Microsoft AZ-500 Practice Test 31
Question 300
A new contractor has the correct VPN gateway address but no valid credential recognized by the P2S configuration. A review identifies this consequence: A correct gateway address cannot authorize a client whose credential is invalid or not trusted. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to disable server certificate validation to bypass the revoked client credential.
- The controlled remediation is to trust every self-signed certificate submitted by any client.
- The controlled remediation is to permit all public IP addresses to the VNet as a substitute for VPN authentication.
- The controlled remediation is to issue approved credentials and retest authenticated tunnel and least-privileged access.
Explanation
Correct Answer
D:Test using these records: VPN gateway P2S configuration, client authentication logs, trusted issuers and revoked certificates. Point-to-site VPN establishes individual client connectivity using the configured authentication and tunnel policies.
Incorrect Answers
A:Disable server certificate validation to bypass the revoked client credential. This would not reliably restore the intended security boundary. A correct gateway address cannot authorize a client whose credential is invalid or not trusted. The appropriate controlled recovery is: Issue approved credentials and retest authenticated tunnel and least-privileged access.
B:Trust every self-signed certificate submitted by any client. This would not reliably restore the intended security boundary. A correct gateway address cannot authorize a client whose credential is invalid or not trusted. The appropriate controlled recovery is: Issue approved credentials and retest authenticated tunnel and least-privileged access.
C:Permit all public IP addresses to the VNet as a substitute for VPN authentication. This would not reliably restore the intended security boundary. A correct gateway address cannot authorize a client whose credential is invalid or not trusted. The appropriate controlled recovery is: Issue approved credentials and retest authenticated tunnel and least-privileged access.
Question 301
An Azure VPN gateway and an on-premises router negotiate IKE but fail to establish a stable IPsec tunnel after their shared secrets diverge. Which operator action best meets this technical requirement?
- Align supported IKE or IPsec settings and BGP parameters with the on-premises VPN device.
- Reduce every subnet NSG restriction to repair IKE credentials.
- Assume Azure VPN resources automatically exchange all on-premises prefixes without routing.
- Use one public web certificate as a replacement for IPsec peer key agreement.
Explanation
Correct Answer
A:Confirm the change against these records: Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
Incorrect Answers
B:A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing.
C:Assume Azure VPN resources automatically exchange all on-premises prefixes without routing. The proposed change targets the wrong mechanism or lacks essential validation. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Relevant evidence is tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
D:A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The intended action is: Align supported IKE or IPsec settings and BGP parameters with the on-premises VPN device.
Question 302
An Azure VPN gateway and an on-premises router negotiate IKE but fail to establish a stable IPsec tunnel after their shared secrets diverge. Which collection of observations most directly tests the suspected cause?
- A public DNS response that does not show the intended private service path.
- Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
- A static virtual network diagram with no effective route or packet observation.
- A healthy network interface without the evaluated NSG, route or private endpoint.
Explanation
Correct Answer
B:These records test the actual site-to-site VPN shared key and BGP behavior rather than an unrelated dashboard state. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
C:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
D:On its own, that evidence does not prove the specified security control works. In the given case, an Azure VPN gateway and an on-premises router negotiate IKE but fail to establish a stable IPsec tunnel after their shared secrets diverge.
Question 303
An Azure VPN gateway and an on-premises router negotiate IKE but fail to establish a stable IPsec tunnel after their shared secrets diverge. Which statement most accurately explains this scenario?
- S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
- Creating a virtual network peering link makes all other Azure VNets transitively reachable.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- Successful public name resolution proves that all traffic uses Private Link.
Explanation
Correct Answer
A:Confirmation depends on Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes. This principle supports the security response: Align supported IKE or IPsec settings and BGP parameters with the on-premises VPN device.
Incorrect Answers
B:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for site-to-site VPN shared key and BGP. The relevant security behavior is: S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Check evidence such as tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
C:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for site-to-site VPN shared key and BGP. The relevant security behavior is: S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Check evidence such as tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
D:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for site-to-site VPN shared key and BGP. The relevant security behavior is: S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Check evidence such as tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
Question 304
An Azure VPN gateway and an on-premises router negotiate IKE but fail to establish a stable IPsec tunnel after their shared secrets diverge. Suppose the operator instead follows this unsafe shortcut: Reduce every subnet NSG restriction to repair IKE credentials. What is the principal technical consequence of the mistaken choice?
- The investigation itself created the pre-existing private DNS or route mismatch.
- A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing.
- The failure consists only of retaining valid network flow logs.
- A VNet diagram label alone explains the blocked or uninspected traffic.
