cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 32

Question 310

A branch tunnel comes up but no prefixes are exchanged because BGP peer information does not match the gateway configuration. A review identifies this consequence: A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. Which recovery action addresses the underlying technical fault?

  1. The controlled remediation is to correct the mismatched VPN parameters and verify protected routes and traffic.
  2. The controlled remediation is to use one public web certificate as a replacement for IPsec peer key agreement.
  3. The controlled remediation is to reduce every subnet NSG restriction to repair IKE credentials.
  4. The controlled remediation is to assume Azure VPN resources automatically exchange all on-premises prefixes without routing.

Explanation

Correct Answer

A:

Test using these records: Tunnel negotiation logs, shared key configuration, BGP neighbor state and learned prefixes. S2S VPN connectivity requires compatible cryptographic negotiation and the intended routing configuration.

Incorrect Answers

B:

Use one public web certificate as a replacement for IPsec peer key agreement. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.

C:

Reduce every subnet NSG restriction to repair IKE credentials. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.

D:

Assume Azure VPN resources automatically exchange all on-premises prefixes without routing. This would not reliably restore the intended security boundary. A visible gateway connection resource does not guarantee successful negotiation or end-to-end routing. The appropriate controlled recovery is: Correct the mismatched VPN parameters and verify protected routes and traffic.

Question 311

A Virtual WAN spoke is attached to a secured hub but still bypasses the security provider for internet egress. What is the most defensible Azure security action?

  1. Assume attaching a VNet to the hub automatically enables every firewall rule.
  2. Change a gateway DNS suffix to enforce virtual hub traffic inspection.
  3. Configure Virtual WAN hub routing intent or routing policies for the intended private and internet traffic.
  4. Use only endpoint EDR settings to replace Virtual WAN routing policy.

Explanation

Correct Answer

C:

Confirm the change against these records: Hub effective route tables, secured hub policy, propagated routes and inspected flow logs. This directly addresses Virtual WAN secured hub routing intent.

Incorrect Answers

A:

An attached hub alone does not prove every route traverses the designated inspection control. Assume attaching a VNet to the hub automatically enables every firewall rule.

B:

Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. The proposed change targets the wrong mechanism or lacks essential validation.

D:

An attached hub alone does not prove every route traverses the designated inspection control. The intended action is: Configure Virtual WAN hub routing intent or routing policies for the intended private and internet traffic.

Question 312

A Virtual WAN spoke is attached to a secured hub but still bypasses the security provider for internet egress. Which diagnostic record would most strongly confirm the result?

  1. A successful connection to a different address and different service port.
  2. The name of a firewall policy without its applied match and request logs.
  3. Hub effective route tables, secured hub policy, propagated routes and inspected flow logs.
  4. A static virtual network diagram with no effective route or packet observation.

Explanation

Correct Answer

C:

These records test the actual Virtual WAN secured hub routing intent behavior rather than an unrelated dashboard state. Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: Hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

B:

On its own, that evidence does not prove the specified security control works. Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.

D:

On its own, that evidence does not prove the specified security control works. In the given case, a Virtual WAN spoke is attached to a secured hub but still bypasses the security provider for internet egress.

Question 313

A Virtual WAN spoke is attached to a secured hub but still bypasses the security provider for internet egress. Which platform concept should guide the engineer’s assessment?

  1. A network appliance presence guarantees the effective route traverses it.
  2. Creating a virtual network peering link makes all other Azure VNets transitively reachable.
  3. Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.
  4. An HTTP load balancer automatically inspects every malicious request as a WAF.

Explanation

Correct Answer

C:

Confirmation depends on Hub effective route tables, secured hub policy, propagated routes and inspected flow logs. This principle supports the security response: Configure Virtual WAN hub routing intent or routing policies for the intended private and internet traffic.

Incorrect Answers

A:

A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for Virtual WAN secured hub routing intent. The relevant security behavior is: Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. Check evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

B:

Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for Virtual WAN secured hub routing intent. The relevant security behavior is: Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. Check evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

D:

An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for Virtual WAN secured hub routing intent. The relevant security behavior is: Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. Check evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

Question 314

A Virtual WAN spoke is attached to a secured hub but still bypasses the security provider for internet egress. Suppose the operator instead follows this unsafe shortcut: Assume attaching a VNet to the hub automatically enables every firewall rule. Which root-cause observation follows from that incorrect change?

  1. A VNet diagram label alone explains the blocked or uninspected traffic.
  2. Changing a resource description fixes every underlying transport rule.
  3. An attached hub alone does not prove every route traverses the designated inspection control.
  4. The root problem was using a permitted endpoint reachability test.

Explanation

Correct Answer

C:

Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

A VNet diagram label alone explains the blocked or uninspected traffic. This does not explain the real Virtual WAN secured hub routing intent weakness after the shortcut. The material failure is: An attached hub alone does not prove every route traverses the designated inspection control. Inspect evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

B:

Changing a resource description fixes every underlying transport rule. This does not explain the real Virtual WAN secured hub routing intent weakness after the shortcut. The material failure is: An attached hub alone does not prove every route traverses the designated inspection control. Inspect evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

D:

The root problem was using a permitted endpoint reachability test. This does not explain the real Virtual WAN secured hub routing intent weakness after the shortcut. The material failure is: An attached hub alone does not prove every route traverses the designated inspection control. Inspect evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

Question 315

A Virtual WAN spoke is attached to a secured hub but still bypasses the security provider for internet egress. A review identifies this consequence: An attached hub alone does not prove every route traverses the designated inspection control. Which recovery action addresses the underlying technical fault?

