HOTSPOT
-
You plan to implement an Azure Virtual WAN named VWAN1 that will contain a hub named Hub1. VWAN1 will include the virtual networks shown in the following table.
You need to ensure that hosts connected to VNet1 can communicate with hosts connected to VNet3.
How should you configure the routing tables for VWAN1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Default route table:
From destination 10.2.0.0/16 to next hop Conn2
Route table for Conn1:
From destination 10.2.3.0/24 to next hop 10.2.0.5
Explanation: VNet3 is reachable only through VNet2, which hosts the NVA (10.2.0.5). The default route table sends all 10.2.0.0/16 traffic to Conn2 (VNet2). A specific route on Conn1 forwards traffic destined for VNet3 (10.2.3.0/24) to the NVA for onward routing via the VNet2–VNet3 peering.
Question 84
DRAG DROP -
Your on-premises network contains two subnets named Subnet and Subnet2. Subnet2 contains a Hyper-V host that contains two virtual machines named VM1 and VM2. VM1 and VM2 are connected to Subnet2.
You have an Azure virtual network named VNet1 that contains GatewaySubnet and a subnet named VSubnet1. VNet1 is connected to the on-premises network by using a Site-to-Site (S2S) VPN connection.
You plan to migrate VM1 to VNet1 and maintain the existing IP address of VM1. VM2 will remain on Subnet2.
You need to prepare the environment to ensure that VM1 can communicate with VM2 once the migration is complete.
Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: D
Explanation: To keep VM1’s original IP address and enable communication with VM2 over the S2S VPN, you must use Azure Extended Network. The correct sequence is: (1) Extend the IP address space of VNet1 to include the Subnet2 address range (this must be done before creating a subnet with that range). (2) Add a subnet (VSubnet2) to VNet1 that uses the same address range as Subnet2. (3) Deploy an Azure VM running Windows Server Azure Edition with two NICs connected to VSubnet1 and VSubnet2. (4) Install the Hyper‑V server role on that Azure VM. (5) Create external Hyper‑V virtual switches. This prepares Azure to host VM1 with its existing IP and maintain connectivity to VM2.
Question 85
HOTSPOT -
You have 50 on-premises networks. Each network contains a server that runs Windows Server.
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a database server named DB1.
You plan to deploy an app named App1 that will be hosted on the on-premises servers and will connect to DB1 by using Azure Network Adapter.
What should you use to support the Azure Network Adapter connections to VNet1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: D
Explanation: Azure Network Adapter (configured through Windows Admin Center) connects individual Windows Server machines to an Azure virtual network by using a point-to-site (P2S) VPN. To support P2S connections, VNet1 must have an Azure VPN Gateway deployed. Therefore, the correct combination is an Azure VPN Gateway with point-to-site (P2S) VPN connectivity.
Question 86
HOTSPOT -
You have an Azure subscription. The subscription contains 500 virtual machines that run either Windows 11 or Linux.
You need to identify which Linux virtual machines are accessible from the internet. The solution must minimize administrative effort.
What should you use, and what should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: B
Explanation: To identify which Linux virtual machines are accessible from the internet with minimal administrative effort, Microsoft Defender External Attack Surface Management (Defender EASM) is the best choice. Defender EASM automatically discovers and inventories external-facing assets across the subscription without requiring agents on the VMs. By configuring a discovery group, Defender EASM continuously identifies which virtual machines are exposed to the internet, fulfilling the requirement efficiently and at scale.
Question 87
HOTSPOT -
You create an ExpressRoute circuit named ERC1 that is enabled by your connectivity provider.
You need to ensure that the routes for Azure Backup and Azure Cosmos DB are advertised to the on-premises network via ECR1.
The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: D
Explanation: To advertise Azure Backup and Azure Cosmos DB routes over ExpressRoute, you must use Microsoft peering, as these are Microsoft/Azure public services. With Microsoft peering, no routes are advertised by default, so you associate a route filter. A single route filter is sufficient, and it can contain only one Allow rule; that single rule can include multiple BGP community values, covering both Azure Backup and Azure Cosmos DB. This approach minimizes administrative effort.
