You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an Azure Virtual Desktop host pool named Pool1.
You need to implement Azure Firewall and TLS inspection for all the outbound traffic from Pool1.
Which two resources should you configure? Each correct answer present part of the solution.
NOTE: Each correct answer is worth one point.
A. an Azure Private DNS zone
B. a private endpoint
C. an Azure key vault
D. an Azure NAT gateway
E. a Microsoft Entra enterprise app
F. a managed identity
Show Answer
Correct Answer: C, F
Explanation: Azure Firewall Premium TLS inspection requires access to a CA certificate stored in Azure Key Vault and a managed identity so the firewall can retrieve and use the certificate. A NAT Gateway is unrelated to TLS inspection, and Private DNS, Private Endpoint, and Entra enterprise apps are not required for this functionality.
Question 113
You have an Azure subscription that contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has the default rules configured. VM1 runs Windows Server 2022 and contains a single NIC named NIC1. NIC1 is associated with NSG1.
You need to prevent access to the Azure Instance Metadata Service (IMDS) REST API on VM1. The solution must minimize administrative effort.
What should you add to NSG1?
A. an outbound rule that blocks traffic to an IP address.
B. an inbound rule that blocks traffic to an IP address.
C. an inbound and outbound rule that blocks traffic to an application security group.
D. an outbound rule that blocks traffic to a service tag.
Show Answer
Correct Answer: D
Explanation: The Azure Instance Metadata Service is accessed from the VM as outbound traffic. To prevent access with minimal administrative effort, add an outbound NSG rule that denies traffic to the Azure platform IMDS service tag rather than managing IP addresses. This is the Azure-recommended, maintainable approach.
Question 114
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that the virtual machines can access storage1, storage2, and DB1 by using service endpoints.
What is the minimum number of service endpoints you should create?
A. 2
B. 3
C. 4
D. 12
Show Answer
Correct Answer: C
Explanation: Service endpoints are enabled per subnet for a specific Azure service (for example, Microsoft.Storage or Microsoft.Sql). Two Azure service types are required (Storage and SQL). With virtual machines located across two virtual networks/subnets, you must enable the required service endpoints on each participating subnet. That results in 2 service endpoint types × 2 VNets/subnets = 4 service endpoint configurations. Service endpoints do not extend across VNet peering.
Question 115
You have an Azure subscription that contains the resources shown in the following table.
NSG1 is associated to the NIC of VM1 and contains the rules shown in the following table.
You collect NSG flow logs for five minutes for the following activities:
• Two RDP sessions from VM1 to VM2, each initiated from a different TCP port
• Three SSH sessions from VM2 to VM1, each initiated from a different TCP port
You analyze the logs by using Traffic Analytics in Azure Network Watcher.
How many aggregated flow entries will Traffic Analytics identify?
A. 1
B. 2
C. 5
D. 10
Show Answer
Correct Answer: B
Explanation: Traffic Analytics aggregates NSG flow logs by source IP, destination IP, destination port, NSG, NSG rule, flow direction, and protocol. The source port is excluded from aggregation. Therefore, the two RDP sessions from VM1 to VM2 (same destination port 3389) become one aggregated flow, and the three SSH sessions from VM2 to VM1 (same destination port 22) become one aggregated flow, for a total of two aggregated flow entries.
Question 116
You have an Azure Front Door instance named FD that contains an origin group named OG1.
You need to configure a health probe for OG1. The solution must minimize the amount of traffic generated by the health probe.
Which HTTP method should you use?
A. CONNECT
B. HEAD
C. TRACE
D. GET
Show Answer
Correct Answer: B
Explanation: Use the HEAD method. Azure Front Door health probes support GET and HEAD. HEAD returns only the response headers without a message body, minimizing bandwidth and probe traffic while still verifying the origin's availability. GET transfers the response body, generating more traffic. CONNECT and TRACE are not appropriate health probe methods.
Question 117
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure Web Application Firewall (WAF).
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: A Virtual WAN hub is marked as Secured when it is associated with a supported security provider such as Azure Firewall in a secured virtual hub. Azure Web Application Firewall (WAF) protects web applications and does not secure an Azure Virtual WAN hub or change its security status.
Question 118
You have an Azure subscription that contains an Azure App Service web app named WebApp1 and an Azure Front Door profile named FDProfile1. FDProfile1 forwards requests addressed to https://www.contoso.com to WebApp1.
You need to ensure that only requests addressed to https://www.contoso.com/users/* are forwarded to WebApp1.
What should you modify in FDProfile1?
A. the routes
B. the origin group
C. the endpoint
D. the domain
Show Answer
Correct Answer: A
Explanation: Azure Front Door determines which incoming requests are forwarded by using route matching. Routes define the accepted domains, path patterns (such as /users/*), protocols, and the origin group to forward to. To ensure that only requests to https://www.contoso.com/users/* are forwarded to the web app, modify the route's path pattern.
Question 119
You have an on-premises DNS server named Server that hosts a primary DNS zone named fabrikam.com.
You have an Azure subscription that contains the resources shown in the following table.
Users on the on-premises network access resources on all the virtual networks by using a Site-to-Site (S2S) VPN.
You need to deploy an Azure DNS Private Resolver solution that meets the following requirements:
• Resources connected to the virtual networks must be able to resolve DNS names for fabrikam.com.
• Server1 must be able to resolve the DNS names of the resources in contoso.com.
• The solution must minimize costs and administrative effort.
What is the minimum number of resolvers you should deploy?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: The minimum is two Azure DNS Private Resolvers because the service is regional. A resolver and its outbound endpoint/ruleset are associated with a virtual network in a single Azure region. To support name resolution for virtual networks in two different regions while also providing inbound resolution from the on-premises DNS server and outbound forwarding to the on-premises fabrikam.com zone with minimal administration, deploy one resolver per region.
Question 120
You purchase an Azure subscription. You plan to deploy resources shown in the following table to the subscription.
You need to create a NSG1 rule named Rule1 to meet the following requirements:
• Enable the search servers of App1 to establish outbound HTTP connections to internet services.
• Minimize administrative effort when new search servers are deployed.
• Use the principle of least privilege.
What should you select as the source for Rule1?
A. Application security group
B. IP Addresses
C. Any
D. VirtualNetwork
Show Answer
Correct Answer: A
Explanation: Use an Application Security Group (ASG) as the source so the NSG rule applies only to the search servers. New search server VMs can be added to the ASG without modifying the NSG rule, minimizing administrative effort while following least privilege. Using IP addresses requires ongoing updates, 'Any' is overly permissive, and 'VirtualNetwork' includes far more resources than necessary.
Question 121
You have an Azure subscription.
You plan to deploy Azure Firewall Premium, enable all the Premium features, and configure both network and application rules.
Which type of rule will the firewall process first?
A. network
B. application
C. threat intelligence
D. infrastructure
Show Answer
Correct Answer: C
Explanation: When Azure Firewall Premium has threat intelligence-based filtering enabled, threat intelligence rules are evaluated before user-defined network and application rules. Infrastructure rules are internal, while among user rules network rules are normally processed before application rules, but threat intelligence filtering takes precedence over both.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.