You have an on-premises network named Site1.
You have an Azure subscription that contains a storage account named storage1 and a virtual network named VNet1. VNet1 contains a subnet named Subnet1. A private endpoint for storage1 is connected to Subnet1. Site1 is connected to VNet1 by using a Site-to-Site (S2S) VPN.
You need to control access to storage1 from Site1 by using network security groups (NSGs),
What should you do first?
A. Configure a network policy for private endpoints on Subnet1.
B. Create a subnet delegation on Subnet1.
C. Associate a route table with Subnet1.
D. Associate a NAT gateway with Subnet1.
Show Answer
Correct Answer: A
Explanation: To filter traffic to a private endpoint by using NSGs, you must first enable network policies for private endpoints on the subnet that contains the private endpoint. By default, NSG and UDR policies are disabled for private endpoints. Subnet delegation, route tables, and NAT gateways do not enable NSG enforcement for private endpoint traffic.
Question 62
You have an Azure subscription that contains the resources shown in the following table.
VNet1 contains a subnet named Subnet.
You need to ensure that the resources connected to Subnet1 can access only storage1 and storage3. The solution must minimize administrative effort.
What should you configure?
A. an application security group
B. Azure Private Link
C. a service endpoint policy
D. a service tag
Show Answer
Correct Answer: C
Explanation: A service endpoint policy lets you restrict traffic from a subnet using Azure service endpoints so that it can access only specified Azure Storage accounts. This directly satisfies the requirement that resources in Subnet1 can access only storage1 and storage3 while minimizing administrative effort. Application security groups control VM network security grouping, Private Link provides private connectivity but does not enforce an allow-list of specific storage accounts for subnet egress, and service tags represent groups of IP prefixes rather than individual storage resources.
Question 63
HOTSPOT -
You have an on-premises VPN appliance named GW1.
You have an Azure subscription that contains an Azure VPN gateway named VPNGW1. VPNGW1 connects to GW1.
You need to modify the IKEv2 encryption algorithm used by VPNGW1 and GW1.
Which PowerShell cmdlet should you run? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: To configure the use of IKEv2 encryption:
New-AzIpsecPolicy
To apply the new policy:
Set-AzVirtualNetworkGatewayConnection
Explanation: IKE/IPsec cryptographic settings are defined in an IPsec policy created with New-AzIpsecPolicy (using parameters such as -IkeEncryption). The policy is then applied to the site-to-site VPN connection with Set-AzVirtualNetworkGatewayConnection by assigning the IPsec policy to the connection.
Question 64
HOTSPOT -
You have an Azure subscription.
You plan to implement an Azure application gateway named AGW1.
You need to implement an external TLS certificate store for AGW1. The solution must meet the following requirements:
• Keys must be stored by using the highest possible security.
• Administrative effort must be minimized.
Which type of certificate store should you use, and which type of identity should you use to access the store? To answer, select the appropriate options in the answer area
NOTE: Each correct answer is worth one point.
Explanation: Application Gateway integrates with Azure Key Vault for TLS certificates. Managed HSM and Dedicated HSM are not supported as the certificate source for Application Gateway. Access to Key Vault for Application Gateway uses a user-assigned managed identity.
Question 65
HOTSPOT -
You have an Azure subscription that contains two virtual machines.
You monitor traffic between the virtual machines by using NSG flow logs.
You have a network security group (NSG) flow log that has the following entries.
1493763938,185.170.185.105,10.2.0.4,35370,23,T,I,A,B,,,,
1493695838,185.170.185.105,10.2.0.4,35370,23,T,I,A,C,200,500,100,300
1493696138,185.170.185.105,10.2.0.4,35370,23,T,I,A,E,1000,6000,500,1200
You need to identify the following metrics from the log entries:
• The total number of packets transferred between the virtual machines
• The total amount of bytes transferred between the virtual machines
What should you identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Total number of packets: 1,800
Total amount of bytes: 8,000
Explanation: Only the C (continuation) and E (end) flow records include packet/byte counters. Sum packets_tx + packets_rx: (200+100)+(1000+500)=1,800. Sum bytes_tx + bytes_rx: (500+300)+(6000+1200)=8,000.
Question 66
DRAG DROP -
You have an Azure Web Application Firewall (WAF) v2 tier named AG1 on an Azure application gateway. AG1 has a policy named Policy1.
You need to add a custom rule to Policy1. The rule must block all requests from IP addresses in a specific IP address range.
Which four PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
Explanation: Create the match variable (RemoteAddr), use it in a condition for the target IP range, build the custom rule with Block action, then apply the updated rule set to the WAF policy.
Question 67
HOTSPOT -
You have an on-premises network that includes the sites shown in the following table.
Each site is connected to the Internet by a firewall. All sites are connected to an SD-WAN. Each site is configured to propagate routes by using BGP.
You have an Azure subscription that includes a virtual network named Vnet1 that contains a Virtual Network Gateway named Gateway1.
You create a local network gateway with the configuration shown in the gateway exhibit (Click the Gateway tab.)
You create a Site-to-Site (S2S) connection with the configuration shown in connection exhibit. (Click the Connection tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: The VPN terminates at the Paris firewall (public IP 131.107.50.60). Because the on-prem sites exchange routes over the SD-WAN using BGP and the LNG advertises 172.16.0.0/16, Berlin can reach Azure through Paris. A direct VPN to Berlin requires a separate Local Network Gateway because it has a different VPN endpoint public IP. The Local Network Gateway must reference the on-prem public VPN IP, not the private firewall IP.
Question 68
HOTSPOT -
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
You plan to deploy Azure virtual machines and Azure Bastion to VNet1.
You need to recommend an IP subnetting configuration for VNet1. The solution must maximize the number of IP addresses that can be assigned to the virtual machines.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: /25
182
Explanation: Azure Bastion requires a dedicated AzureBastionSubnet of at least /26. From the /24 VNet, allocate /26 to Bastion and split the remaining space into one /25 and one /26 VM subnet. Azure reserves 5 IPs per subnet, so usable VM IPs are 123 + 59 = 182.
Question 69
HOTSPOT
-
You have an Azure subscription that contains a virtual network named VNet1.
Your on-premises network connects to VNet1 by using a Site-to-Site (S2S) VPN connection.
You need to ensure that Azure Network Watcher generates an alert if the VPN connection fails.
Which Network Watcher feature should you use to generate the alert, and which data source should the feature query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Feature: Connection monitor
Data source: Network Watcher Agent
Explanation: Connection Monitor is the Network Watcher feature designed for continuous monitoring and alerting. It relies on the Network Watcher agent/extension on monitored VMs to collect connectivity data, which can be used to trigger alerts.
Question 70
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
You create a service endpoint policy as shown in the Policy exhibit. (Click the Policy tab.)
You configure the Service Endpoints settings for Subnet3 as shown in the Subnets exhibit. (Click the Subnets tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: 1. No
2. Yes
3. No
Explanation: The service endpoint policy allowlists only the specified Storage account (storage85347). After the policy is associated with Subnet3, access over Microsoft.Storage service endpoints is limited to that account, so storage85348 is blocked. A service endpoint policy can be associated with multiple subnets that have the required Storage service endpoint enabled. Service endpoint policies apply only to Azure Storage, not Azure SQL, so they cannot restrict access to DB1.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
