Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement an Azure Front Door profile.
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The security status of an Azure Virtual WAN hub is marked as Secured when a supported security provider such as Azure Firewall (via a secured virtual hub/Security Partner integration) is enabled for the hub. Implementing an Azure Front Door profile does not change the Virtual WAN hub's security status.
Question 133
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You add a rule to the rule set of AFD1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Rate limiting for Azure Front Door is configured through a WAF custom rule of type Rate limit in the associated WAF policy, not by adding a rule to an Azure Front Door Rule Set. Rule Sets modify request/response handling and routing behavior, while WAF rate limiting is a security policy feature.
Question 134
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You configure a custom rule for WAF1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. In Azure Front Door Premium, request rate limiting is implemented by creating a custom rule in the associated Web Application Firewall (WAF) policy with the rule type set to Rate limit. Since AFD1 is already associated with WAF1, configuring a custom rule in WAF1 meets the requirement.
Question 135
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You modify the policy settings of WAF1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Rate limiting for Azure Front Door is configured by creating a WAF custom rule with the Rate limit rule type. Simply modifying the WAF policy settings (managed policy settings) does not configure a rate limit. Therefore, the proposed solution does not meet the goal.
Question 136
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You configure a managed rule for WAF1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Rate limiting in Azure Front Door WAF is configured by creating a custom WAF rule with the RateLimit rule type. Managed rules provide predefined protections (such as OWASP rules) and are not used to define custom request rate limits.
Question 137
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the
portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You need to restrict access to the storage35433841 storage account to ensure that only subnet1-2 can access the account.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Sign in to the Azure portal.
Open storage35433841 > Networking.
Set Public network access to Selected networks.
Under Firewall, add the virtual network subnet subnet1-2 and remove any other allowed networks if required.
Save the changes.
Explanation: Restricting a storage account so that only a specific subnet can access it is done by configuring the storage account networking/firewall rules to allow only the required subnet. A private endpoint is not required unless explicitly requested.
Question 138
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You need to ensure that subnet3-2 can only access resources on subnet3-1.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Associate an NSG with subnet3-2.
Create outbound rule: Allow destination = subnet3-1 (higher priority).
Create outbound rule: Deny destination = Any (lower priority).
Explanation: Traffic within a VNet is allowed by default. Restricting outbound traffic from subnet3-2 so only subnet3-1 is reachable satisfies the requirement.
Question 141
HOTSPOT -
Your on-premises network uses an IP address range of 10.1.0.0 to 10.1.255.255.
You plan to deploy a new Azure virtual network solution that will include the following elements:
• A virtual network named VNet1
• A Site-to-Site (S2S) VPN connection between VNet1 and the on-premises network
• GatewaySubnet in VNet1, which will be used as a route-based virtual network gateway
You need to recommend which subnet masks to assign to VNet1 and GatewaySubnet. The solution must meet the following requirements:
• Maximize the number of available IP addresses on VNet1.
• Minimize the number of available IP addresses on GatewaySubnet.
Which address spaces should you assign to VNet1 and GatewaySubnet? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: 10.0.0.0/8 overlaps with the on-premises 10.1.0.0/16 range, so the largest non-overlapping VNet option is 10.0.0.0/16. For a route-based VPN gateway, /27 is the minimum recommended and generally required size for non-Basic SKUs; /29 is only applicable to the Basic SKU.
Question 142
DRAG DROP
-
You have an Azure subscription that contains the resources shown in the following table.
You need to associate Gateway1 with Subnet1. The solution must minimize downtime on VM1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Disassociate PIP1 from NIC1.
Change the PIP1 SKU to Standard.
Associate Gateway1 with Subnet1.
Explanation: A NAT gateway cannot be associated with a subnet containing resources that use a Basic SKU public IP. Remove the Basic public IP from the NIC, upgrade it to Standard, then associate the NAT gateway with the subnet.
Question 143
HOTSPOT
-
Your on-premises network contains the subnets shown in the following table.
The network contains a firewall named FW1 that uses a public IP address of 131.107.100.200.
You have an Azure subscription that contains the resources shown in the following table.
You plan to configure a Site-to-Site (S2S) VPN named VPN1 that will connect GW1 to FW1.
You need to configure LNG1 to support VPN1. The solution must meet the following requirements:
• Ensure that the resources on Subnet1 and Subnet2 can communicate with the resources on VNet1.
• Minimize administrative effort.
How should you configure LNG1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Address space: 192.168.10.0/23
IP address: 131.107.100.200
Explanation: The local network gateway should represent the on-premises network and VPN device. Summarizing the contiguous on-premises subnets as 192.168.10.0/23 minimizes administration, and the IP address must be the public IP of the on-premises firewall (131.107.100.200).
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
