HOTSPOT
-
You have an Azure subscription that contains 1,000 virtual machines.
You collect network security group (NSG) flow logs.
You need to identify all the virtual machines that have interacted with non-Azure public IP addresses during the last 30 days.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: NSG flow logs analyzed by Traffic Analytics are stored in the AzureNetworkAnalytics_CL table. Filtering FlowType_s == "ExternalPublic" identifies traffic between virtual machines and non-Azure public IP addresses within the last 30 days.
Question 54
HOTSPOT
-
You have a firewall that is managed by using an Azure Firewall Premium policy named Policy1.
You need to configure Policy1 to block outbound traffic to the following locations:
• Malicious addresses identified by Microsoft.
• Social networking sites
The solution must minimize administrative effort.
What should you configure in Policy1 for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Block traffic to malicious addresses:
Threat intelligence
Block traffic to social networking sites:
An application rule
Explanation: Azure Firewall Premium threat intelligence automatically blocks traffic to Microsoft-identified malicious IPs with minimal administration. Social networking sites are best controlled using application rules, which filter outbound web traffic by FQDN and web categories.
Question 55
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table.
You plan to deploy an app named App1 to meet the following requirements:
• External users must be able to access App1 from the internet.
• App1 will be load balanced across all the virtual machines.
• App1 will be hosted on VM1, VM2, VM3, and VM4.
• App1 must be available if an Azure region fails.
• Costs must be minimized.
You need to implement a global load balancer solution for App1.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: One cross-region load balancer and two regional load balancers only
Standard
Explanation: A cross-region Azure Load Balancer provides global load balancing and regional failover between West Europe and East US. Separate regional load balancers distribute traffic across the VMs within each region. The Standard SKU is required for cross-region load balancing and provides higher availability and resiliency at minimal necessary cost.
Question 56
DRAG DROP
-
You have the resources shown in the following table.
From the Microsoft Entra admin center, you register the Azure VPN application as an enterprise application.
You need to enable Microsoft Entra authentication for the P2S VPN connections. The solution must meet the following requirements:
• Ensure that only the members of Group1 can establish VPN connections to VPNGW1.
• Ensure that only the members of Group2 can establish VPN connections to VPNGW2.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Register two apps (App1, App2) in Microsoft Entra and assign Group1 to App1 and Group2 to App2.
Add a scope to App1 and App2.
Add a client app to App1 and App2.
Configure the Point-to-Site settings for VPNGW1 and VPNGW2 in the Azure portal.
Explanation: Each VPN gateway requires its own Entra application to enforce group-based access. Groups are assigned first, then scopes and client apps are configured to enable Entra authentication. Finally, each VPN gateway is configured to use its corresponding application for P2S authentication.
Question 57
You have an on-premises network named Site1.
You have an Azure subscription that contains a storage account named storage1 and a virtual network named VNet1. VNet1 contains a subnet named Subnet1. A private endpoint for storage1 is connected to Subnet1. Site1 is connected to VNet1 by using a Site-to-Site (S2S) VPN.
You need to control access to storage1 from Site1 by using network security groups (NSGs),
What should you do first?
A. Configure a network policy for private endpoints on Subnet1.
B. Create a subnet delegation on Subnet1.
C. Associate a route table with Subnet1.
D. Associate a NAT gateway with Subnet1.
Show Answer
Correct Answer: A
Explanation: To control traffic to a private endpoint using NSGs, you must first enable network policies for private endpoints on the subnet. By default, private endpoints have network policies (NSGs/UDRs) disabled on the subnet, so NSG rules are not enforced. Configuring the network policy for private endpoints on Subnet1 allows NSG rules to control access from Site1 over the S2S VPN.
Question 58
You have an Azure subscription that contains the resources shown in the following table.
VNet1 contains a subnet named Subnet.
You need to ensure that the resources connected to Subnet1 can access only storage1 and storage3. The solution must minimize administrative effort.
What should you configure?
A. an application security group
B. Azure Private Link
C. a service endpoint policy
D. a service tag
Show Answer
Correct Answer: C
Explanation: To restrict subnet resources so they can access only specific Azure Storage accounts while minimizing administrative effort, a service endpoint policy is appropriate. Service endpoint policies are allow-only policies applied at the subnet level, enabling access only to the specified storage resources (storage1 and storage3) and implicitly denying access to all other storage accounts. Other options do not provide this precise, low-effort restriction.
Question 59
HOTSPOT -
You have an on-premises VPN appliance named GW1.
You have an Azure subscription that contains an Azure VPN gateway named VPNGW1. VPNGW1 connects to GW1.
You need to modify the IKEv2 encryption algorithm used by VPNGW1 and GW1.
Which PowerShell cmdlet should you run? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: To change the IKEv2 encryption algorithm, you must first define a custom IPsec/IKE policy using New-AzIpsecPolicy, which allows specifying IkeEncryption and related parameters. That policy is then applied to the existing VPN connection between VPNGW1 and the on-premises gateway by updating the connection with Set-AzVirtualNetworkGatewayConnection.
Question 60
HOTSPOT -
You have an Azure subscription.
You plan to implement an Azure application gateway named AGW1.
You need to implement an external TLS certificate store for AGW1. The solution must meet the following requirements:
• Keys must be stored by using the highest possible security.
• Administrative effort must be minimized.
Which type of certificate store should you use, and which type of identity should you use to access the store? To answer, select the appropriate options in the answer area
NOTE: Each correct answer is worth one point.
Explanation: Azure Application Gateway supports storing TLS certificates in Azure Key Vault, but not in Dedicated HSM or Managed HSM. Key Vault provides the highest supported security with minimal operational overhead. Access from Application Gateway to Key Vault requires a user-assigned managed identity, as this is the supported identity type for certificate retrieval.
Question 61
HOTSPOT -
You have an Azure subscription that contains two virtual machines.
You monitor traffic between the virtual machines by using NSG flow logs.
You have a network security group (NSG) flow log that has the following entries.
1493763938,185.170.185.105,10.2.0.4,35370,23,T,I,A,B,,,,
1493695838,185.170.185.105,10.2.0.4,35370,23,T,I,A,C,200,500,100,300
1493696138,185.170.185.105,10.2.0.4,35370,23,T,I,A,E,1000,6000,500,1200
You need to identify the following metrics from the log entries:
• The total number of packets transferred between the virtual machines
• The total amount of bytes transferred between the virtual machines
What should you identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: A
Explanation: Only the flow records with state C (Continue) and E (End) contain packet and byte counters. In each of those records, the last four fields represent packets_tx, bytes_tx, packets_rx, and bytes_rx. Summing both directions:
Packets = (200 + 100) from C + (1000 + 500) from E = 1,800 packets.
Bytes = (500 + 300) from C + (6000 + 1200) from E = 8,000 bytes.
The initial A (Begin) record has no counters and is not included.
Question 62
DRAG DROP
-
You have an Azure Web Application Firewall (WAF) v2 tier named AG1 on an Azure application gateway. AG1 has a policy named Policy1.
You need to add a custom rule to Policy1. The rule must block all requests from IP addresses in a specific IP address range.
Which four PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
Explanation: Create a match variable for client IP, use it in a condition that specifies the IP range, build a custom rule with a Block action, then apply the updated custom rule to the existing WAF policy.
$19
Get all 344 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
