Microsoft AZ-500 Practice Test 49
Question 480
A security architect applies a regional Application Gateway policy but the global Front Door route lacks the intended web protection. A review identifies this consequence: A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. What is the BEST controlled recovery once this failure is recognized?
- The controlled remediation is to turn off Front Door origin authentication to permit all direct origin traffic.
- The controlled remediation is to assume an origin VM NSG inspects requests before Front Door receives them.
- The controlled remediation is to correct policy association and test regional failover and web attack filtering.
- The controlled remediation is to attach a WAF policy to an unused Front Door endpoint and consider production protected.
Explanation
Correct Answer
C:Test using these records: Front Door endpoint and route settings, security policy association, WAF logs and backend health. Azure Front Door can enforce web security at a global edge independently of regional backends.
Incorrect Answers
A:Turn off Front Door origin authentication to permit all direct origin traffic. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
B:Assume an origin VM NSG inspects requests before Front Door receives them. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
D:Attach a WAF policy to an unused Front Door endpoint and consider production protected. This would not reliably restore the intended security boundary. A WAF policy that is not bound to the active Front Door route will not protect requests through that edge. The appropriate controlled recovery is: Correct policy association and test regional failover and web attack filtering.
Question 481
An internet-facing application public IP is targeted by sustained volumetric traffic and only NSG rules are configured. What is the BEST supported implementation or corrective action?
- Use only application-layer WAF rules to guarantee mitigation of every volumetric flood.
- Disable the public endpoint and treat that as proof DDoS protections are configured.
- Evaluate and enable the appropriate current Azure DDoS protection service for eligible protected public IP resources.
- Assume all private VNet addresses require the same public-IP DDoS plan.
Explanation
Correct Answer
C:Confirm the change against these records: DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals. This directly addresses DDoS protection for public IP resources.
Incorrect Answers
A:WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. Use only application-layer WAF rules to guarantee mitigation of every volumetric flood.
B:Disable the public endpoint and treat that as proof DDoS protections are configured. The proposed change targets the wrong mechanism or lacks essential validation. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Relevant evidence is DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
D:WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The intended action is: Evaluate and enable the appropriate current Azure DDoS protection service for eligible protected public IP resources.
Question 482
An internet-facing application public IP is targeted by sustained volumetric traffic and only NSG rules are configured. Which evidence BEST verifies the intended technical behavior?
- A static virtual network diagram with no effective route or packet observation.
- A successful connection to a different address and different service port.
- A public DNS response that does not show the intended private service path.
- DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
Explanation
Correct Answer
D:These records test the actual DDoS protection for public IP resources behavior rather than an unrelated dashboard state. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. The more relevant observations are: DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
B:On its own, that evidence does not prove the specified security control works. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
C:On its own, that evidence does not prove the specified security control works. In the given case, an internet-facing application public IP is targeted by sustained volumetric traffic and only NSG rules are configured.
Question 483
An internet-facing application public IP is targeted by sustained volumetric traffic and only NSG rules are configured. Which principle BEST explains why the recommended solution is appropriate?
- An HTTP load balancer automatically inspects every malicious request as a WAF.
- Successful public name resolution proves that all traffic uses Private Link.
- Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
- Creating a virtual network peering link makes all other Azure VNets transitively reachable.
Explanation
Correct Answer
C:Confirmation depends on DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals. This principle supports the security response: Evaluate and enable the appropriate current Azure DDoS protection service for eligible protected public IP resources.
Incorrect Answers
A:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for DDoS protection for public IP resources. The relevant security behavior is: Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Check evidence such as DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
B:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for DDoS protection for public IP resources. The relevant security behavior is: Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Check evidence such as DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
D:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for DDoS protection for public IP resources. The relevant security behavior is: Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Check evidence such as DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
Question 484
An internet-facing application public IP is targeted by sustained volumetric traffic and only NSG rules are configured. Suppose the operator instead follows this unsafe shortcut: Use only application-layer WAF rules to guarantee mitigation of every volumetric flood. What is the MOST significant failure introduced by that shortcut?
- The failure consists only of retaining valid network flow logs.
- A VNet diagram label alone explains the blocked or uninspected traffic.
- WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints.
- Changing a resource description fixes every underlying transport rule.
Explanation
Correct Answer
C:The suitable control is: Evaluate and enable the appropriate current Azure DDoS protection service for eligible protected public IP resources. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real DDoS protection for public IP resources weakness after the shortcut. The material failure is: WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints.
B:This does not explain the real DDoS protection for public IP resources weakness after the shortcut. Inspect evidence such as DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
D:This does not explain the real DDoS protection for public IP resources weakness after the shortcut. Changing a resource description fixes every underlying transport rule.