Explanation
Correct Answer
B:The suitable control is: Align supported IKE or IPsec settings and BGP parameters with the on-premises VPN device. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
Incorrect Answers
A:This does not explain the real site-to-site VPN shared key and BGP weakness after the shortcut. The material failure is: A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing.
C:This does not explain the real site-to-site VPN shared key and BGP weakness after the shortcut. Inspect evidence such as tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
D:This does not explain the real site-to-site VPN shared key and BGP weakness after the shortcut. In the given case, an Azure VPN gateway and an on-premises router negotiate IKE but fail to establish a stable IPsec tunnel after their shared secrets diverge.
Question 305
An Azure VPN gateway and an on-premises router negotiate IKE but fail to establish a stable IPsec tunnel after their shared secrets diverge. A review identifies this consequence: A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. Which recovery action restores the intended control and validates its effect?
- Assume Azure VPN resources automatically exchange all on-premises prefixes without routing.
- Use one public web certificate as a replacement for IPsec peer key agreement.
- Reduce every subnet NSG restriction to repair IKE credentials.
- Correct the mismatched VPN parameters and verify protected routes and traffic.
Explanation
Correct Answer
D:Test using these records: Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Assume Azure VPN resources automatically exchange all on-premises prefixes without routing. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.
B:That option would use one public web certificate as a replacement for IPsec peer key agreement, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
C:Reduce every subnet NSG restriction to repair IKE credentials. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.
Question 306
A branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration. What is the most defensible Azure security action?
- For this Azure workload, the team should assume Azure VPN resources automatically exchange all on-premises prefixes without routing.
- For this Azure workload, the team should use one public web certificate as a replacement for IPsec peer key agreement.
- For this Azure workload, the team should reduce every subnet NSG restriction to repair IKE credentials.
- For this Azure workload, the team should align supported IKE or IPsec settings and BGP parameters with the on-premises VPN device.
Explanation
Correct Answer
D:Confirm the change against these records: Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes. This directly addresses site-to-site VPN shared key and BGP.
Incorrect Answers
A:Assume Azure VPN resources automatically exchange all on-premises prefixes without routing. The proposed change targets the wrong mechanism or lacks essential validation. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Relevant evidence is tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
B:A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing.
C:A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. Reduce every subnet NSG restriction to repair IKE credentials.
Question 307
A branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration. Which diagnostic record would most strongly confirm the result?
- In this security review, examine tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
- In this security review, examine a successful connection to a different address and different service port.
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
Explanation
Correct Answer
A:These records test the actual site-to-site VPN shared key and BGP behavior rather than an unrelated dashboard state. The intended action is: Align supported IKE or IPsec settings and BGP parameters with the on-premises VPN device.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, a branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration.
C:S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
D:The more relevant observations are: Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
Question 308
A branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that s2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that an HTTP load balancer automatically inspects every malicious request as a WAF.
Explanation
Correct Answer
B:Confirmation depends on Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
Incorrect Answers
A:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for site-to-site VPN shared key and BGP. The relevant security behavior is: S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Check evidence such as tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
C:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for site-to-site VPN shared key and BGP. The relevant security behavior is: S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Check evidence such as tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
D:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for site-to-site VPN shared key and BGP. The relevant security behavior is: S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration. Check evidence such as tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes.
Question 309
A branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration. Suppose the operator instead follows this unsafe shortcut: Reduce every subnet NSG restriction to repair IKE credentials. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that a visible gateway connection resource does not guarantee successful negotiation or end-to-end routing.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
- The resulting security weakness is that changing a resource description fixes every underlying transport rule.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
Explanation
Correct Answer
A:The suitable control is: Align supported IKE or IPsec settings and BGP parameters with the on-premises VPN device. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real site-to-site VPN shared key and BGP weakness after the shortcut. In the given case, a branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration.
C:This does not explain the real site-to-site VPN shared key and BGP weakness after the shortcut. Changing a resource description fixes every underlying transport rule.
D:This does not explain the real site-to-site VPN shared key and BGP weakness after the shortcut. The failure consists only of retaining valid network flow logs.
Question 310
A branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration. A review identifies this consequence: A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to correct the mismatched VPN parameters and verify protected routes and traffic.
- The controlled remediation is to use one public web certificate as a replacement for IPsec peer key agreement.
- The controlled remediation is to reduce every subnet NSG restriction to repair IKE credentials.
- The controlled remediation is to assume Azure VPN resources automatically exchange all on-premises prefixes without routing.
Explanation
Correct Answer
A:Test using these records: Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.
Incorrect Answers
B:Use one public web certificate as a replacement for IPsec peer key agreement. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.
C:Reduce every subnet NSG restriction to repair IKE credentials. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.
D:Assume Azure VPN resources automatically exchange all on-premises prefixes without routing. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.
