HOTSPOT -
You have an on-premises web server that hosts a web app named App1 and has the following configurations:
• IP address: 131.107.50.60
• FQDN: server1.contoso.com
You have an Azure subscription.
You need to publish App1 by using Azure Front Door. The solution must meet the following requirements:
• Ensure that internet users can connect to App1 by using an FQDN of app1.contoso.com.
• Minimize the changes required to the configuration of Front Door if Server1 is migrated to Azure.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: Point the custom domain to the Front Door endpoint using a CNAME. Configure the origin host name as the server FQDN so if the server is migrated, updating DNS/backend mapping is sufficient with minimal Front Door changes.
Question 52
SIMULATION
-
Username and password
-
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username:
Azure Password: xxxxxxxxxx
-
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
-
You have two servers that are each hosted by a separate service provider in New York and Germany. The server hosted in New York is accessible by using a host name of ny.contoso.com. The server hosted in Germany is accessible by using a host name of de.contoso.com.
You need to provide a single host name to access both servers. The solution must ensure that traffic originating from Germany is routed to de.contoso.com. All other traffic must be routed to ny.contoso.com.
To complete this task, sign in to the Azure portal.
Show Answer
Correct Answer: Create an Azure Traffic Manager profile using the Geographic routing method.
Add an external endpoint for de.contoso.com mapped to Germany.
Add an external endpoint for ny.contoso.com mapped to World (all other regions).
Use the Traffic Manager DNS name (or a CNAME from the required single hostname) for client access.
Explanation: Traffic Manager supports DNS-based geographic routing, allowing requests originating from Germany to resolve to the Germany server while all other requests resolve to the New York server. Application Gateway is regional and does not provide this global geographic DNS routing.
Question 53
DRAG DROP
-
You have an on-premises network.
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway named Gateway1.
You need to implement an ExpressRoute solution from a third-party provider named Fabrikam, Inc. The solution must ensure that devices on the on-premises network can connect to the Azure resources on VNet1.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Create an ExpressRoute circuit.
Send the service key to Fabrikam.
Configure Azure private peering.
Connect Gateway1 to the ExpressRoute circuit.
Explanation: Create the circuit first, provide the service key to the connectivity provider so they can provision the connection, configure Azure private peering for VNet connectivity, and finally link the virtual network gateway to the ExpressRoute circuit.
Question 54
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that remote users can establish RDP connections to the virtual machines by using Bastion1.
How should you configure the rules for NSG1 for traffic from the internet to AzureBastionSubnet and for traffic from AzureBastionSubnet to Subnet1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Traffic from the internet to AzureBastionSubnet: Enable TCP port 443 inbound.
Traffic from AzureBastionSubnet to Subnet1: Enable TCP port 3389 outbound.
Explanation: Azure Bastion is accessed by users over HTTPS (TCP 443) on its public IP. Bastion then initiates RDP connections to Windows VMs over TCP 3389 within the virtual network.
Question 55
DRAG DROP -
You have an on-premises network.
You have an Azure subscription that contains a virtual network named VNet1. VNet1 is connected to an Azure Virtual WAN hub named Hub1.
You need to enable connectivity between the on-premises network and VNet1 by using Hub1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: 1. Configure a Site-to-Site (S2S) VPN gateway.
2. Create a VPN site.
3. Connect the VPN site to Hub1.
Explanation: A Virtual WAN hub requires an S2S VPN gateway before a VPN site can connect. Then create the on-premises VPN site resource and finally associate it with the existing Hub1. VNet1 is already connected to Hub1, so no additional VNet or Hub actions are needed.
Question 56
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that network traffic is routed over the Azure backbone network for the following scenarios:
• Traffic from SQLMIT to storage1
• Traffic from domain joined servers on VNet2 to storage
The solution must minimize costs.
What should you configure for each scenario? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Traffic from SQLMI1 to storage1: A service endpoint policy
Traffic from domain-joined servers on VNet2 to storage1: A private endpoint
Explanation: A service endpoint policy is the relevant low-cost configuration associated with Azure SQL Managed Instance access restrictions to Azure Storage over the Azure backbone. For domain-joined servers in VNet2, a private endpoint for the storage account provides private connectivity over the Azure backbone, and is the available appropriate option.
Question 57
HOTSPOT
-
You have an Azure subscription that contains 1,000 virtual machines.
You collect network security group (NSG) flow logs.
You need to identify all the virtual machines that have interacted with non-Azure public IP addresses during the last 30 days.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: NSG Traffic Analytics data is stored in AzureNetworkAnalytics_CL. Filter FlowLog records from the last 30 days where FlowType_s equals "ExternalPublic" to identify VM interactions with non-Azure public IP addresses, then project and distinct the VM names.
Question 58
HOTSPOT
-
You have a firewall that is managed by using an Azure Firewall Premium policy named Policy1.
You need to configure Policy1 to block outbound traffic to the following locations:
• Malicious addresses identified by Microsoft.
• Social networking sites
The solution must minimize administrative effort.
What should you configure in Policy1 for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Block traffic to malicious addresses: Threat intelligence
Block traffic to social networking sites: An application rule
Explanation: Threat intelligence automatically blocks traffic to Microsoft-identified malicious IPs/domains with minimal administration. Application rules support FQDNs and web categories (Premium), making them appropriate for blocking social networking sites.
Question 59
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy an app named App1 to meet the following requirements:
• External users must be able to access App1 from the internet.
• App1 will be load balanced across all the virtual machines.
• App1 will be hosted on VM1, VM2, VM3, and VM4.
• App1 must be available if an Azure region fails.
• Costs must be minimized.
You need to implement a global load balancer solution for App1.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Number and type of load balancers: One cross-region load balancer and two regional load balancers only
Load balancer SKU: Standard
Explanation: A cross-region Azure Load Balancer fronts regional Standard Load Balancers. Each region needs its own regional Standard Load Balancer to distribute traffic across the VMs in that region, while the cross-region load balancer provides global failover and internet entry point.
Question 60
DRAG DROP
-
You have the resources shown in the following table.
From the Microsoft Entra admin center, you register the Azure VPN application as an enterprise application.
You need to enable Microsoft Entra authentication for the P2S VPN connections. The solution must meet the following requirements:
• Ensure that only the members of Group1 can establish VPN connections to VPNGW1.
• Ensure that only the members of Group2 can establish VPN connections to VPNGW2.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: 1. Register App1 and App2, assigning Group1 to App1 and Group2 to App2.
2. Add a scope to App1 and App2.
3. Add a client app to App1 and App2.
4. Configure the Point-to-site settings for VPNGW1 and VPNGW2.
Explanation: For Microsoft Entra authentication with separate authorization per VPN gateway, create separate app registrations, define scopes, authorize the VPN client application, then configure each VPN gateway to use the corresponding application/audience so group assignments control access.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.