AZ-500 Question #9: Real Exam Question with Answer & Explanation

Question

Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York. The company hosts its entire server infrastructure in Azure. Contoso has two Azure subscriptions named Sub1 and Sub2. Both subscriptions are associated to an Azure Active Directory (Azure AD) tenant named contoso.com. Technical requirements Contoso identifies the following technical requirements: Deploy Azure Firewall to VNetWork1 in Sub2. Register an application named App2 in contoso.com. Whenever possible, use the principle of least privilege. Enable Azure AD Privileged Identity Management (PIM) for contoso.com Existing Environment Azure AD Contoso.com contains the users shown in the following table. Contoso.com contains the security groups shown in the following table. Sub1 Sub1 contains six resource groups named RG1, RG2, RG3, RG4, RG5, and RG6. User2 creates the virtual networks shown in the following table. Sub1 contains the locks shown in the following table. Sub1 contains the Azure policies shown in the following table. Sub2 Sub2 contains the virtual machines shown in the following table. All virtual machines have the public IP addresses and the Web Server (IIS) role installed. The firewalls for each virtual machine allow ping requests and web requests. Sub2 contains the network security groups (NSGs) shown in the following table. NSG1 has the inbound security rules shown in the following table. NSG2 has the inbound security rules shown in the following table. NSG3 has the inbound security rules shown in the following table. NSG4 has the inbound security rules shown in the following table. NSG1, NSG2, NSG3, and NSG4 have the outbound security rules shown in the following table. Contoso identifies the following technical requirements: Deploy Azure Firewall to VNetwork1 in Sub2. Register an application named App2 in contoso.com. Whenever possible, use the principle of least privilege. Enable Azure AD Privileged Identity Management (PIM) for contoso.com. Hotspot Question You are evaluating the security of the network communication between the virtual machines in Sub2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer:

Options

• __typehotspot
• variantyes_no

Explanation

Important Caveat

The question references specific NSG rule tables and VM/subnet assignments that are not included in the text you provided. Without those tables, I cannot give definitive Yes/No answers. However, I can explain exactly how to reason through each statement — this is the skill the exam is testing.

Framework for Evaluating NSG-Based Ping Questions

Core Concepts You Must Apply

1. NSG Rule Evaluation

• Rules are processed by priority (lowest number first)
• First matching rule wins — processing stops
• Default rules at the end: AllowVnetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound
• ICMP (ping) must be explicitly permitted — it does not automatically pass just because HTTP/RDP is allowed

2. Public IP vs. Private IP Traffic Path

This distinction matters because NSG rules filter differently depending on whether traffic is tagged as Internet or VirtualNetwork.

3. OS Firewall vs. NSG The case study states all VM firewalls allow ping. So OS-level blocking is not the issue — focus entirely on NSG rules.

How to Answer Each Statement

Statement 1: VM1 → ping public IP of VM2

What to check:

• VM2's associated NSG inbound rules
• Look for a rule that allows ICMP (protocol = ICMP or Any) from source Internet or *
• If no such rule exists before a DenyAll, the answer is No

Key concept: Traffic to a public IP is tagged as Internet source. Most NSGs in exam scenarios only explicitly allow TCP 80/443/3389 — ICMP is denied by the default DenyAllInBound rule.

Statement 2: VM1 → ping private IP of VM3

What to check:

• VM3's associated NSG inbound rules
• Look for a rule allowing ICMP from source VirtualNetwork or the specific subnet/IP of VM1
• The default AllowVnetInBound rule does allow all traffic from the VNet tag — but only if no higher-priority rule denies it first

Key concept: If NSG3 has a high-priority Deny Any rule for inbound traffic before the AllowVnetInBound default, pings from within the same VNet are still blocked.

Statement 3: VM1 → ping public IP of VM5

What to check:

• VM5's associated NSG (or whether VM5 has an NSG at all)
• If VM5 has no NSG, or its NSG has a rule Allow ICMP Any, the answer is Yes
• Also check if VM5 is on a subnet with a subnet-level NSG

Key concept: No NSG = all traffic flows. A missing or permissive NSG is often the "Yes" scenario in exam questions.

Memory Tips

To get the definitive answers, locate the NSG inbound rule tables for NSG2 (applied to VM2), NSG3 (applied to VM3), and whichever NSG applies to VM5 — then trace each ping through the priority-ordered rules looking for an Allow ICMP or Allow Any match before a Deny.

No community discussion yet for this question.