An organization uses Azure API Management to expose backend APIs. They need to secure client-to-API Management communication using TLS. Which component in API Management is responsible for terminating TLS from clients?

The frontend (client-facing) endpoint's TLS certificate

The Azure Application Gateway in front of API Management

The developer portal's SSL configuration

The backend API's TLS certificate

A company has a hub-and-spoke network with Azure Firewall in the hub. They want to protect a web app in a spoke VNet from SQL injection and also filter traffic between the web app and the internet. They already have an Application Gateway with WAF in the spoke. What should they do to ensure all traffic goes through the firewall?

Use Network Security Groups in the spoke to force traffic through the firewall

Deploy a second Azure Firewall in the spoke VNet and disable the WAF on the Application Gateway

Route all traffic through the Application Gateway and use Azure Firewall only for management traffic

Configure forced tunneling on the spoke VNet to route internet-bound traffic through the Azure Firewall, and keep the WAF on the Application Gateway

A company has a web application behind Azure Front Door. They want to block requests from specific IP addresses and also enforce TLS 1.2 or higher. What should they configure?

Use Azure CDN to block IPs and set TLS version.

Configure a WAF policy with IP restriction rules and set the minimum TLS version on Front Door.

Configure an NSG on the backend to block IPs and enable HTTPS Only.

Use Azure Firewall to block IP addresses and set TLS version on the backend.

You are configuring an Azure Application Gateway to load balance traffic to a set of virtual machines. What is the purpose of a backend pool in this configuration?

It stores the TLS certificates for the gateway

It defines the health probe interval for the gateway

It specifies the public IP address of the gateway

It defines the set of servers that receive traffic from the gateway

Microsoft Certified:Azure Security Engineer Associate

Domain 2Objective 3

Plan and Implement Security for Public Access to Azure Resources AZ-500 Practice Questions (Page 5)

Part of the Secure networking domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

20–25%of the exam

Questions 21–25

21foundation · easy
An organization uses Azure API Management to expose backend APIs. They need to secure client-to-API Management communication using TLS. Which component in API Management is responsible for terminating TLS from clients?
Select an answer first
22expert · hard
A company has a hub-and-spoke network with Azure Firewall in the hub. They want to protect a web app in a spoke VNet from SQL injection and also filter traffic between the web app and the internet. They already have an Application Gateway with WAF in the spoke. What should they do to ensure all traffic goes through the firewall?
Select an answer first
23application · medium
A company has a web application behind Azure Front Door. They want to block requests from specific IP addresses and also enforce TLS 1.2 or higher. What should they configure?
Select an answer first
24foundation · easy
A security team wants to centrally manage firewall policies across multiple Azure Firewall instances in different regions. Which Azure service should they use to create and apply firewall policies consistently?
Select an answer first
25foundation · easy
You are configuring an Azure Application Gateway to load balance traffic to a set of virtual machines. What is the purpose of a backend pool in this configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.

Plan and Implement Security for Public Access to Azure Resources AZ-500 Practice Questions (Page 5)

Questions 21–25

An organization uses Azure API Management to expose backend APIs. They need to secure client-to-API Management communication using TLS. Which component in API Management is responsible for terminating TLS from clients?

A company has a web application behind Azure Front Door. They want to block requests from specific IP addresses and also enforce TLS 1.2 or higher. What should they configure?

A security team wants to centrally manage firewall policies across multiple Azure Firewall instances in different regions. Which Azure service should they use to create and apply firewall policies consistently?

You are configuring an Azure Application Gateway to load balance traffic to a set of virtual machines. What is the purpose of a backend pool in this configuration?

Keep studying — Secure networking