Plan and Implement Security for Private Access to Azure Resources AZ-500 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A company is deploying an App Service Environment (ASE) v3. They have a requirement that all outbound traffic from the ASE must go through a network virtual appliance (NVA) for inspection. They also need to ensure that the ASE can access an Azure SQL Database that is configured to allow only virtual network traffic. What should they do?

   • AUse the ASE's outbound IP addresses in the SQL firewall.
   • BCreate a private endpoint for the SQL database and route traffic through the NVA.
   • CConfigure a user-defined route (UDR) on the ASE subnet to route outbound traffic through the NVA, and enable a service endpoint for Microsoft.Sql on the ASE subnet.
   • DConfigure an NSG on the ASE subnet to allow only the NVA's IP address.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When you enable a service endpoint on a subnet, what happens to the source IP address of traffic from that subnet to the Azure service?

   • AIt remains the same public IP address of the virtual machine
   • BIt is replaced with the public IP address of the Azure service
   • CIt is changed to the virtual network's private IP address space
   • DIt is hidden from the Azure service entirely
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has an Azure App Service app that needs to access an Azure SQL Database. The app is on a public App Service plan and has VNet Integration enabled to a subnet. The SQL Database has a private endpoint in the same VNet. The app cannot connect to the database. The database's private endpoint is in a different subnet than the VNet Integration subnet. What is the most likely cause?

   • AThe VNet Integration subnet does not have a service endpoint for Microsoft.Sql enabled.
   • BThe private endpoint is in a different VNet than the VNet Integration subnet.
   • CThe app is using the database's public hostname instead of the private endpoint's FQDN.
   • DThe App Service plan does not support VNet Integration.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A company has an Azure Storage account that is accessed by both a virtual machine in a subnet and an on-premises application via a site-to-site VPN. The storage account must be accessible only from the virtual network and on-premises. Which solution should they implement?

   • AConfigure the storage account firewall to allow the VPN gateway's public IP.
   • BEnable a service endpoint for Microsoft.Storage on the subnet and add a virtual network rule.
   • CUse Azure Front Door with a private endpoint to the storage account.
   • DCreate a private endpoint for the storage account and configure a private DNS zone.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company is moving a legacy application to Azure. The application must connect to an Azure Storage account without using the public internet. The storage account must remain accessible from on-premises via a private connection. Which solution should they implement?

   • AEnable a service endpoint for Microsoft.Storage on the subnet.
   • BUse Azure Bastion to connect to the storage account from on-premises.
   • CConfigure the storage account firewall to allow only the virtual network's public IP range.
   • DCreate a private endpoint for the storage account and configure a private DNS zone.
   Reveal Solution Discussion Select an answer first