nerdexam
Microsoft

AZ-500 · Question #2

Case Study 1 - Litware, Inc Overview Litware, Inc. is a digital media company that has 500 employees in the Chicago area and 20 employees in the San Francisco area. Existing Environment Litware has…

The correct answer is D. On Firewall, configure a DNAT rule. Explanation Option D is correct because to enable users to access VM0 (which sits behind the Azure Firewall), a Destination Network Address Translation (DNAT) rule must be configured on the Firewall to translate and forward incoming traffic from the public internet to VM0's…

Submitted by tom_us· Mar 6, 2026Secure networking

Question

Case Study 1 - Litware, Inc Overview Litware, Inc. is a digital media company that has 500 employees in the Chicago area and 20 employees in the San Francisco area. Existing Environment Litware has an Azure subscription named Sub1 that has a subscription ID of 43894a43-17c2- 4a39-8cfc-3540c2653ef4. Sub1 is associated to an Azure Active Directory (Azure AD) tenant named litwareinc.com. The tenant contains the user objects and the device objects of all the Litware employees and their devices. Each user is assigned an Azure AD Premium P2 license. Azure AD Privileged Identity Management (PIM) is activated. The tenant contains the groups shown in the following table. The Azure subscription contains the objects shown in the following table. Azure Security Center is set to the Free tier. Planned changes Litware plans to deploy the Azure resources shown in the following table. Litware identifies the following identity and access requirements: All San Francisco users and their devices must be members of Group1. The members of Group2 must be assigned the Contributor role to Resource Group2 by using a permanent eligible assignment. Users must be prevented from registering applications in Azure AD and from consenting to applications that access company information on the users' behalf. Platform Protection Requirements Litware identifies the following platform protection requirements: Microsoft Antimalware must be installed on the virtual machines in Resource Group1. The members of Group2 must be assigned the Azure Kubernetes Service Cluster Admin Role. Azure AD users must be to authenticate to AKS1 by using their Azure AD credentials. Following the implementation of the planned changes, the IT team must be able to connect to VM0 by using JIT VM access. A new custom RBAC role named Role1 must be used to delegate the administration of the managed disks in Resource Group1. Role1 must be available only for Resource Group1. Security Operations Requirements Litware must be able to customize the operating system security configurations in Azure Security Center. You need to ensure that users can access VM0. The solution must meet the platform protection requirements. What should you do?

Options

  • AMove VM0 to Subnet1.
  • BOn Firewall, configure a network traffic filtering rule.
  • CAssign RT1 to AzureFirewallSubnet.
  • DOn Firewall, configure a DNAT rule.

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    11% (4)
  • D
    78% (29)

Explanation

Explanation

Option D is correct because to enable users to access VM0 (which sits behind the Azure Firewall), a Destination Network Address Translation (DNAT) rule must be configured on the Firewall to translate and forward incoming traffic from the public internet to VM0's private IP address - this is the standard method to expose internal VMs through a firewall while meeting the Just-In-Time (JIT) VM access requirement.

Option A is wrong because simply moving VM0 to Subnet1 does not enable external access or satisfy the JIT access requirement - network routing and firewall rules still need to be properly configured regardless of which subnet the VM resides in.

Option B is wrong because a network traffic filtering rule only allows or denies traffic but does not perform address translation, meaning external users still cannot reach VM0's private IP address through the firewall.

Option C is wrong because assigning Route Table RT1 to the AzureFirewallSubnet would interfere with the firewall's own routing behavior - Azure Firewall manages its own routes and associating a custom route table to that subnet can break its functionality.

Memory Tip: Think of DNAT as a "doorbell translator" - when someone rings the firewall's public IP (the front door), DNAT redirects that call to the correct private VM inside, making it the go-to rule whenever you need to expose something sitting behind a firewall.

Topics

#Azure Firewall#DNAT Rules#Network Access Control#Virtual Machine Connectivity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice