A company has a hub-and-spoke network with an Azure Firewall in the hub. They want to allow outbound HTTPS traffic from a specific subnet to a specific external IP address only. They also want to log all traffic for auditing. What should they configure?

A route table entry that directs traffic to the firewall and an NSG rule.

A network rule in Azure Firewall that allows HTTPS to the specific IP address, and enable diagnostic logs.

An application rule in Azure Firewall that allows HTTPS to the specific FQDN.

A company has a public web app on Azure VMs. They need to protect it from DDoS attacks, block SQL injection, and distribute traffic across multiple VMs. They have a limited budget and want to minimize the number of services. They also need TLS termination. What should you recommend?

Deploy Azure Front Door with WAF and enable DDoS Protection Standard on the Front Door profile

Deploy Azure Firewall with WAF and enable DDoS Protection Standard on the VNet

Deploy Azure Application Gateway with WAF enabled and enable DDoS Protection Standard on the VNet

Deploy Azure Load Balancer with WAF and enable DDoS Protection Standard on the VNet

A media company wants to deliver video content to users globally with low latency. They plan to use Azure Front Door for global load balancing and caching. They are also concerned about DDoS attacks on their origin. What should they do to protect the origin?

Enable Azure DDoS Protection Standard on the origin's public IP.

Use Azure Firewall on the origin.

Restrict access to the origin using an NSG.

Configure a WAF policy on Front Door.

Microsoft Certified:Azure Security Engineer Associate

Domain 2Objective 3

Plan and Implement Security for Public Access to Azure Resources AZ-500 Practice Questions (Page 2)

Part of the Secure networking domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

20–25%of the exam

Questions 6–10

6application · medium
A company has a hub-and-spoke network with an Azure Firewall in the hub. They want to allow outbound HTTPS traffic from a specific subnet to a specific external IP address only. They also want to log all traffic for auditing. What should they configure?
Select an answer first
7foundation · easy
You need to route users to the nearest available backend based on their geographic location. Which routing method in Azure Front Door should you use?
Select an answer first
8expert · hard
A company has a public web app on Azure VMs. They need to protect it from DDoS attacks, block SQL injection, and distribute traffic across multiple VMs. They have a limited budget and want to minimize the number of services. They also need TLS termination. What should you recommend?
Select an answer first
9application · medium
A global e-commerce company wants to improve performance for users worldwide by caching static content at edge locations and also provide global load balancing across multiple Azure regions. They also require TLS termination at the edge. Which Azure service should they use?
Select an answer first
10application · medium
A media company wants to deliver video content to users globally with low latency. They plan to use Azure Front Door for global load balancing and caching. They are also concerned about DDoS attacks on their origin. What should they do to protect the origin?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Public Access to Azure Resources AZ-500 Practice Questions (Page 2)

Questions 6–10

A company has a hub-and-spoke network with an Azure Firewall in the hub. They want to allow outbound HTTPS traffic from a specific subnet to a specific external IP address only. They also want to log all traffic for auditing. What should they configure?

You need to route users to the nearest available backend based on their geographic location. Which routing method in Azure Front Door should you use?

A company has a public web app on Azure VMs. They need to protect it from DDoS attacks, block SQL injection, and distribute traffic across multiple VMs. They have a limited budget and want to minimize the number of services. They also need TLS termination. What should you recommend?

A global e-commerce company wants to improve performance for users worldwide by caching static content at edge locations and also provide global load balancing across multiple Azure regions. They also require TLS termination at the edge. Which Azure service should they use?

A media company wants to deliver video content to users globally with low latency. They plan to use Azure Front Door for global load balancing and caching. They are also concerned about DDoS attacks on their origin. What should they do to protect the origin?

Keep studying — Secure networking