Plan and Implement Security for Virtual Networks AZ-500 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which Azure resource is required to deploy a VPN gateway in a virtual network?

   • AAn Azure Firewall in the same virtual network
   • BA Network Security Group on the gateway subnet
   • CA route table associated with the gateway subnet
   • DA dedicated subnet named GatewaySubnet
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   You need to monitor the network traffic of a VM to identify which IP addresses are communicating with it and on which ports. You want to use a Network Watcher feature that provides this information. What should you use?

   • AUse IP flow verify to check specific traffic flows.
   • BEnable NSG flow logs and view them in Log Analytics.
   • CUse connection monitor to monitor connectivity between two resources.
   • DUse Azure Monitor metrics for the VM's network interface.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are troubleshooting a connectivity issue where a VM cannot reach the internet. You have verified that the VM has a public IP and that the NSG allows outbound traffic. You suspect a routing issue. Which Network Watcher tool should you use to confirm the next hop for the traffic?

   • APacket capture
   • BNext hop
   • CConnection troubleshoot
   • DIP flow verify
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   You have a hub-and-spoke topology with an Azure Firewall in the hub. Spoke VNets are peered to the hub. You need to force all outbound internet traffic from spoke VMs to go through the firewall, but you also need to ensure that traffic between spoke VMs in the same VNet does NOT go through the firewall. You have created a route table with a default route (0.0.0.0/0) to the firewall and associated it with the spoke subnets. What else must you do to meet the requirement?

   • AAssociate the route table to the firewall subnet as well.
   • BAdd a more specific route for the spoke VNet address space with next hop type Virtual network to the route table.
   • CAdd a route for the hub VNet address space with next hop type Virtual network gateway.
   • DDisable BGP route propagation on the route table.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of a Network Security Group (NSG) in Azure?

   • ATo filter inbound and outbound traffic to and from Azure resources based on security rules
   • BTo encrypt data stored in Azure Blob Storage
   • CTo route traffic between virtual networks and on-premises networks
   • DTo provide a dedicated private IP address for a virtual machine
   Reveal Solution Discussion Select an answer first