You have an Azure Front Door instance named FD that contains an origin group named OG1.
You need to configure a health probe for OG1. The solution must minimize the amount of traffic generated by the health probe.
Which HTTP method should you use?
A. CONNECT
B. HEAD
C. TRACE
D. GET
Show Answer
Correct Answer: B
Explanation: To minimize traffic from Azure Front Door health probes, use the HEAD HTTP method. HEAD checks the availability of the origin by returning only response headers and status code without a response body, generating less bandwidth than GET. CONNECT and TRACE are not appropriate or supported for health probing.
Question 114
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure Web Application Firewall (WAF).
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: In Azure Virtual WAN, a hub is marked as Secured only when a supported network security service such as Azure Firewall or a third‑party NVA firewall is deployed in the hub. Azure Web Application Firewall (WAF) protects web applications at the HTTP/HTTPS layer and does not secure a Virtual WAN hub. Therefore, implementing WAF does not meet the requirement.
Question 115
You have an Azure subscription that contains an Azure App Service web app named WebApp1 and an Azure Front Door profile named FDProfile1. FDProfile1 forwards requests addressed to https://www.contoso.com to WebApp1.
You need to ensure that only requests addressed to https://www.contoso.com/users/* are forwarded to WebApp1.
What should you modify in FDProfile1?
A. the routes
B. the origin group
C. the endpoint
D. the domain
Show Answer
Correct Answer: A
Explanation: In Azure Front Door Standard/Premium, path-based request filtering and forwarding (such as allowing only /users/* to reach an origin) is configured on routes. Routes define the accepted domains, protocols, and URL path patterns and map them to an origin group. Therefore, modifying the route to match only https://www.contoso.com/users/* ensures that only those requests are forwarded to WebApp1.
Question 116
You have an on-premises DNS server named Server that hosts a primary DNS zone named fabrikam.com.
You have an Azure subscription that contains the resources shown in the following table.
Users on the on-premises network access resources on all the virtual networks by using a Site-to-Site (S2S) VPN.
You need to deploy an Azure DNS Private Resolver solution that meets the following requirements:
• Resources connected to the virtual networks must be able to resolve DNS names for fabrikam.com.
• Server1 must be able to resolve the DNS names of the resources in contoso.com.
• The solution must minimize costs and administrative effort.
What is the minimum number of resolvers you should deploy?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: Azure DNS Private Resolver is a regional service and is deployed into a specific virtual network in a specific Azure region. A resolver can only be associated with VNets in the same region via its DNS forwarding ruleset. Because the scenario involves multiple VNets in different regions that must resolve both on‑premises (fabrikam.com) and Azure private DNS (contoso.com) names, at least one resolver is required per region. Deploying two resolvers satisfies the requirements while minimizing cost and administrative effort.
Question 117
You purchase an Azure subscription. You plan to deploy resources shown in the following table to the subscription.
You need to create a NSG1 rule named Rule1 to meet the following requirements:
• Enable the search servers of App1 to establish outbound HTTP connections to internet services.
• Minimize administrative effort when new search servers are deployed.
• Use the principle of least privilege.
What should you select as the source for Rule1?
A. Application security group
B. IP Addresses
C. Any
D. VirtualNetwork
Show Answer
Correct Answer: A
Explanation: Using an Application Security Group (ASG) as the source allows the NSG rule to apply only to the search servers’ NICs, satisfying least privilege. It also minimizes administrative effort because newly deployed search servers are automatically covered when added to the ASG, unlike IP addresses which require manual updates. Using Any or VirtualNetwork would be overly permissive.
Question 118
You have an Azure subscription.
You plan to deploy Azure Firewall Premium, enable all the Premium features, and configure both network and application rules.
Which type of rule will the firewall process first?
A. network
B. application
C. threat intelligence
D. infrastructure
Show Answer
Correct Answer: C
Explanation: In Azure Firewall Premium, threat intelligence–based filtering has the highest priority. When enabled, threat intelligence rules are always evaluated first, before any network or application rules, regardless of rule configuration.
Question 119
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You are planning security for Azure Front Door.
You need to create a rule that can be applied to Front Door hosts. The rule must prevent hosts in Japan from making more than 50 requests per minute. You do NOT need to associate the rule to a Front Door instance to complete this task.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create a Global WAF (Azure Front Door) policy
Add a custom rule (Rate limit)
Set 50 requests per 1 minute
Condition: Geo location = Japan (JP)
Action: Deny/Block
Explanation: Azure Front Door uses a Global WAF policy. A custom rule of type Rate limit allows limiting requests per client. Setting the duration to 1 minute with a threshold of 50 and adding a Geo-location condition for Japan ensures hosts from Japan are rate-limited. The rule can exist without associating it to a Front Door instance.
Question 120
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You need to ensure that traffic to host.fabrikam.com is directed to the Traffic Manager profile.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create a DNS CNAME record for host.fabrikam.com that points to the Traffic Manager profile DNS name (e.g., <profile>.trafficmanager.net).
Explanation: Traffic Manager is DNS-based. Directing traffic requires configuring DNS so that host.fabrikam.com resolves to the Traffic Manager profile, which then routes requests to its configured endpoints.
Question 121
HOTSPOT
-
You have an Azure subscription that contains an Azure Firewall policy named FWPolicy1.
You need to configure FWPolicy1 to meet the following requirements:
• Allow traffic based on the FQDN of the destination.
• Allow TCP traffic based on the source.
Which types of rules should you use for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Allow traffic based on the FQDN of the destination:
Application only
Allow TCP traffic based on the source:
Network or DNAT only
Explanation: FQDN-based filtering is supported only by Application rules in Azure Firewall. TCP traffic filtered by source IP and protocol is handled by Network rules, and DNAT rules can also allow TCP traffic for inbound scenarios.
Question 122
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
You need to restrict access to storage1 and sql1 by using service endpoints. The solution must meet the following requirements:
• Allow access from Subnet1 to SQLDB1.
• Implement service endpoint policies to restrict access to supported resources.
• Allow access from Subnet1 to storage1 and the read-only replica of storage1 in the paired Azure region.
What is the minimum number of service endpoints and service endpoint policies you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Service endpoints: 2
Service endpoint policies: 1
Explanation: Subnet1 needs service endpoints for Azure SQL and Azure Storage. Service endpoint policies are supported only for Azure Storage, not Azure SQL. A single storage service endpoint policy can restrict access to storage1, and RA-GRS automatically allows access to the read-only replica in the paired region without additional endpoints or policies.
$19
Get all 344 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
