Secure Networking

You must ensure that traffic from a subnet to an Azure Storage account never traverses the public internet and that the storage account is reachable by a private IP inside your virtual network. What should you deploy?

• AAn Azure Firewall application rule
• BA service endpoint for Microsoft.Storage
• CA private endpoint for the storage account✓
• DA network security group allow rule

Answer: A private endpoint projects the storage account into your virtual network with a private IP, so traffic stays on the Microsoft backbone and the resource is reachable privately. Service endpoints keep traffic on the backbone but the resource still uses a public endpoint.

A subnet hosts web servers that must accept inbound HTTPS from the internet but must not accept inbound RDP. Which control most directly enforces this at the subnet level?

• AMicrosoft Defender for Cloud just-in-time VM access, opening management ports temporarily on request rather than filtering inbound web traffic
• BA network security group with appropriate inbound rules✓
• CAzure DDoS Protection Standard
• DA route table with a default route to a virtual appliance, changing the next hop for traffic but never blocking a port

Answer: A network security group filters inbound and outbound traffic by port, protocol, and address, so you can allow TCP 443 and deny TCP 3389. Route tables control next hops, not whether traffic is permitted.

You need a managed firewall that provides fully qualified domain name filtering for outbound traffic, threat intelligence-based filtering, and centralized policy across a hub-and-spoke topology. Which service should you use?

• AAzure Front Door
• BAzure Firewall✓
• CAzure Application Gateway
• DNetwork security groups

Answer: Azure Firewall is a stateful, managed network firewall offering FQDN application rules, threat intelligence filtering, and centralized policy, well suited to a hub-and-spoke design. NSGs cannot filter by FQDN or apply threat intelligence.

Your web application must be protected against SQL injection and cross-site scripting at the HTTP layer. Which Azure capability provides this?

• AA network security group referencing an application security group, filtering on port and address without reading an HTTP request body
• BA Web Application Firewall on Application Gateway or Front Door✓
• CAzure Bastion for browser-based RDP and SSH to virtual machines, with no inspection of application traffic
• DA service endpoint policy restricting the PaaS resources a subnet may reach

Answer: The Web Application Firewall, available on Application Gateway and Azure Front Door, inspects HTTP traffic and blocks common web attacks such as SQL injection and cross-site scripting using managed rule sets. NSGs operate at the network layer, not the application layer.

You want to administer Azure VMs over RDP and SSH without exposing public IP addresses or opening inbound 3389/22 from the internet. Which service should you deploy?

• AAzure Bastion✓
• BAn Azure Firewall DNAT rule
• CA jump box with a public IP
• DA point-to-site VPN gateway

Answer: Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal over TLS, so the VMs need no public IPs and no inbound 3389/22 rules. A jump box with a public IP reintroduces the exposure you are trying to avoid.

Which Azure feature provides automatic mitigation of volumetric, protocol, and resource-layer attacks against your public IP resources with tuned telemetry and cost protection?

• AAzure DDoS Protection (Network Protection tier)✓
• BA user-defined route
• CA network security group with rate limiting
• DAzure Traffic Manager

Answer: Azure DDoS Protection Network Protection provides always-on monitoring and automatic mitigation of network-layer DDoS attacks, plus telemetry and cost protection for scaled resources. NSGs cannot perform DDoS mitigation.

You need to force all outbound internet traffic from a subnet through a network virtual appliance for inspection. Which mechanism accomplishes this?

• AA network security group outbound rule
• BA service endpoint
• CA private endpoint
• DA user-defined route with the appliance as the next hop✓

Answer: A user-defined route can set the next hop type to a virtual appliance, forcing subnet traffic through the NVA for inspection. NSGs allow or deny traffic but do not redirect the next hop.

You want to ensure that a specific subnet can use a service endpoint to reach only one named storage account and no other storage accounts. What should you configure?

• AAn application security group
• BA route table default route
• CA service endpoint policy✓
• DA private DNS zone

Answer: Service endpoint policies let you filter virtual network traffic over service endpoints to a specific list of Azure resources, such as a single storage account, preventing exfiltration to other accounts. Private DNS zones are used with private endpoints, not service endpoint filtering.

You need outbound traffic from several spoke virtual networks to share a single static public IP and to be filtered centrally, without assigning public IPs to the VMs. Which combination is most appropriate?

• AAzure Bastion in each spoke
• BAzure Firewall in the hub with a public IP and source NAT✓
• CA public load balancer with inbound NAT rules
• DA network security group outbound deny rule

Answer: Azure Firewall deployed in the hub source-NATs spoke traffic to its public IP and applies centralized network and application rules, so VMs need no public IPs. Network security groups filter traffic but do not provide shared outbound SNAT or FQDN filtering.

