Microsoft AZ-500 Practice Test 28
Question 270
A security policy permits database traffic only from an ASG yet a migrated workload is not classified into the expected group. A review identifies this consequence: An omitted ASG membership causes the flow to miss an expected allow condition. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to permit all source IP addresses globally to avoid maintaining groups.
- The controlled remediation is to add the VM's name to the ASG rule text without assigning NIC membership.
- The controlled remediation is to repair ASG membership and verify the allowed application flow while denying others.
- The controlled remediation is to replace ASG memberships with a public DNS TXT record.
Explanation
Correct Answer
C:Application security groups let Azure NSG policies group participating NICs without hard-coding every IP address. Test using these records: NIC ASG membership, effective NSG rule source and destination and test traffic.
Incorrect Answers
A:Permit all source IP addresses globally to avoid maintaining groups. This would not reliably restore the intended security boundary. An omitted ASG membership causes the flow to miss an expected allow condition. The appropriate controlled recovery is: Repair ASG membership and verify the allowed application flow while denying others.
B:Add the VM's name to the ASG rule text without assigning NIC membership. This would not reliably restore the intended security boundary. An omitted ASG membership causes the flow to miss an expected allow condition. The appropriate controlled recovery is: Repair ASG membership and verify the allowed application flow while denying others.
D:Replace ASG memberships with a public DNS TXT record. This would not reliably restore the intended security boundary. An omitted ASG membership causes the flow to miss an expected allow condition. The appropriate controlled recovery is: Repair ASG membership and verify the allowed application flow while denying others.
Question 271
A spoke subnet has a route to its destination directly through the Internet even though security design mandates Azure Firewall inspection. What is the most defensible Azure security action?
- Add an inbound NSG Allow and assume it changes the routing next hop.
- Set the route next hop to an unrelated public DNS server.
- Delete every route and assume the required inspection path remains enforced.
- Apply a valid UDR with the intended next hop and check effective routing and return paths.
Explanation
Correct Answer
D:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Confirm the change against these records: Effective routes, next hop, peering settings, firewall IP and route symmetry.
Incorrect Answers
A:An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. Add an inbound NSG Allow and assume it changes the routing next hop.
B:Set the route next hop to an unrelated public DNS server. The proposed change targets the wrong mechanism or lacks essential validation. User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Relevant evidence is effective routes, next hop, peering settings, firewall IP and route symmetry.
C:An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The intended action is: Apply a valid UDR with the intended next hop and check effective routing and return paths.
Question 272
A spoke subnet has a route to its destination directly through the Internet even though security design mandates Azure Firewall inspection. Which diagnostic record would most strongly confirm the result?
- A healthy network interface without the evaluated NSG, route or private endpoint.
- A public DNS response that does not show the intended private service path.
- Effective routes, next hop, peering settings, firewall IP and route symmetry.
- The name of a firewall policy without its applied match and request logs.
Explanation
Correct Answer
C:These records test the actual user-defined route forced inspection behavior rather than an unrelated dashboard state. User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Effective routes, next hop, peering settings, firewall IP and route symmetry.
B:On its own, that evidence does not prove the specified security control works. User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop.
D:On its own, that evidence does not prove the specified security control works. In the given case, a spoke subnet has a route to its destination directly through the Internet even though security design mandates Azure Firewall inspection.
Question 273
A spoke subnet has a route to its destination directly through the Internet even though security design mandates Azure Firewall inspection. Which platform concept should guide the engineer’s assessment?
- User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop.
- Successful public name resolution proves that all traffic uses Private Link.
- A network appliance presence guarantees the effective route traverses it.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
Explanation
Correct Answer
A:This principle supports the security response: Apply a valid UDR with the intended next hop and check effective routing and return paths. Confirmation depends on Effective routes, next hop, peering settings, firewall IP and route symmetry.
Incorrect Answers
B:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for user-defined route forced inspection. The relevant security behavior is: User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Check evidence such as effective routes, next hop, peering settings, firewall IP and route symmetry.
C:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for user-defined route forced inspection. The relevant security behavior is: User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Check evidence such as effective routes, next hop, peering settings, firewall IP and route symmetry.
D:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for user-defined route forced inspection. The relevant security behavior is: User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Check evidence such as effective routes, next hop, peering settings, firewall IP and route symmetry.
Question 274
A spoke subnet has a route to its destination directly through the Internet even though security design mandates Azure Firewall inspection. Suppose the operator instead follows this unsafe shortcut: Add an inbound NSG Allow and assume it changes the routing next hop. Which root-cause observation follows from that incorrect change?
- The root problem was using a permitted endpoint reachability test.
- The investigation itself created the pre-existing private DNS or route mismatch.
- The failure consists only of retaining valid network flow logs.
- An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows.
Explanation
Correct Answer
D:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real user-defined route forced inspection weakness after the shortcut. The material failure is: An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows.
