HOTSPOT
-
You have an on-premises network.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that on-premises devices can communicate with Azure resources that are connected to Subnet4.
What should you do on each resource? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Server1: Deploy the On-Premises Extended-Network Gateway appliance.
VM2: Deploy the Azure Extended-Network Gateway appliance.
Explanation: Subnet4 and the on-premises Subnet1 use the same IP range (10.1.1.0/24). To enable communication across overlapping address spaces, use Azure Extended Network by deploying the on-premises gateway appliance on the on-prem server and the Azure Extended-Network Gateway appliance in Azure.
Question 72
HOTSPOT -
You have an Azure subscription that contains a dual-stack virtual network named VNet1. VNet1 has the following IP address spaces:
• IPv4: 192.168.0.0/24
• IPv6: fd00:db8:deca:deed:/48
You plan to deploy an Azure VPN gateway and multiple virtual machines to VNet1.
You need to configure the subnet masks for VNet1. The solution must meet the following requirements:
• Maximize the number of usable IP addresses.
• Support the deployment of the VPN gateway and the virtual machines.
Which subnet mask should you use for each address space? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: IPv4: /25
IPv6: /64
Explanation: A VPN gateway requires a dedicated GatewaySubnet, so the IPv4 /24 address space must be split into at least two subnets. The largest subnet size that still allows another subnet is /25. For Azure IPv6, subnets must use a /64 prefix.
Question 73
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
You need to identify the number of established outbound connections from the virtual machines.
Which resource and metric should you review? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Resource: IP_LB1
Metric: Used SNAT Ports
Explanation: Outbound internet connections through a public Load Balancer use SNAT on its public IP. The 'Used SNAT Ports' metric on the public IP indicates the number of outbound connections consuming SNAT ports.
Question 74
DRAG DROP -
You have an Azure subscription that contains a virtual machine named VM1. VM1 contains a NIC named NIC1 and a public IP address named PIP1. PIP1 is assigned to NIC1.
You plan to deploy four Network Virtual Appliances (NVAs).
You need to ensure that all the inbound traffic from the internet to PIP1 is inspected by the NVAs. The solution must ensure that the NVA deployment is highly available.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Create a gateway load balancer.
Deploy the NVAs.
Link NIC1 to the load balancer.
Explanation: A Gateway Load Balancer provides transparent service chaining for highly available NVAs. After deploying the NVAs behind the Gateway Load Balancer, chain the protected VM's frontend (NIC/public endpoint association) to the Gateway Load Balancer so inbound internet traffic to PIP1 is inspected before reaching VM1.
Question 75
DRAG DROP -
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.
You plan to deploy the resources shown in the following table.
You need to deploy two load balancers to manage the traffic for VMSS1, VM1, and VM2. The solution must meet the following requirements:
• Either VM1 or VM2 must inspect all the traffic from the internet to App1.
• All user connections from the internet to App1 must be load balanced.
• Costs must be minimized.
Which load balancer SKU should you include in the solution? To answer, drag the appropriate SKUs to the correct resources. Each SKU may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: VMSS1: Standard
VM1 and VM2: Gateway
Explanation: Gateway Load Balancer is designed to insert NVAs into the traffic path for inspection. The application front end should use a Standard Load Balancer, which supports chaining with Gateway Load Balancer and internet-facing load balancing for VM scale sets. Basic Load Balancer does not support this architecture.
Question 76
You have an Azure subscription that contains the resources shown in the following table.
You need to configure FW1 to filter traffic that originates from VNet1 and targets the FQDN of SQLDB1.
Which type of rule should you use?
A. DNAT
B. network
C. application
D. infrastructure
Show Answer
Correct Answer: C
Explanation: Application rules in Azure Firewall filter outbound traffic based on fully qualified domain names (FQDNs), which matches the requirement to filter traffic from VNet1 targeting the FQDN of SQLDB1. Network rules filter by IP address, port, and protocol, DNAT is for inbound destination translation, and infrastructure rules are for Azure Firewall's internal operations.
Question 77
HOTSPOT
-
You have an on-premises server named Server that is assigned a public IP address of 131.107.100.200.
You have an Azure subscription that contains the resources shown in the following table.
storage85347 has the Networking settings configured as shown in the following exhibit.
From the Firewalls and virtual networks tab, you add Subnet1 to storage85347.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: Adding Subnet1 to the storage account network rules enables the Microsoft.Storage service endpoint for that subnet if needed. Only Subnet1 (not Subnet2) is allowed to access the storage account. Enabling a service endpoint adds Azure-managed service endpoint system routes for the subnet.
Question 78
HOTSPOT -
You have an on-premises network and an Azure virtual network named VNet1.
You need to implement Azure Extended Network. The solution must minimize costs.
Which type of virtual machine should you deploy to VNet1, and which tool should you use to configure Azure Extended Network? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Virtual machine: Windows Server 2022 Datacenter: Azure Edition
Tool: Windows Admin Center
Explanation: Azure Extended Network is configured through Windows Admin Center, and the Azure-hosted proxy VM requirement is Windows Server 2022 Datacenter: Azure Edition. This satisfies the feature requirements while avoiding unnecessary additional components.
Question 79
HOTSPOT -
You have an Azure subscription that contains a virtual machine named VM1 and a virtual network named Vnet1. Vnet1 contains three subnets named Subnet1, Subnet2, and GatewaySubnet. VM1 is connected to Subnet1.
You plan to deploy a new virtual machine named VM2 that will perform network traffic routing and inspection.
You need to ensure that all the traffic from VM1 to the internet will be routed through VM2.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Deploy VM2 to: Subnet2
Create a custom route table and associate the table with: Subnet1
Explanation: A network virtual appliance should be deployed in a regular subnet, not GatewaySubnet. To force VM1's internet-bound traffic through VM2, associate a user-defined route with the subnet containing VM1 (Subnet1) and set the next hop to the virtual appliance (VM2).
Question 80
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
Each virtual network contains 20 virtual machines and a subnet that has an IP address space of /24.
You need to ensure that you can access the virtual machines from the internet by using Azure Bastion.
What is the minimum number of bastion subnets you should deploy, and what is the smallest supported IP address space for each bastion subnet? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: 2
/26
Explanation: One Azure Bastion can provide access across peered virtual networks, so one Bastion serves VNet1 and VNet2, while VNet3 requires its own because it is not peered. The smallest supported AzureBastionSubnet size is /26.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.