You want to apply a network security group rule to a logical group of virtual machines based on workload rather than specifying each IP address. Which feature supports this?

• ARoute tables, steering packets towards a chosen next hop but unable to allow or deny traffic
• BService endpoint policies, which restrict a subnet to named Azure PaaS resources and play no part in NSG rules
• CPrivate DNS zones
• DApplication security groups✓

Answer: Application security groups let you group VM network interfaces by role and reference those groups as the source or destination in network security group rules, simplifying rule management as IPs change. Route tables and service endpoint policies serve different purposes.

After deploying a private endpoint for an Azure SQL logical server, clients in the virtual network still resolve the server to its public IP. What must you configure so the private IP is returned?

• AA network security group allow rule for port 1433
• BA service endpoint for Microsoft.Sql
• CA private DNS zone linked to the virtual network with an A record for the endpoint✓
• DA user-defined route pointing at the Sql service tag range

Answer: Private endpoints require DNS to resolve the resource name to the private IP, which is achieved by linking the appropriate private DNS zone to the virtual network so the endpoint A record is used. NSG rules and routes do not change name resolution.

Your Azure Front Door WAF is in Detection mode and logging malicious requests, but you now want it to actively block them. What change is required?

• ADisable the managed rule set
• BEnable a service endpoint
• CSwitch the WAF policy to Prevention mode✓
• DAdd a network security group to the origin

Answer: A Web Application Firewall policy in Detection mode only logs rule matches, whereas Prevention mode enforces actions such as blocking, so switching to Prevention activates protection. Disabling the managed rule set would remove protection entirely.

You need TLS termination, cookie-based session affinity, and URL path-based routing for an internal web application, combined with a Web Application Firewall. Which service provides all of these?

• AA network security group filtering by port and address, unable to terminate a TLS session
• BAzure Traffic Manager, steering clients between endpoints using DNS responses only
• CAzure Bastion for RDP and SSH to VMs
• DAzure Application Gateway with WAF✓

Answer: Azure Application Gateway is a layer 7 load balancer that offers TLS termination, cookie-based affinity, and path-based routing, and its WAF tier adds protection against common web attacks. Traffic Manager is DNS-based and does not perform TLS termination or WAF.

You need encrypted private connectivity between an on-premises datacenter and an Azure virtual network over the public internet for a small branch office. Which gateway connection type is appropriate?

• AAn ExpressRoute circuit only
• BA site-to-site IPsec VPN connection✓
• CA private endpoint
• DA service endpoint

Answer: A site-to-site IPsec VPN over a VPN gateway provides encrypted tunnels between on-premises networks and Azure across the internet, which suits a branch office without dedicated circuits. Private and service endpoints address Azure PaaS access, not network-to-network tunnels.

You want to prevent a virtual network subnet from reaching the internet entirely while still allowing access to a specific Azure PaaS service over the Microsoft backbone. Which design achieves least exposure?

• AA service endpoint policy applied to the subnet, narrowing the PaaS resources reachable over service endpoints but leaving general internet egress open
• BAzure DDoS Protection applied to the subnet
• CA public IP on each VM with NSG rules denying inbound traffic, still leaving every VM able to reach the internet outbound
• DPrivate endpoints for the PaaS service plus a default route of 0.0.0.0/0 to None✓

Answer: Using private endpoints lets the subnet reach the PaaS service privately, and a user-defined route sending 0.0.0.0/0 to next hop None blocks general internet egress, minimizing exposure. DDoS Protection and public IPs do not restrict outbound internet reachability.

You want to verify whether a specific packet from a source IP and port to a destination would be allowed or denied by the effective network security group rules on a VM, without sending real traffic. Which Network Watcher tool should you use?

• APacket capture
• BConnection monitor
• CNSG flow logs
• DIP flow verify✓

Answer: IP flow verify evaluates the effective network security group rules for a specified 5-tuple and reports whether the traffic is allowed or denied and which rule applies. Flow logs record actual traffic rather than testing a hypothetical packet.

A spoke virtual network must send all internet-bound and inter-spoke traffic through Azure Firewall in the hub. Besides peering, what must be configured in the spoke to force traffic to the firewall?

