SIMULATION -
Username and password -
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx -
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678 -
You plan to deploy a VPN gateway and an ExpressRoute gateway to VNET2.
You need to prepare VNET2 to ensure that you can deploy the gateways.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create a subnet named **GatewaySubnet** in VNET2 with an address prefix **/27 or larger** (for example, 10.0.0.0/27).
Explanation: Both VPN and ExpressRoute gateways can coexist in the same virtual network only if a properly named GatewaySubnet exists and is sized at /27 or larger, which is required before deploying either gateway.
Question 124
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You plan to deploy two DNS servers to subnet2-1. Each server will host a DNS zone for fabrikam,com. The DNS zones will contain records from the on-premises network only. The IP address of the DNS servers will be 10.2.1.4 and 10.2.1.5.
You need to ensure that virtual machines on VNET2 can resolve the names of the on-premises servers in fabrikam.com.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create an Azure DNS Private Resolver in VNET2
Create an outbound endpoint in a dedicated /28 subnet
Create a DNS forwarding ruleset for fabrikam.com
Add destination DNS servers 10.2.1.4 and 10.2.1.5
Link the ruleset to VNET2
Explanation: DNS Private Resolver enables conditional forwarding so only fabrikam.com queries are sent to the on‑premises DNS servers (10.2.1.4, 10.2.1.5), while all other name resolution continues to use Azure-provided DNS. This avoids configuring custom DNS on the VNET and prevents disruption of Azure internal name resolution.
Question 125
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You plan to configure a VPN tunnel for VNET2.
You need to ensure that all internet traffic from subnet2-1 is routed through an on-premises firewall before reaching the destination. The solution must be achieved without using dynamic routing protocols.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create a user-defined route (UDR) for subnet2-1:
Destination: 0.0.0.0/0
Next hop type: Virtual network gateway
Explanation: To force all internet-bound traffic from subnet2-1 through the on-premises firewall without dynamic routing, configure forced tunneling using a UDR. A default route (0.0.0.0/0) with next hop set to the VPN (virtual network) gateway ensures traffic is sent through the site-to-site VPN to on-premises, where the firewall processes it before reaching the internet.
Question 126
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You need to block all outbound internet traffic for HTTP and HTTPS that originates from subnet1-1. All other traffic must be allowed.
To complete this task, sign in to the Azure portal.
Explanation: Blocking HTTP/HTTPS regardless of port requires Layer 7 inspection. Azure Firewall application rules can deny HTTP and HTTPS traffic from a specific subnet while allowing all other traffic. NSGs only filter Layer 3/4 (IP/port) and cannot reliably block the HTTP/HTTPS protocols themselves.
Question 127
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure Firewall.
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: In Azure Virtual WAN, a hub is marked as Secured when Azure Firewall is deployed and managed through Azure Firewall Manager in that virtual hub. Implementing Azure Firewall in Hub1 therefore changes its security status from Unsecured to Secured, meeting the requirement.
Question 128
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure NAT Gateway.
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: An Azure Virtual WAN hub is marked as Secured only when a supported security provider, such as Azure Firewall or a third-party firewall, is deployed in the hub. Azure NAT Gateway provides outbound internet connectivity and address translation but does not add security services to a Virtual WAN hub. Therefore, implementing Azure NAT Gateway does not change the hub’s security status to Secured.
Question 129
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement an Azure Front Door profile.
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: An Azure Virtual WAN hub is marked as Secured only when Azure Firewall or a supported third-party security provider is enabled in the hub. Azure Front Door is a global application delivery service and does not integrate with Virtual WAN hub security status, so it does not secure Hub1.
Question 130
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You add a rule to the rule set of AFD1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Rate limiting for Azure Front Door Premium is configured in the associated Web Application Firewall (WAF) policy by creating a custom Rate Limit rule. Rule sets in Azure Front Door are used for routing and header/URL manipulation, not for WAF rate limiting. Therefore, adding a rule to the rule set of AFD1 does not meet the goal.
Question 131
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You configure a custom rule for WAF1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. Azure Front Door Premium implements rate limiting through Azure Web Application Firewall custom rules. By creating a custom WAF rule with the Rate limit rule type in WAF1 (which is associated with AFD1), you can limit the number of incoming requests, so this configuration meets the goal.
Question 132
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You modify the policy settings of WAF1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Rate limiting for Azure Front Door is configured by creating a WAF custom rule with a rate limit action. Modifying the general policy settings of a WAF policy does not configure rate limiting, so this solution does not meet the goal.
$19
Get all 344 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.