WGU D338 | AZURE NETWORKING & SECURITY | ORIGINAL PRACTICE
WGU D338 Azure Networking & Security
Practice Questions 2026–2027 | 110 Questions & Rationales
Original independent educational practice resource. Not official WGU assessment questions or Microsoft AZ-104
certification questions. Alignment with a particular 2026–2027 assessment blueprint has not been verified.
High-Yield Review
Network segmentation: Use VNets/subnets to segment; NSGs filter traffic, UDRs choose next hops, and ASGs
organize NICs.
Private connectivity: Compare VNet peering, VPN Gateway, ExpressRoute, Private Endpoint, and service
endpoints.
Application delivery: Distinguish Layer 4 Load Balancer, regional Layer 7 Application Gateway, global Front Door,
and DNS-based Traffic Manager.
Security controls: WAF handles web exploits; DDoS Protection addresses volumetric attacks; Azure Firewall
centralizes filtering.
Identity and governance: Azure RBAC controls management actions; Conditional Access governs sign-in; Azure
Policy enforces resource rules.
Troubleshooting: Network Watcher effective routes, IP flow verify, packet capture, and Connection Monitor
address different failure modes.
Independent Study Resource • Page 1
,WGU D338 | AZURE NETWORKING & SECURITY | ORIGINAL PRACTICE
Practice Questions 1–55: Service Selection
Question 1. Which Azure solution is the best fit to isolate a subnet from inbound Internet connections at the
subnet boundary?
A. Azure DNS
B. Route table
C. Private DNS zone
D. Network security group
Correct Answer: D. Network security group
Detailed Rationale: NSG rules filter inbound and outbound traffic at subnet or NIC scope.
Why the Other Options Are Incorrect: A — Azure DNS addresses a different Azure networking, security, or
administration requirement and does not directly meet the stated need. B — Route table addresses a
different Azure networking, security, or administration requirement and does not directly meet the stated
need. C — Private DNS zone addresses a different Azure networking, security, or administration requirement
and does not directly meet the stated need.
Question 2. Which Azure solution is the best fit to centrally inspect and filter traffic between spoke VNets?
A. Azure Firewall
B. Network security group
C. Azure DNS
D. Azure Bastion
Correct Answer: A. Azure Firewall
Detailed Rationale: Azure Firewall provides centralized stateful network and application filtering.
Why the Other Options Are Incorrect: B — Network security group addresses a different Azure networking,
security, or administration requirement and does not directly meet the stated need. C — Azure DNS
Independent Study Resource • Page 2
,WGU D338 | AZURE NETWORKING & SECURITY | ORIGINAL PRACTICE
addresses a different Azure networking, security, or administration requirement and does not directly meet
the stated need. D — Azure Bastion addresses a different Azure networking, security, or administration
requirement and does not directly meet the stated need.
Question 3. Which Azure solution is the best fit to protect a public web application from SQL injection?
A. Azure Firewall DNS proxy
B. Web Application Firewall
C. Azure DDoS Protection
D. Network security group
Correct Answer: B. Web Application Firewall
Detailed Rationale: WAF inspects HTTP requests for application-layer attacks.
Why the Other Options Are Incorrect: A — Azure Firewall DNS proxy addresses a different Azure networking,
security, or administration requirement and does not directly meet the stated need. C — Azure DDoS
Protection addresses a different Azure networking, security, or administration requirement and does not
directly meet the stated need. D — Network security group addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need.
Question 4. Which Azure solution is the best fit to protect a public IP against large volumetric attacks?
A. Private Endpoint
B. Application Security Group
C. Azure DDoS Protection
D. Azure Bastion
Correct Answer: C. Azure DDoS Protection
Detailed Rationale: DDoS Protection addresses volumetric network attacks, not application payloads.
Why the Other Options Are Incorrect: A — Private Endpoint addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need. B — Application Security Group
addresses a different Azure networking, security, or administration requirement and does not directly meet
the stated need. D — Azure Bastion addresses a different Azure networking, security, or administration
requirement and does not directly meet the stated need.
Question 5. Which Azure solution is the best fit to provide secure RDP access to VMs without public IPs?
