CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AZ-500 Exam Question Walkthrough: Secure Communication in Azure VNet
Learn how to answer a critical AZ-500 exam question about securing Azure Virtual Networks with the right features.
When preparing for the AZ-500 exam, candidates often trip over questions about securing Azure resources. The challenge lies in distinguishing between various security features. Understanding their specific functions is key to selecting the right option.
The question
Your organization is implementing an Azure Virtual Network (VNet) to host multiple resources. You need to ensure that the resources within the VNet can communicate securely over the internet while preventing unauthorized access. Which Azure feature should you use to achieve this?
- A. Azure Firewall
- B. Azure DDoS Protection
- C. VPN Gateway
- D. Network Security Group (NSG)
Think before you scroll
Before selecting an answer, reflect on the specific requirements of secure communication over the internet. Consider the purpose of each option and how they contribute to overall security.
The answer
The correct option is A. Azure Firewall. Azure Firewall provides a full-featured security solution that controls and monitors network traffic, ensuring secure communication over the internet. It is designed to prevent unauthorized access while allowing legitimate traffic.
Why the other options lose
- B. Azure DDoS Protection: This option focuses on mitigating distributed denial-of-service attacks. While it enhances security, it does not directly secure communication over the internet for resources within a VNet.
- C. VPN Gateway: A VPN Gateway is primarily for secure site-to-site connections or point-to-site connections. It does not manage internet traffic security for resources within a VNet, which is the primary goal of this question.
- D. Network Security Group (NSG): NSGs are used to manage access control and restrict traffic within a VNet. However, they do not provide the internet security features necessary to meet the requirements outlined in the question.
The concept behind it
The key principle here is understanding the distinct roles of Azure security features. Azure Firewall is essential for internet security, while NSGs and VPN Gateways serve different, more limited purposes. Knowing this will help in making informed decisions about which feature to apply in various scenarios.
Exam trap to remember
Remember: Azure Firewall is for securing internet traffic, while NSGs control internal network access. Always assess the context of the question to choose the right security feature.