Microsoft AZ-500 Practice Test 48
Question 470
A security team needs centralized HTTP reverse proxy routing plus WAF protection for a regional app. A review identifies this consequence: An ordinary network load balancer does not automatically apply OWASP-style HTTP protection. Which recovery action addresses the underlying technical fault?
- The controlled remediation is to permit every backend HTTP request to bypass WAF for simpler routing.
- The controlled remediation is to use only an NSG to inspect SQL injection payloads in HTTP bodies.
- The controlled remediation is to enable a plain load balancer and call it a web application firewall.
- The controlled remediation is to configure and tune the WAF policy and verify legitimate traffic and blocked attack patterns.
Explanation
Correct Answer
D:Application Gateway WAF inspects Layer 7 web requests and is distinct from general IP and port filtering. Test using these records: WAF policy match, listener configuration, backend health and blocked versus allowed HTTP requests.
Incorrect Answers
A:Permit every backend HTTP request to bypass WAF for simpler routing. This would not reliably restore the intended security boundary. An ordinary network load balancer does not automatically apply OWASP-style HTTP protection. The appropriate controlled recovery is: Configure and tune the WAF policy and verify legitimate traffic and blocked attack patterns.
B:Use only an NSG to inspect SQL injection payloads in HTTP bodies. This would not reliably restore the intended security boundary. An ordinary network load balancer does not automatically apply OWASP-style HTTP protection. The appropriate controlled recovery is: Configure and tune the WAF policy and verify legitimate traffic and blocked attack patterns.
C:Enable a plain load balancer and call it a web application firewall. This would not reliably restore the intended security boundary. An ordinary network load balancer does not automatically apply OWASP-style HTTP protection. The appropriate controlled recovery is: Configure and tune the WAF policy and verify legitimate traffic and blocked attack patterns.
Question 471
An internet application deployed across regions needs global edge WAF enforcement and fast regional failover. What is the most defensible Azure security action?
- Assume an origin VM NSG inspects requests before Front Door receives them.
- Attach a WAF policy to an unused Front Door endpoint and consider production protected.
- Attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
- Turn off Front Door origin authentication to permit all direct origin traffic.
Explanation
Correct Answer
C:Confirm the change against these records: Front Door endpoint and route settings, security policy association, WAF logs and backend health. Azure Front Door can enforce web security at a global edge independently of regional backends.
Incorrect Answers
A:That option would assume an origin VM NSG inspects requests before Front Door receives them, but it addresses a different concern. Azure Front Door can enforce web security at a global edge independently of regional backends.
B:Attach a WAF policy to an unused Front Door endpoint and consider production protected. The proposed change targets the wrong mechanism or lacks essential validation. Azure Front Door can enforce web security at a global edge independently of regional backends. Relevant evidence is front Door endpoint and route settings, security policy association, WAF logs and backend health.
D:Turn off Front Door origin authentication to permit all direct origin traffic. This leaves the security requirement unresolved. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The intended action is: Attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
Question 472
An internet application deployed across regions needs global edge WAF enforcement and fast regional failover. Which diagnostic record would most strongly confirm the result?
- A healthy network interface without the evaluated NSG, route or private endpoint.
- A public DNS response that does not show the intended private service path.
- Front Door endpoint and route settings, security policy association, WAF logs and backend health.
- The name of a firewall policy without its applied match and request logs.
Explanation
Correct Answer
C:These records test the actual Azure Front Door global WAF policy behavior rather than an unrelated dashboard state. Azure Front Door can enforce web security at a global edge independently of regional backends.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Azure Front Door can enforce web security at a global edge independently of regional backends.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: Front Door endpoint and route settings, security policy association, WAF logs and backend health.
D:On its own, that evidence does not prove the specified security control works. In the given case, an internet application deployed across regions needs global edge WAF enforcement and fast regional failover.
Question 473
An internet application deployed across regions needs global edge WAF enforcement and fast regional failover. Which platform concept should guide the engineer’s assessment?
- Successful public name resolution proves that all traffic uses Private Link.
- Azure Front Door can enforce web security at a global edge independently of regional backends.
- A network appliance presence guarantees the effective route traverses it.
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
Explanation
Correct Answer
B:Confirmation depends on Front Door endpoint and route settings, security policy association, WAF logs and backend health. This principle supports the security response: Attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
Incorrect Answers
A:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for Azure Front Door global WAF policy. The relevant security behavior is: Azure Front Door can enforce web security at a global edge independently of regional backends. Check evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
C:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for Azure Front Door global WAF policy. The relevant security behavior is: Azure Front Door can enforce web security at a global edge independently of regional backends. Check evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
D:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for Azure Front Door global WAF policy. The relevant security behavior is: Azure Front Door can enforce web security at a global edge independently of regional backends. Check evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
Question 474
An internet application deployed across regions needs global edge WAF enforcement and fast regional failover. Suppose the operator instead follows this unsafe shortcut: Assume an origin VM NSG inspects requests before Front Door receives them. Which root-cause observation follows from that incorrect change?
- The root problem was using a permitted endpoint reachability test.
- A WAF policy that is not bound to the active Front Door route will not protect requests through that edge.
- The investigation itself created the pre-existing private DNS or route mismatch.
- The failure consists only of retaining valid network flow logs.
Explanation
Correct Answer
B:The suitable control is: Attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
Incorrect Answers
A:This does not explain the real Azure Front Door global WAF policy weakness after the shortcut. The material failure is: A WAF policy that is not bound to the active Front Door route will not protect requests through that edge.
C:This does not explain the real Azure Front Door global WAF policy weakness after the shortcut. Inspect evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
D:This does not explain the real Azure Front Door global WAF policy weakness after the shortcut. The failure consists only of retaining valid network flow logs.
