AZ-500 exam dumps: questions 101 to 200 of 273

Correct answer: A

• A. Correct.

  Correct. Azure Firewall Manager allows you to create a standardized Firewall Policy that can be shared across multiple Azure Firewalls in different subscriptions and regions. This ensures consistency and centralizes administration.

• B. Incorrect.

  Incorrect. Managing application and network rules directly on each Azure Firewall separately can create inconsistent configurations and makes ongoing maintenance challenging. Azure Firewall Manager with Firewall Policy is designed to avoid this siloed approach.

• C. Incorrect.

  Incorrect. Network Security Groups (NSGs) can provide additional filtering at the network interface or subnet level, but they do not replace the centralized policy management capabilities of Azure Firewall Manager and Firewall Policies.

• D. Incorrect.

  Incorrect. Azure Default Routes automatically handle basic routing but do not distribute firewall rules. You must explicitly configure a Firewall Policy in Azure Firewall Manager to ensure consistent rule enforcement across multiple deployments.

Correct answers: B, E

• A. Incorrect.

  Incorrect: While creating a firewall policy is important, you do not need to create a separate policy in each region along with each Azure Firewall. A single Azure Firewall Policy can be centrally managed and associated with multiple firewalls, regardless of their regions, simplifying rule management rather than duplicating policy efforts.

• B. Correct.

  Correct: You must associate each Azure Firewall instance with the Azure Firewall Policy. This association ensures that all firewalls will enforce the same set of rules, making it easier to maintain consistent security standards across subscriptions.

• C. Incorrect.

  Incorrect: Deploying a separate Azure Firewall Manager instance in each subscription goes against the goal of centralizing and simplifying management. Azure Firewall Manager is designed to orchestrate firewall policies across multiple subscriptions from one place, not to create multiple isolated managers.

• D. Incorrect.

  Incorrect: Forced tunneling routes traffic from Azure to on-premises for inspection and might not be necessary for achieving a single, centralized rule set. Enabling forced tunneling by itself does not guarantee unified rule management across subscriptions and can introduce additional network complexity.

• E. Correct.

  Correct: Azure Firewall Manager allows you to create secured virtual hubs (if using Virtual WAN) and apply the same Azure Firewall Policy to those hubs, enabling consistent security rules. This approach scales across multiple virtual hubs and subscriptions, providing a unified management experience.

Correct answers: A, C

• A. Correct.

  Option 1 is correct. To achieve end-to-end SSL, you must enable HTTPS at the front-end and also encrypt traffic to the Web Apps at the back end. You do this by uploading a proper PFX certificate for the front end and configuring an HTTPS back-end pool with the back-end certificates trusted by the Application Gateway.

• B. Incorrect.

  Option 2 is incorrect. The default health probe only checks the root path (/) using HTTP by default. Since you need a specific path (/health) and want to use HTTPS, relying on the default probe won’t meet your exact requirements.

• C. Correct.

  Option 3 is correct. A custom probe is required to specify the exact path (/health) and the HTTPS protocol. Configuring this ensures the gateway accurately checks the availability of the Web Apps based on returning a 200 status code at the /health endpoint.

• D. Incorrect.

  Option 4 is incorrect. There is no 'Response Based Detection' feature that automatically discovers all endpoints. Azure Application Gateway does not remove the need for custom probes simply by enabling a WAF policy. When specific paths or protocols are needed, a custom probe is required.

Correct answers: B, D

• A. Incorrect.

  Although a dedicated subnet and WAF Prevention mode can be important for secure planning, they do not themselves enable path-based routing or re-encryption to backend pools. ‘Dedicated subnet’ is a requirement to deploy Application Gateway properly, but the question specifically focuses on ensuring path-based routing and end-to-end encryption.

• B. Correct.

  This is correct. Path-based routing requires you to configure rules telling the gateway to forward /api and /web requests to the correct backend pools. This matches the requirement to route distinct paths to different backend targets.

• C. Incorrect.

  This is incorrect. Enabling SSL offloading ends SSL at the gateway, forwarding traffic unencrypted (HTTP) to the backend. The requirement is to inspect and then re-encrypt traffic, so full end-to-end encryption is needed.

• D. Correct.

  This is correct. To re-encrypt traffic after WAF inspection, you must configure a valid certificate in the HTTP settings. This allows the Application Gateway to re-establish an HTTPS connection to each backend pool.

• E. Incorrect.

  This is incorrect. Multi-site listeners help if you have different domain names, but the question states that you have two paths (/api and /web) on a single domain. You can use a single listener with path-based routing rather than multiple listeners or multiple IP addresses.

Correct answers: A, C

• A. Correct.

  Correct. To establish end-to-end SSL, Application Gateway must trust the backend’s certificate. You need to upload the backend’s root or intermediate CA certificates under ‘Trusted root certificates’ and select HTTPS in the backend pool’s HTTP settings so that the gateway re-encrypts traffic to the VMs.

• B. Incorrect.

  Incorrect. ‘Rewrite HTTP headers’ allows customizing or removing certain headers, but it does not provide SSL re-encryption or certificate trust. Relying on HTTP headers alone does not achieve end-to-end encryption.

• C. Correct.

  Correct. The front-end listener must be configured with a valid SSL certificate for your custom domain so user requests over HTTPS terminate at the Application Gateway. This is the first step in ensuring traffic is encrypted as it comes in from the client.

• D. Incorrect.

  Incorrect. Setting WAF to ‘Prevention’ mode enforces blocking of malicious traffic, but it does not automatically enable end-to-end SSL. Encrypted traffic requires proper certificate configuration on both the front end and the back end.