Plan and Implement Security for Private Access to Azure Resources AZ-500 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is deploying an App Service Environment (ASE) v3. They need to ensure that the ASE can access an Azure SQL Database that is configured to allow only virtual network traffic. What should they configure?

   • AEnable a service endpoint for Microsoft.Sql on the ASE subnet and add a virtual network rule on the SQL server.
   • BCreate a private endpoint for the SQL database and connect it to the ASE.
   • CUse the ASE's outbound IP addresses in the SQL firewall.
   • DConfigure a UDR on the ASE subnet to route traffic to the SQL database.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has an Azure SQL Managed Instance (MI) in a VNet. A separate application subnet in the same VNet needs to connect to the MI. The MI's NSG currently allows all inbound traffic. The security team wants to restrict access to only the application subnet. What should you do?

   • ACreate a private endpoint for the MI in the application subnet.
   • BEnable a service endpoint for Microsoft.Sql on the application subnet.
   • CConfigure the MI's firewall to allow only the application subnet's IP range.
   • DAdd an NSG rule to the MI's subnet that denies inbound traffic from all sources except the application subnet.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of a virtual network service endpoint in Azure?

   • ATo extend the virtual network identity to Azure services, allowing traffic to be secured to the virtual network
   • BTo assign a public IP address to a virtual machine for internet access
   • CTo encrypt all traffic between virtual machines and the internet
   • DTo create a private IP address for an Azure service within the virtual network
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of an Azure Private Link Service?

   • ATo provide a public endpoint for a custom application
   • BTo expose a custom service hosted behind a standard load balancer to consumers via private endpoints
   • CTo load balance traffic between multiple virtual machines
   • DTo connect a virtual network to an on-premises data center
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is deploying an Azure SQL Managed Instance. They need to ensure that the instance is only accessible from a specific virtual network and not from the public internet. What should they do?

   • ADeploy the managed instance inside a delegated subnet and do not assign a public endpoint.
   • BEnable a service endpoint for Microsoft.Sql on the subnet where the managed instance is deployed.
   • CCreate a private endpoint for the managed instance and disable public network access.
   • DConfigure the managed instance's firewall to allow only the virtual network's IP range.
   Reveal Solution Discussion Select an answer first