Unit 2: Secure Networking - Practice Quiz

1 What is the main purpose of an Azure Virtual Network (AVN)?

2 Which component divides an Azure Virtual Network into smaller network sections?

3 What type of address is commonly used for communication inside an Azure Virtual Network?

4 What is the primary function of a Network Security Group (NSG)?

5 Which type of traffic can an NSG rule control?

6 What does an NSG rule with an Allow action do?

7 What is a security group mainly used to manage?

8 Why are security groups useful in cloud environments?

9 Which principle gives users only the access they need?

10 What is the purpose of a user-defined route?

11 Where are user-defined routes commonly applied in Azure?

12 Which device can be selected as the next hop in a custom route?

13 What is the main purpose of a network firewall?

14 Which rule would allow web traffic using HTTPS?

15 What should a firewall usually do with traffic that violates its rules?

16 What type of traffic does a Web Application Firewall (WAF) primarily protect?

17 Which attack can a WAF help detect and block?

18 At which layer does a WAF mainly inspect requests?

19 What does DDoS stand for?

20 What is the main goal of Azure DDoS Protection Standard?

21 Two Azure virtual networks must be connected through VNet peering. VNet-A uses 10.10.0.0/16, and VNet-B uses 10.10.20.0/24. What must be done before creating the peering?

22 VNet-A is peered with VNet-B, and VNet-B is peered with VNet-C. Without additional configuration, which communication path is available?

23 An application in an Azure VNet must access Azure Storage without sending traffic through the public internet. The storage service may retain its public endpoint. Which feature should be enabled on the application subnet?

24 An NSG contains an inbound allow rule for TCP port 443 at priority 300 and an inbound deny rule for all TCP traffic at priority 200. What happens to an incoming HTTPS connection?

25 An NSG allows an outbound TCP connection from a virtual machine to a database. No explicit inbound rule permits the database's response packets. Why can the response still reach the virtual machine?

26 A network interface has an NSG that allows SSH, while its subnet has an NSG that denies SSH from the same source. What is the effective result for traffic reaching that interface?

27 A web tier must connect to a database tier whose instances are replaced frequently. Which security group rule best avoids maintaining individual IP addresses?

28 Administrators need SSH access to private servers only through a bastion host. Which inbound security group rule should be applied to the private servers?

29 A security group currently permits inbound HTTPS from 0.0.0.0/0 to an internal reporting service used only by corporate employees. Which change best reduces exposure?

30 All outbound traffic from an application subnet must be inspected by a network virtual appliance at 10.0.4.4. Which user-defined route should be associated with the subnet?

31 A subnet route table contains 0.0.0.0/0 to a firewall and 10.20.0.0/16 to a VPN gateway. A packet is sent to 10.20.5.10. Which route is selected?

32 A user-defined route sends traffic to a network virtual appliance, but packets do not continue to the destination after reaching it. Which appliance setting should be checked first?

33 An Azure Firewall must publish an internal web server to internet clients while translating the firewall's public IP to the server's private IP. Which rule type is required?

34 Virtual machines should access only updates.example.com over HTTPS, regardless of changes to the site's IP addresses. Which Azure Firewall rule is most suitable?

35 A subnet has a default route to Azure Firewall, but the firewall has no rule allowing outbound DNS requests. What is the expected result?

36 A public web application is being targeted with SQL injection and cross-site scripting payloads over HTTPS. Which control is designed to inspect and block these requests?

37 A WAF managed rule blocks a legitimate request because one JSON field resembles an attack signature. What is the most targeted corrective action?

38 A team wants to evaluate how a new WAF policy would affect production traffic without immediately blocking requests. Which mode should it use first?

39 A company enables DDoS Protection Standard on a VNet containing public-facing services. What is a key advantage over relying only on basic platform protection?

40 A service uses DDoS Protection Standard but remains vulnerable to malicious HTTP requests that mimic legitimate users. Which additional control best addresses this gap?

41 VNet-A is peered with VNet-B, and VNet-B is peered with VNet-C. No VPN gateways or network virtual appliances are deployed. A VM in VNet-A must communicate privately with a VM in VNet-C. What change is required?

42 An organization attempts to peer VNet-A (10.20.0.0/16) with VNet-B (10.20.128.0/17). Both VNets are in supported Azure regions. What prevents the peering?

43 A spoke VNet uses a remote gateway in a peered hub VNet. Which peering configuration is required for the spoke to use that gateway?

44 A VM NIC has an inbound NSG rule allowing TCP 443 from the Internet. Its subnet NSG denies TCP 443 from the Internet with a higher priority than the subnet's default rules. What happens to a new HTTPS connection?

45 An NSG initially permits a long-lived TCP session. An administrator then adds a higher-priority deny rule matching that session. What is the expected immediate effect?

46 An inbound NSG allows TCP 8443 from a client to a VM. No custom outbound rule permits the VM's return packets, but the default outbound Internet rule is removed by a higher-priority deny. Why can the response still return?

47 An NSG rule uses an Application Security Group named WebTier as its destination. A new VM is created in the same VNet and should receive the rule without editing the NSG. What should be changed?

48 A team tries to place NICs from VNet-A and VNet-B into one Azure Application Security Group so a single NSG rule can identify both application tiers. Why does the design fail?

49 An NSG rule permits AppTier to reach DbTier on TCP 1433. A database VM has two NIC IP configurations, but only the secondary IP configuration belongs to DbTier. Which destination is matched by the rule?

50 A subnet has a user-defined route 0.0.0.0/0 to a firewall. Azure also provides a system route 10.40.0.0/16 for the local VNet. A packet targets 10.40.5.10. Which route is selected?

51 For the same destination prefix, a subnet's effective routes contain a user-defined route, a BGP route, and a system route. Assuming all three are active and have identical prefix lengths, which route wins?

52 A UDR sends subnet traffic to a Linux NVA as a virtual-appliance next hop. The NVA receives packets but does not forward them. NSGs allow the traffic. Which configuration pair is essential?

53 Azure Firewall has a DNAT rule for its public IP and TCP 443, a network rule that could allow the translated flow, and an application rule for related HTTPS traffic. Which rule type is evaluated first for the inbound connection?

54 Clients must access an external service over TCP 8443 using only its FQDN, and Azure Firewall must filter the traffic by hostname. Which rule design is appropriate when the protocol is HTTPS?

55 A subnet uses 0.0.0.0/0 to send traffic through Azure Firewall. Connectivity tests show asymmetric routing because return traffic reaches a workload through another path. What is the primary requirement for a stateful firewall design?

56 An Azure WAF policy is in Detection mode and a managed rule identifies a SQL injection attempt. No custom rule blocks the request. What should occur?

57 A TLS connection passes through Azure Application Gateway WAF, but the gateway is configured for end-to-end TLS with termination and re-encryption. Where can WAF inspect the HTTP request?

58 A WAF managed rule falsely flags a specific JSON field, but the same attack signature must remain active for all other request data. What is the narrowest appropriate change?

59 A public web application is protected by both Azure DDoS Protection Standard and WAF. During an attack, which responsibility is primarily assigned to DDoS Protection rather than WAF?

60 A DDoS protection plan is enabled on VNet-A. A public-IP resource in VNet-B must receive the plan's adaptive protection. Peering exists between the VNets. What must be done?