SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the
portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You plan to implement an Azure application gateway in the East US Azure region. The
application gateway will have Web Application Firewall (WAF) enabled.
You need to create a policy that can be linked to the planned application gateway. The policy must block connections from IP addresses in the 131.107.150.0/24 range. You do NOT need to provision the application gateway to complete this task.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create a WAF policy (Regional – Application Gateway) in East US.
Add a custom rule:
- Rule type: Match
- Match type: IP address
- Match variable: SocketAddr
- Operator: IPMatch / Does contain
- IP range: 131.107.150.0/24
- Action: Deny
Save the policy (association to an application gateway is optional/not required).
Explanation: Azure Application Gateway WAF blocks traffic using WAF policies with custom rules. An IP-based match rule configured to deny the specified CIDR range fulfills the requirement without provisioning the application gateway.
Question 184
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. On FW1, configure a DNAT rule for port 1688
B. Deploy a NAT gateway.
C. Add an internet route to RT1 for the Azure Key Management Service (KMS).
D. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
Show Answer
Correct Answer: C
Explanation: The default route (0.0.0.0/0) forces all outbound traffic from Subnet1 through Azure Firewall. Windows Server activation uses Azure Key Management Service (KMS) over TCP 1688, and Azure Firewall blocks this traffic unless explicitly allowed. Adding a specific Internet route for the Azure KMS service ensures activation traffic bypasses the firewall while keeping other traffic inspected. DNAT, NSG changes, or a NAT gateway do not resolve the blocked KMS activation path.
Question 189
DRAG DROP
-
You have a DNS domain named contoso.com that is hosted by a third-party domain name registrar.
You have an Azure subscription.
You need to ensure that all DNS queries for the contoso.com domain are resolved by using Azure DNS.
What should you create in the registrar, and what should you create in Azure? To answer, drag the appropriate options to the correct targets. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Registrar:
A delegation
Azure:
A public DNS zone
Explanation: To use Azure DNS for contoso.com, the domain registrar must delegate the domain to Azure DNS name servers. In Azure, a public DNS zone for contoso.com hosts the DNS records that answer internet queries.
Question 191
You have an Azure subscription that contains four virtual machines. The virtual machines host an app named App1.
You deploy an Azure Standard Load Balancer named LB1 to load balance incoming HTTPS requests to App1.
You need to reduce how long it takes for LB1 to stop sending App1 traffic to failed servers. The solution must minimize administrative effort.
What should you modify?
A. the Backend pools settings
B. the Diagnostic settings
C. the Load-balancing rules
D. the Health probes settings
Show Answer
Correct Answer: D
Explanation: Azure Standard Load Balancer stops sending traffic to failed backends based on health probe results. By modifying the health probe settings (such as probe interval and unhealthy threshold), you can detect failures faster and remove unhealthy virtual machines from rotation more quickly. This directly reduces failover time with minimal administrative effort compared to changing rules or backend configuration.
Question 192
You have an Azure subscription that contains the resources shown in the following table.
Subnet1 contains three virtual machines that host an app named App1. App1 is accessed by using the SFTP protocol.
From NSG1, you configure an inbound security rule named Rule2 that allows inbound SFTP connections to ASG1.
You need to ensure that the inbound SFTP connections are managed by using ASG1. The solution must minimize administrative effort.
What should you do?
A. From NSG1, modify the priority of Rule2.
B. From each virtual machine, associate the network interface to ASG1.
C. From Subnet1, create a subnet delegation.
D. From ASG1, modify the role assignments.
Show Answer
Correct Answer: B
Explanation: An Application Security Group (ASG) controls traffic based on the NICs associated with it. For NSG1’s inbound SFTP rule targeting ASG1 to apply to App1 VMs, each VM’s network interface must be associated with ASG1. This directly enables management via ASG1 and minimizes administrative effort. Changing rule priority, subnet delegation, or role assignments does not associate traffic with the ASG.
