You have an Azure subscription that contains 100 network security groups (NSGs).
You need to ensure that you log the application of specific NSG rules.
Which type of log should you configure?
A. flow log
B. activity log
C. Azure resource log
D. audit log
Show Answer
Correct Answer: A
Explanation: To log the application of specific NSG rules (which rules allow or deny traffic), you must use NSG flow logs. Flow logs record ingress and egress traffic flows through an NSG and indicate whether traffic was allowed or denied, along with the rule that evaluated the traffic. Activity logs track management operations, and Azure resource logs focus on control-plane or diagnostic events, not per-traffic rule application.
Question 104
Your company has a remote office that contains a macOS device named Device1. Device1 has an IKEv2 VPN client installed.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that Device1 can access the resources on VNet1 by using the VPN connections of VPNGW1. The solution must minimize administrative effort.
What should you do first?
A. To VNet1, deploy a virtual machine that contains a RADIUS server.
B. On Device1, install the OpenVPN client.
C. On Device1, add an X.509 certificate.
D. From Devices in the Microsoft Entra admin center, configure the Device settings.
Show Answer
Correct Answer: B
Explanation: Azure VPN Gateway point-to-site connections that use Microsoft Entra ID authentication on macOS require the Azure VPN Client (OpenVPN). The built-in IKEv2 client does not support Entra ID authentication. Installing the OpenVPN/Azure VPN client is the first and least administrative-effort step to enable Device1 to connect to VNet1 via VPNGW1.
Question 105
You have an Azure subscription that contains a virtual network named VNet1 and the resources shown in the following table.
You need to implement a solution for the traffic originating from VNet1. The solution must meet the following requirements:
• Perform transparent proxying to external web servers.
• Inspect all outbound TLS traffic.
• Minimize costs.
Which resource should you include in the solution?
A. FW2
B. AG1
C. FD1
D. FW1
Show Answer
Correct Answer: D
Explanation: To transparently proxy outbound traffic from VNet1 and inspect all outbound TLS traffic, Azure Firewall Premium is required. Azure Firewall operates as a transparent proxy via UDRs and, in the Premium SKU, supports TLS inspection. This meets the requirements while minimizing cost compared to alternatives like Application Gateway or Front Door, which are not suitable for generic outbound traffic inspection.
Question 106
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy an Azure Virtual Network NAT gateway named Gateway1. The solution must meet the following requirements:
• VM1 will access the internet by using its public IP address.
• VM2 will access the internet by using its public IP address.
• Administrative effort must be minimized.
You need to ensure that you can deploy Gateway1 to Vnet1.
What is the minimum number of subnets that Vnet1 must have?
A. 2
B. 3
C. 4
D. 5
Show Answer
Correct Answer: B
Explanation: An Azure NAT gateway is not deployed into a subnet; it is only associated with subnets to provide outbound NAT. Because VM1 and VM2 must continue using their own public IP addresses, the NAT gateway must not be associated with their subnets. To simply deploy Gateway1 in Vnet1, no additional subnet is required beyond the existing ones (Subnet1, Subnet2, and GatewaySubnet). Therefore, the minimum number of subnets in Vnet1 is three.
Question 107
You have an instance of Azure Web Application Firewall (WAF) on Azure Front Door.
You plan to create a WAF rule that will block high rates of requests from a single IP address.
You need to query Log Analytics to identify the optimal threshold for the rule.
Which table should you query in Log Analytics?
A. AZFWThreatIntel
B. AzureDiagnostics
C. SecurityDetection
D. AGWFirewallLogs
Show Answer
Correct Answer: B
Explanation: Azure Front Door WAF logs are written to the AzureDiagnostics table in Log Analytics. By querying AzureDiagnostics and filtering on the FrontdoorWebApplicationFirewallLog category, you can analyze request rates per client IP to determine an appropriate threshold for a rate-limiting or custom WAF rule. The other tables relate to Azure Firewall, security detections, or Application Gateway, not Front Door WAF.
Question 108
You have an Azure subscription that contains the resources shown in the following table.
Subnet1 is associated with a service endpoint policy named Policy1. Policy1 specifies a single resource that references storage1.