  1. Change a gateway DNS suffix to enforce virtual hub traffic inspection.
  2. Use only endpoint EDR settings to replace Virtual WAN routing policy.
  3. Assume attaching a VNet to the hub automatically enables every firewall rule.
  4. Correct hub route policies and inspect actual east-west and egress forwarding.

Explanation

Correct Answer

D:

Test using these records: Hub effective route tables, secured hub policy, propagated routes and inspected flow logs. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Change a gateway DNS suffix to enforce virtual hub traffic inspection. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

B:

Use only endpoint EDR settings to replace Virtual WAN routing policy. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

C:

Assume attaching a VNet to the hub automatically enables every firewall rule. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

Question 316

A new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub. What is the BEST supported implementation or corrective action?

  1. For this Azure workload, the team should configure Virtual WAN hub routing intent or routing policies for the intended private and internet traffic.
  2. For this Azure workload, the team should change a gateway DNS suffix to enforce virtual hub traffic inspection.
  3. For this Azure workload, the team should use only endpoint EDR settings to replace Virtual WAN routing policy.
  4. For this Azure workload, the team should assume attaching a VNet to the hub automatically enables every firewall rule.

Explanation

Correct Answer

A:

Confirm the change against these records: Hub effective route tables, secured hub policy, propagated routes and inspected flow logs. Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.

Incorrect Answers

B:

Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. Relevant evidence is hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

C:

An attached hub alone does not prove every route traverses the designated inspection control. Use only endpoint EDR settings to replace Virtual WAN routing policy.

D:

An attached hub alone does not prove every route traverses the designated inspection control. In the given case, a new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub.

Question 317

A new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub. Which evidence BEST verifies the intended technical behavior?

  1. In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
  2. In this security review, examine a successful connection to a different address and different service port.
  3. In this security review, examine the name of a firewall policy without its applied match and request logs.
  4. In this security review, examine hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

Explanation

Correct Answer

D:

These records test the actual Virtual WAN secured hub routing intent behavior rather than an unrelated dashboard state. The intended action is: Configure Virtual WAN hub routing intent or routing policies for the intended private and internet traffic.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. In the given case, a new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub.

B:

The more relevant observations are: Hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

C:

Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.

Question 318

A new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub. Which principle BEST explains why the recommended solution is appropriate?

  1. The applicable security principle is that an HTTP load balancer automatically inspects every malicious request as a WAF.
  2. The applicable security principle is that Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.
  3. The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
  4. The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.

Explanation

Correct Answer

B:

Confirmation depends on Hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

Incorrect Answers

A:

An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for Virtual WAN secured hub routing intent. The relevant security behavior is: Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. Check evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

C:

A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for Virtual WAN secured hub routing intent. The relevant security behavior is: Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. Check evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

D:

An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for Virtual WAN secured hub routing intent. The relevant security behavior is: Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. Check evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

Question 319

A new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub. Suppose the operator instead follows this unsafe shortcut: Assume attaching a VNet to the hub automatically enables every firewall rule. What is the MOST significant failure introduced by that shortcut?

  1. The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
  2. The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
  3. The resulting security weakness is that changing a resource description fixes every underlying transport rule.
  4. The resulting security weakness is that an attached hub alone does not prove every route traverses the designated inspection control.

Explanation

Correct Answer

D:

Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs. The suitable control is: Configure Virtual WAN hub routing intent or routing policies for the intended private and internet traffic.

Incorrect Answers

A:

The root problem was using a permitted endpoint reachability test. This does not explain the real Virtual WAN secured hub routing intent weakness after the shortcut. The material failure is: An attached hub alone does not prove every route traverses the designated inspection control. Inspect evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

B:

The investigation itself created the pre-existing private DNS or route mismatch. This does not explain the real Virtual WAN secured hub routing intent weakness after the shortcut. The material failure is: An attached hub alone does not prove every route traverses the designated inspection control. Inspect evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

C:

Changing a resource description fixes every underlying transport rule. This does not explain the real Virtual WAN secured hub routing intent weakness after the shortcut. The material failure is: An attached hub alone does not prove every route traverses the designated inspection control. Inspect evidence such as hub effective route tables, secured hub policy, propagated routes and inspected flow logs.

Question 320

A new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub. A review identifies this consequence: An attached hub alone does not prove every route traverses the designated inspection control. What is the BEST controlled recovery once this failure is recognized?

  1. The controlled remediation is to correct hub route policies and inspect actual east-west and egress forwarding.
  2. The controlled remediation is to use only endpoint EDR settings to replace Virtual WAN routing policy.
  3. The controlled remediation is to assume attaching a VNet to the hub automatically enables every firewall rule.
  4. The controlled remediation is to change a gateway DNS suffix to enforce virtual hub traffic inspection.

Explanation

Correct Answer

A:

Test using these records: Hub effective route tables, secured hub policy, propagated routes and inspected flow logs. Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.

Incorrect Answers

B:

Use only endpoint EDR settings to replace Virtual WAN routing policy. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

C:

Assume attaching a VNet to the hub automatically enables every firewall rule. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

D:

Change a gateway DNS suffix to enforce virtual hub traffic inspection. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

Microsoft Azure Security Technologies (AZ-500) Practice Tests