Microsoft AZ-500 Practice Test 44
Question 430
A Function App webhook is expected to receive inbound calls through a private IP instead of a public endpoint. A review identifies this consequence: Enabling outbound integration alone does not make the app's inbound listener private. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to add the correct inbound private link and confirm the public path is restricted as required.
- The controlled remediation is to expose the app publicly and rely on hidden DNS names for isolation.
- The controlled remediation is to enable only outbound VNet integration and assume the App Service public listener disappears.
- The controlled remediation is to use an NSG rule on a separate VM as the sole App Service inbound protection.
Explanation
Correct Answer
A:Test using these records: Private endpoint approval, app private DNS mapping, public network setting and test inbound path. App Service inbound Private Endpoint and outbound VNet integration solve different traffic directions.
Incorrect Answers
B:Expose the app publicly and rely on hidden DNS names for isolation. This would not reliably restore the intended security boundary. Enabling outbound integration alone does not make the app's inbound listener private. The appropriate controlled recovery is: Add the correct inbound private link and confirm the public path is restricted as required.
C:Enable only outbound VNet integration and assume the App Service public listener disappears. This would not reliably restore the intended security boundary. Enabling outbound integration alone does not make the app's inbound listener private. The appropriate controlled recovery is: Add the correct inbound private link and confirm the public path is restricted as required.
D:Use an NSG rule on a separate VM as the sole App Service inbound protection. This would not reliably restore the intended security boundary. Enabling outbound integration alone does not make the app's inbound listener private. The appropriate controlled recovery is: Add the correct inbound private link and confirm the public path is restricted as required.
Question 431
An App Service should only accept calls from a trusted front door but the default endpoint still accepts requests from arbitrary IPs. What is the most defensible Azure security action?
- Rely on a user-defined route to control every inbound App Service HTTP source.
- Set a public DNS alias instead of enforcing network access restrictions.
- Apply App Service access restriction rules and test the correct app endpoint or deployment slot.
- Assume a firewall policy on a disconnected VNet protects the public App Service hostname.
Explanation
Correct Answer
C:Confirm the change against these records: Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests. App Service access restrictions evaluate incoming requests to the configured app endpoint.
Incorrect Answers
A:An incomplete or incorrectly scoped allowlist can leave unintended public ingress. In the given case, an App Service should only accept calls from a trusted front door but the default endpoint still accepts requests from arbitrary IPs.
B:Set a public DNS alias instead of enforcing network access restrictions. The proposed change targets the wrong mechanism or lacks essential validation. App Service access restrictions evaluate incoming requests to the configured app endpoint. Relevant evidence is effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
D:An incomplete or incorrectly scoped allowlist can leave unintended public ingress. The intended action is: Apply App Service access restriction rules and test the correct app endpoint or deployment slot.
Question 432
An App Service should only accept calls from a trusted front door but the default endpoint still accepts requests from arbitrary IPs. Which diagnostic record would most strongly confirm the result?
- A static virtual network diagram with no effective route or packet observation.
- A successful connection to a different address and different service port.
- A public DNS response that does not show the intended private service path.
- Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
Explanation
Correct Answer
D:These records test the actual App Service access restrictions behavior rather than an unrelated dashboard state. App Service access restrictions evaluate incoming requests to the configured app endpoint.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
B:On its own, that evidence does not prove the specified security control works. App Service access restrictions evaluate incoming requests to the configured app endpoint.
C:On its own, that evidence does not prove the specified security control works. In the given case, an App Service should only accept calls from a trusted front door but the default endpoint still accepts requests from arbitrary IPs.
Question 433
An App Service should only accept calls from a trusted front door but the default endpoint still accepts requests from arbitrary IPs. Which platform concept should guide the engineer’s assessment?
- App Service access restrictions evaluate incoming requests to the configured app endpoint.
- An HTTP load balancer automatically inspects every malicious request as a WAF.
- Successful public name resolution proves that all traffic uses Private Link.
- Creating a virtual network peering link makes all other Azure VNets transitively reachable.
Explanation
Correct Answer
A:Confirmation depends on Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests. This principle supports the security response: Apply App Service access restriction rules and test the correct app endpoint or deployment slot.