Question 193
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
A. storage account
B. internal load balancers
C. service endpoints
D. virtual network peering
Show Answer
Correct Answer: B
Explanation: Subnets must have available IP addresses for resources that are deployed into them. An internal load balancer is assigned a private frontend IP from the subnet, so it consumes IP addresses. Storage accounts, service endpoints, and virtual network peering do not require IP addresses from subnets.
Question 194
HOTSPOT
-
You have an on-premises network.
You have an Azure subscription that contains the resources shown in the following table.
You need to implement an ExpressRoute circuit to access the resources in the subscription. The solution must ensure that the on-premises network connects to the Azure resources by using the ExpressRoute circuit.
Which type of peering should you use for each connection? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Connection to VNet1:
Private peering
Connection to SQL1:
Microsoft peering
Explanation: ExpressRoute private peering is used to connect on-premises networks to Azure virtual networks and VMs. Azure SQL Database is a Microsoft SaaS service and is accessed over ExpressRoute using Microsoft peering.
Question 195
You have the on-premises networks shown in the following table.
You have an Azure subscription that contains an Azure virtual WAN named VWAN1 and a virtual network named VNet1. VWAN is connected to the on-premises networks and VNet1 in a full mesh topology. The virtual hub routing preference for VWAN1 is AS Path.
You need to route traffic from VNet1 to 10.61.1.5.
Which path will be used?
A. the VPN connection to Branch1
B. the VPN connection to Branch2
C. the ExpressRoute connection to Branch2
D. the ExpressRoute connection to Branch3
Show Answer
Correct Answer: D
Explanation: The destination IP 10.61.1.5 falls within the 10.61.0.0/16 prefix, which is advertised by all branches. With the virtual hub routing preference set to AS Path, Azure vWAN prefers the route with the shortest AS‑Path. Branch2 is performing AS‑path prepending (the same ASN repeated multiple times), which makes its AS‑Path longer and therefore less preferred. Branch1 uses VPN and is also less preferred than ExpressRoute when other factors are equal. Branch3 advertises the prefix over ExpressRoute without AS‑path prepending, resulting in the shortest AS‑Path and a local ExpressRoute route. Therefore, traffic from VNet1 to 10.61.1.5 uses the ExpressRoute connection to Branch3.
Question 196
HOTSPOT
-
You have an Azure subscription that contains multiple virtual machine scale sets and multiple Azure load balancers. The load balancers balance traffic across the scale sets.
You plan to deploy Azure Front Door to load balance traffic across the load balancers.
You need to identify which Front Door SKU to configure, and what to use to route the traffic to the load balancers. The solution must minimize costs.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: SKU:
Premium
Use:
Azure Private Link
Explanation: To route Azure Front Door to Azure Load Balancers privately (especially internal load balancers), Front Door Premium is required because it is the only SKU that supports Private Link. Private Link enables secure, private connectivity from Front Door to the load balancers while minimizing exposure and meeting the routing requirement.
Question 197
You have an Azure subscription that contains an Azure Front Door named FD1.
You plan to deploy an app named App1 by using Azure App Service. Users will access App1 by using FD1.
You need to provide FD1 with access to App1. The solution must meet the following requirements:
• Ensure that users can only access App1 by using FD1.
• Ensure that users cannot access App1 directly from the internet.
What should you create for App1?
A. an access restriction
B. a private endpoint
C. a subnet delegation
D. a service endpoint
Show Answer
Correct Answer: A
Explanation: To ensure users can access the App Service only through Azure Front Door and not directly from the internet, you should configure App Service access restrictions. By creating an access restriction rule that allows traffic only from Azure Front Door (using the AzureFrontDoor.Backend service tag and optional X-Azure-FDID header validation), all direct internet access is blocked while Front Door access is permitted. A private endpoint is optional and mainly used with Front Door Standard/Premium for private connectivity, but it is not required to meet the stated requirements.
$19
Get all 344 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
