You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a virtual machine named VM1.
You plan to make VM1 available to the resources in Sub2 by using Azure Private Link.
You need to ensure that the private link service can be configured to provide access to VM1.
What should you configure in Sub1 first?
A. an Azure Private DNS zone
B. an Azure load balancer
C. a service endpoint
D. a private endpoint
Show Answer
Correct Answer: B
Explanation: To expose a virtual machine via Azure Private Link, you must create a **Private Link Service** on the provider side. A Private Link Service requires a **Standard Azure Load Balancer** with a frontend IP that represents the service. VM1 must be placed behind this load balancer before the Private Link Service can be configured. Private endpoints are created by consumers (Sub2), not first in Sub1, and DNS or service endpoints are not prerequisites.
Question 94
You have an Azure subscription that contains an instance of Azure Firewall Standard named AzFW1.
You plan to enable the following:
• TLS inspection
• Threat intelligence
• A network intrusion detection and prevention system (IDPS)
What can you enable by using AzFW1?
A. TLS inspection only
B. threat intelligence only
C. TLS inspection and the IDPS only
D. threat intelligence and the IDPS only
E. TLS inspection, threat intelligence, and the IDPS
Show Answer
Correct Answer: B
Explanation: Azure Firewall Standard supports threat intelligence (alerting and deny modes). TLS inspection and the network intrusion detection and prevention system (IDPS) are available only in Azure Firewall Premium. Therefore, with AzFW1 (Standard), you can enable threat intelligence only.
Question 95
You have two Azure virtual networks named VNet1 and VNet2 that are peered with each other. VNet1 hosts 10 virtual machines that contain web servers. VNet2 hosts five virtual machines that contain database servers.
You need to configure a security solution that meets the following requirements:
• Ensures that the database servers can accept connections only from the web servers
• Ensures that the web servers can initiate connections only to the database servers
• Ensures that all network security groups (NSGs) are associated only with subnets
• Use application security groups to implement the solution
What is the minimum number of application security groups required?
A. 1
B. 2
C. 4
D. 8
Show Answer
Correct Answer: B
Explanation: Two application security groups are sufficient: one ASG for all web server VMs and one ASG for all database server VMs. NSGs can be associated with subnets and use ASG-to-ASG rules to allow only web-to-database traffic and restrict web servers to initiate connections only to database servers. No additional ASGs are required.
Question 96
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1.
You plan to add a private endpoint to Subnet.
You need to ensure that you can route traffic between the private endpoint and the Azure Private Link service by using a user-defined route.
What should you do first on Subnet1?
A. Enable network policy.
B. Enable delegation.
C. Create a service endpoint.
D. Provision a Standard Azure load balancer.
Show Answer
Correct Answer: A
Explanation: To route traffic for a private endpoint using a user-defined route, the subnet must have private endpoint network policies enabled. By default, these policies are disabled for private endpoints, which prevents the use of UDRs and NSGs. Enabling network policy on Subnet1 allows UDRs to apply to traffic between the private endpoint and the Azure Private Link service. Subnet delegation is not used with private endpoints and would actually block their creation.
Question 97
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. Add an internet route to RT1 for the Azure Key Management Service (KMS).
B. On FW1, create an outbound service tag rule for Azure Cloud.
C. Deploy a NAT gateway.
D. On FW1, configure a DNAT rule for TCP port 1688.
Show Answer
Correct Answer: B
Explanation: All outbound traffic from Subnet1 is forced through Azure Firewall by the 0.0.0.0/0 UDR. Windows Server activation requires outbound access to Microsoft’s KMS service (TCP 1688). If the firewall does not explicitly allow this traffic, activation fails. Creating an outbound rule on FW1 that allows the AzureCloud (or equivalent Azure service) service tag enables access to KMS. Adding routes or DNAT rules does not address the outbound firewall restriction, and a NAT gateway is unnecessary because Azure Firewall already performs SNAT.
Question 98
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machine operating systems were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. Deploy a NAT gateway.
