You have an Azure subscription. The subscription contains a locally-redundant storage (LRS) account named storage1 that is deployed to the US East Azure region and has a Microsoft.Storage service endpoint.
You set Redundancy for storage1 to Read-access geo-redundant storage (RA-GRS).
You need to ensure that the contents of storage1 will be accessible by using a service endpoint in a paired region. The solution must minimize administrative effort.
What should you do first?
A. Create an object replication rule for storage.
B. Delete the existing service endpoint.
C. From storage1, select Secure transfer required.
D. Create a service endpoint policy.
Show Answer
Correct Answer: D
Explanation: The correct first step is to create a service endpoint policy. For RA-GRS storage accounts, service endpoint policies upgrade Azure Storage service endpoint scope from regional to global, allowing secure access to the RA-GRS secondary endpoint in the paired region with minimal administrative effort. Object replication is unrelated because RA-GRS already replicates data. Deleting the service endpoint or enabling Secure transfer required does not provide paired-region service endpoint access.
Question 103
You have an on-premises network.
You have an Azure subscription that contains a virtual network.
You have an ExpressRoute service provider.
You plan to connect the Azure virtual network and the on-premises network by using an ExpressRoute circuit.
You create a new ExpressRoute circuit.
You need to provision the new circuit.
Which information should you provide to the service provider?
A. the IKEv2 shared key
B. the certificate
C. the public IP address
D. the service key
Show Answer
Correct Answer: D
Explanation: After creating an ExpressRoute circuit, Azure generates a unique service key (also called the service key/S-Key). You provide this service key to the ExpressRoute connectivity provider so they can identify and provision the circuit. IKEv2 shared keys and certificates are used for VPN connections, and a public IP address is not used to provision the ExpressRoute circuit.
Question 104
You have an on-premises datacenter named Site1 that contains a firewall named FW1. FW1 connects to the internet.
You have an Azure subscription that contains the resources shown in the following table.
You plan to connect Site1 to Hub1 by using a site-to-site connection.
You need to configure the site-to-site connection to FW1.
What should you create in VWAN1?
A. a VPN site
B. a virtual network connection
C. a network virtual appliance (NVA)
D. a User VPN configuration
Show Answer
Correct Answer: A
Explanation: In Azure Virtual WAN, a site-to-site VPN connection to an on-premises firewall is established by first creating a VPN site, which represents the on-premises VPN device and its public IP/address space. Virtual network connections connect VNets to a virtual hub, User VPN configurations are for point-to-site clients, and an NVA is not required for this scenario.
Question 105
You have the Azure subscriptions shown in the following table.
Each virtual network contains 20 internet-accessible resources that are assigned public IP addresses.
You need to implement Azure DDoS Network Protection to protect the resources. The solution must minimize costs.
What is the minimum number of DDoS Network Protection plans you should deploy?
A. 1
B. 2
C. 3
D. 6
Show Answer
Correct Answer: B
Explanation: Azure DDoS Network Protection plans can be associated with virtual networks across multiple subscriptions within the same Microsoft Entra tenant. They cannot be shared across different tenants. Based on the scenario, the subscriptions span two different Entra tenants, so one plan is needed per tenant. The 100-public-IP pricing threshold affects billing for additional protected IPs, not the minimum number of plans required.
Question 106
You have an Azure subscription that contains 100 network security groups (NSGs).
You need to ensure that you log the application of specific NSG rules.
Which type of log should you configure?
A. flow log
B. activity log
C. Azure resource log
D. audit log
Show Answer
Correct Answer: C
Explanation: To log the application of specific NSG rules, configure Azure resource logs (diagnostic/resource logs) for the NSG. NSG resource logs include 'Event' logs that record which NSG rule was applied and 'Rule counter' logs that count how often each rule allows or denies traffic. Flow logs are primarily for recording network flow information (5-tuple traffic flows), whereas the question specifically asks for logging the application of NSG rules.
Sources:
https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group
Question 107
Your company has a remote office that contains a macOS device named Device1. Device1 has an IKEv2 VPN client installed.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that Device1 can access the resources on VNet1 by using the VPN connections of VPNGW1. The solution must minimize administrative effort.
What should you do first?
