Microsoft AZ-500 Practice Test 43
Question 420
A Function App can invoke public APIs but its outbound traffic does not take the intended private network route. A review identifies this consequence: Adding only an inbound private endpoint does not automatically route application egress into the VNet. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to enable an unrelated Application Gateway listener to change the app's outbound source.
- The controlled remediation is to create only an inbound App Service private endpoint and assume it fixes all outbound calls.
- The controlled remediation is to permit every SQL public IP instead of validating VNet integration.
- The controlled remediation is to correct VNet integration and routing then validate outbound private service access.
Explanation
Correct Answer
D:App Service virtual network integration mainly enables outbound connectivity from the hosted app to integrated VNet resources. Test using these records: App Service VNet integration setting, route configuration, destination DNS and connectivity logs.
Incorrect Answers
A:Enable an unrelated Application Gateway listener to change the app's outbound source. This would not reliably restore the intended security boundary. Adding only an inbound private endpoint does not automatically route application egress into the VNet. The appropriate controlled recovery is: Correct VNet integration and routing then validate outbound private service access.
B:Create only an inbound App Service private endpoint and assume it fixes all outbound calls. This would not reliably restore the intended security boundary. Adding only an inbound private endpoint does not automatically route application egress into the VNet. The appropriate controlled recovery is: Correct VNet integration and routing then validate outbound private service access.
C:Permit every SQL public IP instead of validating VNet integration. This would not reliably restore the intended security boundary. Adding only an inbound private endpoint does not automatically route application egress into the VNet. The appropriate controlled recovery is: Correct VNet integration and routing then validate outbound private service access.
Question 421
An internal employee portal should be accessible only from a private corporate network but its App Service default hostname is public. Which operator action best meets this technical requirement?
- Enable only outbound VNet integration and assume the App Service public listener disappears.
- Use an NSG rule on a separate VM as the sole App Service inbound protection.
- Expose the app publicly and rely on hidden DNS names for isolation.
- Configure an approved inbound Private Endpoint for App Service and appropriately restrict public network access.
Explanation
Correct Answer
D:Confirm the change against these records: Private endpoint approval, app private DNS mapping, public network setting and test inbound path. App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Incorrect Answers
A:Enabling outbound integration alone does not make the app's inbound listener private. Enable only outbound VNet integration and assume the App Service public listener disappears.
B:That option would use an NSG rule on a separate VM as the sole App Service inbound protection, but it addresses a different concern. Confirm the change against these records: Private endpoint approval, app private DNS mapping, public network setting and test inbound path.
C:Enabling outbound integration alone does not make the app's inbound listener private. The intended action is: Configure an approved inbound Private Endpoint for App Service and appropriately restrict public network access.
Question 422
An internal employee portal should be accessible only from a private corporate network but its App Service default hostname is public. Which collection of observations most directly tests the suspected cause?
- Private endpoint approval, app private DNS mapping, public network setting and test inbound path.
- A healthy network interface without the evaluated NSG, route or private endpoint.
- A public DNS response that does not show the intended private service path.
- The name of a firewall policy without its applied match and request logs.
Explanation
Correct Answer
A:These records test the actual App Service inbound Private Endpoint behavior rather than an unrelated dashboard state. App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Incorrect Answers
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Private endpoint approval, app private DNS mapping, public network setting and test inbound path.
C:On its own, that evidence does not prove the specified security control works. App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
D:On its own, that evidence does not prove the specified security control works. In the given case, an internal employee portal should be accessible only from a private corporate network but its App Service default hostname is public.
Question 423
An internal employee portal should be accessible only from a private corporate network but its App Service default hostname is public. Which statement most accurately explains this scenario?
- Successful public name resolution proves that all traffic uses Private Link.
- A network appliance presence guarantees the effective route traverses it.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Explanation
Correct Answer
D:Confirmation depends on Private endpoint approval, app private DNS mapping, public network setting and test inbound path. This principle supports the security response: Configure an approved inbound Private Endpoint for App Service and appropriately restrict public network access.
Incorrect Answers
A:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for App Service inbound Private Endpoint. The relevant security behavior is: App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions. Check evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
B:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for App Service inbound Private Endpoint. The relevant security behavior is: App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions. Check evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
C:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for App Service inbound Private Endpoint. The relevant security behavior is: App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions. Check evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
Question 424
An internal employee portal should be accessible only from a private corporate network but its App Service default hostname is public. Suppose the operator instead follows this unsafe shortcut: Enable only outbound VNet integration and assume the App Service public listener disappears. What is the principal technical consequence of the mistaken choice?
- Enabling outbound integration alone does not make the app's inbound listener private.
- The root problem was using a permitted endpoint reachability test.
- The investigation itself created the pre-existing private DNS or route mismatch.
- The failure consists only of retaining valid network flow logs.
Explanation
Correct Answer
A:The suitable control is: Configure an approved inbound Private Endpoint for App Service and appropriately restrict public network access. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:The root problem was using a permitted endpoint reachability test. This does not explain the real App Service inbound Private Endpoint weakness after the shortcut. The material failure is: Enabling outbound integration alone does not make the app's inbound listener private. Inspect evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
C:The investigation itself created the pre-existing private DNS or route mismatch. This does not explain the real App Service inbound Private Endpoint weakness after the shortcut. The material failure is: Enabling outbound integration alone does not make the app's inbound listener private. Inspect evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
D:The failure consists only of retaining valid network flow logs. This does not explain the real App Service inbound Private Endpoint weakness after the shortcut. The material failure is: Enabling outbound integration alone does not make the app's inbound listener private. Inspect evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
Question 425
An internal employee portal should be accessible only from a private corporate network but its App Service default hostname is public. A review identifies this consequence: Enabling outbound integration alone does not make the app's inbound listener private. Which recovery action restores the intended control and validates its effect?
