Plan and Implement Security for Virtual Networks AZ-500 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In an NSG rule, how do you specify an Application Security Group as the destination?

   • ABy entering the ASG's resource ID in the Destination IP addresses field
   • BBy selecting 'Application Security Group' as the destination type and choosing the ASG
   • CBy assigning the ASG to the subnet and using the subnet as the destination
   • DBy using the ASG's name as a fully qualified domain name
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a requirement for establishing virtual network peering?

   • AThe virtual networks must have non-overlapping address spaces
   • BBoth virtual networks must be in the same subscription
   • CEach virtual network must have a VPN gateway
   • DBoth virtual networks must be in the same Azure region
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You have an Azure Firewall in a hub VNet. You need to allow outbound HTTPS traffic from a specific subnet to a specific FQDN, but deny all other outbound traffic from that subnet. What should you configure?

   • AAn Azure Firewall network rule that allows HTTPS to the FQDN's IP address.
   • BAn NSG on the subnet that allows HTTPS to the FQDN and denies all other outbound traffic.
   • CA UDR that routes all traffic from the subnet to the firewall, and then rely on the firewall's default rules.
   • DAn Azure Firewall application rule that allows HTTPS to the FQDN, and a network rule that denies all other outbound traffic.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of virtual network peering?

   • ATo provide a VPN connection between Azure and an on-premises network
   • BTo connect two virtual networks so that resources in them can communicate privately
   • CTo create a hub-and-spoke topology automatically
   • DTo filter traffic between virtual networks
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   You have a hub-and-spoke topology with Azure Firewall in the hub. You need to ensure that traffic between two spoke VNets (Spoke-A and Spoke-B) is inspected by the firewall. You have already peered both spokes to the hub. What else must you configure?

   • AAn Azure Virtual Network Manager security admin rule that blocks direct traffic between the spokes.
   • BNSGs on the spoke subnets that deny direct traffic between the spokes.
   • CUDRs on both spoke subnets that route traffic destined for the other spoke's address space to the firewall's private IP.
   • DA VNet peering between Spoke-A and Spoke-B to enable direct connectivity.
   Reveal Solution Discussion Select an answer first