Plan and Implement Security for Private Access to Azure Resources AZ-500 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   Contoso has an Azure SQL Database that must be reachable only from a specific subnet in their production virtual network. They do not need to connect from on-premises or from peered networks. Which configuration should they implement?

   • AEnable a service endpoint for Microsoft.Sql on the subnet and add a virtual network rule on the SQL server.
   • BAssign a public IP address to the SQL server and create a firewall rule allowing the subnet's IP range.
   • CAdd the SQL server to a subnet with a network security group that denies all inbound traffic.
   • DCreate a private endpoint for the SQL server and disable public network access.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is deploying an App Service Environment (ASE) v3 for a highly sensitive application. The application must not be reachable from the public internet. The ASE is deployed in a VNet. What should you configure to ensure the application is only accessible from within the VNet?

   • AEnable VNet Integration on the ASE to restrict access.
   • BCreate a private endpoint for the ASE and disable public network access.
   • CConfigure the ASE with an internal load balancer (ILB) and do not assign a public IP.
   • DUse an NSG on the ASE subnet to deny all inbound traffic from the internet.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which Azure service is used to create a private endpoint for a PaaS service like Azure Storage?

   • AAzure Application Gateway
   • BAzure VPN Gateway
   • CAzure Private Link
   • DAzure Front Door
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has an Azure App Service app that needs to access an Azure Storage account. The storage account is configured to allow access only from a private endpoint in the same VNet. The App Service app is on a Premium v3 plan and has VNet Integration enabled to a subnet in that VNet. However, the app cannot connect to the storage account. What is the most likely cause?

   • AThe VNet Integration subnet does not have a service endpoint for Microsoft.Storage enabled.
   • BThe App Service app's outbound traffic is not routed through the VNet Integration subnet because the app is using a public endpoint for the storage account.
   • CThe App Service plan does not support VNet Integration.
   • DThe storage account's private endpoint is in a different VNet than the VNet Integration subnet.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a key security benefit of deploying an App Service Environment into a virtual network?

   • AIt automatically encrypts all data at rest
   • BIt provides a public IP address for each app
   • CIt eliminates the need for network security groups
   • DIt allows the apps to be accessed only from within the virtual network or through a VPN/ExpressRoute
   Reveal Solution Discussion Select an answer first