You have an Azure subscription. The subscription contains a locally-redundant storage (LRS) account named storage1 that is deployed to the US East Azure region and has a Microsoft.Storage service endpoint.
You set Redundancy for storage1 to Read-access geo-redundant storage (RA-GRS).
You need to ensure that the contents of storage1 will be accessible by using a service endpoint in a paired region. The solution must minimize administrative effort.
What should you do first?
A. Create an object replication rule for storage.
B. Delete the existing service endpoint.
C. From storage1, select Secure transfer required.
D. Create a service endpoint policy.
Show Answer
Correct Answer: D
Explanation: The correct first step is to create a service endpoint policy. For RA-GRS storage accounts, service endpoint policies upgrade Azure Storage service endpoint scope from regional to global, allowing secure access to the RA-GRS secondary endpoint in the paired region with minimal administrative effort. Object replication is unrelated because RA-GRS already replicates data. Deleting the service endpoint or enabling Secure transfer required does not provide paired-region service endpoint access.
Question 103
You have an on-premises network.
You have an Azure subscription that contains a virtual network.
You have an ExpressRoute service provider.
You plan to connect the Azure virtual network and the on-premises network by using an ExpressRoute circuit.
You create a new ExpressRoute circuit.
You need to provision the new circuit.
Which information should you provide to the service provider?
A. the IKEv2 shared key
B. the certificate
C. the public IP address
D. the service key
Show Answer
Correct Answer: D
Explanation: After creating an ExpressRoute circuit, Azure generates a unique service key (also called the service key/S-Key). You provide this service key to the ExpressRoute connectivity provider so they can identify and provision the circuit. IKEv2 shared keys and certificates are used for VPN connections, and a public IP address is not used to provision the ExpressRoute circuit.
Question 106
You have an Azure subscription that contains 100 network security groups (NSGs).
You need to ensure that you log the application of specific NSG rules.
Which type of log should you configure?
A. flow log
B. activity log
C. Azure resource log
D. audit log
Show Answer
Correct Answer: C
Explanation: To log the application of specific NSG rules, configure Azure resource logs (diagnostic/resource logs) for the NSG. NSG resource logs include 'Event' logs that record which NSG rule was applied and 'Rule counter' logs that count how often each rule allows or denies traffic. Flow logs are primarily for recording network flow information (5-tuple traffic flows), whereas the question specifically asks for logging the application of NSG rules.
Sources:
https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group
Question 110
You have an instance of Azure Web Application Firewall (WAF) on Azure Front Door.
You plan to create a WAF rule that will block high rates of requests from a single IP address.
You need to query Log Analytics to identify the optimal threshold for the rule.
Which table should you query in Log Analytics?
A. AZFWThreatIntel
B. AzureDiagnostics
C. SecurityDetection
D. AGWFirewallLogs
Show Answer
Correct Answer: B
Explanation: Azure Front Door WAF diagnostic logs are stored in the AzureDiagnostics table (when using Azure Diagnostics mode). To determine an appropriate rate-limiting threshold, you analyze Front Door WAF log entries, filtering for the FrontdoorWebApplicationFirewallLog category and aggregating requests by client IP over time. The other tables are for Azure Firewall Threat Intelligence (AZFWThreatIntel), Microsoft Sentinel detections (SecurityDetection), or Application Gateway-specific firewall logs (AGWFirewallLogs).
Question 112
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an Azure Virtual Desktop host pool named Pool1.
You need to implement Azure Firewall and TLS inspection for all the outbound traffic from Pool1.
Which two resources should you configure? Each correct answer present part of the solution.
NOTE: Each correct answer is worth one point.
A. an Azure Private DNS zone
B. a private endpoint
C. an Azure key vault
D. an Azure NAT gateway
E. a Microsoft Entra enterprise app
F. a managed identity
Show Answer
Correct Answer: C, F
Explanation: Azure Firewall Premium TLS inspection requires access to a CA certificate stored in Azure Key Vault and a managed identity so the firewall can retrieve and use the certificate. A NAT Gateway is unrelated to TLS inspection, and Private DNS, Private Endpoint, and Entra enterprise apps are not required for this functionality.
Question 113
You have an Azure subscription that contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has the default rules configured. VM1 runs Windows Server 2022 and contains a single NIC named NIC1. NIC1 is associated with NSG1.
You need to prevent access to the Azure Instance Metadata Service (IMDS) REST API on VM1. The solution must minimize administrative effort.
What should you add to NSG1?
A. an outbound rule that blocks traffic to an IP address.
B. an inbound rule that blocks traffic to an IP address.
C. an inbound and outbound rule that blocks traffic to an application security group.
D. an outbound rule that blocks traffic to a service tag.
Show Answer
Correct Answer: D
Explanation: The Azure Instance Metadata Service is accessed from the VM as outbound traffic. To prevent access with minimal administrative effort, add an outbound NSG rule that denies traffic to the Azure platform IMDS service tag rather than managing IP addresses. This is the Azure-recommended, maintainable approach.
Question 116
You have an Azure Front Door instance named FD that contains an origin group named OG1.
You need to configure a health probe for OG1. The solution must minimize the amount of traffic generated by the health probe.
Which HTTP method should you use?
A. CONNECT
B. HEAD
C. TRACE
D. GET
Show Answer
Correct Answer: B
Explanation: Use the HEAD method. Azure Front Door health probes support GET and HEAD. HEAD returns only the response headers without a message body, minimizing bandwidth and probe traffic while still verifying the origin's availability. GET transfers the response body, generating more traffic. CONNECT and TRACE are not appropriate health probe methods.
Question 117
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure Web Application Firewall (WAF).
Does this meet the requirement?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: A Virtual WAN hub is marked as Secured when it is associated with a supported security provider such as Azure Firewall in a secured virtual hub. Azure Web Application Firewall (WAF) protects web applications and does not secure an Azure Virtual WAN hub or change its security status.
Question 118
You have an Azure subscription that contains an Azure App Service web app named WebApp1 and an Azure Front Door profile named FDProfile1. FDProfile1 forwards requests addressed to https://www.contoso.com to WebApp1.
You need to ensure that only requests addressed to https://www.contoso.com/users/* are forwarded to WebApp1.
What should you modify in FDProfile1?
A. the routes
B. the origin group
C. the endpoint
D. the domain
Show Answer
Correct Answer: A
Explanation: Azure Front Door determines which incoming requests are forwarded by using route matching. Routes define the accepted domains, path patterns (such as /users/*), protocols, and the origin group to forward to. To ensure that only requests to https://www.contoso.com/users/* are forwarded to the web app, modify the route's path pattern.
Question 121
You have an Azure subscription.
You plan to deploy Azure Firewall Premium, enable all the Premium features, and configure both network and application rules.
Which type of rule will the firewall process first?
A. network
B. application
C. threat intelligence
D. infrastructure
Show Answer
Correct Answer: C
Explanation: When Azure Firewall Premium has threat intelligence-based filtering enabled, threat intelligence rules are evaluated before user-defined network and application rules. Infrastructure rules are internal, while among user rules network rules are normally processed before application rules, but threat intelligence filtering takes precedence over both.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.