AZ-700 Network Security and Compliance 5

Question 1

You need to allow Azure Monitor to collect diagnostic logs from resources in a private VNet without public internet exposure. What should you configure?

Accepted Answer

Deploy Private Endpoints for Azure Monitor (Azure Monitor Private Link Scope)

Answer

Enable VNet Integration on Azure Monitor

Answer

Create a Service Endpoint for Microsoft.Insights

Answer

Open outbound NSG rule for AzureMonitor service tag

Question 2

Which Azure Firewall rule collection type should be used to allow an on-premises server to initiate RDP sessions to Azure VMs?

Accepted Answer

Network rule collection

Answer

Application rule collection

Answer

DNAT rule collection

Answer

NAT rule collection with SNAT

Question 3

A security audit requires that all Azure resources have no public IP addresses. Which Azure Policy effect enforces this during resource deployment?

Accepted Answer

Deny

Answer

Audit

Answer

AuditIfNotExists

Answer

Modify

Question 4

You are designing a zero-trust network for Azure. Which combination of services best enforces micro-segmentation between application tiers?

Accepted Answer

NSGs on each subnet combined with Azure Firewall for inter-tier inspection

Answer

VNet Peering with route tables

Answer

Single VNet with one large NSG

Answer

ExpressRoute with private peering

Question 5

Which feature in Azure Firewall allows it to identify and control traffic based on web categories such as gambling or social media?

Accepted Answer

Web Categories filtering

Answer

FQDN Tags

Answer

IDPS signature rules

Answer

Network rules with wildcard IPs

Question 6

An application deployed behind Azure Application Gateway WAF is returning 403 errors only for requests containing special characters in query strings. What is the most likely cause?

Accepted Answer

A WAF rule matching the special characters as a SQL injection or XSS pattern

Answer

NSG blocking traffic to Application Gateway

Answer

Application Gateway SKU does not support query strings

Answer

The backend pool health probe is failing

Question 7

You need to ensure that Azure Virtual Desktop session hosts can only be accessed through Azure Bastion and never via direct RDP from the internet. What is the correct approach?

Accepted Answer

Block port 3389 inbound in the subnet NSG and deploy Azure Bastion in the same VNet

Answer

Enable Just-in-Time access and keep port 3389 open

Answer

Use a VPN gateway and allow RDP through VPN only

Answer

Apply an application rule in Azure Firewall for RDP