Microsoft AZ-500 Practice Test 29
Question 280
A peered application VNet bypasses the central NVA because the effective route table points to a different next hop. A review identifies this consequence: An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to correct the route and test bidirectional path through the approved inspection point.
- The controlled remediation is to delete every route and assume the required inspection path remains enforced.
- The controlled remediation is to add an inbound NSG Allow and assume it changes the routing next hop.
- The controlled remediation is to set the route next hop to an unrelated public DNS server.
Explanation
Correct Answer
A:User-defined routes can direct subnet traffic to a virtual appliance or other supported next hop. Test using these records: Effective routes, next hop, peering settings, firewall IP and route symmetry.
Incorrect Answers
B:Delete every route and assume the required inspection path remains enforced. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
C:Add an inbound NSG Allow and assume it changes the routing next hop. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
D:Set the route next hop to an unrelated public DNS server. This would not reliably restore the intended security boundary. An incorrect UDR or missing return route can bypass inspection or blackhole legitimate flows. The appropriate controlled recovery is: Correct the route and test bidirectional path through the approved inspection point.
Question 281
A spoke VNet reaches the hub but cannot directly reach another spoke through peering alone. What is the BEST supported implementation or corrective action?
- Enable a peering relationship to the hub and assume all spokes route through it automatically.
- Increase DNS TTL to provide network layer transitivity.
- Implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering.
- Disable all NSGs to simulate missing route transit.
Explanation
Correct Answer
C:Confirm the change against these records: Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces. Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
Incorrect Answers
A:Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths.
B:Increase DNS TTL to provide network layer transitivity. The proposed change targets the wrong mechanism or lacks essential validation. Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Relevant evidence is peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
D:Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. The intended action is: Implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering.
Question 282
A spoke VNet reaches the hub but cannot directly reach another spoke through peering alone. Which evidence BEST verifies the intended technical behavior?
- A static virtual network diagram with no effective route or packet observation.
- A successful connection to a different address and different service port.
- Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
- A public DNS response that does not show the intended private service path.
Explanation
Correct Answer
C:These records test the actual VNet peering and nontransitivity behavior rather than an unrelated dashboard state. Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
B:On its own, that evidence does not prove the specified security control works. Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
D:On its own, that evidence does not prove the specified security control works. In the given case, a spoke VNet reaches the hub but cannot directly reach another spoke through peering alone.
Question 283
A spoke VNet reaches the hub but cannot directly reach another spoke through peering alone. Which principle BEST explains why the recommended solution is appropriate?
- An HTTP load balancer automatically inspects every malicious request as a WAF.
- Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
- Successful public name resolution proves that all traffic uses Private Link.
- Creating a virtual network peering link makes all other Azure VNets transitively reachable.
Explanation
Correct Answer
B:This principle supports the security response: Implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering. Confirmation depends on Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
Incorrect Answers
A:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for VNet peering and nontransitivity. The relevant security behavior is: Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Check evidence such as peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
C:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for VNet peering and nontransitivity. The relevant security behavior is: Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Check evidence such as peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
D:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for VNet peering and nontransitivity. The relevant security behavior is: Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Check evidence such as peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
Question 284
A spoke VNet reaches the hub but cannot directly reach another spoke through peering alone. Suppose the operator instead follows this unsafe shortcut: Enable a peering relationship to the hub and assume all spokes route through it automatically. What is the MOST significant failure introduced by that shortcut?
- Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths.
- The failure consists only of retaining valid network flow logs.
- A VNet diagram label alone explains the blocked or uninspected traffic.
- Changing a resource description fixes every underlying transport rule.
Explanation
Correct Answer
A:The suitable control is: Implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering. Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
Incorrect Answers
B:This does not explain the real VNet peering and nontransitivity weakness after the shortcut. The material failure is: Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths.
C:This does not explain the real VNet peering and nontransitivity weakness after the shortcut. Inspect evidence such as peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
D:This does not explain the real VNet peering and nontransitivity weakness after the shortcut. Changing a resource description fixes every underlying transport rule.
Question 285
A spoke VNet reaches the hub but cannot directly reach another spoke through peering alone. A review identifies this consequence: Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. What is the BEST controlled recovery once this failure is recognized?
- Configure the approved transit path and verify both routing and security inspection.
- Increase DNS TTL to provide network layer transitivity.
- Disable all NSGs to simulate missing route transit.
- Enable a peering relationship to the hub and assume all spokes route through it automatically.
Explanation
Correct Answer
A:Test using these records: Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Increase DNS TTL to provide network layer transitivity. This would not reliably restore the intended security boundary. Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. The appropriate controlled recovery is: Configure the approved transit path and verify both routing and security inspection.
C:Disable all NSGs to simulate missing route transit. This would not reliably restore the intended security boundary. Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. The appropriate controlled recovery is: Configure the approved transit path and verify both routing and security inspection.
D:Enable a peering relationship to the hub and assume all spokes route through it automatically. This would not reliably restore the intended security boundary. Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. The appropriate controlled recovery is: Configure the approved transit path and verify both routing and security inspection.
Question 286
Two peered Azure virtual networks expect transitive routing through a third network without configuring forwarding. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering.
- For this Azure workload, the team should increase DNS TTL to provide network layer transitivity.
- For this Azure workload, the team should disable all NSGs to simulate missing route transit.
- For this Azure workload, the team should enable a peering relationship to the hub and assume all spokes route through it automatically.
Explanation
Correct Answer
A:Confirm the change against these records: Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
Incorrect Answers
B:Increase DNS TTL to provide network layer transitivity. The proposed change targets the wrong mechanism or lacks essential validation. Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Relevant evidence is peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
C:Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths.
D:Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. Enable a peering relationship to the hub and assume all spokes route through it automatically.
Question 287
Two peered Azure virtual networks expect transitive routing through a third network without configuring forwarding. What evidence most directly confirms the intended security behavior?
- In this security review, examine the name of a firewall policy without its applied match and request logs.
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
- In this security review, examine a successful connection to a different address and different service port.
- In this security review, examine peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
Explanation
Correct Answer
D:These records test the actual VNet peering and nontransitivity behavior rather than an unrelated dashboard state. The intended action is: Implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, two peered Azure virtual networks expect transitive routing through a third network without configuring forwarding.
B:The more relevant observations are: Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
C:Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
Question 288
Two peered Azure virtual networks expect transitive routing through a third network without configuring forwarding. Which security principle best explains the intended decision?
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that an HTTP load balancer automatically inspects every malicious request as a WAF.
- The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
- The applicable security principle is that Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
Explanation
Correct Answer
D:This principle supports the security response: Implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering.
Incorrect Answers
A:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for VNet peering and nontransitivity. The relevant security behavior is: Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Check evidence such as peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
B:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for VNet peering and nontransitivity. The relevant security behavior is: Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Check evidence such as peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
C:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for VNet peering and nontransitivity. The relevant security behavior is: Azure VNet peering is not inherently transitive and routed transit requires an explicit design. Check evidence such as peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces.
Question 289
Two peered Azure virtual networks expect transitive routing through a third network without configuring forwarding. Suppose the operator instead follows this unsafe shortcut: Enable a peering relationship to the hub and assume all spokes route through it automatically. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that changing a resource description fixes every underlying transport rule.
- The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
- The resulting security weakness is that assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths.
Explanation
Correct Answer
D:The suitable control is: Implement supported hub routing and required gateway transit or forwarded-traffic settings instead of assuming transitive peering. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real VNet peering and nontransitivity weakness after the shortcut. In the given case, two peered Azure virtual networks expect transitive routing through a third network without configuring forwarding.
B:This does not explain the real VNet peering and nontransitivity weakness after the shortcut. The root problem was using a permitted endpoint reachability test.
C:This does not explain the real VNet peering and nontransitivity weakness after the shortcut. A VNet diagram label alone explains the blocked or uninspected traffic.
Question 290
Two peered Azure virtual networks expect transitive routing through a third network without configuring forwarding. A review identifies this consequence: Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. Which remediation most directly restores the intended behavior?
- The controlled remediation is to configure the approved transit path and verify both routing and security inspection.
- The controlled remediation is to disable all NSGs to simulate missing route transit.
- The controlled remediation is to enable a peering relationship to the hub and assume all spokes route through it automatically.
- The controlled remediation is to increase DNS TTL to provide network layer transitivity.
Explanation
Correct Answer
A:Test using these records: Peering flags, effective routes, hub appliance forwarding and end-to-end traffic traces. Azure VNet peering is not inherently transitive and routed transit requires an explicit design.
Incorrect Answers
B:Disable all NSGs to simulate missing route transit. This would not reliably restore the intended security boundary. Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. The appropriate controlled recovery is: Configure the approved transit path and verify both routing and security inspection.
C:Enable a peering relationship to the hub and assume all spokes route through it automatically. This would not reliably restore the intended security boundary. Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. The appropriate controlled recovery is: Configure the approved transit path and verify both routing and security inspection.
D:Increase DNS TTL to provide network layer transitivity. This would not reliably restore the intended security boundary. Assuming automatic spoke-to-spoke transitivity can leave isolation gaps or unreachable service paths. The appropriate controlled recovery is: Configure the approved transit path and verify both routing and security inspection.
