Plan and Implement Security for Private Access to Azure Resources AZ-500 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A SaaS provider has a Private Link service that exposes an application behind a Standard Load Balancer. A customer has created a private endpoint in their VNet and requested a connection. The provider wants to automatically approve all connections from that customer's subscription but reject connections from other subscriptions. What should they configure?

   • APeer the customer's VNet to the provider's VNet and use NSG rules.
   • BConfigure the Private Link service's access control to allow the customer's subscription and set the connection approval method to automatic.
   • CUse Azure Policy to approve all connections from the customer's subscription.
   • DCreate a private endpoint for the customer's subscription and approve it manually.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A software vendor hosts a multi-tenant SaaS application on Azure VMs. They want to allow customers to connect to the application privately from their own virtual networks, without exposing the VMs to the internet. What should the vendor implement?

   • ACreate a service endpoint on the vendor's subnet and share the subnet ID with customers.
   • BUse VNet peering between the vendor and each customer's virtual network.
   • CAssign public IPs to the VMs and configure NSG rules to allow only customer IP ranges.
   • DDeploy an Azure Private Link service in front of the VMs and have customers create private endpoints in their own virtual networks.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has an Azure SQL Managed Instance (MI) in a VNet. They need to allow an on-premises application to connect to the MI through a site-to-site VPN. The on-premises network is connected to the VNet. The MI's subnet NSG currently allows all inbound traffic. What should you configure to ensure the on-premises application can connect?

   • AUse Azure Bastion to proxy the connection from on-premises to the MI.
   • BCreate a private endpoint for the MI in the on-premises network.
   • CEnsure the on-premises network can route to the MI's private IP through the VPN and that the MI's NSG allows inbound traffic from the on-premises IP range.
   • DEnable a service endpoint for Microsoft.Sql on the VPN gateway subnet.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which Azure resource must be associated with an Azure Private Link Service to provide the backend for the service?

   • AAzure Standard Load Balancer
   • BAzure Application Gateway
   • CAzure Front Door
   • DAzure Traffic Manager
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has an App Service Environment (ASE) v3 with an internal load balancer (ILB). The ASE is in a spoke VNet that is peered to a hub VNet. The hub VNet has an Azure Firewall. The security team requires that all outbound traffic from the ASE go through the Azure Firewall for inspection. What should you configure?

   • ACreate a private endpoint for the Azure Firewall and route traffic through it.
   • BConfigure an NSG on the ASE subnet to allow outbound traffic only to the firewall's IP.
   • CEnable VNet Integration on the ASE to route traffic through the firewall.
   • DAdd a user-defined route (UDR) on the ASE subnet that sends all outbound traffic to the Azure Firewall's private IP.
   Reveal Solution Discussion Select an answer first