Question 475
An internet application deployed across regions needs global edge WAF enforcement and fast regional failover. A review identifies this consequence: A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. Which recovery action addresses the underlying technical fault?
- Attach a WAF policy to an unused Front Door endpoint and consider production protected.
- Turn off Front Door origin authentication to permit all direct origin traffic.
- Correct policy association and test regional failover and web attack filtering.
- Assume an origin VM NSG inspects requests before Front Door receives them.
Explanation
Correct Answer
C:Test using these records: Front Door endpoint and route settings, security policy association, WAF logs and backend health. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Attach a WAF policy to an unused Front Door endpoint and consider production protected. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
B:Turn off Front Door origin authentication to permit all direct origin traffic. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
D:Assume an origin VM NSG inspects requests before Front Door receives them. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
Question 476
A security architect applies a regional Application Gateway policy but the global Front Door route lacks the intended web protection. What is the BEST supported implementation or corrective action?
- For this Azure workload, the team should attach a WAF policy to an unused Front Door endpoint and consider production protected.
- For this Azure workload, the team should turn off Front Door origin authentication to permit all direct origin traffic.
- For this Azure workload, the team should attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
- For this Azure workload, the team should assume an origin VM NSG inspects requests before Front Door receives them.
Explanation
Correct Answer
C:Confirm the change against these records: Front Door endpoint and route settings, security policy association, WAF logs and backend health. This directly addresses Azure Front Door global WAF policy.
Incorrect Answers
A:Azure Front Door can enforce web security at a global edge independently of regional backends. The proposed change targets the wrong mechanism or lacks essential validation.
B:Turn off Front Door origin authentication to permit all direct origin traffic. This leaves the security requirement unresolved. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The intended action is: Attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
D:Assume an origin VM NSG inspects requests before Front Door receives them. This is not a valid substitute for the specified security control. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The correct targeted action is: Attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
Question 477
A security architect applies a regional Application Gateway policy but the global Front Door route lacks the intended web protection. Which evidence BEST verifies the intended technical behavior?
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
- In this security review, examine front Door endpoint and route settings, security policy association, WAF logs and backend health.
- In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
- In this security review, examine a public DNS response that does not show the intended private service path.
Explanation
Correct Answer
B:These records test the actual Azure Front Door global WAF policy behavior rather than an unrelated dashboard state. The intended action is: Attach the appropriate Azure Front Door WAF policy and route configuration at the global edge.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a security architect applies a regional Application Gateway policy but the global Front Door route lacks the intended web protection.
C:Azure Front Door can enforce web security at a global edge independently of regional backends.
D:The more relevant observations are: Front Door endpoint and route settings, security policy association, WAF logs and backend health.
Question 478
A security architect applies a regional Application Gateway policy but the global Front Door route lacks the intended web protection. Which principle BEST explains why the recommended solution is appropriate?
- The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that Azure Front Door can enforce web security at a global edge independently of regional backends.
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
Explanation
Correct Answer
C:Confirmation depends on Front Door endpoint and route settings, security policy association, WAF logs and backend health. Azure Front Door can enforce web security at a global edge independently of regional backends.
Incorrect Answers
A:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for Azure Front Door global WAF policy. The relevant security behavior is: Azure Front Door can enforce web security at a global edge independently of regional backends. Check evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
B:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for Azure Front Door global WAF policy. The relevant security behavior is: Azure Front Door can enforce web security at a global edge independently of regional backends. Check evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
D:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for Azure Front Door global WAF policy. The relevant security behavior is: Azure Front Door can enforce web security at a global edge independently of regional backends. Check evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
Question 479
A security architect applies a regional Application Gateway policy but the global Front Door route lacks the intended web protection. Suppose the operator instead follows this unsafe shortcut: Assume an origin VM NSG inspects requests before Front Door receives them. What is the MOST significant failure introduced by that shortcut?
- The resulting security weakness is that a WAF policy that is not bound to the active Front Door route will not protect requests through that edge.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
- The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
Explanation
Correct Answer
A:Azure Front Door can enforce web security at a global edge independently of regional backends. This is a material consequence of the incorrect shortcut.
Incorrect Answers
B:The failure consists only of retaining valid network flow logs. This does not explain the real Azure Front Door global WAF policy weakness after the shortcut. The material failure is: A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. Inspect evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
C:A VNet diagram label alone explains the blocked or uninspected traffic. This does not explain the real Azure Front Door global WAF policy weakness after the shortcut. The material failure is: A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. Inspect evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
D:The investigation itself created the pre-existing private DNS or route mismatch. This does not explain the real Azure Front Door global WAF policy weakness after the shortcut. The material failure is: A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. Inspect evidence such as front Door endpoint and route settings, security policy association, WAF logs and backend health.
Question 480
A security architect applies a regional Application Gateway policy but the global Front Door route lacks the intended web protection. A review identifies this consequence: A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to turn off Front Door origin authentication to permit all direct origin traffic.
- The controlled remediation is to assume an origin VM NSG inspects requests before Front Door receives them.
- The controlled remediation is to correct policy association and test regional failover and web attack filtering.
- The controlled remediation is to attach a WAF policy to an unused Front Door endpoint and consider production protected.
Explanation
Correct Answer
C:Test using these records: Front Door endpoint and route settings, security policy association, WAF logs and backend health. Azure Front Door can enforce web security at a global edge independently of regional backends.
Incorrect Answers
A:Turn off Front Door origin authentication to permit all direct origin traffic. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
B:Assume an origin VM NSG inspects requests before Front Door receives them. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
D:Attach a WAF policy to an unused Front Door endpoint and consider production protected. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