To Subnet1, you deploy an Azure Batch pool named Pool1.
You need to ensure that the compute resources in Pool1 can access storage1.
What should you do?
A. To Policy1, add a resource.
B. To Policy1, add an alias.
C. To Subnet1, add a storage endpoint for the storage service.
D. To Subnet1, add a subnet delegation.
Show Answer
Correct Answer: B
Explanation: A service endpoint policy has two key parts: resources (the target storage accounts) and aliases (the source Azure services that are allowed to access those resources over the service endpoint). The policy already references storage1 as the resource, so adding another resource is unnecessary and does not help. To allow Azure Batch pool compute nodes to access storage1 through the service endpoint, you must add the Azure Batch service alias to Policy1. Therefore, adding an alias is the correct action.
Question 109
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an Azure Virtual Desktop host pool named Pool1.
You need to implement Azure Firewall and TLS inspection for all the outbound traffic from Pool1.
Which two resources should you configure? Each correct answer present part of the solution.
NOTE: Each correct answer is worth one point.
A. an Azure Private DNS zone
B. a private endpoint
C. an Azure key vault
D. an Azure NAT gateway
E. a Microsoft Entra enterprise app
F. a managed identity
Show Answer
Correct Answer: C, F
Explanation: Azure Firewall TLS inspection (Premium) requires a trusted root CA to decrypt and re-encrypt outbound traffic. This is implemented by storing the root CA certificate in an Azure Key Vault and granting Azure Firewall access to it via a managed identity. NAT gateway, private endpoints, DNS zones, or Entra apps are not required for TLS inspection itself.
Question 110
You have an Azure subscription that contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has the default rules configured. VM1 runs Windows Server 2022 and contains a single NIC named NIC1. NIC1 is associated with NSG1.
You need to prevent access to the Azure Instance Metadata Service (IMDS) REST API on VM1. The solution must minimize administrative effort.
What should you add to NSG1?
A. an outbound rule that blocks traffic to an IP address.
B. an inbound rule that blocks traffic to an IP address.
C. an inbound and outbound rule that blocks traffic to an application security group.
D. an outbound rule that blocks traffic to a service tag.
Show Answer
Correct Answer: D
Explanation: Access to the Azure Instance Metadata Service (IMDS) occurs as outbound traffic from the VM to a well-known endpoint. To block this with minimal administrative effort, you should add an outbound NSG rule. Using the built-in service tag for Azure Instance Metadata Service avoids hard-coding IP addresses and automatically handles any backend changes, making it the simplest and most maintainable solution.
Question 111
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that the virtual machines can access storage1, storage2, and DB1 by using service endpoints.
What is the minimum number of service endpoints you should create?
A. 2
B. 3
C. 4
D. 12
Show Answer
Correct Answer: C
Explanation: Azure service endpoints are enabled per subnet and do not traverse VNet peering. In this scenario there are two VNets (with subnets hosting the VMs) and two service types required: Microsoft.Storage (for storage1 and storage2) and Microsoft.Sql (for DB1). Each VNet/subnet must enable both service endpoint types independently. Therefore, 2 VNets × 2 service endpoint types = 4 service endpoints.
Question 112
You have an Azure subscription that contains the resources shown in the following table.
NSG1 is associated to the NIC of VM1 and contains the rules shown in the following table.
You collect NSG flow logs for five minutes for the following activities:
• Two RDP sessions from VM1 to VM2, each initiated from a different TCP port
• Three SSH sessions from VM2 to VM1, each initiated from a different TCP port
You analyze the logs by using Traffic Analytics in Azure Network Watcher.
How many aggregated flow entries will Traffic Analytics identify?
A. 1
B. 2
C. 5
D. 10
Show Answer
Correct Answer: B
Explanation: Traffic Analytics aggregates NSG flow logs by source IP, destination IP, destination port, protocol, direction, and rule — the source port is excluded from aggregation. Therefore, multiple sessions that differ only by source TCP port are combined into a single aggregated flow. The two RDP sessions from VM1 to VM2 aggregate into one flow, and the three SSH sessions from VM2 to VM1 aggregate into one flow, for a total of 2 aggregated flow entries.
$19
Get all 344 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.