You have an Azure Private Link service named PL1 that uses an Azure load balancer named LB1.
You need to ensure that PL1 can support a higher volume of outbound traffic.
What should you do?
A. Increase the number of frontend IP configurations for LB1.
B. Increase the number of NAT IP addresses assigned to PL1.
C. Deploy an Azure Application Gateway v2 instance to the source NAT subnet.
D. Redeploy LB1 with a different SKU.
Show Answer
Correct Answer: B
Explanation: A Private Link service scales outbound SNAT capacity by increasing the number of NAT IP addresses assigned to the service. Each NAT IP adds additional ephemeral ports/connections for outbound translation. Increasing load balancer frontend IPs, adding an Application Gateway, or changing the load balancer SKU does not increase the Private Link service's SNAT port capacity.
Question 171
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
The subscription contains the virtual machines shown in the following table.
You create a load balancer named LB1 that has the following configurations:
• SKU: Basic
• Type: Internal
• Subnet: Subnet12
• Virtual network: VNet1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
No
Explanation: A Basic internal Azure Load Balancer supports backend instances only within the same virtual network and, for Basic SKU, backend members must belong to the same availability set (or scale set/single VM). VM1 and VM2 are in AS1 within VNet1, so they can be balanced. VM2 and VM3 are not in the same availability set. VM4 is in a different virtual network.
Question 172
DRAG DROP
-
You have two on-premises datacenters.
You have an Azure subscription that contains four virtual networks named VNet1, VNet2, VNet3, and VNet4.
You create an Azure virtual WAN named VWAN1. VWAN1 contains a single virtual hub that is connected to both on-premises datacenters and all the virtual networks in a full mesh topology.
You create a route table named RT1.
You need to configure VWAN1 to meet the following requirements:
• Connectivity between VNet1 and VNet2 and both on-premises datacenters must be allowed.
• Connectivity between VNet3 and VNet4 and both on-premises datacenters must be allowed.
• VNet1 and VNet2 must be isolated from VNet3 and VNet4.
How should you configure routing for VNet1 and VNet2 and for both on-premises datacenters? To answer, drag the appropriate route tables and route table propagation to the correct requirements. Each route table and route table propagation may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: VNet1 and VNet2:
Associated route table: RT1; Propagating to route tables: RT1 and Default
On-premises datacenters:
Associated route table: Default; Propagating to route tables: RT1 and Default
Explanation: To allow VNet1 and VNet2 to communicate with each other and the branches, they should be associated with the custom route table and advertise into both RT1 and Default. Branches should remain associated with Default while propagating into both tables so each isolated VNet group can reach on-premises without learning routes to the other group.
Question 173
You have the Azure virtual networks shown in the following table.
You deploy Azure Firewall to Vnet3.
You need to ensure that the traffic from Subnet1-1 to Subnet2-1 passes through the firewall.
What should you configure?
A. peering links between Vnet1 and Vnet2
B. a route table associated to Subnet1-1 and Subnet2-1
C. an Azure private DNS zone
D. a route table associated to AzureFirewallSubnet
Show Answer
Correct Answer: B
Explanation: To force traffic between subnets in different virtual networks through Azure Firewall, you configure user-defined routes (route tables) on the source and destination subnets, with the firewall's private IP as the next hop (Virtual appliance). Associating a route table only to AzureFirewallSubnet is not how traffic is redirected, peering alone does not force firewall traversal, and a private DNS zone is unrelated.
Question 175
You plan to implement an Azure virtual network that will contain 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.
You need to recommend which subnet mask size to use for the virtual subnets.
What should you recommend?
A. /64
B. /120
C. /48
D. /24
Show Answer
Correct Answer: A
Explanation: Azure virtual network IPv6 subnets must be exactly /64 in size. Although a /120 would numerically provide enough addresses for 200 VMs, Azure's IPv6 implementation requires /64 subnets for compatibility and supported routing behavior. Therefore the correct recommendation is /64.
