A company is deploying Azure Firewall in a hub network. They want to ensure that all outbound traffic from a spoke network goes through the firewall. They also want to protect the firewall itself from DDoS attacks. What should they do?

Use Azure Firewall Manager to propagate routes and enable DDoS Protection on the virtual network.

Enable Azure Firewall's built-in DDoS protection.

Configure a route table on the spoke subnet with the firewall as the next hop, and enable DDoS Protection Standard on the firewall's public IP.

Configure an NSG on the spoke subnet to force traffic to the firewall.

A company wants to filter inbound internet traffic to a web app and also block SQL injection attempts. They are considering Azure Firewall and WAF. What should they implement?

Deploy WAF on Application Gateway only and use NSGs for network filtering

Deploy Azure Firewall and WAF on the same Application Gateway

Deploy Azure Firewall only and enable SQL injection rules in the firewall policy

Deploy Azure Firewall for network filtering and enable WAF on the Application Gateway in front of the app

A global company wants to use Azure Front Door to route traffic to different backends based on the geographic location of the user. They also want to protect the application from common web attacks. What should they configure?

Use Azure Application Gateway with path-based routing and WAF.

Configure Azure CDN with geographic filtering and enable WAF.

Configure a routing rule with a geographic-based traffic routing method and enable WAF policy.

Use Azure Traffic Manager with geographic routing and enable WAF on the backend.

A web application is vulnerable to SQL injection attacks. Which Azure service can be deployed in front of the application to inspect and block malicious SQL injection payloads?

Azure Web Application Firewall (WAF)

Azure Network Security Group (NSG)

Microsoft Certified:Azure Security Engineer Associate

Domain 2Objective 3

Plan and Implement Security for Public Access to Azure Resources AZ-500 Practice Questions (Page 4)

Part of the Secure networking domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

20–25%of the exam

Questions 16–20

16application · medium
A company is deploying Azure Firewall in a hub network. They want to ensure that all outbound traffic from a spoke network goes through the firewall. They also want to protect the firewall itself from DDoS attacks. What should they do?
Select an answer first
17foundation · easy
A company wants to route HTTP traffic to different backend pools based on the URL path (e.g., /images to one pool and /api to another). Which feature of Azure Application Gateway should be used?
Select an answer first
18application · medium
A company wants to filter inbound internet traffic to a web app and also block SQL injection attempts. They are considering Azure Firewall and WAF. What should they implement?
Select an answer first
19application · medium
A global company wants to use Azure Front Door to route traffic to different backends based on the geographic location of the user. They also want to protect the application from common web attacks. What should they configure?
Select an answer first
20foundation · easy
A web application is vulnerable to SQL injection attacks. Which Azure service can be deployed in front of the application to inspect and block malicious SQL injection payloads?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.