cert
cert-1
cert-2

Pass Microsoft AZ-500 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
AZ-500 Exam - Verified By Experts
AZ-500 Premium Bundle
$29.98

AZ-500 Premium Bundle

$79.99
$109.97
  • Premium File 523 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 73 Video Lectures
  • Study Guide 635 Pages
 
$109.97
$79.99
accept 10 downloads in last 7 days
block-screenshots
Purchase Microsoft AZ-500 Exam Training Products Individually
Microsoft AZ-500 Premium File
Premium File 523 Q&A
$76.99$69.99
Microsoft AZ-500 Video Training Course
Training Course 73 Lectures
$21.99 $19.99
Microsoft AZ-500 PDF Study Guide
Study Guide 635 Pages
$21.99 $19.99
Microsoft AZ-500 Practice Test 33

Question 320

A new branch connection has an unexpected route to a sensitive VNet despite intended segmentation in a virtual hub. A review identifies this consequence: An attached hub alone does not prove every route traverses the designated inspection control. What is the BEST controlled recovery once this failure is recognized?

  1. The controlled remediation is to correct hub route policies and inspect actual east-west and egress forwarding.
  2. The controlled remediation is to use only endpoint EDR settings to replace Virtual WAN routing policy.
  3. The controlled remediation is to assume attaching a VNet to the hub automatically enables every firewall rule.
  4. The controlled remediation is to change a gateway DNS suffix to enforce virtual hub traffic inspection.

Explanation

Correct Answer

A:

Test using these records: Hub effective route tables, secured hub policy, propagated routes and inspected flow logs. Virtual WAN routing intent and secured hubs influence traffic paths independently of ordinary spoke NSGs.

Incorrect Answers

B:

Use only endpoint EDR settings to replace Virtual WAN routing policy. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

C:

Assume attaching a VNet to the hub automatically enables every firewall rule. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

D:

Change a gateway DNS suffix to enforce virtual hub traffic inspection. This would not reliably restore the intended security boundary. An attached hub alone does not prove every route traverses the designated inspection control. The appropriate controlled recovery is: Correct hub route policies and inspect actual east-west and egress forwarding.

Question 321

A company uses ExpressRoute private peering and incorrectly assumes transport encryption is guaranteed end to end. What is the BEST supported implementation or corrective action?

  1. Assume private ExpressRoute peering encrypts every application payload automatically.
  2. Disable TLS on the applications because the path is private.
  3. Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.
  4. Use only an NSG to turn ordinary packets into encrypted IPsec traffic.

Explanation

Correct Answer

C:

Confirm the change against these records: ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.

Incorrect Answers

A:

Assume private ExpressRoute peering encrypts every application payload automatically. This is not a valid substitute for the specified security control. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The correct targeted action is: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.

B:

Disable TLS on the applications because the path is private. The proposed change targets the wrong mechanism or lacks essential validation. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Relevant evidence is expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

D:

Use only an NSG to turn ordinary packets into encrypted IPsec traffic. This leaves the security requirement unresolved. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The intended action is: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.

Question 322

A company uses ExpressRoute private peering and incorrectly assumes transport encryption is guaranteed end to end. Which evidence BEST verifies the intended technical behavior?

  1. A healthy network interface without the evaluated NSG, route or private endpoint.
  2. A public DNS response that does not show the intended private service path.
  3. The name of a firewall policy without its applied match and request logs.
  4. ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

Explanation

Correct Answer

D:

These records test the actual expressRoute encryption overlay behavior rather than an unrelated dashboard state. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.

Incorrect Answers

A:

On its own, that evidence does not prove the specified security control works. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.

B:

On its own, that evidence does not prove the specified security control works. The more relevant observations are: ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

C:

On its own, that evidence does not prove the specified security control works. In the given case, a company uses ExpressRoute private peering and incorrectly assumes transport encryption is guaranteed end to end.

Question 323

A company uses ExpressRoute private peering and incorrectly assumes transport encryption is guaranteed end to end. Which principle BEST explains why the recommended solution is appropriate?

