nerdexam
Microsoft

AZ-500 · Question #486

Hotspot Question You have an Azure subscription that contains the resources shown in the following table. VNet1 connects to a remote site by using a Site-to-Site (S2S) VPN that uses forced…

The correct answer is To restrict inbound traffic to SQL1, you must modify an access rule in NSG1. = Yes; To enable VM1 to access storage1 by using the Microsoft backbone network, you must enable a service endpoint on the Default subnet. = Yes; You can deploy an App Service Environment to the Default subnet. = No. NSG1 is associated with the SQL subnet, so any inbound traffic restrictions to SQL1 (which resides in the SQL subnet) must be managed through NSG1's access rules - this is correct because the NSG governs subnet-level traffic filtering. Enabling a service endpoint on the Default…

Submitted by fatima_kr· Mar 6, 2026Configure and manage virtual networking - including NSGs, service endpoints, and subnet delegation for Azure networking and hybrid connectivity scenarios (AZ-104: Implement and manage virtual networking)

Question

Hotspot Question You have an Azure subscription that contains the resources shown in the following table. VNet1 connects to a remote site by using a Site-to-Site (S2S) VPN that uses forced tunneling. VNet1 contains the subnets shown in the following table. The SQL subnet contains SQL1. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #486 exhibit 1
AZ-500 question #486 exhibit 2
AZ-500 question #486 exhibit 3
AZ-500 question #486 exhibit 4

Answer Area

  • To restrict inbound traffic to SQL1, you must modify an access rule in NSG1.Yes
  • To enable VM1 to access storage1 by using the Microsoft backbone network, you must enable a service endpoint on the Default subnet.Yes
  • You can deploy an App Service Environment to the Default subnet.No

Explanation

NSG1 is associated with the SQL subnet, so any inbound traffic restrictions to SQL1 (which resides in the SQL subnet) must be managed through NSG1's access rules - this is correct because the NSG governs subnet-level traffic filtering. Enabling a service endpoint on the Default subnet (where VM1 resides) allows traffic from VM1 to Azure Storage to traverse the Microsoft backbone network rather than the public internet, which is the correct mechanism for private routing to PaaS services. An App Service Environment (ASE) requires a dedicated subnet with a minimum size of /24 and cannot be deployed to the Default subnet if it is already in use by other resources (VM1) or does not meet the size/delegation requirements; ASE also requires subnet delegation to Microsoft.Web/hostingEnvironments, which conflicts with general-purpose subnet usage.

Topics

#Network Security Groups#Service Endpoints#App Service Environment#Virtual Network Subnets

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice