Microsoft AZ-500 Practice Test 50
Question 490
A company hosts critical applications on VNet public IPs and needs managed mitigation of network-layer DDoS floods. A review identifies this consequence: WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. Which remediation most directly restores the intended behavior?
- The controlled remediation is to assume all private VNet addresses require the same public-IP DDoS plan.
- The controlled remediation is to use only application-layer WAF rules to guarantee mitigation of every volumetric flood.
- The controlled remediation is to disable the public endpoint and treat that as proof DDoS protections are configured.
- The controlled remediation is to apply the appropriate protection tier and verify monitoring and incident response readiness.
Explanation
Correct Answer
D:Test using these records: DDoS protection plan or IP protection association, attack telemetry, resource IP and mitigation signals. Network-layer DDoS mitigation addresses volumetric attacks differently from WAF application request filtering.
Incorrect Answers
A:Assume all private VNet addresses require the same public-IP DDoS plan. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
B:Use only application-layer WAF rules to guarantee mitigation of every volumetric flood. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
C:Disable the public endpoint and treat that as proof DDoS protections are configured. This would not reliably restore the intended security boundary. WAF alone does not replace dedicated network-layer DDoS protection for eligible high-risk endpoints. The appropriate controlled recovery is: Apply the appropriate protection tier and verify monitoring and incident response readiness.
Question 491
A VM cannot receive an expected inbound connection and engineers disagree about which NSG rule denied it. Which configuration decision MOST directly resolves the issue?
- Delete every security group before running a specific flow-verification test.
- Assume a successful TCP connection to a different host proves the requested flow is permitted.
- Use Network Watcher IP flow verify and effective NSG rules for the exact source, destination and port.
- Change the VM operating system hostname to resolve an NSG rule denial.
Explanation
Correct Answer
C:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Confirm the change against these records: IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
Incorrect Answers
A:Testing ping alone does not identify the rule responsible for a different port and protocol. In the given case, a VM cannot receive an expected inbound connection and engineers disagree about which NSG rule denied it.
B:That option would assume a successful TCP connection to a different host proves the requested flow is permitted, but it addresses a different concern. Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
D:Testing ping alone does not identify the rule responsible for a different port and protocol. The intended action is: Use Network Watcher IP flow verify and effective NSG rules for the exact source, destination and port.
Question 492
A VM cannot receive an expected inbound connection and engineers disagree about which NSG rule denied it. What evidence most directly confirms the intended security behavior?
- The name of a firewall policy without its applied match and request logs.
- A healthy network interface without the evaluated NSG, route or private endpoint.
- IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
- A successful connection to a different address and different service port.
Explanation
Correct Answer
C:These records test the actual network Watcher IP flow verify behavior rather than an unrelated dashboard state. Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
B:On its own, that evidence does not prove the specified security control works. The more relevant observations are: IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
D:On its own, that evidence does not prove the specified security control works. In the given case, a VM cannot receive an expected inbound connection and engineers disagree about which NSG rule denied it.
Question 493
A VM cannot receive an expected inbound connection and engineers disagree about which NSG rule denied it. Which security principle best explains the intended decision?
- An NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
- An HTTP load balancer automatically inspects every malicious request as a WAF.
- A network appliance presence guarantees the effective route traverses it.
Explanation
Correct Answer
B:Confirmation depends on IP flow verify verdict and rule name, effective NSGs and traffic source and destination. This principle supports the security response: Use Network Watcher IP flow verify and effective NSG rules for the exact source, destination and port.
Incorrect Answers
A:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for network Watcher IP flow verify. The relevant security behavior is: Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Check evidence such as IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
C:An HTTP load balancer automatically inspects every malicious request as a WAF. This is an incorrect assumption for network Watcher IP flow verify. The relevant security behavior is: Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Check evidence such as IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
D:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for network Watcher IP flow verify. The relevant security behavior is: Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Check evidence such as IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
Question 494
A VM cannot receive an expected inbound connection and engineers disagree about which NSG rule denied it. Suppose the operator instead follows this unsafe shortcut: Delete every security group before running a specific flow-verification test. Which resulting risk or fault should the reviewer identify?
- Changing a resource description fixes every underlying transport rule.
- The root problem was using a permitted endpoint reachability test.
- The investigation itself created the pre-existing private DNS or route mismatch.
- Testing ping alone does not identify the rule responsible for a different port and protocol.
Explanation
Correct Answer
D:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. This is a material consequence of the incorrect shortcut.
Incorrect Answers
A:This does not explain the real network Watcher IP flow verify weakness after the shortcut. The material failure is: Testing ping alone does not identify the rule responsible for a different port and protocol.
B:This does not explain the real network Watcher IP flow verify weakness after the shortcut. Inspect evidence such as IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
C:This does not explain the real network Watcher IP flow verify weakness after the shortcut. The investigation itself created the pre-existing private DNS or route mismatch.
Question 495
A VM cannot receive an expected inbound connection and engineers disagree about which NSG rule denied it. A review identifies this consequence: Testing ping alone does not identify the rule responsible for a different port and protocol. Which remediation most directly restores the intended behavior?
- Assume a successful TCP connection to a different host proves the requested flow is permitted.
- Correct the blocking rule and repeat the same flow test with a least-privilege change.
- Change the VM operating system hostname to resolve an NSG rule denial.
- Delete every security group before running a specific flow-verification test.
Explanation
Correct Answer
B:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. This addresses the observed security problem while providing a verifiable outcome.
Incorrect Answers
A:That option would assume a successful TCP connection to a different host proves the requested flow is permitted, but it addresses a different concern. This addresses the observed security problem while providing a verifiable outcome.
C:Change the VM operating system hostname to resolve an NSG rule denial. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
D:Delete every security group before running a specific flow-verification test. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
Question 496
An outbound HTTPS request is rejected and a subnet policy change may be responsible. Which operator action best meets this technical requirement?
- For this Azure workload, the team should assume a successful TCP connection to a different host proves the requested flow is permitted.
- For this Azure workload, the team should use Network Watcher IP flow verify and effective NSG rules for the exact source, destination and port.
- For this Azure workload, the team should change the VM operating system hostname to resolve an NSG rule denial.
- For this Azure workload, the team should delete every security group before running a specific flow-verification test.
Explanation
Correct Answer
B:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
Incorrect Answers
A:Assume a successful TCP connection to a different host proves the requested flow is permitted. The proposed change targets the wrong mechanism or lacks essential validation. Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Relevant evidence is IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
C:Testing ping alone does not identify the rule responsible for a different port and protocol. Change the VM operating system hostname to resolve an NSG rule denial.
D:Testing ping alone does not identify the rule responsible for a different port and protocol. Delete every security group before running a specific flow-verification test.
Question 497
An outbound HTTPS request is rejected and a subnet policy change may be responsible. Which collection of observations most directly tests the suspected cause?
- In this security review, examine a public DNS response that does not show the intended private service path.
- In this security review, examine IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
- In this security review, examine the name of a firewall policy without its applied match and request logs.
- In this security review, examine a healthy network interface without the evaluated NSG, route or private endpoint.
Explanation
Correct Answer
B:These records test the actual network Watcher IP flow verify behavior rather than an unrelated dashboard state. The intended action is: Use Network Watcher IP flow verify and effective NSG rules for the exact source, destination and port.
Incorrect Answers
A:On its own, that evidence does not prove the specified security control works. In the given case, an outbound HTTPS request is rejected and a subnet policy change may be responsible.
C:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
D:The more relevant observations are: IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
Question 498
An outbound HTTPS request is rejected and a subnet policy change may be responsible. Which statement most accurately explains this scenario?
- The applicable security principle is that a network appliance presence guarantees the effective route traverses it.
- The applicable security principle is that an NSG allow is sufficient even when another relevant security layer explicitly denies the flow.
- The applicable security principle is that successful public name resolution proves that all traffic uses Private Link.
- The applicable security principle is that network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
Explanation
Correct Answer
D:Confirmation depends on IP flow verify verdict and rule name, effective NSGs and traffic source and destination. Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow.
Incorrect Answers
A:A network appliance presence guarantees the effective route traverses it. This is an incorrect assumption for network Watcher IP flow verify. The relevant security behavior is: Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Check evidence such as IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
B:An NSG allow is sufficient even when another relevant security layer explicitly denies the flow. This is an incorrect assumption for network Watcher IP flow verify. The relevant security behavior is: Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Check evidence such as IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
C:Successful public name resolution proves that all traffic uses Private Link. This is an incorrect assumption for network Watcher IP flow verify. The relevant security behavior is: Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Check evidence such as IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
Question 499
An outbound HTTPS request is rejected and a subnet policy change may be responsible. Suppose the operator instead follows this unsafe shortcut: Delete every security group before running a specific flow-verification test. What is the principal technical consequence of the mistaken choice?
- The resulting security weakness is that the investigation itself created the pre-existing private DNS or route mismatch.
- The resulting security weakness is that the failure consists only of retaining valid network flow logs.
- The resulting security weakness is that the root problem was using a permitted endpoint reachability test.
- The resulting security weakness is that testing ping alone does not identify the rule responsible for a different port and protocol.
Explanation
Correct Answer
D:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. The suitable control is: Use Network Watcher IP flow verify and effective NSG rules for the exact source, destination and port.
Incorrect Answers
A:This does not explain the real network Watcher IP flow verify weakness after the shortcut. In the given case, an outbound HTTPS request is rejected and a subnet policy change may be responsible.
B:This does not explain the real network Watcher IP flow verify weakness after the shortcut. The failure consists only of retaining valid network flow logs.
C:This does not explain the real network Watcher IP flow verify weakness after the shortcut. The root problem was using a permitted endpoint reachability test.
Question 500
An outbound HTTPS request is rejected and a subnet policy change may be responsible. A review identifies this consequence: Testing ping alone does not identify the rule responsible for a different port and protocol. Which recovery action restores the intended control and validates its effect?
- The controlled remediation is to change the VM operating system hostname to resolve an NSG rule denial.
- The controlled remediation is to delete every security group before running a specific flow-verification test.
- The controlled remediation is to correct the blocking rule and repeat the same flow test with a least-privilege change.
- The controlled remediation is to assume a successful TCP connection to a different host proves the requested flow is permitted.
Explanation
Correct Answer
C:Network Watcher flow verification can identify whether a matching NSG rule permits or denies a tested flow. Test using these records: IP flow verify verdict and rule name, effective NSGs and traffic source and destination.
Incorrect Answers
A:Change the VM operating system hostname to resolve an NSG rule denial. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
B:Delete every security group before running a specific flow-verification test. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
D:Assume a successful TCP connection to a different host proves the requested flow is permitted. This would not reliably restore the intended security boundary. Testing ping alone does not identify the rule responsible for a different port and protocol. The appropriate controlled recovery is: Correct the blocking rule and repeat the same flow test with a least-privilege change.