Incorrect Answers
B:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for App Service access restrictions. The relevant security behavior is: App Service access restrictions evaluate incoming requests to the configured app endpoint. Check evidence such as effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
C:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for App Service access restrictions. The relevant security behavior is: App Service access restrictions evaluate incoming requests to the configured app endpoint. Check evidence such as effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
D:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for App Service access restrictions. The relevant security behavior is: App Service access restrictions evaluate incoming requests to the configured app endpoint. Check evidence such as effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
Question 434
An App Service should only accept calls from a trusted front door but the default endpoint still accepts requests from arbitrary IPs. Suppose the operator instead follows this unsafe shortcut: Rely on a user-defined route to control every inbound App Service HTTP source. Which root-cause observation follows from that incorrect change?
- An incomplete or incorrectly scoped allowlist can leave unintended public ingress.
- The failure consists only of retaining valid network flow logs.
- A VNet diagram label alone explains the blocked or uninspected traffic.
- Changing a resource description fixes every underlying transport rule.
Explanation
Correct Answer
A:The suitable control is: Apply App Service access restriction rules and test the correct app endpoint or deployment slot. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:This does not explain the real App Service access restrictions weakness after the shortcut. The material failure is: An incomplete or incorrectly scoped allowlist can leave unintended public ingress.
C:This does not explain the real App Service access restrictions weakness after the shortcut. Inspect evidence such as effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
D:This does not explain the real App Service access restrictions weakness after the shortcut. Changing a resource description fixes every underlying transport rule.
Question 435
An App Service should only accept calls from a trusted front door but the default endpoint still accepts requests from arbitrary IPs. A review identifies this consequence: An incomplete or incorrectly scoped allowlist can leave unintended public ingress. Which recovery action addresses the underlying technical fault?
- Correct the access restriction and verify both trusted and untrusted client behavior.
- Set a public DNS alias instead of enforcing network access restrictions.
- Assume a firewall policy on a disconnected VNet protects the public App Service hostname.
- Rely on a user-defined route to control every inbound App Service HTTP source.
Explanation
Correct Answer
A:Test using these records: Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
B:Set a public DNS alias instead of enforcing network access restrictions. This would not reliably restore the intended security boundary. An incomplete or incorrectly scoped allowlist can leave unintended public ingress. The appropriate controlled recovery is: Correct the access restriction and verify both trusted and untrusted client behavior.
C:Assume a firewall policy on a disconnected VNet protects the public App Service hostname. This would not reliably restore the intended security boundary. An incomplete or incorrectly scoped allowlist can leave unintended public ingress. The appropriate controlled recovery is: Correct the access restriction and verify both trusted and untrusted client behavior.
D:Rely on a user-defined route to control every inbound App Service HTTP source. This would not reliably restore the intended security boundary. An incomplete or incorrectly scoped allowlist can leave unintended public ingress. The appropriate controlled recovery is: Correct the access restriction and verify both trusted and untrusted client behavior.
Question 436
A public application has an IP allowlist yet access restrictions are applied to the wrong site or slot. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should apply App Service access restriction rules and test the correct app endpoint or deployment slot.
- For this Azure workload, the team should set a public DNS alias instead of enforcing network access restrictions.
- For this Azure workload, the team should assume a firewall policy on a disconnected VNet protects the public App Service hostname.
- For this Azure workload, the team should rely on a user-defined route to control every inbound App Service HTTP source.
Explanation
Correct Answer
A:Confirm the change against these records: Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
Incorrect Answers
B:Set a public DNS alias instead of enforcing network access restrictions. The proposed change targets the wrong mechanism or lacks essential validation. App Service access restrictions evaluate incoming requests to the configured app endpoint. Relevant evidence is effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
C:An incomplete or incorrectly scoped allowlist can leave unintended public ingress. Assume a firewall policy on a disconnected VNet protects the public App Service hostname.
D:An incomplete or incorrectly scoped allowlist can leave unintended public ingress. Rely on a user-defined route to control every inbound App Service HTTP source.