- Add the correct inbound private link and confirm the public path is restricted as required.
- Use an NSG rule on a separate VM as the sole App Service inbound protection.
- Expose the app publicly and rely on hidden DNS names for isolation.
- Enable only outbound VNet integration and assume the App Service public listener disappears.
Explanation
Correct Answer
A:Test using these records: Private endpoint approval, app private DNS mapping, public network setting and test inbound path. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:That option would use an NSG rule on a separate VM as the sole App Service inbound protection, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
C:Expose the app publicly and rely on hidden DNS names for isolation. This would not reliably restore the intended security boundary. Enabling outbound integration alone does not make the app's inbound listener private. The appropriate controlled recovery is: Add the correct inbound private link and confirm the public path is restricted as required.
D:That option would enable only outbound VNet integration and assume the App Service public listener disappears, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
Question 426
A Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint. What is the most defensible Azure security action?
- For this Azure workload, the team should use an NSG rule on a separate VM as the sole App Service inbound protection.
- For this Azure workload, the team should expose the app publicly and rely on hidden DNS names for isolation.
- For this Azure workload, the team should configure an approved inbound Private Endpoint for App Service and appropriately restrict public network access.
- For this Azure workload, the team should enable only outbound VNet integration and assume the App Service public listener disappears.
Explanation
Correct Answer
C:Confirm the change against these records: Private endpoint approval, app private DNS mapping, public network setting and test inbound path.
Incorrect Answers
A:Use an NSG rule on a separate VM as the sole App Service inbound protection. The proposed change targets the wrong mechanism or lacks essential validation. App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions. Relevant evidence is private endpoint approval, app private DNS mapping, public network setting and test inbound path.
B:Enabling outbound integration alone does not make the app's inbound listener private. In the given case, a Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint.
D:Enable only outbound VNet integration and assume the App Service public listener disappears.
Question 427
A Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint. Which diagnostic record would most strongly confirm the result?
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
- In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine private endpoint approval, app private DNS mapping, public network setting and test inbound path.
Explanation
Correct Answer
D:These records test the actual App Service inbound Private Endpoint behavior rather than an unrelated dashboard state. The intended action is: Configure an approved inbound Private Endpoint for App Service and appropriately restrict public network access.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint.
B:The more relevant observations are: Private endpoint approval, app private DNS mapping, public network setting and test inbound path.
C:App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Question 428
A Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint. Which platform concept should guide the engineer’s assessment?
- The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Explanation
Correct Answer
D:Confirmation depends on Private endpoint approval, app private DNS mapping, public network setting and test inbound path.
Incorrect Answers
A:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for App Service inbound Private Endpoint. The relevant security behavior is: App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions. Check evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
B:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for App Service inbound Private Endpoint. The relevant security behavior is: App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions. Check evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
C:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for App Service inbound Private Endpoint. The relevant security behavior is: App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions. Check evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
Question 429
A Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint. Suppose the operator instead follows this unsafe shortcut: Enable only outbound VNet integration and assume the App Service public listener disappears. Which root-cause observation follows from that incorrect change?
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
- The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
- The resulting security weakness is that enabling outbound integration alone does not make the app's inbound listener private.
Explanation
Correct Answer
D:The suitable control is: Configure an approved inbound Private Endpoint for App Service and appropriately restrict public network access. App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Incorrect Answers
A:The failure consists only of retaining valid network flow logs. This does not explain the real App Service inbound Private Endpoint weakness after the shortcut. The material failure is: Enabling outbound integration alone does not make the app's inbound listener private. Inspect evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
B:A VNet diagram label alone explains the blocked or uninspected traffic. This does not explain the real App Service inbound Private Endpoint weakness after the shortcut. The material failure is: Enabling outbound integration alone does not make the app's inbound listener private. Inspect evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
C:The investigation itself created the pre-existing private DNS or route mismatch. This does not explain the real App Service inbound Private Endpoint weakness after the shortcut. The material failure is: Enabling outbound integration alone does not make the app's inbound listener private. Inspect evidence such as private endpoint approval, app private DNS mapping, public network setting and test inbound path.
Question 430
A Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint. A review identifies this consequence: Enabling outbound integration alone does not make the app's inbound listener private. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to add the correct inbound private link and confirm the public path is restricted as required.
- The controlled remediation is to expose the app publicly and rely on hidden DNS names for isolation.
- The controlled remediation is to enable only outbound VNet integration and assume the App Service public listener disappears.
- The controlled remediation is to use an NSG rule on a separate VM as the sole App Service inbound protection.
Explanation
Correct Answer
A:Test using these records: Private endpoint approval, app private DNS mapping, public network setting and test inbound path. App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Incorrect Answers
B:Expose the app publicly and rely on hidden DNS names for isolation. This would not reliably restore the intended security boundary. Enabling outbound integration alone does not make the app's inbound listener private. The appropriate controlled recovery is: Add the correct inbound private link and confirm the public path is restricted as required.
C:Enable only outbound VNet integration and assume the App Service public listener disappears. This would not reliably restore the intended security boundary. Enabling outbound integration alone does not make the app's inbound listener private. The appropriate controlled recovery is: Add the correct inbound private link and confirm the public path is restricted as required.
D:Use an NSG rule on a separate VM as the sole App Service inbound protection. This would not reliably restore the intended security boundary. Enabling outbound integration alone does not make the app's inbound listener private. The appropriate controlled recovery is: Add the correct inbound private link and confirm the public path is restricted as required.
