Microsoft AZ-500 Practice Test 40
Question 390
A storage account's private endpoint was deployed in the wrong VNet and callers still use its public endpoint. A review identifies this consequence: A pending or incorrectly targeted endpoint does not provide a usable approved private service connection. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to move the application to public DNS and treat that as private endpoint connectivity.
- The controlled remediation is to assume any VNet with service endpoints automatically shares all private endpoints.
- The controlled remediation is to open all public firewall rules instead of validating private link approval.
- The controlled remediation is to repair the target and approval and verify traffic reaches the correct private endpoint address.
Explanation
Correct Answer
D:Test using these records: Private endpoint connection state, target resource ID, private IP and client network path. Azure Private Endpoints expose supported service resources via a private IP after the endpoint connection is approved.
Incorrect Answers
A:Move the application to public DNS and treat that as private endpoint connectivity. This would not reliably restore the intended security boundary. A pending or incorrectly targeted endpoint does not provide a usable approved private service connection. The appropriate controlled recovery is: Repair the target and approval and verify traffic reaches the correct private endpoint address.
B:Assume any VNet with service endpoints automatically shares all private endpoints. This would not reliably restore the intended security boundary. A pending or incorrectly targeted endpoint does not provide a usable approved private service connection. The appropriate controlled recovery is: Repair the target and approval and verify traffic reaches the correct private endpoint address.
C:Open all public firewall rules instead of validating private link approval. This would not reliably restore the intended security boundary. A pending or incorrectly targeted endpoint does not provide a usable approved private service connection. The appropriate controlled recovery is: Repair the target and approval and verify traffic reaches the correct private endpoint address.
Question 391
A workload has an approved storage private endpoint but resolves the public blob service IP rather than its private address. What is the most defensible Azure security action?
- Replace the endpoint private IP with an arbitrary public address in private DNS.
- Assume private endpoint creation guarantees automatic DNS for every remote resolver.
- Link the correct Private DNS zone to each authorized VNet and verify resource records.
- Disable name resolution entirely to force private IP selection.
Explanation
Correct Answer
C:Confirm the change against these records: DNS response chain, private endpoint IP, private DNS zone records and VNet links. Private Endpoint connectivity typically depends on correct service-specific private DNS resolution.
Incorrect Answers
A:An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address.
B:Assume private endpoint creation guarantees automatic DNS for every remote resolver. The proposed change targets the wrong mechanism or lacks essential validation. Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Relevant evidence is dNS response chain, private endpoint IP, private DNS zone records and VNet links.
D:An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. The intended action is: Link the correct Private DNS zone to each authorized VNet and verify resource records.
Question 392
A workload has an approved storage private endpoint but resolves the public blob service IP rather than its private address. Which diagnostic record would most strongly confirm the result?
- DNS response chain, private endpoint IP, private DNS zone records and VNet links.
- The name of a firewall policy without its applied match and request logs.
- A healthy network interface without the evaluated NSG, route or private endpoint.
- A successful connection to a different address and different service port.
Explanation
Correct Answer
A:These records test the actual private DNS zone for Private Link behavior rather than an unrelated dashboard state. Private Endpoint connectivity typically depends on correct service-specific private DNS resolution.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: DNS response chain, private endpoint IP, private DNS zone records and VNet links.
C:On its own, that evidence does not prove the specified security control works. Private Endpoint connectivity typically depends on correct service-specific private DNS resolution.
D:On its own, that evidence does not prove the specified security control works. In the given case, a workload has an approved storage private endpoint but resolves the public blob service IP rather than its private address.
Question 393
A workload has an approved storage private endpoint but resolves the public blob service IP rather than its private address. Which platform concept should guide the engineer’s assessment?
- Private Endpoint connectivity typically depends on correct service-specific private DNS resolution.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- An HTTP load balancer automatically inspects every malicious request as a WAF.
- A network appliance presence guarantees the effective route traverses it.
Explanation
Correct Answer
A:This principle supports the security response: Link the correct Private DNS zone to each authorized VNet and verify resource records. Confirmation depends on DNS response chain, private endpoint IP, private DNS zone records and VNet links.
Incorrect Answers
B:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for private DNS zone for Private Link. The relevant security behavior is: Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Check evidence such as dNS response chain, private endpoint IP, private DNS zone records and VNet links.
C:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for private DNS zone for Private Link. The relevant security behavior is: Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Check evidence such as dNS response chain, private endpoint IP, private DNS zone records and VNet links.
D:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for private DNS zone for Private Link. The relevant security behavior is: Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Check evidence such as dNS response chain, private endpoint IP, private DNS zone records and VNet links.
Question 394
A workload has an approved storage private endpoint but resolves the public blob service IP rather than its private address. Suppose the operator instead follows this unsafe shortcut: Replace the endpoint private IP with an arbitrary public address in private DNS. Which root-cause observation follows from that incorrect change?
- Changing a resource description fixes every underlying transport rule.
- The root problem was using a permitted endpoint reachability test.
- An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address.
- The investigation itself created the pre-existing private DNS or route mismatch.
Explanation
Correct Answer
C:The suitable control is: Link the correct Private DNS zone to each authorized VNet and verify resource records. Private Endpoint connectivity typically depends on correct service-specific private DNS resolution.
Incorrect Answers
A:This does not explain the real private DNS zone for Private Link weakness after the shortcut. The material failure is: An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address.
B:This does not explain the real private DNS zone for Private Link weakness after the shortcut. Inspect evidence such as dNS response chain, private endpoint IP, private DNS zone records and VNet links.
D:This does not explain the real private DNS zone for Private Link weakness after the shortcut. The investigation itself created the pre-existing private DNS or route mismatch.