• AAn application security group containing the spoke virtual machines, which can only be referenced inside NSG rules
• BA private DNS zone linked to the spoke virtual network
• CA service endpoint on the spoke subnet, giving optimised access to a PaaS service rather than steering traffic to an appliance
• DA route table with a default route to the firewall private IP associated to the spoke subnets✓

Answer: A user-defined route table with a 0.0.0.0/0 next hop set to the Azure Firewall private IP, associated with the spoke subnets, forces traffic through the firewall. Peering alone provides connectivity but does not redirect the next hop.

You need to allow an Azure Firewall to permit outbound access only to *.windowsupdate.com and *.microsoft.com for VMs, blocking all other web destinations. Which rule type should you use?

• AA route table entry for each permitted domain, steering packets to a next hop and never inspecting the requested host name
• BA network rule filtering by IP address and port, unable to match a wildcard host name
• CA DNAT rule for inbound connections
• DAn application rule with target FQDNs✓

Answer: Azure Firewall application rules filter outbound HTTP and HTTPS by fully qualified domain name, so you can allow specific FQDN wildcards and implicitly deny others. Network rules filter by IP, port, and protocol and cannot match wildcard FQDNs for web traffic.

Two virtual networks in different regions must communicate privately over the Microsoft backbone with low latency and no gateway. Which connectivity option should you use?

• AA service endpoint
• BGlobal virtual network peering✓
• CA site-to-site VPN
• DA public load balancer

Answer: Global virtual network peering connects virtual networks across regions over the Microsoft backbone with private IP connectivity and no VPN gateway, offering low latency. Site-to-site VPN adds gateways and traverses encrypted tunnels rather than native peering.

You want to inspect and filter TLS-encrypted outbound traffic for malicious URLs and apply intrusion detection. Which Azure Firewall tier and feature combination is required?

• ABasic tier with network rules
• BStandard tier with threat intelligence only
• CApplication Gateway WAF only
• DPremium tier with TLS inspection and IDPS✓

Answer: Azure Firewall Premium adds TLS inspection, which decrypts outbound traffic to apply URL filtering and an intrusion detection and prevention system. The Standard and Basic tiers do not provide TLS inspection or IDPS.

An NSG has a rule allowing inbound TCP 443 with priority 200 and a rule denying inbound TCP 443 with priority 100. What is the effective behaviour for inbound 443 traffic?

• AIt is denied because the lower priority number is evaluated first✓
• BIt is allowed, because an explicit allow rule always overrides a deny rule in the same NSG
• CBoth rules are ignored
• DIt depends on the subnet

Answer: NSG rules are processed in priority order from the lowest number, and the first matching rule wins. With a deny at priority 100 matching before the allow at priority 200, inbound 443 is denied.

You need private, dedicated connectivity between on-premises and Azure that does not traverse the public internet for a high-throughput, latency-sensitive workload. Which option is appropriate?

• AA NAT gateway
• BA site-to-site VPN over the internet
• CA private endpoint
• DExpressRoute✓

Answer: ExpressRoute provides a private, dedicated connection between on-premises and Azure through a connectivity provider, bypassing the public internet with predictable latency and high bandwidth. A site-to-site VPN traverses the internet.

To protect a publicly exposed application against large volumetric DDoS attacks and obtain access to DDoS rapid response support and cost protection, which option should you enable?

• AA network security group with rules limiting the source addresses that may connect
• BAzure DDoS Network Protection on the virtual network✓
• CThe always-on platform DDoS infrastructure protection alone, which is applied to all Azure traffic at no cost
• DA user-defined route to the gateway

Answer: Azure DDoS Network Protection adds tuned mitigation policies, attack analytics, cost protection, and access to the DDoS rapid response team for resources in the protected virtual network. The default platform protection lacks these tuned and support features.

You want outbound connectivity for VMs in a subnet with a predictable set of source IP addresses and to avoid SNAT port exhaustion, without assigning public IPs to each VM. Which service should you use?

• AA private endpoint for one PaaS resource
• BA service endpoint routing traffic to a PaaS service over the Azure backbone using the VM's own address
• CA NAT gateway associated with the subnet✓
• DAzure Bastion, brokering inbound RDP and SSH sessions and playing no part in outbound flows

Answer: A NAT gateway provides scalable outbound connectivity with static public IPs and a large pool of SNAT ports, preventing port exhaustion, without public IPs on the VMs. Private and service endpoints address inbound PaaS access, not outbound NAT.

A private endpoint connection to a storage account shows a status of Pending. Why might a consumer in a different subscription be unable to use it yet?

• AThe storage key has expired
• BDDoS protection has been disabled on the virtual network
• CThe NSG has no rules
• DThe private endpoint connection requires manual approval by the resource owner✓

Answer: When a private endpoint is created across subscriptions or tenants, the connection can require manual approval by the owner of the target resource before traffic flows; until approved it stays Pending. Storage keys and NSGs are unrelated to the approval state.

You need to filter outbound traffic from Azure VMs to a specific Azure PaaS service using a service tag instead of maintaining IP lists. Where can service tags be used?

• AOnly in private DNS zones
• BOnly in storage account lifecycle policies, where tiering rules decide when blobs move between access tiers
• COnly in Key Vault
• DIn NSG and Azure Firewall rules as source or destination✓

Answer: Service tags represent groups of IP ranges for Azure services and can be used in NSG rules and Azure Firewall rules to allow or deny traffic to or from a service without manually tracking IPs. They are not used in DNS zones or lifecycle policies.

Your web tier subnet must accept traffic only from the Application Gateway subnet and nothing else inbound. Which NSG source specification is most precise and maintainable?

• AThe Internet service tag, which represents every public IP address outside the virtual network
• BThe Application Gateway subnet address prefix or its application security group✓
• CAny source, thereby leaving the rule open to every address that can route to the subnet
• DThe VirtualNetwork service tag for the whole VNet

Answer: Restricting the inbound rule source to the Application Gateway subnet prefix, or an application security group containing those instances, ensures only the gateway can reach the web tier. Allowing any source or the internet tag would be far broader than required.

You want to centrally inspect traffic between many spoke networks and on-premises using a managed routing and security service rather than building and maintaining your own hub appliances. Which Azure service provides this?

• AA storage account with a firewall
• BAzure Bastion
• CAzure Virtual WAN with secured virtual hubs✓
• DA single NSG

Answer: Azure Virtual WAN with secured virtual hubs provides managed any-to-any connectivity and integrated security through Azure Firewall in the hub, simplifying large hub-and-spoke and branch topologies. NSGs and Bastion do not provide WAN-scale routing and inspection.

A WAF on Azure Front Door is blocking a legitimate request that matches a managed rule. You must allow that specific request pattern while keeping the rest of the rule set active. What should you configure?

• ADelete the Front Door profile and publish the application directly, so that the managed rules no longer see the request
• BCreate a custom exclusion or rule override for the specific rule and matching condition✓
• CSwitch the whole WAF policy to Detection mode permanently, so that matches are logged and nothing is ever blocked
• DDisable the entire managed rule set on the policy, removing protection from every other rule as well

Answer: WAF rule exclusions and per-rule overrides let you allow a specific field or request pattern that triggers a false positive while leaving the rest of the managed rules enforcing protection. Disabling the rule set or switching to Detection removes protection broadly.

You need to ensure that management traffic to PaaS resources stays within your virtual network and that data exfiltration to other tenants' resources is blocked even over service endpoints. Which two features together best achieve this?

• APrivate endpoints for the resources plus service endpoint policies where service endpoints remain✓
• BSecurity defaults and per-user MFA
• CA route table and DDoS protection
• DA public load balancer and a NAT gateway, which distribute inbound sessions and provide outbound SNAT addresses

Answer: Private endpoints keep PaaS access on private IPs within the virtual network, and where service endpoints are still used, service endpoint policies restrict access to approved resource lists, limiting exfiltration. MFA and DDoS protection do not address this network exfiltration concern.

To allow Azure Bastion to connect to VMs, which inbound configuration is required on the target VM's subnet NSG for the Bastion host?

• AAllow inbound from the AzureBastionSubnet or the Bastion's address range on RDP/SSH✓
• BAllow inbound 3389 and 22 from anywhere on the public internet
• CAn NSG is forbidden on the VM subnet
• DAllow all inbound traffic

Answer: The VM subnet NSG must permit inbound RDP/SSH from the Bastion host, typically by allowing the AzureBastionSubnet or VirtualNetwork as the source, while still keeping those ports closed to the internet. Bastion removes the need to expose 3389/22 publicly.

You want a globally distributed entry point that provides TLS offload, WAF, and routing to multiple regional backends with low latency, for an internet-facing application. Which service is most appropriate?

• AA single NSG
• BAzure Application Gateway in one region
• CAzure Bastion
• DAzure Front Door with WAF✓

Answer: Azure Front Door is a global, edge-based application delivery service with WAF, TLS offload, and intelligent routing to backends across regions, suited to internet-facing global apps. Application Gateway is regional and does not provide global edge distribution.

A subnet hosting a database tier must have no outbound internet access at all, yet still reach Azure SQL via a private endpoint. Which routing change enforces no internet egress?