Question 485
An internet-facing application public IP is targeted by sustained volumetric traffic and only NSG rules are configured. A review identifies this consequence: WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. What is the BEST controlled recovery once this failure is recognized?
- Disable the public endpoint and treat that as proof DDoS protections are configured.
- Assume all private VNet addresses require the same public-IP DDoS plan.
- Apply the appropriate protection tier and verify monitoring and incident response readiness.
- Use only application-layer WAF rules to guarantee mitigation of every volumetric flood.
Explanation
Correct Answer
C:Test using these records: DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:Disable the public endpoint and treat that as proof DDoS protections are configured. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
B:Assume all private VNet addresses require the same public-IP DDoS plan. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
D:Use only application-layer WAF rules to guarantee mitigation of every volumetric flood. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
Question 486
A company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods. Which configuration decision MOST directly resolves the issue?
- For this Azure workload, the team should disable the public endpoint and treat that as proof DDoS protections are configured.
- For this Azure workload, the team should assume all private VNet addresses require the same public-IP DDoS plan.
- For this Azure workload, the team should evaluate and enable the appropriate current Azure DDoS protection service for eligible protected public IP resources.
- For this Azure workload, the team should use only application-layer WAF rules to guarantee mitigation of every volumetric flood.
Explanation
Correct Answer
C:Confirm the change against these records: DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
Incorrect Answers
A:Disable the public endpoint and treat that as proof DDoS protections are configured. The proposed change targets the wrong mechanism or lacks essential validation. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Relevant evidence is DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
B:WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints.
D:Use only application-layer WAF rules to guarantee mitigation of every volumetric flood.
Question 487
A company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods. What evidence most directly confirms the intended security behavior?
- In this security review, examine the name of a firewall policy without its applied match and request logs.
- In this security review, examine a static virtual network diagram with no effective route or packet observation.
- In this security review, examine a successful connection to a different address and different service port.
- In this security review, examine DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
Explanation
Correct Answer
D:These records test the actual DDoS protection for public IP resources behavior rather than an unrelated dashboard state. The intended action is: Evaluate and enable the appropriate current Azure DDoS protection service for eligible protected public IP resources.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, a company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods.
B:The more relevant observations are: DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
C:Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
Question 488
A company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods. Which security principle best explains the intended decision?
- The applicable security principle is that creating a virtual network peering link makes all other Azure VNets transitively reachable.
- The applicable security principle is that an HTTP load balancer automatically inspects every malicious request as a WAF.
- The applicable security principle is that network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
- The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
Explanation
Correct Answer
C:Confirmation depends on DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
Incorrect Answers
A:Creating a virtual network peering link makes all other Azure VNets transitively reachable. This is an incorrect assumption for DDoS protection for public IP resources. The relevant security behavior is: Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Check evidence such as DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
B:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for DDoS protection for public IP resources. The relevant security behavior is: Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Check evidence such as DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
D:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for DDoS protection for public IP resources. The relevant security behavior is: Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering. Check evidence such as DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals.
Question 489
A company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods. Suppose the operator instead follows this unsafe shortcut: Use only application-layer WAF rules to guarantee mitigation of every volumetric flood. Which resulting risk or fault should the reviewer identify?
- The resulting security weakness is that changing a resource description fixes every underlying transport rule.
- The resulting security weakness is that WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints.
- The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
- The resulting security weakness is that a VNet diagram label alone explains the blocked or uninspected traffic.
Explanation
Correct Answer
B:The suitable control is: Evaluate and enable the appropriate current Azure DDoS protection service for eligible protected public IP resources. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
Incorrect Answers
A:This does not explain the real DDoS protection for public IP resources weakness after the shortcut. In the given case, a company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods.
C:This does not explain the real DDoS protection for public IP resources weakness after the shortcut. The root problem was using a permitted endpoint reachability test.
D:This does not explain the real DDoS protection for public IP resources weakness after the shortcut. A VNet diagram label alone explains the blocked or uninspected traffic.
Question 490
A company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods. A review identifies this consequence: WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume all private VNet addresses require the same public-IP DDoS plan.
- The controlled remediation is to use only application-layer WAF rules to guarantee mitigation of every volumetric flood.
- The controlled remediation is to disable the public endpoint and treat that as proof DDoS protections are configured.
- The controlled remediation is to apply the appropriate protection tier and verify monitoring and incident response readiness.
Explanation
Correct Answer
D:Test using these records: DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
Incorrect Answers
A:Assume all private VNet addresses require the same public-IP DDoS plan. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
B:Use only application-layer WAF rules to guarantee mitigation of every volumetric flood. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
C:Disable the public endpoint and treat that as proof DDoS protections are configured. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