  1. Successful public name resolution proves that all traffic uses Private Link.
  2. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.
  3. A network appliance presence guarantees the effective route traverses it.
  4. An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.

Explanation

Correct Answer

B:

Confirmation depends on ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification. This principle supports the security response: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.

Incorrect Answers

A:

Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for expressRoute encryption overlay. The relevant security behavior is: ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Check evidence such as expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

C:

A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for expressRoute encryption overlay. The relevant security behavior is: ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Check evidence such as expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

D:

An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for expressRoute encryption overlay. The relevant security behavior is: ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Check evidence such as expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

Question 324

A company uses ExpressRoute private peering and incorrectly assumes transport encryption is guaranteed end to end. Suppose the operator instead follows this unsafe shortcut: Assume private ExpressRoute peering encrypts every application payload automatically. What is the MOST significant failure introduced by that shortcut?

  1. The root problem was using a permitted endpoint reachability test.
  2. The investigation itself created the pre-existing private DNS or route mismatch.
  3. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap.
  4. The failure consists only of retaining valid network flow logs.

Explanation

Correct Answer

C:

The suitable control is: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.

Incorrect Answers

A:

This does not explain the real expressRoute encryption overlay weakness after the shortcut. The material failure is: Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap.

B:

This does not explain the real expressRoute encryption overlay weakness after the shortcut. Inspect evidence such as expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

D:

This does not explain the real expressRoute encryption overlay weakness after the shortcut. The failure consists only of retaining valid network flow logs.

Question 325

A company uses ExpressRoute private peering and incorrectly assumes transport encryption is guaranteed end to end. A review identifies this consequence: Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. What is the BEST controlled recovery once this failure is recognized?

  1. Disable TLS on the applications because the path is private.
  2. Configure and test an approved encryption method above the private circuit path.
  3. Use only an NSG to turn ordinary packets into encrypted IPsec traffic.
  4. Assume private ExpressRoute peering encrypts every application payload automatically.

Explanation

Correct Answer

B:

Test using these records: ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification. This addresses the observed security problem while providing a verifiable outcome.

Incorrect Answers

A:

Disable TLS on the applications because the path is private. This would not reliably restore the intended security boundary. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The appropriate controlled recovery is: Configure and test an approved encryption method above the private circuit path.

C:

Use only an NSG to turn ordinary packets into encrypted IPsec traffic. This would not reliably restore the intended security boundary. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The appropriate controlled recovery is: Configure and test an approved encryption method above the private circuit path.

D:

Assume private ExpressRoute peering encrypts every application payload automatically. This would not reliably restore the intended security boundary. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The appropriate controlled recovery is: Configure and test an approved encryption method above the private circuit path.

Question 326

Sensitive on-premises Azure traffic travels through private circuit routing but the compliance policy requires cryptographic protection. Which configuration decision MOST directly resolves the issue?

  1. For this Azure workload, the team should disable TLS on the applications because the path is private.
  2. For this Azure workload, the team should deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.
  3. For this Azure workload, the team should use only an NSG to turn ordinary packets into encrypted IPsec traffic.
  4. For this Azure workload, the team should assume private ExpressRoute peering encrypts every application payload automatically.

Explanation

Correct Answer

B:

Confirm the change against these records: ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

Incorrect Answers

A:

Disable TLS on the applications because the path is private. The proposed change targets the wrong mechanism or lacks essential validation. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Relevant evidence is expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

C:

Use only an NSG to turn ordinary packets into encrypted IPsec traffic. This leaves the security requirement unresolved. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The intended action is: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.

D:

Assume private ExpressRoute peering encrypts every application payload automatically. This is not a valid substitute for the specified security control. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The correct targeted action is: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.

Question 327

Sensitive on-premises Azure traffic travels through private circuit routing but the compliance policy requires cryptographic protection. What evidence most directly confirms the intended security behavior?