• AAn NSG outbound rule allowing all destinations, leaving the internet fully reachable from the subnet
• BA service endpoint for Microsoft.Sql, sending database traffic over the backbone but leaving other egress intact
• CA 0.0.0.0/0 user-defined route with next hop None✓
• DA 0.0.0.0/0 route with next hop Internet

Answer: A user-defined route for 0.0.0.0/0 with next hop type None drops traffic to the internet, while the private endpoint provides private connectivity to Azure SQL, achieving no internet egress. Routing to Internet or allowing all outbound does the opposite.

You need to verify whether outbound connectivity from a VM to a specific endpoint on TCP 443 is succeeding and measure latency over time. Which Network Watcher capability should you use?

• AConnection Monitor✓
• BIP flow verify, which checks a single packet against the effective NSG rules and returns allow or deny
• CNSG flow logs recording the five-tuple of each flow allowed or denied over time
• DTopology

Answer: Connection Monitor provides ongoing reachability, latency, and packet loss monitoring between a source and a destination over a chosen port, including alerting. IP flow verify only evaluates whether a single packet would be allowed by NSG rules.

You want a single NSG rule to allow inbound from your on-premises address space and Azure Load Balancer health probes, while keeping the rule list minimal. Which built-in source should you reference for the health probes?

• AThe Internet service tag
• BThe VirtualNetwork tag only
• CA private DNS zone
• DThe AzureLoadBalancer service tag✓

Answer: The AzureLoadBalancer service tag represents the load balancer health probe source addresses, so a rule can allow probe traffic precisely without hardcoding IPs. The Internet tag would be far too broad for probe traffic.

Your organisation requires that no VM in a subscription has a public IP address directly attached. Which mechanism enforces this preventively across the subscription?

• AA manual review each week that lists the network interfaces which have gained a public IP since the last check
• BAn NSG rule
• CA Key Vault firewall
• DAn Azure Policy with a deny effect on public IP associations to network interfaces✓

Answer: An Azure Policy denying the creation or association of public IP addresses on network interfaces prevents non-compliant configurations at deployment time across the assigned scope. NSGs filter traffic but do not stop a public IP from being attached.

To allow Azure Application Gateway to retrieve a TLS certificate securely for its listeners without storing the certificate in the gateway configuration, which integration should you use?

• AStore the PFX in a storage account container with anonymous read access so the gateway can fetch it over HTTPS
• BEmail the certificate to the operations team
• CReference the certificate from Azure Key Vault using the gateway's managed identity✓
• DUpload the PFX to the listener and record its password in plaintext in the deployment template

Answer: Application Gateway can reference TLS certificates stored in Azure Key Vault using a user-assigned managed identity, so certificates are centrally managed and rotated without embedding them in the gateway. Storing certificates in plaintext or public storage is insecure.

You want east-west traffic between two subnets in the same virtual network to be inspected by a network virtual appliance. Which configuration directs the traffic to the NVA?

• AA private DNS zone linked to the virtual network containing both
• BA service endpoint
• CPeering the subnets
• DA user-defined route on each subnet pointing the other subnet's range to the NVA✓

Answer: Associating user-defined routes that send each subnet's traffic destined for the other subnet to the NVA as the next hop forces intra-VNet east-west traffic through the appliance. Subnets in one virtual network are routed directly by default without UDRs.

A security requirement states that Azure Firewall must log all allowed and denied connections to a central workspace for the SOC. How is this achieved?

• AAdd a route table sending the firewall subnet traffic to the workspace address range
• BConfigure diagnostic settings on the firewall to send logs to Log Analytics✓
• CUse IP flow verify against each virtual machine to record whether traffic was permitted
• DEnable NSG flow logs on the firewall subnet, capturing flows rather than firewall rule decisions

Answer: Configuring diagnostic settings on Azure Firewall to send its application, network, and threat intelligence logs to a Log Analytics workspace gives the SOC central visibility of allowed and denied traffic. NSG flow logs capture NSG-level data, not firewall rule decisions.

You need to grant a partner VNet access to one of your subnets but prevent that partner from reaching your other peered networks (no transitive routing). Which peering setting controls transit?

• ADisable Allow gateway transit and do not enable transitive routing through an NVA✓
• BEnable global peering
• CEnable allow forwarded traffic and gateway transit on the peering so the partner can use your gateway
• DAdd a public IP

Answer: Virtual network peering is non-transitive by default, so leaving gateway transit and forwarded traffic disabled ensures the partner cannot reach networks peered to yours. Transit only occurs if you deliberately route through a shared gateway or NVA.