a subscription key and distribute the key to partners.
   • DDeploy Azure Application Gateway with a WAF in front of APIM.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company has a VM that stores sensitive customer data on its OS and data disks. The compliance team requires that all data at rest be encrypted, and they want to avoid any dependency on Azure Key Vault for key management. The VM is accessed only via Azure Bastion. What should you implement to encrypt the disks?

   • AUse Azure Storage Service Encryption for the managed disks
   • BUse confidential disk encryption with a confidential VM
   • CEnable Azure Disk Encryption with a Key Encryption Key
   • DEnable encryption at host on the VM
   Reveal Solution Discussion Select an answer first