A. Azure Front Door
B. VPN Gateway
C. Azure DNS
D. Azure Bastion
Correct Answer: D. Azure Bastion
Detailed Rationale: Bastion provides browser-based RDP/SSH access through a managed service.
Independent Study Resource • Page 3
, WGU D338 | AZURE NETWORKING & SECURITY | ORIGINAL PRACTICE
Why the Other Options Are Incorrect: A — Azure Front Door addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need. B — VPN Gateway addresses a
different Azure networking, security, or administration requirement and does not directly meet the stated
need. C — Azure DNS addresses a different Azure networking, security, or administration requirement and
does not directly meet the stated need.
Question 6. Which Azure solution is the best fit to privately expose a storage account using a VNet IP?
A. Private Endpoint
B. Service Endpoint
C. Public Load Balancer
D. Traffic Manager
Correct Answer: A. Private Endpoint
Detailed Rationale: Private Endpoint maps a private IP to a supported PaaS resource via Private Link.
Why the Other Options Are Incorrect: B — Service Endpoint addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need. C — Public Load Balancer
addresses a different Azure networking, security, or administration requirement and does not directly meet
the stated need. D — Traffic Manager addresses a different Azure networking, security, or administration
requirement and does not directly meet the stated need.
Question 7. Which Azure solution is the best fit to restrict storage access to selected subnets using service
identity routing?
A. ExpressRoute
B. Virtual network service endpoint
C. Public IP prefix
D. NAT Gateway
Correct Answer: B. Virtual network service endpoint
Detailed Rationale: Service endpoints extend VNet identity to supported Azure services without giving the
service a private IP.
Why the Other Options Are Incorrect: A — ExpressRoute addresses a different Azure networking, security, or
administration requirement and does not directly meet the stated need. C — Public IP prefix addresses a
different Azure networking, security, or administration requirement and does not directly meet the stated
need. D — NAT Gateway addresses a different Azure networking, security, or administration requirement and
does not directly meet the stated need.
Question 8. Which Azure solution is the best fit to provide outbound Internet connectivity with a predictable
public IP?
A. Private DNS zone
B. Azure Bastion
Independent Study Resource • Page 4
WGU D338 Azure Networking & Security
Practice Questions 2026–2027 | 110 Questions & Rationales
Original independent educational practice resource. Not official WGU assessment questions or Microsoft AZ-104
certification questions. Alignment with a particular 2026–2027 assessment blueprint has not been verified.
High-Yield Review
Network segmentation: Use VNets/subnets to segment; NSGs filter traffic, UDRs choose next hops, and ASGs
organize NICs.
Private connectivity: Compare VNet peering, VPN Gateway, ExpressRoute, Private Endpoint, and service
endpoints.
Application delivery: Distinguish Layer 4 Load Balancer, regional Layer 7 Application Gateway, global Front Door,
and DNS-based Traffic Manager.
Security controls: WAF handles web exploits; DDoS Protection addresses volumetric attacks; Azure Firewall
centralizes filtering.
Identity and governance: Azure RBAC controls management actions; Conditional Access governs sign-in; Azure
Policy enforces resource rules.
Troubleshooting: Network Watcher effective routes, IP flow verify, packet capture, and Connection Monitor
address different failure modes.
Independent Study Resource • Page 1
,WGU D338 | AZURE NETWORKING & SECURITY | ORIGINAL PRACTICE
Practice Questions 1–55: Service Selection
Question 1. Which Azure solution is the best fit to isolate a subnet from inbound Internet connections at the
subnet boundary?
A. Azure DNS
B. Route table
C. Private DNS zone
D. Network security group
Correct Answer: D. Network security group
Detailed Rationale: NSG rules filter inbound and outbound traffic at subnet or NIC scope.
Why the Other Options Are Incorrect: A — Azure DNS addresses a different Azure networking, security, or
administration requirement and does not directly meet the stated need. B — Route table addresses a
different Azure networking, security, or administration requirement and does not directly meet the stated
need. C — Private DNS zone addresses a different Azure networking, security, or administration requirement
and does not directly meet the stated need.
Question 2. Which Azure solution is the best fit to centrally inspect and filter traffic between spoke VNets?
