Question 990 Azure shows a live tunnel but the branch device blocks traffic to one prefix. What is the most defensible solution for this case? On-premises VPN device policy matching IPsec/IKE policy interoperability BGP route advertisement on VPN Policy-based traffic-selector compatibility Explanation Correct Answer A:On-premises VPN device policy matching aligns corporate firewall route, access and selector rules with Azure connection design. Incorrect Answers B:This choice aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. It leaves the specific need to align corporate firewall route, access and selector rules with Azure connection design unaddressed. C:This alternative exchanges dynamic network prefixes over a supported route-based VPN configuration, which solves a different networking task. It does not directly align corporate firewall route, access and selector rules with Azure connection design. D:This choice handles a restricted legacy VPN peer that relies on specific address selectors. It leaves the specific need to align corporate firewall route, access and selector rules with Azure connection design unaddressed.
Question 991 An on-premises DNS forwarder needs an Azure destination to resolve private-zone records. Which Azure networking capability should be selected? DNS private endpoint record validation Azure DNS Private Resolver inbound endpoint Azure private DNS zone Azure DNS public zone delegation Explanation Correct Answer B:The intended behavior is to accept DNS queries arriving from on-premises or connected networks into Azure resolution. Azure DNS Private Resolver inbound endpoint is the direct configuration or deployment choice. Incorrect Answers A:DNS private endpoint record validation is useful when the goal is to confirm private service FQDNs resolve to the intended private endpoint addresses. Here, the required behavior is to accept DNS queries arriving from on-premises or connected networks into Azure resolution. C:Azure private DNS zone stores DNS records visible through linked private-network resolution rather than public DNS. The current problem instead requires a control that accepts DNS queries arriving from on-premises or connected networks into Azure resolution. D:Although Azure DNS public zone delegation hosts authoritative public DNS records under an internet-resolvable zone, that is not sufficient to accept DNS queries arriving from on-premises or connected networks into Azure resolution in this case.
Question 992 A VM in a peered VNet can reach the existing approved Private Endpoint IP, but its normal storage FQDN resolves publicly. Its application must retain TLS hostname validation. What should the engineer fix? Move the functioning Private Endpoint into an unrelated Azure subnet Replace the private endpoint with public service-endpoint addressing Configure a VPN tunnel to an on-premises network that is not part of this traffic path Link the consumer VNet to the correct Private DNS zone with the storage FQDN record targeting the endpoint private IP Explanation Correct Answer D:The Private DNS zone must be visible to the consuming VNet and resolve the storage service FQDN to the approved endpoint IP, preserving the hostname used for TLS validation. Incorrect Answers A:The endpoint is already reachable at its intended private IP, so relocating it does not fix name resolution. B:Switching to public service-endpoint addressing would abandon the stated Private Endpoint architecture rather than fix its DNS. C:Adding an unrelated hybrid tunnel cannot change the Azure VM’s public DNS result for the service.
Question 993 A hub-spoke topology grows beyond practical hand-managed peering changes. What should the team implement or correct? Azure Virtual Network Manager connectivity groups VNet address-space peering sync Azure Virtual Network Manager security admin rules Azure Route Server for BGP exchange Explanation Correct Answer A:The relevant action is Azure Virtual Network Manager connectivity groups: it centrally coordinates VNet connectivity topology across many subscriptions. Incorrect Answers B:This alternative updates peering awareness after VNet address-space changes, which solves a different networking task. It does not directly centrally coordinate VNet connectivity topology across many subscriptions. C:This choice centrally enforces supported security policies across network groups before workload NSGs. It leaves the specific need to centrally coordinate VNet connectivity topology across many subscriptions unaddressed. D:This alternative exchanges dynamic routes with supported network virtual appliances over BGP, which solves a different networking task. It does not directly centrally coordinate VNet connectivity topology across many subscriptions.
Question 994 A storage account has an approved private endpoint but remains reachable from public networks. Which configuration should the team verify or implement first? Private Endpoint subresource selection Private Endpoint approval workflow Private Endpoint for PaaS private IP access Private Endpoint public access restriction Explanation Correct Answer D:The relevant action is Private Endpoint public access restriction: it disables or limits public service exposure separately from creating the private endpoint. Incorrect Answers A:Although Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection, that is not sufficient to disable or limits public service exposure separately from creating the private endpoint in this case. B:Private Endpoint approval workflow is useful when the goal is to require the service owner to authorize pending private endpoint connections when necessary. Here, the required behavior is to disable or limits public service exposure separately from creating the private endpoint. C:Private Endpoint for PaaS private IP access exposes a supported Azure service through a private IP interface in the consumer VNet. The current problem instead requires a control that disables or limits public service exposure separately from creating the private endpoint.
