Question 180 A maintenance window requires a temporary narrowly scoped management rule. Which Azure control would meet the operational need? ASG-based NSG access rule NSG remote management least privilege NSG outbound rule destination and port Azure Bastion for browser-based VM administration Explanation Correct Answer B:The relevant action is NSG remote management least privilege: it limits administrative connections to approved sources and ports rather than Internet-wide access. Incorrect Answers A:ASG-based NSG access rule references application security groups as source or destination in supported NSG rules. The current problem instead requires a control that limits administrative connections to approved sources and ports rather than Internet-wide access. C:This choice restricts workloads initiating network connections toward disallowed destinations. It leaves the specific need to limit administrative connections to approved sources and ports rather than Internet-wide access unaddressed. D:This choice provides managed remote VM access without exposing RDP or SSH public IPs on each VM. It leaves the specific need to limit administrative connections to approved sources and ports rather than Internet-wide access unaddressed.
Question 181 A route table contains correct routes but the target subnet still uses system routing. Which configuration should the team verify or implement first? User-defined route to virtual appliance NAT Gateway for predictable outbound SNAT NAT Gateway subnet association Route table association to subnet Explanation Correct Answer D:The relevant action is Route table association to subnet: it applies a defined user route collection to the workload subnet. Incorrect Answers A:This choice directs selected subnet traffic to a nominated next-hop NVA address. It leaves the specific need to apply a defined user route collection to the workload subnet unaddressed. B:NAT Gateway for predictable outbound SNAT provides scalable managed outbound connectivity for private subnet workloads. The current problem instead requires a control that applies a defined user route collection to the workload subnet. C:NAT Gateway subnet association is useful when the goal is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet. Here, the required behavior is to apply a defined user route collection to the workload subnet.
Question 182 An architect proposes a static route list for frequently changing NVA networks. Which Azure control would meet the operational need? Azure Route Server for BGP exchange Effective routes and next-hop diagnosis VNet peering for private backbone connectivity Azure Virtual Network Manager security admin rules Explanation Correct Answer A:The relevant action is Azure Route Server for BGP exchange: it exchanges dynamic routes with supported network virtual appliances over BGP. Incorrect Answers B:Effective routes and next-hop diagnosis is useful when the goal is to reveal which system, BGP or user route determines an actual VM next hop. Here, the required behavior is to exchange dynamic routes with supported network virtual appliances over BGP. C:That approach connects two Azure virtual networks over the Microsoft backbone without a VPN appliance; it does not replace Azure Route Server for BGP exchange for the constraint in this scenario. D:This choice centrally enforces supported security policies across network groups before workload NSGs. It leaves the specific need to exchange dynamic routes with supported network virtual appliances over BGP unaddressed.
Question 183 Two NICs on a network appliance require different approved interface-level NSGs. Which configuration addresses the stated network constraint? NSG rule priority and first-match evaluation ASG-based NSG access rule NSG network interface association NSG subnet association Explanation Correct Answer C:NSG network interface association applies additional instance-specific NSG rules to a selected network interface. Incorrect Answers A:This alternative ensures a more specific permitted or denied flow is evaluated in the intended priority order, which solves a different networking task. It does not directly apply additional instance-specific NSG rules to a selected network interface. B:This alternative references application security groups as source or destination in supported NSG rules, which solves a different networking task. It does not directly apply additional instance-specific NSG rules to a selected network interface. D:NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet. The current problem instead requires a control that applies additional instance-specific NSG rules to a selected network interface.
Question 184 A planned scale-out needs public IP resources drawn from one reserved prefix. Which configuration should the team verify or implement first? Custom IP Prefix for bring-your-own-IP Standard Public IP for internet-facing VM Public IP Prefix for contiguous outbound allocation NIC-level public IP association Explanation Correct Answer C:Public IP Prefix for contiguous outbound allocation is appropriate because it reserves a managed contiguous block of standard public addresses for public IP resources. Incorrect Answers A:Although Custom IP Prefix for bring-your-own-IP onboards an organization's eligible public IPv4 address block into Azure, that is not sufficient to reserve a managed contiguous block of standard public addresses for public IP resources in this case. B:This choice assigns a routable public endpoint to a specified Azure resource when direct exposure is justified. It leaves the specific need to reserve a managed contiguous block of standard public addresses for public IP resources unaddressed. D:This alternative attaches the public IP to the correct network interface IP configuration, which solves a different networking task. It does not directly reserve a managed contiguous block of standard public addresses for public IP resources.