B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
C. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
D. Deploy an Azure Standard Load Balancer that has an outbound NAT rule.
Show Answer
Correct Answer: B
Explanation: The virtual machines are forced to send all outbound traffic (0.0.0.0/0) through Azure Firewall. Windows Server activation uses Azure Key Management Service (KMS) over TCP port 1688. Because the firewall controls egress, it must explicitly allow this traffic. Creating an outbound network rule on FW1 to permit traffic to the Azure KMS endpoints enables OS activation. NAT gateways, load balancers, or NSGs alone do not resolve the firewall egress restriction.
Question 99
You have an Azure subscription. The subscription contains a locally-redundant storage (LRS) account named storage1 that is deployed to the US East Azure region and has a Microsoft.Storage service endpoint.
You set Redundancy for storage1 to Read-access geo-redundant storage (RA-GRS).
You need to ensure that the contents of storage1 will be accessible by using a service endpoint in a paired region. The solution must minimize administrative effort.
What should you do first?
A. Create an object replication rule for storage.
B. Delete the existing service endpoint.
C. From storage1, select Secure transfer required.
D. Create a service endpoint policy.
Show Answer
Correct Answer: D
Explanation: When a storage account is changed to RA-GRS, Azure automatically creates a secondary (read-only) endpoint in the paired region. However, Azure Storage service endpoints are regional by default. To allow access to the RA-GRS secondary endpoint via a service endpoint in the paired region with minimal administrative effort, you must use a service endpoint policy. Applying a service endpoint policy upgrades the service endpoint scope from regional to global, enabling secure access to both the primary and secondary (paired) regions without recreating endpoints or adding replication rules.
Question 100
You have an on-premises network.
You have an Azure subscription that contains a virtual network.
You have an ExpressRoute service provider.
You plan to connect the Azure virtual network and the on-premises network by using an ExpressRoute circuit.
You create a new ExpressRoute circuit.
You need to provision the new circuit.
Which information should you provide to the service provider?
A. the IKEv2 shared key
B. the certificate
C. the public IP address
D. the service key
Show Answer
Correct Answer: D
Explanation: To provision an ExpressRoute circuit, the service provider requires the service key generated when you create the circuit in Azure. This key uniquely identifies the circuit and allows the provider to complete provisioning on their side. Other items like IKEv2 shared keys, certificates, or public IP addresses are used for VPN connections, not ExpressRoute provisioning.
Question 101
You have an on-premises datacenter named Site1 that contains a firewall named FW1. FW1 connects to the internet.
You have an Azure subscription that contains the resources shown in the following table.
You plan to connect Site1 to Hub1 by using a site-to-site connection.
You need to configure the site-to-site connection to FW1.
What should you create in VWAN1?
A. a VPN site
B. a virtual network connection
C. a network virtual appliance (NVA)
D. a User VPN configuration
Show Answer
Correct Answer: A
Explanation: In Azure Virtual WAN, a site-to-site VPN connection to an on-premises location starts by defining a VPN site. The VPN site represents the on-premises location (Site1) and its VPN device (FW1), including its public IP and link details. Virtual network connections, NVAs, and User VPN configurations are not used to define on-premises site-to-site connectivity in VWAN.
Question 102
You have the Azure subscriptions shown in the following table.
Each virtual network contains 20 internet-accessible resources that are assigned public IP addresses.
You need to implement Azure DDoS Network Protection to protect the resources. The solution must minimize costs.
What is the minimum number of DDoS Network Protection plans you should deploy?
A. 1
B. 2
C. 3
D. 6
Show Answer
Correct Answer: B
Explanation: Azure DDoS Network Protection plans are scoped to a Microsoft Entra tenant. A single plan can protect multiple virtual networks across multiple subscriptions and regions within the same tenant, but it cannot be shared across different tenants. In the scenario, the subscriptions are split across two tenants, so one plan is required per tenant. To minimize cost, deploy one plan in each tenant, for a total of two plans.
$19
Get all 344 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.