HOTSPOT
-
You have two Azure subscriptions.
You need to perform the following actions in the East US Azure region of each subscription:
• Deploy 50 virtual machines to availability zone 1.
• Deploy 50 virtual machines to availability zone 2.
• Deploy 50 virtual machines to availability zone 3.
What is the minimum number of virtual networks and /25 subnets you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Virtual networks: 2
Subnets: 4
Explanation: A virtual network spans all availability zones within a region, so separate VNets or subnets per zone are unnecessary. Each subscription requires its own VNet. A /25 subnet provides 123 usable IP addresses, so 150 VMs per subscription require two /25 subnets (123 + 123 usable capacity). Across two subscriptions, that is 2 VNets and 4 /25 subnets.
Question 82
You have an Azure subscription that contains the resources shown in the following table.
You create a service endpoint policy that has the following settings:
• Associated subnets: Subnet1
• Service: Microsoft.Storage
• Scope: Single account
• Resource: storage1
Which resources can VM1 access?
A. storage1 in the East US Azure region and its replica in the paired region
B. storage1 in the East US Azure region only
C. storage1 and storage2 in the East US Azure region only
D. storage1 and storage2 in the East US Azure region and their replicas in the paired region
Show Answer
Correct Answer: A
Explanation: A service endpoint policy scoped to a single Azure Storage account allows access only to the specified storage account. For storage accounts using geo-redundant replication with read access, the paired-region replica (secondary endpoint) is automatically included when the primary account is allowed. It does not grant access to other storage accounts.
Question 83
You have an Azure virtual machine named VM1.
You need to capture all the network traffic of VM1 by using Azure Network Watcher.
To which locations can the capture be written?
A. a file path on VM1 only
B. General purpose v2 standard only
C. a Block blob premium account only
D. General purpose v2 standard and a file path on VM1 only
E. General purpose v2 standard and a Block blob premium account only
F. blob storage, a file path on VM1, and a Block blob premium account
Show Answer
Correct Answer: D
Explanation: Azure Network Watcher packet capture for virtual machines supports writing captures either to a local file on the target VM or to a Standard Azure Storage account (such as a General-purpose v2 standard account). Premium Block Blob storage accounts are not supported for packet capture storage in the referenced Azure Network Watcher functionality.
Question 84
You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1.
You need to deploy Azure Firewall to RG1. The solution must minimize administrative effort.
What should you do first?
A. Create a secured virtual hub named AzureFirewallHub.
B. Create a new virtual network named AzureFirewallNetwork.
C. Create a new resource group named AzurFirewellRescurceGroup.
D. On VNet1, create virtual subnet named AzureFirewallSubnet
Show Answer
Correct Answer: D
Explanation: For deploying Azure Firewall into an existing virtual network, a dedicated subnet named AzureFirewallSubnet is a prerequisite. Since RG1 and VNet1 already exist, the first action that minimizes administrative effort is to create the required AzureFirewallSubnet in VNet1. Creating a new virtual network or resource group is unnecessary, and a secured virtual hub is used for Azure Firewall Manager/Secured Virtual WAN deployments rather than a standard VNet deployment.
Question 85
You have an on-premises server named Server1 that runs Windows Server.
You have an Azure subscription that contains a virtual network named VNet1.
You plan to connect Server1 to VNet1 by using Azure Network Adapter.
You need to minimize how long it takes to deploy the adapter to Server1.
What should you create first?
A. a route server
B. an Azure Bastion host
C. a private endpoint
D. an Azure VPN gateway
Show Answer
Correct Answer: D
Explanation: Azure Network Adapter for Windows Admin Center creates a Point-to-Site VPN connection from the server to an Azure virtual network. The target virtual network must already have an Azure VPN Gateway deployed, and gateway deployment is typically the longest prerequisite. Creating it first minimizes the overall deployment time.
Question 86
HOTSPOT
-
You plan to implement an Azure Virtual WAN named VWAN1 that will contain a hub named Hub1. VWAN1 will include the virtual networks shown in the following table.
You need to ensure that hosts connected to VNet1 can communicate with hosts connected to VNet3.
How should you configure the routing tables for VWAN1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Default route table:
From destination 10.2.3.0/24 to next hop 10.2.0.5
Route table for Conn1:
From destination 10.2.0.0/16 to next hop Conn2
Explanation: Traffic from VNet1 to the 10.2.x.x space is sent to the Conn2 attachment. Because VNet3 is only reachable through VNet2 via peering, the hub's default routing must forward the specific 10.2.3.0/24 prefix to the NVA (10.2.0.5), which then forwards it to VNet3.
Question 87
DRAG DROP -
Your on-premises network contains two subnets named Subnet and Subnet2. Subnet2 contains a Hyper-V host that contains two virtual machines named VM1 and VM2. VM1 and VM2 are connected to Subnet2.
You have an Azure virtual network named VNet1 that contains GatewaySubnet and a subnet named VSubnet1. VNet1 is connected to the on-premises network by using a Site-to-Site (S2S) VPN connection.
You plan to migrate VM1 to VNet1 and maintain the existing IP address of VM1. VM2 will remain on Subnet2.
You need to prepare the environment to ensure that VM1 can communicate with VM2 once the migration is complete.
Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: 1. Extend the IP address space of VNet1 to include the IP address range of Subnet2.
2. To VNet1, add a subnet named VSubnet2 that uses the same address range as Subnet2.
3. Deploy an Azure virtual machine that runs Windows Server Azure Edition and has two NICs connected to VSubnet1 and VSubnet2.
4. Install the Hyper-V server role in the Azure virtual machine.
5. Create external Hyper-V virtual switches.
Explanation: Azure Extended Network requires extending the VNet address space first, then creating the matching subnet, deploying the Windows Server Azure Edition gateway VM, enabling Hyper-V, and configuring external virtual switches to preserve the on-premises IP address across Azure.
Question 88
HOTSPOT -
You have 50 on-premises networks. Each network contains a server that runs Windows Server.
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a database server named DB1.
You plan to deploy an app named App1 that will be hosted on the on-premises servers and will connect to DB1 by using Azure Network Adapter.
What should you use to support the Azure Network Adapter connections to VNet1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: For inbound connections to the subscription: Azure VPN Gateway
For connections between the on-premises servers and VNet1: Point-to-site (P2S) VPN
Explanation: Azure Network Adapter for Windows Server creates a Point-to-Site VPN connection from the server to an Azure virtual network. P2S connections terminate on an Azure VPN Gateway deployed in the target VNet.
Question 89
HOTSPOT -
You have an Azure subscription. The subscription contains 500 virtual machines that run either Windows 11 or Linux.
You need to identify which Linux virtual machines are accessible from the internet. The solution must minimize administrative effort.
What should you use, and what should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Use: Microsoft Defender External Attack Surface Management (Defender EASM)
Configure: A discovery group in Microsoft Defender External Attack Surface Management (Defender EASM)
Explanation: Defender EASM is designed to discover and inventory internet-exposed assets with minimal administrative effort. A discovery group defines the scope for automated discovery of external-facing resources, allowing you to identify internet-accessible Linux VMs.
Question 90
HOTSPOT -
You create an ExpressRoute circuit named ERC1 that is enabled by your connectivity provider.
You need to ensure that the routes for Azure Backup and Azure Cosmos DB are advertised to the on-premises network via ECR1.
The solution must minimize administrative effort.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Microsoft peering
A route filter and a single filter rule
Explanation: Azure Backup and Azure Cosmos DB public service prefixes are advertised over Microsoft peering. Associate one route filter containing a single Allow rule that includes multiple BGP community values for the required services, minimizing administration.
$19
Get all 347 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