Question 185 The Private Endpoint is approved, but clients still resolve the service FQDN to its public address. What should the engineer configure for private DNS resolution? Private Endpoint resource-specific authorization Private Endpoint from on-premises via hybrid route Link the correct private DNS zone and A record to the Private Endpoint private IP Private Endpoint for PaaS private IP access Explanation Correct Answer C:The appropriate private DNS zone records map the service FQDN to the approved Private Endpoint IP for the querying VNet, correcting the public-address resolution. Incorrect Answers A:Resource authorization determines who may access a given service, not whether its FQDN resolves to a private IP. B:A VPN or ExpressRoute route can carry hybrid traffic to the endpoint, but the current failure is an incorrect DNS answer, not missing hybrid connectivity. D:Creating another Private Endpoint is unnecessary when the existing connection is approved and only private DNS mapping is wrong.
Question 186 A VM NIC lacks a public IP configuration although the approved design requires one. What should the administrator change or deploy? Standard Public IP for internet-facing VM Static private NIC IP configuration Public IP Prefix for contiguous outbound allocation NIC-level public IP association Explanation Correct Answer A:This choice assigns a routable public endpoint to a specified Azure resource when direct exposure is justified. Incorrect Answers B:Although Static private NIC IP configuration assigns an intended stable private address to a VM network interface within its subnet, that is not sufficient to assign a routable public endpoint to a specified Azure resource when direct exposure is justified in this case. C:That approach reserves a managed contiguous block of standard public addresses for public IP resources; it does not replace Standard Public IP for internet-facing VM for the constraint in this scenario. D:This choice attaches the public IP to the correct network interface IP configuration. It leaves the specific need to assign a routable public endpoint to a specified Azure resource when direct exposure is justified unaddressed.
Question 187 An NVA upgrade changes learned routes and a managed route exchange service is required. Which choice matches the specific technical condition? VNet peering for private backbone connectivity Azure Virtual Network Manager connectivity groups Azure Route Server for BGP exchange Effective routes and next-hop diagnosis Explanation Correct Answer C:The relevant action is Azure Route Server for BGP exchange: it exchanges dynamic routes with supported network virtual appliances over BGP. Incorrect Answers A:This alternative connects two Azure virtual networks over the Microsoft backbone without a VPN appliance, which solves a different networking task. It does not directly exchange dynamic routes with supported network virtual appliances over BGP. B:Although Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions, that is not sufficient to exchange dynamic routes with supported network virtual appliances over BGP in this case. D:This choice reveals which system, BGP or user route determines an actual VM next hop. It leaves the specific need to exchange dynamic routes with supported network virtual appliances over BGP unaddressed.
Question 188 A newly deployed workload subnet is missing the intended network security group association. Which implementation most directly resolves this requirement? Subnet network policy placement NIC-level public IP association Subnet size and reserved IP planning Public IP Prefix for contiguous outbound allocation Explanation Correct Answer A:The intended behavior is to place security and routing policies on the workload subnet rather than assuming a public IP defines security. Subnet network policy placement is the direct configuration or deployment choice. Incorrect Answers B:NIC-level public IP association attaches the public IP to the correct network interface IP configuration. The current problem instead requires a control that places security and routing policies on the workload subnet rather than assuming a public IP defines security. C:Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that places security and routing policies on the workload subnet rather than assuming a public IP defines security. D:That approach reserves a managed contiguous block of standard public addresses for public IP resources; it does not replace Subnet network policy placement for the constraint in this scenario.
Question 189 The VPN application presents a certificate or token error before any tunnel is created. Which configuration should the team verify or implement first? P2S VPN client profile generation Microsoft Entra ID P2S authentication P2S client-side authentication troubleshooting VPN client device deployment validation Explanation Correct Answer C:P2S client-side authentication troubleshooting is appropriate because it checks identity, certificates and local profile logs before changing gateway routes. Incorrect Answers A:Although P2S VPN client profile generation delivers the correct gateway endpoints, routes and authentication settings to client devices, that is not sufficient to check identity, certificates and local profile logs before changing gateway routes in this case. B:That approach authenticates supported VPN clients using the organization's Entra identity platform; it does not replace P2S client-side authentication troubleshooting for the constraint in this scenario. D:VPN client device deployment validation is useful when the goal is to validate supported OS, client version, tunnel profile and endpoint requirements. Here, the required behavior is to check identity, certificates and local profile logs before changing gateway routes.
Question 190 A hub wants managed custom DNS forwarding through Azure Firewall. Which change should the network engineer make? Azure Firewall Standard for stateful filtering Azure Firewall network rule Azure Firewall Manager for fleet governance Azure Firewall DNS proxy Explanation Correct Answer D:This choice provides centrally proxied DNS resolution for supported FQDN-based network policy. Incorrect Answers A:This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy. B:This alternative permits or denies supported IP-based TCP or UDP flows by addresses and ports, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy. C:Azure Firewall Manager for fleet governance manages and monitors multiple cloud firewalls and supported secure hubs centrally. The current problem instead requires a control that provides centrally proxied DNS resolution for supported FQDN-based network policy.