A. Azure Firewall
B. Network security group
C. Azure DNS
D. Azure Bastion
Correct Answer: A. Azure Firewall
Detailed Rationale: Azure Firewall provides centralized stateful network and application filtering.
Why the Other Options Are Incorrect: B — Network security group addresses a different Azure networking,
security, or administration requirement and does not directly meet the stated need. C — Azure DNS
Independent Study Resource • Page 2
,WGU D338 | AZURE NETWORKING & SECURITY | ORIGINAL PRACTICE
addresses a different Azure networking, security, or administration requirement and does not directly meet
the stated need. D — Azure Bastion addresses a different Azure networking, security, or administration
requirement and does not directly meet the stated need.
Question 3. Which Azure solution is the best fit to protect a public web application from SQL injection?
A. Azure Firewall DNS proxy
B. Web Application Firewall
C. Azure DDoS Protection
D. Network security group
Correct Answer: B. Web Application Firewall
Detailed Rationale: WAF inspects HTTP requests for application-layer attacks.
Why the Other Options Are Incorrect: A — Azure Firewall DNS proxy addresses a different Azure networking,
security, or administration requirement and does not directly meet the stated need. C — Azure DDoS
Protection addresses a different Azure networking, security, or administration requirement and does not
directly meet the stated need. D — Network security group addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need.
Question 4. Which Azure solution is the best fit to protect a public IP against large volumetric attacks?
A. Private Endpoint
B. Application Security Group
C. Azure DDoS Protection
D. Azure Bastion
Correct Answer: C. Azure DDoS Protection
Detailed Rationale: DDoS Protection addresses volumetric network attacks, not application payloads.
Why the Other Options Are Incorrect: A — Private Endpoint addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need. B — Application Security Group
addresses a different Azure networking, security, or administration requirement and does not directly meet
the stated need. D — Azure Bastion addresses a different Azure networking, security, or administration
requirement and does not directly meet the stated need.
Question 5. Which Azure solution is the best fit to provide secure RDP access to VMs without public IPs?
A. Azure Front Door
B. VPN Gateway
C. Azure DNS
D. Azure Bastion
Correct Answer: D. Azure Bastion
Detailed Rationale: Bastion provides browser-based RDP/SSH access through a managed service.
Independent Study Resource • Page 3
, WGU D338 | AZURE NETWORKING & SECURITY | ORIGINAL PRACTICE
Why the Other Options Are Incorrect: A — Azure Front Door addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need. B — VPN Gateway addresses a
different Azure networking, security, or administration requirement and does not directly meet the stated
need. C — Azure DNS addresses a different Azure networking, security, or administration requirement and
does not directly meet the stated need.
Question 6. Which Azure solution is the best fit to privately expose a storage account using a VNet IP?
A. Private Endpoint
B. Service Endpoint
C. Public Load Balancer
D. Traffic Manager
Correct Answer: A. Private Endpoint
Detailed Rationale: Private Endpoint maps a private IP to a supported PaaS resource via Private Link.
Why the Other Options Are Incorrect: B — Service Endpoint addresses a different Azure networking, security,
or administration requirement and does not directly meet the stated need. C — Public Load Balancer
addresses a different Azure networking, security, or administration requirement and does not directly meet
the stated need. D — Traffic Manager addresses a different Azure networking, security, or administration
requirement and does not directly meet the stated need.
Question 7. Which Azure solution is the best fit to restrict storage access to selected subnets using service
identity routing?
A. ExpressRoute
B. Virtual network service endpoint
C. Public IP prefix
D. NAT Gateway
Correct Answer: B. Virtual network service endpoint
Detailed Rationale: Service endpoints extend VNet identity to supported Azure services without giving the
service a private IP.
Why the Other Options Are Incorrect: A — ExpressRoute addresses a different Azure networking, security, or
administration requirement and does not directly meet the stated need. C — Public IP prefix addresses a
different Azure networking, security, or administration requirement and does not directly meet the stated
need. D — NAT Gateway addresses a different Azure networking, security, or administration requirement and
does not directly meet the stated need.
Question 8. Which Azure solution is the best fit to provide outbound Internet connectivity with a predictable
public IP?
A. Private DNS zone
B. Azure Bastion
Independent Study Resource • Page 4
