Microsoft AZ-500 Practice Test 26
Question 250
A VM is reachable on a sensitive management port because an earlier matching NSG rule permits traffic. A review identifies this consequence: A lower-priority number Allow can render a later Deny ineffective. Which remediation most directly restores the intended behavior?
- The controlled remediation is to use a route table as a replacement for a matching inbound NSG deny.
- The controlled remediation is to add the intended Deny at a larger numeric priority than the current broad Allow.
- The controlled remediation is to change an ASG display name to alter NSG evaluation order.
- The controlled remediation is to apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
Explanation
Correct Answer
D:Test using these records: Effective NSG rules, source and destination, direction, port and evaluated priority. Network security group rules are processed from lower numeric priority to higher until a matching rule is found.
Incorrect Answers
A:Use a route table as a replacement for a matching inbound NSG deny. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
B:Add the intended Deny at a larger numeric priority than the current broad Allow. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
C:Change an ASG display name to alter NSG evaluation order. This would not reliably restore the intended security boundary. A lower-priority number Allow can render a later Deny ineffective. The appropriate controlled recovery is: Apply a narrowly scoped deny or allow ordering and validate the effective flow evaluation.
Question 251
A VM NIC NSG permits RDP but the subnet NSG denies it and the operator assumes one permit suffices. Which configuration decision MOST directly resolves the issue?
- Delete every NSG on the virtual network because a single permit did not work.
- Assume NIC NSG permissions always override an explicit subnet deny.
- Disable network monitoring to avoid recording denied flows.
- Check both associated NSGs and correct the relevant blocking rule without weakening other protections.
Explanation
Correct Answer
D:Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Confirm the change against these records: Subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
Incorrect Answers
A:Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. Delete every NSG on the virtual network because a single permit did not work.
B:That option would assume NIC NSG permissions always override an explicit subnet deny, but it addresses a different concern. Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow.
C:Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. The intended action is: Check both associated NSGs and correct the relevant blocking rule without weakening other protections.
Question 252
A VM NIC NSG permits RDP but the subnet NSG denies it and the operator assumes one permit suffices. What evidence most directly confirms the intended security behavior?
- A public DNS response that does not show the intended private service path.
- Subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
- A static virtual network diagram with no effective route or packet observation.
- A healthy network interface without the evaluated NSG, route or private endpoint.
Explanation
Correct Answer
B:These records test the actual subnet and NIC NSG combined enforcement behavior rather than an unrelated dashboard state. Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
D:On its own, that evidence does not prove the specified security control works. In the given case, a VM NIC NSG permits RDP but the subnet NSG denies it and the operator assumes one permit suffices.
Question 253
A VM NIC NSG permits RDP but the subnet NSG denies it and the operator assumes one permit suffices. Which security principle best explains the intended decision?
- Creating a virtual network peering link makes all other Azure VNets transitively reachable.
- Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- Successful public name resolution proves that all traffic uses Private Link.
Explanation
Correct Answer
B:This principle supports the security response: Check both associated NSGs and correct the relevant blocking rule without weakening other protections. Confirmation depends on Subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
Incorrect Answers
A:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for subnet and NIC NSG combined enforcement. The relevant security behavior is: Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Check evidence such as subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
C:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for subnet and NIC NSG combined enforcement. The relevant security behavior is: Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Check evidence such as subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
D:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for subnet and NIC NSG combined enforcement. The relevant security behavior is: Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Check evidence such as subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
Question 254
A VM NIC NSG permits RDP but the subnet NSG denies it and the operator assumes one permit suffices. Suppose the operator instead follows this unsafe shortcut: Delete every NSG on the virtual network because a single permit did not work. Which resulting risk or fault should the reviewer identify?
- Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association.
- The investigation itself created the pre-existing private DNS or route mismatch.
- The failure consists only of retaining valid network flow logs.
- A VNet diagram label alone explains the blocked or uninspected traffic.
Explanation
Correct Answer
A:Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. The suitable control is: Check both associated NSGs and correct the relevant blocking rule without weakening other protections.
Incorrect Answers
B:This does not explain the real subnet and NIC NSG combined enforcement weakness after the shortcut. The material failure is: Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association.
C:This does not explain the real subnet and NIC NSG combined enforcement weakness after the shortcut. Inspect evidence such as subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
D:This does not explain the real subnet and NIC NSG combined enforcement weakness after the shortcut. In the given case, a VM NIC NSG permits RDP but the subnet NSG denies it and the operator assumes one permit suffices.
Question 255
A VM NIC NSG permits RDP but the subnet NSG denies it and the operator assumes one permit suffices. A review identifies this consequence: Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. Which remediation most directly restores the intended behavior?
- Fix the intended scoped policy and retest effective access across both NSGs.
- Assume NIC NSG permissions always override an explicit subnet deny.
- Disable network monitoring to avoid recording denied flows.
- Delete every NSG on the virtual network because a single permit did not work.
Explanation
Correct Answer
A:Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Assume NIC NSG permissions always override an explicit subnet deny. This would not reliably restore the intended security boundary. Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. The appropriate controlled recovery is: Fix the intended scoped policy and retest effective access across both NSGs.
C:Disable network monitoring to avoid recording denied flows. This would not reliably restore the intended security boundary. Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. The appropriate controlled recovery is: Fix the intended scoped policy and retest effective access across both NSGs.
D:Delete every NSG on the virtual network because a single permit did not work. This would not reliably restore the intended security boundary. Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. The appropriate controlled recovery is: Fix the intended scoped policy and retest effective access across both NSGs.
Question 256
A subnet security rule allows a web service while the VM NIC has a more restrictive inbound NSG rule. Which operator action best meets this technical requirement?
- For this Azure workload, the team should assume NIC NSG permissions always override an explicit subnet deny.
- For this Azure workload, the team should disable network monitoring to avoid recording denied flows.
- For this Azure workload, the team should delete every NSG on the virtual network because a single permit did not work.
- For this Azure workload, the team should check both associated NSGs and correct the relevant blocking rule without weakening other protections.
Explanation
Correct Answer
D:Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. This directly addresses subnet and NIC NSG combined enforcement.
Incorrect Answers
A:Assume NIC NSG permissions always override an explicit subnet deny. The proposed change targets the wrong mechanism or lacks essential validation. Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Relevant evidence is subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
B:Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association.
C:Delete every NSG on the virtual network because a single permit did not work.
Question 257
A subnet security rule allows a web service while the VM NIC has a more restrictive inbound NSG rule. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a successful connection to a different address and different service port.
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
- In this security review, examine subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
Explanation
Correct Answer
D:These records test the actual subnet and NIC NSG combined enforcement behavior rather than an unrelated dashboard state. The intended action is: Check both associated NSGs and correct the relevant blocking rule without weakening other protections.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a subnet security rule allows a web service while the VM NIC has a more restrictive inbound NSG rule.
B:Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow.
C:On its own, that evidence does not prove the specified security control works. A static virtual network diagram with no effective route or packet observation.
Question 258
A subnet security rule allows a web service while the VM NIC has a more restrictive inbound NSG rule. Which statement most accurately explains this scenario?
- The applicable security principle is that traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that an HTTP load balancer automatically inspects every malicious request as a WAF.
Explanation
Correct Answer
A:This principle supports the security response: Check both associated NSGs and correct the relevant blocking rule without weakening other protections.
Incorrect Answers
B:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for subnet and NIC NSG combined enforcement. The relevant security behavior is: Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Check evidence such as subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
C:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for subnet and NIC NSG combined enforcement. The relevant security behavior is: Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Check evidence such as subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
D:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for subnet and NIC NSG combined enforcement. The relevant security behavior is: Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Check evidence such as subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
Question 259
A subnet security rule allows a web service while the VM NIC has a more restrictive inbound NSG rule. Suppose the operator instead follows this unsafe shortcut: Delete every NSG on the virtual network because a single permit did not work. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that treating one allowed rule as an end-to-end permit overlooks an effective denial at another association.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
- The resulting security weakness is that changing a resource description fixes every underlying transport rule.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
Explanation
Correct Answer
A:Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real subnet and NIC NSG combined enforcement weakness after the shortcut. In the given case, a subnet security rule allows a web service while the VM NIC has a more restrictive inbound NSG rule.
C:This does not explain the real subnet and NIC NSG combined enforcement weakness after the shortcut. Changing a resource description fixes every underlying transport rule.
D:This does not explain the real subnet and NIC NSG combined enforcement weakness after the shortcut. The failure consists only of retaining valid network flow logs.
Question 260
A subnet security rule allows a web service while the VM NIC has a more restrictive inbound NSG rule. A review identifies this consequence: Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to disable network monitoring to avoid recording denied flows.
- The controlled remediation is to fix the intended scoped policy and retest effective access across both NSGs.
- The controlled remediation is to delete every NSG on the virtual network because a single permit did not work.
- The controlled remediation is to assume NIC NSG permissions always override an explicit subnet deny.
Explanation
Correct Answer
B:Traffic can be evaluated by both subnet and NIC network security groups, and a deny at either relevant layer blocks the flow. Test using these records: Subnet and NIC NSG associations, effective rules and Network Watcher flow verification.
Incorrect Answers
A:Disable network monitoring to avoid recording denied flows. This would not reliably restore the intended security boundary. Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. The appropriate controlled recovery is: Fix the intended scoped policy and retest effective access across both NSGs.
C:Delete every NSG on the virtual network because a single permit did not work. This would not reliably restore the intended security boundary. Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. The appropriate controlled recovery is: Fix the intended scoped policy and retest effective access across both NSGs.
D:Assume NIC NSG permissions always override an explicit subnet deny. This would not reliably restore the intended security boundary. Treating one allowed rule as an end-to-end permit overlooks an effective denial at another association. The appropriate controlled recovery is: Fix the intended scoped policy and retest effective access across both NSGs.
