SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You are planning security for Azure Front Door.
You need to create a rule that can be applied to Front Door hosts. The rule must prevent hosts in Japan from making more than 50 requests per minute. You do NOT need to associate the rule to a Front Door instance to complete this task.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create a Global WAF (Front Door) policy.
Add a Custom rule of type Rate limit.
Set Priority: 1, Rate limit duration: 1 minute, Threshold: 50.
Add a GeoMatch condition for Country = Japan.
Action: Deny.
Do not associate the policy/rule with a Front Door instance.
Explanation: Azure Front Door host protection uses a Front Door WAF policy. A custom rate-limiting rule with a GeoMatch condition targeting Japan and a deny action blocks requests exceeding 50 per minute from that country. The task does not require associating the policy.
Question 123
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You need to ensure that traffic to host.fabrikam.com is directed to the Traffic Manager profile.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create or update the DNS record for host.fabrikam.com as a CNAME that points to the Traffic Manager profile DNS name (trafficmanager.net endpoint).
Explanation: To direct traffic through Azure Traffic Manager, the hostname must resolve via a CNAME to the Traffic Manager profile's DNS name. This is typically done in the Azure DNS zone for the domain.
Question 124
HOTSPOT
-
You have an Azure subscription that contains an Azure Firewall policy named FWPolicy1.
You need to configure FWPolicy1 to meet the following requirements:
• Allow traffic based on the FQDN of the destination.
• Allow TCP traffic based on the source.
Which types of rules should you use for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Allow traffic based on the FQDN of the destination: Network or application only
Allow TCP traffic based on the source: Network or DNAT only
Explanation: Azure Firewall supports FQDN matching in Application rules and also in Network rules (via FQDN destination). TCP/source-based filtering is supported by Network rules, and DNAT rules also match protocol/source for inbound translated traffic.
Question 125
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
You need to restrict access to storage1 and sql1 by using service endpoints. The solution must meet the following requirements:
• Allow access from Subnet1 to SQLDB1.
• Implement service endpoint policies to restrict access to supported resources.
• Allow access from Subnet1 to storage1 and the read-only replica of storage1 in the paired Azure region.
What is the minimum number of service endpoints and service endpoint policies you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Service endpoints: 2
Service endpoint policies: 1
Explanation: Create one service endpoint for Microsoft.Sql and one for Storage (using the appropriate storage endpoint type to support the RA-GRS secondary). Service endpoint policies are supported for Azure Storage, not Azure SQL Database, and listing the primary RA-GRS storage account also allows its read-only secondary.
Question 126
SIMULATION -
Username and password -
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx -
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678 -
You plan to deploy a VPN gateway and an ExpressRoute gateway to VNET2.
You need to prepare VNET2 to ensure that you can deploy the gateways.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: In VNET2, create (or resize) a subnet named GatewaySubnet with a prefix of /27 or larger (for example, /26), then deploy both the VPN gateway and ExpressRoute gateway into that subnet.
Explanation: Azure supports coexistence of VPN and ExpressRoute gateways in the same virtual network when a properly named GatewaySubnet exists and is at least /27 in size.
Question 127
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You plan to deploy two DNS servers to subnet2-1. Each server will host a DNS zone for fabrikam,com. The DNS zones will contain records from the on-premises network only. The IP address of the DNS servers will be 10.2.1.4 and 10.2.1.5.
You need to ensure that virtual machines on VNET2 can resolve the names of the on-premises servers in fabrikam.com.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: On VNET2, configure Custom DNS servers:
10.2.1.4
10.2.1.5
Explanation: Set the virtual network's DNS servers to the two planned DNS server IPs so VMs in VNET2 use them to resolve the on-premises fabrikam.com zone. This is the expected task for this simulation.
Question 128
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You plan to configure a VPN tunnel for VNET2.
You need to ensure that all internet traffic from subnet2-1 is routed through an on-premises firewall before reaching the destination. The solution must be achieved without using dynamic routing protocols.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create a route table (or edit the existing one) for subnet2-1 with route 0.0.0.0/0 and next hop type = Virtual network gateway, then associate it with subnet2-1.
Explanation: To force all Internet-bound traffic from the subnet through the site-to-site VPN to the on-premises firewall without relying on dynamic routing, use a user-defined route that sends the default route (0.0.0.0/0) to the virtual network gateway.
Question 129
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You need to block all outbound internet traffic for HTTP and HTTPS that originates from subnet1-1. All other traffic must be allowed.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create and associate an NSG outbound rule on subnet1-1:
Priority above default allow
Source: subnet1-1 (or Any if attached to subnet)
Protocol: TCP
Destination: Internet
Destination ports: 80,443
Action: Deny
Explanation: For the stated requirement of blocking outbound HTTP/HTTPS from a specific subnet while allowing all other traffic, the expected simulation task is typically an outbound NSG deny rule applied to the subnet. Azure Firewall application rules would only be required if filtering by application protocol independent of port or other advanced requirements were explicitly part of the scenario.
Question 130
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure Firewall.
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. Implementing Azure Firewall in the Virtual WAN hub is the key component required for a secured virtual hub. A hub's security status changes to Secured when Azure Firewall is deployed and managed as part of the secured virtual hub configuration via Azure Firewall Manager.
Question 131
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure NAT Gateway.
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: No. In Azure Virtual WAN, a virtual hub is marked as Secured when it is associated with a secured virtual hub configuration using Azure Firewall (Firewall Manager/Secured Virtual Hub). Deploying an Azure NAT Gateway provides outbound SNAT for supported resources but does not change the virtual hub security status to Secured.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
