DRAG DROP
-
You have a computer named CLIENT1 that runs Windows 11 and has the Azure VPN Client installed.
You have an Azure virtual network gateway named VPNGW1.
You need to ensure that you can connect CLIENT1 to VPNGW1. The solution must support Microsoft Entra authentication.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer are and arrange them in the correct order.
Show Answer
Correct Answer: 1. From the Azure portal, configure the tunnel type and authentication type for VPNGW1.
2. From the Azure portal, authorize the Azure VPN application.
3. From the Azure portal, download the Azure VPN Client profile configuration package to CLIENT1.
4. To CLIENT1, import the Azurevpnconfig.xml file.
Explanation: Microsoft Entra authentication for Azure VPN Client requires an OpenVPN-based Point-to-Site configuration, Azure VPN application authorization, downloading the Azure VPN Client profile, and importing the Azurevpnconfig.xml profile into the Azure VPN Client. The .ovpn file is for OpenVPN clients rather than the Azure VPN Client, and no PFX certificate is needed for Entra authentication.
Question 93
You have an Azure subscription that contains an Azure Front Door named FD1. FD1 is configured as shown in the following exhibit.
You need to enable Azure Private Link for FD1.
What should you do first?
A. Add an endpoint.
B. Create a custom route.
C. Create an origin group.
D. Change Pricing Tier to Azure Front Door Premium.
Show Answer
Correct Answer: D
Explanation: Azure Front Door Private Link is supported only on the Azure Front Door Premium tier. Before configuring Private Link for origins, you must upgrade the Front Door profile to the Premium pricing tier. Only after that can you configure Private Link-enabled origins, origin groups, routes, or endpoints as needed.
Question 94
DRAG DROP
-
You have 100 on-premises servers with IP addresses from the 10.0.0.0/24 IP address space.
You have an Azure subscription that contains a virtual network named VNet1, an Azure VPN gateway named VGW1, and 100 virtual machines. VNet1 has an IP address space of 10.0.0.0/22. VGW1 uses the VpnGw1 SKU.
You need to ensure that the Azure virtual machines and the on-premises servers can communicate by using VGW1. The solution must minimize administrative effort.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: 1. Resize VGW1
2. On VGW1, create a local gateway
3. On VGW1, add NAT rules
4. On VGW1, add a connection
Explanation: The on-premises and Azure VNets have overlapping IP ranges. VPN Gateway NAT is the appropriate solution, but NAT requires VpnGw2 or higher, so upgrade the gateway first. Create the Local Network Gateway, define NAT rules, then create the VPN connection referencing those NAT rules.
Question 95
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
You have devices that run either Windows or macOS. The devices connect to VGW1 by using the OpenVPN protocol.
Which virtual networks can each device access? To answer, select the appropriate options in the answer area.
Show Answer
Correct Answer: Windows: VNet1 and VNet2 only
macOS: VNet1 and VNet2 only
Explanation: VNet2 is reachable through VNet peering with gateway transit (Allow gateway transit + Use remote gateway). VNet3 is connected via S2S VPN, but the VPN gateway has BGP disabled. Point-to-site OpenVPN clients do not learn routes to the S2S-connected network without BGP in this topology, so VNet3 is not reachable.
Question 96
You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a virtual machine named VM1.
You plan to make VM1 available to the resources in Sub2 by using Azure Private Link.
You need to ensure that the private link service can be configured to provide access to VM1.
What should you configure in Sub1 first?
A. an Azure Private DNS zone
B. an Azure load balancer
C. a service endpoint
D. a private endpoint
Show Answer
Correct Answer: B
Explanation: Azure Private Link Service publishes a service that is backed by a Standard Azure Load Balancer. To expose a virtual machine through Private Link, you first need a Standard Load Balancer with the VM as a backend. The Private Link Service is then associated with the load balancer's frontend IP. A private endpoint is created by the consumer subscription later, not first. Private DNS is optional for name resolution, and service endpoints are a different feature.