  1. In this security review, examine expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.
  2. In this security review, examine a static virtual network diagram with no effective route or packet observation.
  3. In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
  4. In this security review, examine a public DNS response that does not show the intended private service path.

Explanation

Correct Answer

A:

These records test the actual expressRoute encryption overlay behavior rather than an unrelated dashboard state. The intended action is: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design.

Incorrect Answers

B:

On its own, that evidence does not prove the specified security control works. In the given case, sensitive on-premises Azure traffic travels through private circuit routing but the compliance policy requires cryptographic protection.

C:

ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.

D:

The more relevant observations are: ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

Question 328

Sensitive on-premises Azure traffic travels through private circuit routing but the compliance policy requires cryptographic protection. Which security principle best explains the intended decision?

  1. The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
  2. The applicable security principle is that expressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.
  3. The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
  4. The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.

Explanation

Correct Answer

B:

Confirmation depends on ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

Incorrect Answers

A:

An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for expressRoute encryption overlay. The relevant security behavior is: ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Check evidence such as expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

C:

Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for expressRoute encryption overlay. The relevant security behavior is: ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Check evidence such as expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

D:

Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for expressRoute encryption overlay. The relevant security behavior is: ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload. Check evidence such as expressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification.

Question 329

Sensitive on-premises Azure traffic travels through private circuit routing but the compliance policy requires cryptographic protection. Suppose the operator instead follows this unsafe shortcut: Assume private ExpressRoute peering encrypts every application payload automatically. Which resulting risk or fault should the reviewer identify?

  1. The resulting security weakness is that the failure consists only of retaining valid network flow logs.
  2. The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
  3. The resulting security weakness is that treating circuit isolation as a substitute for required encryption leaves a confidentiality gap.
  4. The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.

Explanation

Correct Answer

C:

The suitable control is: Deploy supported additional encryption such as site-to-site IPsec overlay when required by the design. This is a material consequence of the incorrect shortcut.

Incorrect Answers

A:

This does not explain the real expressRoute encryption overlay weakness after the shortcut. In the given case, sensitive on-premises Azure traffic travels through private circuit routing but the compliance policy requires cryptographic protection.

B:

This does not explain the real expressRoute encryption overlay weakness after the shortcut. A VNet diagram label alone explains the blocked or uninspected traffic.

D:

This does not explain the real expressRoute encryption overlay weakness after the shortcut. The investigation itself created the pre-existing private DNS or route mismatch.

Question 330

Sensitive on-premises Azure traffic travels through private circuit routing but the compliance policy requires cryptographic protection. A review identifies this consequence: Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. Which remediation most directly restores the intended behavior?

  1. The controlled remediation is to use only an NSG to turn ordinary packets into encrypted IPsec traffic.
  2. The controlled remediation is to assume private ExpressRoute peering encrypts every application payload automatically.
  3. The controlled remediation is to configure and test an approved encryption method above the private circuit path.
  4. The controlled remediation is to disable TLS on the applications because the path is private.

Explanation

Correct Answer

C:

Test using these records: ExpressRoute circuit path, encryption tunnel state, configured algorithms and packet security verification. ExpressRoute private connectivity does not itself establish end-to-end IPsec encryption of every payload.

Incorrect Answers

A:

Use only an NSG to turn ordinary packets into encrypted IPsec traffic. This would not reliably restore the intended security boundary. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The appropriate controlled recovery is: Configure and test an approved encryption method above the private circuit path.

B:

Assume private ExpressRoute peering encrypts every application payload automatically. This would not reliably restore the intended security boundary. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The appropriate controlled recovery is: Configure and test an approved encryption method above the private circuit path.

D:

Disable TLS on the applications because the path is private. This would not reliably restore the intended security boundary. Treating circuit isolation as a substitute for required encryption leaves a confidentiality gap. The appropriate controlled recovery is: Configure and test an approved encryption method above the private circuit path.

Microsoft Azure Security Technologies (AZ-500) Practice Tests