Microsoft SC-500

Topic 1: Cloud and AI Security Engineer

DRAG DROP

You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2, and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines:

VM1 on Subnet1

VM2 on Subnet2

VM3 on Subnet3

You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2.

You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes.

How should you configure the inbound rule on NSG1? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Topic 1: Cloud and AI Security Engineer

You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1.

All the traffic from the virtual machines is routed through FW1.

You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic.

What should you use?

Topic 1: Cloud and AI Security Engineer

You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1.

You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.

You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1. The solution must minimize administrative effort.

What should you use?

Topic 1: Cloud and AI Security Engineer

You have an Azure subscription.

You need to deploy an Azure virtual WAN to meet the following requirements:

Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.

Ensure that security rules sync between the regions.

What should you use?

Topic 1: Cloud and AI Security Engineer

You have an Azure Storage account named storage1 that hosts a blob container named container1.

You have an Azure Functions app named app1 that uses a managed identity.

You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.

What should you do?