B:This does not explain the real user-defined route forced inspection weakness after the shortcut. Inspect evidence such as effective routes, next hop, peering settings, firewall IP and route symmetry.
C:This does not explain the real user-defined route forced inspection weakness after the shortcut. The failure consists only of retaining valid network flow logs.
Question 275
A spoke subnet has a route to its destination directly through the Internet even though security design mandates Azure Firewall inspection. A review identifies this consequence: An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. Which recovery action addresses the underlying technical fault?
- Set the route next hop to an unrelated public DNS server.
- Delete every route and assume the required inspection path remains enforced.
- Add an inbound NSG Allow and assume it changes the routing next hop.
- Correct the route and test bidirectional path through the approved inspection point.
Explanation
Correct Answer
D:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Set the route next hop to an unrelated public DNS server. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
B:Delete every route and assume the required inspection path remains enforced. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
C:That option would add an inbound NSG Allow and assume it changes the routing next hop, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 276
A peered application VNet bypasses the central NVA because the effective route table points to a different next hop. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should apply a valid UDR with the intended next hop and check effective routing and return paths.
- For this Azure workload, the team should set the route next hop to an unrelated public DNS server.
- For this Azure workload, the team should delete every route and assume the required inspection path remains enforced.
- For this Azure workload, the team should add an inbound NSG Allow and assume it changes the routing next hop.
Explanation
Correct Answer
A:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. In the given case, a peered application VNet bypasses the central NVA because the effective route table points to a different next hop.
Incorrect Answers
B:Set the route next hop to an unrelated public DNS server. The proposed change targets the wrong mechanism or lacks essential validation. User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Relevant evidence is effective routes, next hop, peering settings, firewall IP and route symmetry.
C:An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. In the given case, a peered application VNet bypasses the central NVA because the effective route table points to a different next hop.
D:Add an inbound NSG Allow and assume it changes the routing next hop.
Question 277
A peered application VNet bypasses the central NVA because the effective route table points to a different next hop. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
- In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine effective routes, next hop, peering settings, firewall IP and route symmetry.
Explanation
Correct Answer
D:These records test the actual user-defined route forced inspection behavior rather than an unrelated dashboard state. The intended action is: Apply a valid UDR with the intended next hop and check effective routing and return paths.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a peered application VNet bypasses the central NVA because the effective route table points to a different next hop.
B:The more relevant observations are: Effective routes, next hop, peering settings, firewall IP and route symmetry.
C:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop.
Question 278
A peered application VNet bypasses the central NVA because the effective route table points to a different next hop. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that user-defined routes can direct subnet traffic to a virtual appliance or other supported next hop.
Explanation
Correct Answer
D:This principle supports the security response: Apply a valid UDR with the intended next hop and check effective routing and return paths.
Incorrect Answers
A:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for user-defined route forced inspection. The relevant security behavior is: User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Check evidence such as effective routes, next hop, peering settings, firewall IP and route symmetry.
B:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for user-defined route forced inspection. The relevant security behavior is: User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Check evidence such as effective routes, next hop, peering settings, firewall IP and route symmetry.
C:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for user-defined route forced inspection. The relevant security behavior is: User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Check evidence such as effective routes, next hop, peering settings, firewall IP and route symmetry.
Question 279
A peered application VNet bypasses the central NVA because the effective route table points to a different next hop. Suppose the operator instead follows this unsafe shortcut: Add an inbound NSG Allow and assume it changes the routing next hop. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
- The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
- The resulting security weakness is that an incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows.
Explanation
Correct Answer
D:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. The suitable control is: Apply a valid UDR with the intended next hop and check effective routing and return paths.
Incorrect Answers
A:This does not explain the real user-defined route forced inspection weakness after the shortcut. In the given case, a peered application VNet bypasses the central NVA because the effective route table points to a different next hop.
B:This does not explain the real user-defined route forced inspection weakness after the shortcut. A VNet diagram label alone explains the blocked or uninspected traffic.
C:This does not explain the real user-defined route forced inspection weakness after the shortcut. The investigation itself created the pre-existing private DNS or route mismatch.
Question 280
A peered application VNet bypasses the central NVA because the effective route table points to a different next hop. A review identifies this consequence: An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to correct the route and test bidirectional path through the approved inspection point.
- The controlled remediation is to delete every route and assume the required inspection path remains enforced.
- The controlled remediation is to add an inbound NSG Allow and assume it changes the routing next hop.
- The controlled remediation is to set the route next hop to an unrelated public DNS server.
Explanation
Correct Answer
A:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Test using these records: Effective routes, next hop, peering settings, firewall IP and route symmetry.
Incorrect Answers
B:Delete every route and assume the required inspection path remains enforced. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
C:Add an inbound NSG Allow and assume it changes the routing next hop. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
D:Set the route next hop to an unrelated public DNS server. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