Question 437
A public application has an IP allowlist yet access restrictions are applied to the wrong site or slot. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine the name of a firewall policy without its applied match and request logs.
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
- In this security review, examine a successful connection to a different address and different service port.
- In this security review, examine effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
Explanation
Correct Answer
D:These records test the actual App Service access restrictions behavior rather than an unrelated dashboard state. The intended action is: Apply App Service access restriction rules and test the correct app endpoint or deployment slot.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a public application has an IP allowlist yet access restrictions are applied to the wrong site or slot.
B:The more relevant observations are: Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
C:App Service access restrictions evaluate incoming requests to the configured app endpoint.
Question 438
A public application has an IP allowlist yet access restrictions are applied to the wrong site or slot. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that App Service access restrictions evaluate incoming requests to the configured app endpoint.
- The applicable security principle is that an HTTP load balancer automatically inspects every malicious request as a WAF.
- The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
Explanation
Correct Answer
B:Confirmation depends on Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
Incorrect Answers
A:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for App Service access restrictions. The relevant security behavior is: App Service access restrictions evaluate incoming requests to the configured app endpoint. Check evidence such as effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
C:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for App Service access restrictions. The relevant security behavior is: App Service access restrictions evaluate incoming requests to the configured app endpoint. Check evidence such as effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
D:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for App Service access restrictions. The relevant security behavior is: App Service access restrictions evaluate incoming requests to the configured app endpoint. Check evidence such as effective access restriction rule order, requested source, headers as appropriate and HTTP response tests.
Question 439
A public application has an IP allowlist yet access restrictions are applied to the wrong site or slot. Suppose the operator instead follows this unsafe shortcut: Rely on a user-defined route to control every inbound App Service HTTP source. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that an incomplete or incorrectly scoped allowlist can leave unintended public ingress.
- The resulting security weakness is that changing a resource description fixes every underlying transport rule.
- The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
Explanation
Correct Answer
A:The suitable control is: Apply App Service access restriction rules and test the correct app endpoint or deployment slot. App Service access restrictions evaluate incoming requests to the configured app endpoint.
Incorrect Answers
B:This does not explain the real App Service access restrictions weakness after the shortcut. In the given case, a public application has an IP allowlist yet access restrictions are applied to the wrong site or slot.
C:This does not explain the real App Service access restrictions weakness after the shortcut. The root problem was using a permitted endpoint reachability test.
D:This does not explain the real App Service access restrictions weakness after the shortcut. A VNet diagram label alone explains the blocked or uninspected traffic.
Question 440
A public application has an IP allowlist yet access restrictions are applied to the wrong site or slot. A review identifies this consequence: An incomplete or incorrectly scoped allowlist can leave unintended public ingress. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to correct the access restriction and verify both trusted and untrusted client behavior.
- The controlled remediation is to assume a firewall policy on a disconnected VNet protects the public App Service hostname.
- The controlled remediation is to rely on a user-defined route to control every inbound App Service HTTP source.
- The controlled remediation is to set a public DNS alias instead of enforcing network access restrictions.
Explanation
Correct Answer
A:Test using these records: Effective access restriction rule order, requested source, headers as appropriate and HTTP response tests. App Service access restrictions evaluate incoming requests to the configured app endpoint.
Incorrect Answers
B:Assume a firewall policy on a disconnected VNet protects the public App Service hostname. This would not reliably restore the intended security boundary. An incomplete or incorrectly scoped allowlist can leave unintended public ingress. The appropriate controlled recovery is: Correct the access restriction and verify both trusted and untrusted client behavior.
C:Rely on a user-defined route to control every inbound App Service HTTP source. This would not reliably restore the intended security boundary. An incomplete or incorrectly scoped allowlist can leave unintended public ingress. The appropriate controlled recovery is: Correct the access restriction and verify both trusted and untrusted client behavior.
D:Set a public DNS alias instead of enforcing network access restrictions. This would not reliably restore the intended security boundary. An incomplete or incorrectly scoped allowlist can leave unintended public ingress. The appropriate controlled recovery is: Correct the access restriction and verify both trusted and untrusted client behavior.
