You need to connect your on-premises network to Azure using a site-to-site VPN. You want to ensure that the VPN connection is resilient to a single device failure. What should you configure?

Use ExpressRoute instead of VPN for redundancy.

Use an active-passive VPN gateway with a single on-premises VPN device.

Use an active-active VPN gateway with two on-premises VPN devices.

Use a single VPN gateway and a single on-premises VPN device.

Your organization is planning to use Azure Virtual WAN to connect multiple branch offices and VNets. You need to ensure that traffic between branches and VNets is inspected by Azure Firewall. You also need to minimize the number of firewall instances. What should you do?

Deploy a single Azure Firewall in one region and route all traffic from all branches and VNets to that firewall.

Use NSGs on all VNets to inspect traffic instead of Azure Firewall.

Deploy a secured virtual hub with Azure Firewall in each region where you have branches or VNets, and route traffic through the hub.

Use VNet peering to connect all VNets and branches directly, and deploy Azure Firewall in each VNet.

You have an Azure Firewall deployed in a hub VNet. You need to ensure that all outbound traffic from a spoke VNet goes through the firewall for inspection, and that no traffic can bypass it. What should you configure?

A UDR on the spoke subnet with the firewall's private IP as the next hop for all outbound traffic.

An NSG on the spoke subnet that denies all outbound traffic except to the firewall.

An Azure Virtual Network Manager security admin rule that routes all traffic to the firewall.

A VNet peering between the spoke and hub VNets with the firewall as the next hop.

What is the primary difference between point-to-site (P2S) and site-to-site (S2S) VPN connections in Azure?

P2S connects individual client computers to Azure, while S2S connects an entire on-premises network to Azure

P2S requires a VPN gateway, while S2S does not

P2S is used for testing, while S2S is used for production

P2S uses IPsec, while S2S uses SSL/TLS

Which Azure resources can an NSG be associated with to filter traffic?

Storage accounts and SQL databases

Virtual machines and virtual networks

Resource groups and subscriptions

Microsoft Certified:Azure Security Engineer Associate

Domain 2Objective 1

Plan and Implement Security for Virtual Networks AZ-500 Practice Questions (Page 7)

Part of the Secure networking domain, which accounts for 20–25% of the AZ-500 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

11concepts

20–25%of the exam

Questions 31–35

31application · medium
You need to connect your on-premises network to Azure using a site-to-site VPN. You want to ensure that the VPN connection is resilient to a single device failure. What should you configure?
Select an answer first
32expert · hard
Your organization is planning to use Azure Virtual WAN to connect multiple branch offices and VNets. You need to ensure that traffic between branches and VNets is inspected by Azure Firewall. You also need to minimize the number of firewall instances. What should you do?
Select an answer first
33application · medium
You have an Azure Firewall deployed in a hub VNet. You need to ensure that all outbound traffic from a spoke VNet goes through the firewall for inspection, and that no traffic can bypass it. What should you configure?
Select an answer first
34foundation · easy
What is the primary difference between point-to-site (P2S) and site-to-site (S2S) VPN connections in Azure?
Select an answer first
35foundation · easy
Which Azure resources can an NSG be associated with to filter traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to AZ-500

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-500” is a trademark of its owner, used for identification only.