Question 176
HOTSPOT
-
You have an Azure subscription that contain a storage account named st1 in the East US Azure region.
You have the virtual networks shown in the following table.
You have the subnets shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: Azure Bastion requires a dedicated subnet named AzureBastionSubnet of at least /26, not deployment into the existing Subnet1-1. A /25 subnet has 123 usable Azure IPs after reserving 5; with 5 already used, 118 remain, so 100 more VMs fit. 10.3.1.0/16 is not a valid /16 network boundary and does not match the VNet address space network.
Question 177
You have an Azure subscription that contains a virtual network named VNet1.
You deploy several web apps and configure the apps to use private endpoints on VNet1.
You need to identify which DNS records the web apps registered automatically.
Where will the records be created?
A. an Azure DNS zone named privatelink.azurewebsites.net
B. an Azure Private DNS zone named azurewebsites.net
C. an Azure Private DNS zone named privatelink.azurewebsites.net
D. an Azure DNS zone named azurewebsites.net
Show Answer
Correct Answer: C
Explanation: Azure App Service private endpoints use the Azure Private DNS zone named 'privatelink.azurewebsites.net'. When you integrate a private endpoint with private DNS, the required A records for the web app are created automatically in that Azure Private DNS zone.
Question 178
HOTSPOT
-
You have the Azure resources shown in the following table.
You need to link VNet2 to Circuit1.
What should you create in each subscription? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Sub1: An ExpressRoute circuit connection authorization
Sub2: An ExpressRoute circuit connection
Explanation: When an ExpressRoute circuit is shared across subscriptions, the circuit owner creates an authorization in the subscription that owns the circuit. The other subscription then creates the ExpressRoute connection from its virtual network gateway using that authorization.
Question 179
You have 10 on-premises networks that are connected by using a 3rd party Software Defined Wide Area Network (SD-WAN) solution. You have an Azure subscription that contains five virtual networks.
You plan to connect the Azure virtual networks and the on-premises networks by using an Azure Virtual WAN with a single virtual WAN hub.
You need to ensure that the Azure Virtual WAN can act as a node in the 3rd party SD-WAN solution.
What should you include in the solution?
A. An Azure Virtual WAN ExpressRoute gateway
B. A Network Virtual Appliance (NVA)
C. A Site to site gateway (VPN gateway)
D. A Point to site gateway (User VPN gateway)
Show Answer
Correct Answer: B
Explanation: Answer B is correct. To make Azure Virtual WAN act as a node within a third-party SD-WAN solution, you deploy a supported Network Virtual Appliance (NVA) in the Virtual WAN hub. Azure Virtual WAN supports direct integration with select SD-WAN vendor NVAs, allowing the hub to participate in the SD-WAN fabric. ExpressRoute, site-to-site VPN, and point-to-site gateways provide connectivity methods but do not make the Virtual WAN hub itself a third-party SD-WAN node.
Question 180
You have three on-premises networks.
You have an Azure subscription that contains a Basic Azure virtual WAN. The virtual WAN contains a single virtual hub and a virtual network gateway that is limited to a throughput of 1 Gbps.
The on-premises networks connect to the virtual WAN by using Site-to-Site (S2S) VPN connections.
You need to increase the throughput of the virtual WAN to 3 Gbps. The solution must minimize administrative effort.
What should you do?
A. Upgrade the virtual WAN to the Standard SKU.
B. Add an additional VPN gateway to the Azure subscription.
C. Create an additional virtual hub.
D. Increase the number of gateway scale units.
Show Answer
Correct Answer: A
Explanation: A Basic Azure Virtual WAN does not support increasing VPN gateway scale units. Gateway scale units, which increase aggregate VPN throughput, are available with the Standard Virtual WAN SKU. Therefore, to increase throughput from 1 Gbps to 3 Gbps with minimal administrative effort, first upgrade the virtual WAN to the Standard SKU. Adding gateways or hubs adds unnecessary resources and management overhead.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