Question 395
A workload has an approved storage private endpoint but resolves the public blob service IP rather than its private address. A review identifies this consequence: An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. Which recovery action addresses the underlying technical fault?
- Assume private endpoint creation guarantees automatic DNS for every remote resolver.
- Disable name resolution entirely to force private IP selection.
- Replace the endpoint private IP with an arbitrary public address in private DNS.
- Fix DNS records and VNet links and test endpoint resolution and connectivity.
Explanation
Correct Answer
D:Test using these records: DNS response chain, private endpoint IP, private DNS zone records and VNet links. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:That option would assume private endpoint creation guarantees automatic DNS for every remote resolver, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
B:Disable name resolution entirely to force private IP selection. This would not reliably restore the intended security boundary. An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. The appropriate controlled recovery is: Fix DNS records and VNet links and test endpoint resolution and connectivity.
C:That option would replace the endpoint private IP with an arbitrary public address in private DNS, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 396
Two peered VNets use a private Azure SQL endpoint but only one VNet has access to the corresponding private DNS zone. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should link the correct Private DNS zone to each authorized VNet and verify resource records.
- For this Azure workload, the team should assume private endpoint creation guarantees automatic DNS for every remote resolver.
- For this Azure workload, the team should disable name resolution entirely to force private IP selection.
- For this Azure workload, the team should replace the endpoint private IP with an arbitrary public address in private DNS.
Explanation
Correct Answer
A:Confirm the change against these records: DNS response chain, private endpoint IP, private DNS zone records and VNet links. This directly addresses private DNS zone for Private Link.
Incorrect Answers
B:Assume private endpoint creation guarantees automatic DNS for every remote resolver. The proposed change targets the wrong mechanism or lacks essential validation. Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Relevant evidence is dNS response chain, private endpoint IP, private DNS zone records and VNet links.
C:An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address.
D:An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. Replace the endpoint private IP with an arbitrary public address in private DNS.
Question 397
Two peered VNets use a private Azure SQL endpoint but only one VNet has access to the corresponding private DNS zone. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine dNS response chain, private endpoint IP, private DNS zone records and VNet links.
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine the name of a firewall policy without its applied match and request logs.
- In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
Explanation
Correct Answer
A:These records test the actual private DNS zone for Private Link behavior rather than an unrelated dashboard state. The intended action is: Link the correct Private DNS zone to each authorized VNet and verify resource records.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. In the given case, two peered VNets use a private Azure SQL endpoint but only one VNet has access to the corresponding private DNS zone.
C:The more relevant observations are: DNS response chain, private endpoint IP, private DNS zone records and VNet links.
D:A healthy network interface without the evaluated NSG, route or private endpoint.
Question 398
Two peered VNets use a private Azure SQL endpoint but only one VNet has access to the corresponding private DNS zone. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
- The applicable security principle is that Private Endpoint connectivity typically depends on correct service-specific private DNS resolution.
- The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
Explanation
Correct Answer
B:This principle supports the security response: Link the correct Private DNS zone to each authorized VNet and verify resource records.
Incorrect Answers
A:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for private DNS zone for Private Link. The relevant security behavior is: Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Check evidence such as dNS response chain, private endpoint IP, private DNS zone records and VNet links.
C:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for private DNS zone for Private Link. The relevant security behavior is: Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Check evidence such as dNS response chain, private endpoint IP, private DNS zone records and VNet links.
D:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for private DNS zone for Private Link. The relevant security behavior is: Private Endpoint connectivity typically depends on correct service-specific private DNS resolution. Check evidence such as dNS response chain, private endpoint IP, private DNS zone records and VNet links.
Question 399
Two peered VNets use a private Azure SQL endpoint but only one VNet has access to the corresponding private DNS zone. Suppose the operator instead follows this unsafe shortcut: Replace the endpoint private IP with an arbitrary public address in private DNS. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that an approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address.
- The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
Explanation
Correct Answer
C:The suitable control is: Link the correct Private DNS zone to each authorized VNet and verify resource records. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real private DNS zone for Private Link weakness after the shortcut. In the given case, two peered VNets use a private Azure SQL endpoint but only one VNet has access to the corresponding private DNS zone.
B:This does not explain the real private DNS zone for Private Link weakness after the shortcut. The failure consists only of retaining valid network flow logs.
D:This does not explain the real private DNS zone for Private Link weakness after the shortcut. The root problem was using a permitted endpoint reachability test.
Question 400
Two peered VNets use a private Azure SQL endpoint but only one VNet has access to the corresponding private DNS zone. A review identifies this consequence: An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to disable name resolution entirely to force private IP selection.
- The controlled remediation is to replace the endpoint private IP with an arbitrary public address in private DNS.
- The controlled remediation is to assume private endpoint creation guarantees automatic DNS for every remote resolver.
- The controlled remediation is to fix DNS records and VNet links and test endpoint resolution and connectivity.
Explanation
Correct Answer
D:Test using these records: DNS response chain, private endpoint IP, private DNS zone records and VNet links. Private Endpoint connectivity typically depends on correct service-specific private DNS resolution.
Incorrect Answers
A:Disable name resolution entirely to force private IP selection. This would not reliably restore the intended security boundary. An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. The appropriate controlled recovery is: Fix DNS records and VNet links and test endpoint resolution and connectivity.
B:Replace the endpoint private IP with an arbitrary public address in private DNS. This would not reliably restore the intended security boundary. An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. The appropriate controlled recovery is: Fix DNS records and VNet links and test endpoint resolution and connectivity.
C:Assume private endpoint creation guarantees automatic DNS for every remote resolver. This would not reliably restore the intended security boundary. An approved private link cannot ensure clients choose the private endpoint when DNS still returns a public address. The appropriate controlled recovery is: Fix DNS records and VNet links and test endpoint resolution and connectivity.
