Question 160 A regulated application cannot rely solely on the confidentiality of carrier isolation. What is the most defensible solution for this case? ExpressRoute private peering ExpressRoute circuit authorization ExpressRoute circuit provisioning ExpressRoute encryption over private connectivity Explanation Correct Answer D:The intended behavior is to add a supported encryption overlay when private circuit transport alone is insufficient. ExpressRoute encryption over private connectivity is the direct configuration or deployment choice. Incorrect Answers A:That approach provides private routing to VNet private address spaces over an ExpressRoute circuit; it does not replace ExpressRoute encryption over private connectivity for the constraint in this scenario. B:Although ExpressRoute circuit authorization allows an approved cross-subscription connection to an ExpressRoute circuit, that is not sufficient to add a supported encryption overlay when private circuit transport alone is insufficient in this case. C:Although ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets, that is not sufficient to add a supported encryption overlay when private circuit transport alone is insufficient in this case.
Question 161 A custom domain reaches the gateway but no listener matches its hostname. Which Azure networking capability should be selected? Application Gateway HTTP listener Application Gateway for regional HTTP routing Application Gateway HTTP settings Application Gateway multi-site routing Explanation Correct Answer A:Application Gateway HTTP listener matches incoming protocol, port and optional host name before routing requests. Incorrect Answers B:Application Gateway for regional HTTP routing is useful when the goal is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. Here, the required behavior is to match incoming protocol, port and optional host name before routing requests. C:This choice configures supported backend protocol, port, host-name and session behavior. It leaves the specific need to match incoming protocol, port and optional host name before routing requests unaddressed. D:This choice uses host-based listeners to select application backends for different domain names. It leaves the specific need to match incoming protocol, port and optional host name before routing requests unaddressed.
Question 162 A firewall outage investigation needs historical resource metrics from Azure Monitor. What action most directly addresses the documented failure? Azure diagnostic settings to Log Analytics Network Watcher connection monitor Azure Monitor network resource metrics Azure DDoS Protection deployment Explanation Correct Answer C:Azure Monitor network resource metrics collects performance and health signals for Azure networking resources. Incorrect Answers A:Azure diagnostic settings to Log Analytics is useful when the goal is to send supported network resource logs to a workspace for query and retention. Here, the required behavior is to collect performance and health signals for Azure networking resources. B:This alternative continuously tracks network reachability and performance between configured endpoints, which solves a different networking task. It does not directly collect performance and health signals for Azure networking resources. D:This alternative adds managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses, which solves a different networking task. It does not directly collect performance and health signals for Azure networking resources.
Question 163 A VM scale set requires a production-grade supported load balancer configuration. What is the most defensible solution for this case? Standard Load Balancer for modern workloads Load Balancer outbound rule Load Balancer HA ports Cross-region Azure Load Balancer design Explanation Correct Answer A:The relevant action is Standard Load Balancer for modern workloads: it uses the current supported load balancer SKU with configurable health and security behavior. Incorrect Answers B:This alternative controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend, which solves a different networking task. It does not directly use the current supported load balancer SKU with configurable health and security behavior. C:This choice enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. It leaves the specific need to use the current supported load balancer SKU with configurable health and security behavior unaddressed. D:This choice uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. It leaves the specific need to use the current supported load balancer SKU with configurable health and security behavior unaddressed.
Question 164 An engineer must distinguish a layer 3/4 network rule from HTTP application filtering. What is the most appropriate next design decision? Azure Firewall DNS proxy Azure Firewall application rule Azure Firewall network rule Azure Firewall Standard for stateful filtering Explanation Correct Answer C:The intended behavior is to permit or denies supported IP-based TCP or UDP flows by addresses and ports. Azure Firewall network rule is the direct configuration or deployment choice. Incorrect Answers A:This alternative provides centrally proxied DNS resolution for supported FQDN-based network policy, which solves a different networking task. It does not directly permit or denies supported IP-based TCP or UDP flows by addresses and ports. B:This choice applies FQDN- or application-aware outbound access controls for supported protocols. It leaves the specific need to permit or denies supported IP-based TCP or UDP flows by addresses and ports unaddressed. D:Azure Firewall Standard for stateful filtering is useful when the goal is to provide managed stateful network and application filtering without Premium-only inspection. Here, the required behavior is to permit or denies supported IP-based TCP or UDP flows by addresses and ports.