A. To VNet1, deploy a virtual machine that contains a RADIUS server.
B. On Device1, install the OpenVPN client.
C. On Device1, add an X.509 certificate.
D. From Devices in the Microsoft Entra admin center, configure the Device settings.
Show Answer
Correct Answer: B
Explanation: For macOS, Microsoft Entra ID authentication for Azure Point-to-Site VPN uses the OpenVPN protocol with the Azure VPN client/OpenVPN client rather than the built-in IKEv2 client. If the gateway is configured for Microsoft Entra ID authentication, the first step is to install the appropriate OpenVPN-based client. X.509 certificates are for certificate authentication, a RADIUS server is unnecessary for native Entra ID authentication, and configuring Entra device settings is not required simply to establish a user-authenticated VPN connection.
Question 108
You have an Azure subscription that contains a virtual network named VNet1 and the resources shown in the following table.
You need to implement a solution for the traffic originating from VNet1. The solution must meet the following requirements:
• Perform transparent proxying to external web servers.
• Inspect all outbound TLS traffic.
• Minimize costs.
Which resource should you include in the solution?
A. FW2
B. AG1
C. FD1
D. FW1
Show Answer
Correct Answer: D
Explanation: The required capabilities are transparent proxying, outbound TLS inspection, and minimizing cost. TLS inspection for outbound traffic requires Azure Firewall Premium. Application Gateway and Front Door do not provide this function for outbound VNet traffic. Between the firewall options, the Premium firewall (FW1) is the appropriate choice because it supports TLS inspection while Azure Firewall operates inline for transparently routed traffic.
Question 109
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy an Azure Virtual Network NAT gateway named Gateway1. The solution must meet the following requirements:
• VM1 will access the internet by using its public IP address.
• VM2 will access the internet by using its public IP address.
• Administrative effort must be minimized.
You need to ensure that you can deploy Gateway1 to Vnet1.
What is the minimum number of subnets that Vnet1 must have?
A. 2
B. 3
C. 4
D. 5
Show Answer
Correct Answer: B
Explanation: A NAT gateway is a regional resource that is associated with one or more subnets; it is not deployed into its own subnet. It also cannot be associated with the GatewaySubnet. The requirement that VM1 and VM2 access the internet by using their own public IP addresses is still satisfied because Azure uses the instance-level public IP for outbound traffic from VMs that have one, rather than the NAT gateway. Therefore, no additional subnet is required beyond the existing Subnet1, Subnet2, and GatewaySubnet, so VNet1 needs a minimum of three subnets.
Question 110
You have an instance of Azure Web Application Firewall (WAF) on Azure Front Door.
You plan to create a WAF rule that will block high rates of requests from a single IP address.
You need to query Log Analytics to identify the optimal threshold for the rule.
Which table should you query in Log Analytics?
A. AZFWThreatIntel
B. AzureDiagnostics
C. SecurityDetection
D. AGWFirewallLogs
Show Answer
Correct Answer: B
Explanation: Azure Front Door WAF diagnostic logs are stored in the AzureDiagnostics table (when using Azure Diagnostics mode). To determine an appropriate rate-limiting threshold, you analyze Front Door WAF log entries, filtering for the FrontdoorWebApplicationFirewallLog category and aggregating requests by client IP over time. The other tables are for Azure Firewall Threat Intelligence (AZFWThreatIntel), Microsoft Sentinel detections (SecurityDetection), or Application Gateway-specific firewall logs (AGWFirewallLogs).
Question 111
You have an Azure subscription that contains the resources shown in the following table.
Subnet1 is associated with a service endpoint policy named Policy1. Policy1 specifies a single resource that references storage1.
To Subnet1, you deploy an Azure Batch pool named Pool1.
You need to ensure that the compute resources in Pool1 can access storage1.
What should you do?
A. To Policy1, add a resource.
B. To Policy1, add an alias.
C. To Subnet1, add a storage endpoint for the storage service.
D. To Subnet1, add a subnet delegation.
Show Answer
Correct Answer: B
Explanation: Azure Batch pool compute nodes accessing a Storage account through a subnet protected by a service endpoint policy require the policy to permit the Batch service as a source. In a service endpoint policy, the resource is the destination storage account, while an alias identifies the allowed source service. Since storage1 is already referenced as the resource, adding an alias for Azure Batch enables Pool1 compute resources to access storage1.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.