Plan and Implement Security for Private Access to Azure Resources AZ-500 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A company has an Azure App Service app that needs to access an Azure SQL Database. The security policy requires that the app's outbound traffic to the database use a private IP address from the company's VNet. The app is currently on the public App Service plan. What should you configure?

   • ACreate a service endpoint for Microsoft.Sql on the App Service subnet and configure the SQL firewall to allow the service endpoint.
   • BDeploy the app in an App Service Environment (ASE) and use a service endpoint for Microsoft.Sql.
   • CEnable VNet Integration on the App Service app and create a private endpoint for the SQL Database in the integrated subnet.
   • DConfigure an NSG on the App Service subnet to allow outbound traffic to the SQL Database's public IP.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the purpose of regional virtual network integration for Azure App Service?

   • ATo expose the App Service to the internet through a public IP address
   • BTo allow the App Service to access resources in a virtual network using private IP addresses
   • CTo assign a private IP address to the App Service for inbound traffic
   • DTo create a VPN connection between the App Service and on-premises networks
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   Contoso has an Azure Storage account that must be accessible only from a specific virtual network (VNet) subnet. The subnet already has a service endpoint for Microsoft.Storage enabled. A developer reports that a VM in that subnet can access the storage account, but a VM in another subnet in the same VNet cannot. You need to enforce the intended access restriction. What should you do?

   • AAssign a route table to the specific subnet to force traffic to the storage account through the firewall.
   • BConfigure the storage account firewall to allow access only from the specific subnet's service endpoint.
   • CEnable the service endpoint on the other subnet as well.
   • DAdd a private endpoint for the storage account in the specific subnet.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A company has a legacy application running on Azure VMs behind a Standard Load Balancer. They want to expose this application to a specific customer via Private Link. The customer's virtual network is in a different Azure region. What should they consider?

   • AThe company must deploy a Private Link service in each region where customers are located.
   • BThe customer must deploy a private endpoint in the same region as the Private Link service.
   • CThe customer can create a private endpoint in their own virtual network, and Private Link will route traffic across regions.
   • DThe customer must use a VPN gateway to connect to the company's virtual network.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial institution is deploying an App Service Environment (ASE) v3 for a sensitive application. They require that all inbound traffic to the application be filtered by a network virtual appliance (NVA) before reaching the ASE. What should they configure?

   • AEnable service endpoints on the ASE subnet for all Azure services.
   • BPlace the ASE in a subnet and route inbound traffic through an NVA using a user-defined route (UDR) on the subnet.
   • CConfigure an NSG on the ASE subnet to allow only the NVA's IP address.
   • DUse Azure Front Door with Web Application Firewall (WAF) in front of the ASE.
   Reveal Solution Discussion Select an answer first