Question 165 An application needs managed protection against common OWASP Top 10-style request patterns. Which implementation most directly resolves this requirement? Managed WAF rule set selection WAF diagnostic logging and investigation WAF false-positive exclusion tuning Custom WAF rule for scoped conditions Explanation Correct Answer A:Managed WAF rule set selection uses a supported managed web attack signature rule set for common application threats. Incorrect Answers B:This alternative correlates WAF rule IDs, policy actions and client requests to investigate web filtering, which solves a different networking task. It does not directly use a supported managed web attack signature rule set for common application threats. C:This choice narrows a proven harmless match while retaining the remainder of managed protections. It leaves the specific need to use a supported managed web attack signature rule set for common application threats unaddressed. D:Custom WAF rule for scoped conditions matches an application-specific condition such as an approved IP, header or path and applies policy. The current problem instead requires a control that uses a supported managed web attack signature rule set for common application threats.
Question 166 A central network appliance pair must process many arbitrary TCP and UDP ports through one internal LB. What should the administrator change or deploy? Regional Azure Load Balancer for L4 traffic Internal Load Balancer frontend Gateway Load Balancer for transparent NVA insertion Load Balancer HA ports Explanation Correct Answer D:The relevant action is Load Balancer HA ports: it enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. Incorrect Answers A:That approach distributes TCP or UDP flows to healthy backend instances in an Azure region; it does not replace Load Balancer HA ports for the constraint in this scenario. B:Although Internal Load Balancer frontend exposes a private VNet IP address for a load-balanced service rather than a public endpoint, that is not sufficient to enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios in this case. C:Gateway Load Balancer for transparent NVA insertion is useful when the goal is to insert a supported third-party network virtual appliance fleet transparently into traffic paths. Here, the required behavior is to enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios.
Question 167 A VNet must reserve capacity for a planned ExpressRoute gateway. Which change should the network engineer make? GatewaySubnet for virtual network gateway Subnet size and reserved IP planning AzureFirewallSubnet sizing Dedicated AzureBastionSubnet Explanation Correct Answer A:This choice allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. Incorrect Answers B:Although Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet, that is not sufficient to allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways in this case. C:AzureFirewallSubnet sizing is useful when the goal is to provide the reserved firewall subnet for the managed Azure Firewall deployment. Here, the required behavior is to allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. D:Although Dedicated AzureBastionSubnet reserves the specifically named subnet required for Azure Bastion, that is not sufficient to allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways in this case.
Question 168 An endpoint-enabled second subnet can still reach unapproved storage accounts because its required endpoint policy was not associated. What action most directly addresses the documented failure? Service endpoint public address distinction Service endpoint policy subnet binding Service endpoint policy for storage resource scope PaaS resource firewall VNet rule Explanation Correct Answer B:Service endpoint policy subnet binding associates an approved service endpoint policy with the intended endpoint-enabled workload subnet. Incorrect Answers A:Service endpoint public address distinction retains public service endpoint addressing while changing private subnet routing and service firewall identity. The current problem instead requires a control that associates an approved service endpoint policy with the intended endpoint-enabled workload subnet. C:This choice restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. It leaves the specific need to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet unaddressed. D:That approach permits the specified subnet at the target managed service after a service endpoint is enabled; it does not replace Service endpoint policy subnet binding for the constraint in this scenario.
Question 169 A service endpoint design needs supported resource restrictions instead of service-wide routing alone. Which choice matches the specific technical condition? Service endpoint policy for storage resource scope Service endpoint public address distinction Service endpoint policy subnet binding VNet service endpoint enablement Explanation Correct Answer A:The relevant action is Service endpoint policy for storage resource scope: it restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. Incorrect Answers B:Although Service endpoint public address distinction retains public service endpoint addressing while changing private subnet routing and service firewall identity, that is not sufficient to restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources in this case. C:This alternative associates an approved service endpoint policy with the intended endpoint-enabled workload subnet, which solves a different networking task. It does not directly restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. D:VNet service endpoint enablement is useful when the goal is to extend selected Azure service routing and service identity from an approved VNet subnet. Here, the required behavior is to restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources.
Question 170 An engineer needs to refresh remote-user profiles after changing tunnel settings. Which Azure networking capability should be selected? P2S OpenVPN protocol selection P2S client-side authentication troubleshooting VPN client device deployment validation P2S VPN client profile generation Explanation Correct Answer D:This choice delivers the correct gateway endpoints, routes and authentication settings to client devices. Incorrect Answers A:This alternative chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility, which solves a different networking task. It does not directly deliver the correct gateway endpoints, routes and authentication settings to client devices. B:P2S client-side authentication troubleshooting checks identity, certificates and local profile logs before changing gateway routes. The current problem instead requires a control that delivers the correct gateway endpoints, routes and authentication settings to client devices. C:VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements. The current problem instead requires a control that delivers the correct gateway endpoints, routes and authentication settings to client devices.
