nerdexam
Microsoft

AZ-500 · Question #495

Hotspot Question You have an Azure subscription that contains the virtual machines shown in the following table. You have an Azure Cosmos DB account named cosmos1 configured as shown in the…

The correct answer is VM1 can access cosmos1 over the internet. = Yes; VM2 can access cosmos1 over the internet. = No; VM3 can access cosmos1 over the internet. = Yes. Azure Cosmos DB firewall rules control which IP addresses or virtual networks can access the account over the internet. VM1 can access cosmos1 because its public IP or subnet is included in the allowed IP range/virtual network rules configured on cosmos1. VM2 is blocked because…

Submitted by eva_at· Mar 6, 2026Implement and manage virtual networking / Secure access to Azure services using network controls - typically maps to AZ-104 Domain: Configure and manage virtual networks or AZ-305 Domain: Design network solutions

Question

Hotspot Question You have an Azure subscription that contains the virtual machines shown in the following table. You have an Azure Cosmos DB account named cosmos1 configured as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Exhibits

AZ-500 question #495 exhibit 1
AZ-500 question #495 exhibit 2
AZ-500 question #495 exhibit 3
AZ-500 question #495 exhibit 4

Answer Area

  • VM1 can access cosmos1 over the internet.Yes
  • VM2 can access cosmos1 over the internet.No
  • VM3 can access cosmos1 over the internet.Yes

Explanation

Azure Cosmos DB firewall rules control which IP addresses or virtual networks can access the account over the internet. VM1 can access cosmos1 because its public IP or subnet is included in the allowed IP range/virtual network rules configured on cosmos1. VM2 is blocked because its IP/subnet is not in the allowlist, meaning the Cosmos DB firewall denies its internet-based requests. VM3 can access cosmos1 because even though it may be in a different region or VNet, its IP or network is explicitly permitted in the firewall configuration.

Topics

#Azure Cosmos DB#Firewall and Virtual Network Rules#Network Security#Azure Networking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice