SC-500 Practice Test

SC-500 Practice Test practice questions, page 5 of 9, with answer review and explanations.

Question 21

You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2, and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines: VM1 on Subnet1VM2 on Subnet2VM3 on Subnet3 You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2. You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes. How should you configure the inbound rule on NSG1? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Question 22

You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1. All the traffic from the virtual machines is routed through FW1. You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic. What should you use?

  1. an inbound NAT rule
  2. an application rule
  3. an outbound NAT rule
  4. a network rule

Question 23

You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1. You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389. You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1. The solution must minimize administrative effort. What should you use?

  1. a connectivity configuration
  2. a security admin configuration
  3. a user-defined route (UDR)
  4. a network security group (NSG)

Question 24

You have an Azure subscription. You need to deploy an Azure virtual WAN to meet the following requirements: Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.Ensure that security rules sync between the regions. What should you use?

  1. Azure Network Function Manager
  2. Azure Firewall Manager
  3. Azure Virtual Network Manager
  4. Azure Front Door

Question 25

You have an Azure Storage account named storage1 that hosts a blob container named container1. You have an Azure Functions app named app1 that uses a managed identity. You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege. What should you do?

  1. Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1.
  2. Assign the Storage Blob Delegator role to the managed identity of App1 at the scope of container1.
  3. Assign the Owner role to the managed identity of App1 at the scope of container1.
  4. Assign the Storage Blob Data Contributor role to the managed identity of App1 at the scope of container1.