Question 995 A gateway rule must change HTTP URL and header values for a specified route. What is the most defensible solution for this case? Application Gateway path-based routing rule Application Gateway URL rewrite rule Application Gateway for regional HTTP routing Application Gateway autoscale Explanation Correct Answer B:Application Gateway URL rewrite rule modifies a supported request or response header or URL before upstream routing. Incorrect Answers A:Although Application Gateway path-based routing rule selects different backends based on URL path patterns, that is not sufficient to modify a supported request or response header or URL before upstream routing in this case. C:This choice provides managed regional Layer 7 routing, TLS termination and web traffic distribution. It leaves the specific need to modify a supported request or response header or URL before upstream routing unaddressed. D:Application Gateway autoscale adjusts supported v2 gateway capacity automatically to demand within configured boundaries. The current problem instead requires a control that modifies a supported request or response header or URL before upstream routing.
Question 996 A legitimate form field triggers a managed WAF rule and a narrowly scoped exclusion is needed. What is the most appropriate next design decision? WAF detection mode for tuning WAF on Application Gateway for regional web protection Managed WAF rule set selection WAF false-positive exclusion tuning Explanation Correct Answer D:The relevant action is WAF false-positive exclusion tuning: it narrows a proven harmless match while retaining the remainder of managed protections. Incorrect Answers A:That approach logs matching malicious patterns without blocking legitimate traffic during a controlled baseline; it does not replace WAF false-positive exclusion tuning for the constraint in this scenario. B:WAF on Application Gateway for regional web protection inspects HTTP/S requests at a regional application gateway using supported WAF policies. The current problem instead requires a control that narrows a proven harmless match while retaining the remainder of managed protections. C:This alternative uses a supported managed web attack signature rule set for common application threats, which solves a different networking task. It does not directly narrow a proven harmless match while retaining the remainder of managed protections.
Question 997 A workload subnet already has Microsoft.Storage service endpoints enabled, but its Storage account firewall allows only selected networks and omits this subnet. The design must retain service-endpoint access rather than switch to Private Link. What must change? Create an unrelated Private Endpoint and leave the selected-network firewall rules as the only authorization path. Replace the Storage hostname with a private DNS A record even though no Private Endpoint is in use. Attach a service endpoint policy that does not include the intended Storage account. Add a Storage account virtual-network firewall rule authorizing the service-endpoint-enabled application subnet. Explanation Correct Answer D:With service endpoints enabled, the Storage resource firewall must allow the intended VNet/subnet through a virtual-network rule when its network-access policy restricts access to selected networks. Incorrect Answers A:A separate Private Endpoint would introduce a different architecture and does not implement the stated requirement to authorize the existing service endpoint subnet. B:Service endpoint access retains the Storage service address; private DNS A records are needed for Private Endpoint DNS integration, not to grant the existing subnet access. C:A service endpoint policy restricting the intended account would not grant the missing Storage resource-side VNet firewall permission, and a nonmatching policy could block access.
Question 998 A new backend should not serve clients until the Front Door probe succeeds. What is the most appropriate next design decision? Front Door Private Link to supported origin Front Door caching configuration Front Door origin health probe Front Door origin group priority failover Explanation Correct Answer C:Front Door origin health probe is appropriate because it checks origin availability from the edge to exclude unhealthy backends. Incorrect Answers A:Front Door Private Link to supported origin is useful when the goal is to connect an eligible Front Door Premium origin privately without exposing it broadly. Here, the required behavior is to check origin availability from the edge to exclude unhealthy backends. B:That approach caches eligible static web responses at the global edge under explicit policy; it does not replace Front Door origin health probe for the constraint in this scenario. D:This choice selects healthy primary and secondary origins using configured priority and health. It leaves the specific need to check origin availability from the edge to exclude unhealthy backends unaddressed.
Question 999 A production application is migrating from a legacy basic load balancer configuration. Which change should the network engineer make? Load Balancer load-balancing rule Load Balancer HA ports Standard Load Balancer for modern workloads Cross-region Azure Load Balancer design Explanation Correct Answer C:This choice uses the current supported load balancer SKU with configurable health and security behavior. Incorrect Answers A:Although Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections, that is not sufficient to use the current supported load balancer SKU with configurable health and security behavior in this case. B:This alternative enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios, which solves a different networking task. It does not directly use the current supported load balancer SKU with configurable health and security behavior. D:Cross-region Azure Load Balancer design is useful when the goal is to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency. Here, the required behavior is to use the current supported load balancer SKU with configurable health and security behavior.
Question 1000 An Azure VNet must have the right gateway subnet and deployed VPN gateway before tunneling. What is the most defensible solution for this case? Route-based site-to-site VPN gateway Local network gateway configuration Zone-redundant VPN Gateway Virtual network gateway deployment Explanation Correct Answer D:The intended behavior is to provision the Azure-managed VPN gateway attached to the target VNet. Virtual network gateway deployment is the direct configuration or deployment choice. Incorrect Answers A:Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. The current problem instead requires a control that provisions the Azure-managed VPN gateway attached to the target VNet. B:Local network gateway configuration records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. The current problem instead requires a control that provisions the Azure-managed VPN gateway attached to the target VNet. C:That approach places a supported VPN gateway across availability zones for regional resilience; it does not replace Virtual network gateway deployment for the constraint in this scenario.
