Secure Networking
42 practice questions with explanations — 15 free to try
PassNova has 42 Microsoft AZ-500 (Azure Security) practice questions on Secure Networking, each with a clear explanation. A 15-question taster is free with no sign-up; the full bank is part of PassNova Premium. Updated for 2026.
Secure Networking: example questions & answers
3 worked examples with answers and explanations below. Try 15 Microsoft AZ-500 (Azure Security) questions free in the browser; the full 42-question Secure Networking bank is part of PassNova Premium.
You must ensure that traffic from a subnet to an Azure Storage account never traverses the public internet and that the storage account is reachable by a private IP inside your virtual network. What should you deploy?
- AAn Azure Firewall application rule
- BA service endpoint for Microsoft.Storage
- CA private endpoint for the storage account✓
- DA network security group allow rule
Answer: A private endpoint projects the storage account into your virtual network with a private IP, so traffic stays on the Microsoft backbone and the resource is reachable privately. Service endpoints keep traffic on the backbone but the resource still uses a public endpoint.
A subnet hosts web servers that must accept inbound HTTPS from the internet but must not accept inbound RDP. Which control most directly enforces this at the subnet level?
- AMicrosoft Defender for Cloud just-in-time VM access, opening management ports temporarily on request rather than filtering inbound web traffic
- BA network security group with appropriate inbound rules✓
- CAzure DDoS Protection
- DA route table with a default route to a virtual appliance, changing the next hop for traffic but never blocking a port
Answer: A network security group filters inbound and outbound traffic by port, protocol, and address, so you can allow TCP 443 and deny TCP 3389. Route tables control next hops, not whether traffic is permitted.
You need a managed firewall that provides fully qualified domain name filtering for outbound traffic, threat intelligence-based filtering, and centralized policy across a hub-and-spoke topology. Which service should you use?
- AAzure Front Door
- BAzure Firewall✓
- CAzure Application Gateway
- DNetwork security groups
Answer: Azure Firewall is a stateful, managed network firewall offering FQDN application rules, threat intelligence filtering, and centralized policy, well suited to a hub-and-spoke design. NSGs cannot filter by FQDN or apply threat intelligence.