Question 88
DRAG DROP
-
You have a computer named CLIENT1 that runs Windows 11 and has the Azure VPN Client installed.
You have an Azure virtual network gateway named VPNGW1.
You need to ensure that you can connect CLIENT1 to VPNGW1. The solution must support Microsoft Entra authentication.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer are and arrange them in the correct order.
Show Answer
Correct Answer: From the Azure portal, configure the tunnel type and authentication type for VPNGW1.
From the Azure portal, authorize the Azure VPN application.
From the Azure portal, download the Azure VPN Client profile configuration package to CLIENT1.
To CLIENT1, import the Azurevpnconfig.xml file.
Explanation: Microsoft Entra ID authentication for Point-to-Site requires the Azure VPN Client with OpenVPN. The gateway must be configured first, the Azure VPN app authorized in Entra ID, then the client profile downloaded and the azurevpnconfig.xml imported on Windows.
Question 89
HOTSPOT -
You have an on-premises server named Server1 that runs Windows Server and has the DNS Server role installed.
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. VNet1 contains an Azure Firewall instance named FW1. VNet1 peers with VNet2.
The on-premises network is connected to VNet1 by using ExpressRoute. The on-premises network is inaccessible from VNet2.
You need to ensure that virtual machines connected to VNet2 use Server1 to perform name resolution. The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: D
Explanation: VNet2 cannot directly reach the on‑premises DNS server (Server1), but it can reach VNet1 where Azure Firewall (FW1) is deployed and connected to on‑premises via ExpressRoute. The lowest‑effort and correct solution is to enable Azure Firewall DNS proxy on FW1 so it can forward DNS queries to Server1. Then configure VNet2 to use the private IP address of FW1 as its DNS server. DNAT rules are not appropriate for DNS forwarding, and pointing VNet2 directly to Server1 would fail due to lack of connectivity.
Question 90
You have an Azure subscription that contains an Azure Front Door named FD1. FD1 is configured as shown in the following exhibit.
You need to enable Azure Private Link for FD1.
What should you do first?
A. Add an endpoint.
B. Create a custom route.
C. Create an origin group.
D. Change Pricing Tier to Azure Front Door Premium.
Show Answer
Correct Answer: D
Explanation: Azure Private Link support for Azure Front Door is available only in the Azure Front Door Premium tier. Before configuring origins, routes, or endpoints to use Private Link, you must first upgrade the Front Door profile to the Premium pricing tier.
Question 91
DRAG DROP
-
You have 100 on-premises servers with IP addresses from the 10.0.0.0/24 IP address space.
You have an Azure subscription that contains a virtual network named VNet1, an Azure VPN gateway named VGW1, and 100 virtual machines. VNet1 has an IP address space of 10.0.0.0/22. VGW1 uses the VpnGw1 SKU.
You need to ensure that the Azure virtual machines and the on-premises servers can communicate by using VGW1. The solution must minimize administrative effort.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: 1. Resize VGW1.
2. On VGW1, create a local gateway.
3. On VGW1, add NAT rules.
4. On VGW1, add a connection.
Explanation: The on‑premises and Azure networks use overlapping IP ranges, so VPN NAT is required. NAT is only supported on VpnGw2 or higher, requiring a gateway resize. After defining the on‑premises network with a local network gateway, NAT rules must be created before the VPN connection because the connection references those rules. Resizing the VNet or using Azure Extended Network is unnecessary and increases administrative effort.
Question 92
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
You have devices that run either Windows or macOS. The devices connect to VGW1 by using the OpenVPN protocol.
Which virtual networks can each device access? To answer, select the appropriate options in the answer area.
Show Answer
Correct Answer: B, B
Explanation: With Point-to-Site VPN using OpenVPN, clients can access the VNet where the VPN gateway is deployed (VNet1) and any VNets peered to it (VNet2). Access to VNets connected via Site-to-Site VPN (VNet3) requires BGP for P2S route propagation, which is not indicated/enabled here. Therefore, both Windows and macOS devices can access only VNet1 and VNet2.
$19
Get all 344 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