Question 97
You have an Azure subscription that contains an instance of Azure Firewall Standard named AzFW1.
You plan to enable the following:
• TLS inspection
• Threat intelligence
• A network intrusion detection and prevention system (IDPS)
What can you enable by using AzFW1?
A. TLS inspection only
B. threat intelligence only
C. TLS inspection and the IDPS only
D. threat intelligence and the IDPS only
E. TLS inspection, threat intelligence, and the IDPS
Show Answer
Correct Answer: B
Explanation: Azure Firewall Standard supports Threat Intelligence filtering. TLS inspection and the Network Intrusion Detection and Prevention System (IDPS) are Premium SKU features, not Standard. Therefore, with an existing Azure Firewall Standard instance, only Threat Intelligence can be enabled.
Question 98
You have two Azure virtual networks named VNet1 and VNet2 that are peered with each other. VNet1 hosts 10 virtual machines that contain web servers. VNet2 hosts five virtual machines that contain database servers.
You need to configure a security solution that meets the following requirements:
• Ensures that the database servers can accept connections only from the web servers
• Ensures that the web servers can initiate connections only to the database servers
• Ensures that all network security groups (NSGs) are associated only with subnets
• Use application security groups to implement the solution
What is the minimum number of application security groups required?
A. 1
B. 2
C. 4
D. 8
Show Answer
Correct Answer: B
Explanation: Two application security groups are sufficient: one ASG containing the web server NICs and one ASG containing the database server NICs. Associate NSGs only with the subnets, then create NSG rules that allow traffic from the Web ASG to the Database ASG and restrict other traffic accordingly. This satisfies the requirement to use ASGs while keeping NSGs associated only with subnets.
Question 99
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1.
You plan to add a private endpoint to Subnet.
You need to ensure that you can route traffic between the private endpoint and the Azure Private Link service by using a user-defined route.
What should you do first on Subnet1?
A. Enable network policy.
B. Enable delegation.
C. Create a service endpoint.
D. Provision a Standard Azure load balancer.
Show Answer
Correct Answer: A
Explanation: To use user-defined routes (UDRs) with Azure Private Endpoints, you must enable private endpoint network policies on the subnet. By default, private endpoints bypass UDRs and NSGs. Enabling network policies allows UDRs (and/or NSGs) to apply. Subnet delegation is not required for private endpoints and delegated subnets generally cannot host private endpoints.
Question 100
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. Add an internet route to RT1 for the Azure Key Management Service (KMS).
B. On FW1, create an outbound service tag rule for Azure Cloud.
C. Deploy a NAT gateway.
D. On FW1, configure a DNAT rule for TCP port 1688.
Show Answer
Correct Answer: A
Explanation: Windows Server Azure VMs activate by contacting Azure KMS on TCP 1688. Because a user-defined route sends all 0.0.0.0/0 traffic to Azure Firewall, the documented fix is to add a specific route for the Azure KMS endpoint with next hop Internet so activation traffic bypasses the forced-tunnel path. DNAT is inbound only, and a NAT gateway is unnecessary. An AzureCloud service tag rule may allow traffic through the firewall, but the documented activation guidance for forced tunneling is to add the Internet route for Azure KMS.
Sources:
https://learn.microsoft.com/azure/virtual-network/virtual-networks-udr-overview
Question 101
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machine operating systems were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. Deploy a NAT gateway.
B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
C. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
D. Deploy an Azure Standard Load Balancer that has an outbound NAT rule.
Show Answer
Correct Answer: B
Explanation: Windows Server activation in Azure uses Azure Key Management Service (KMS) on TCP port 1688. Because all outbound traffic is forced through Azure Firewall by the 0.0.0.0/0 user-defined route, the firewall must allow outbound access to the Azure KMS service. Without this rule, the VMs cannot reach KMS and activation fails. A NAT Gateway or Standard Load Balancer does not solve the firewall restriction, and adding an NSG rule alone is insufficient because the Azure Firewall is the blocking point.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
