Question 220 The organization has an owned prefix and wants to manage its Azure advertisement lifecycle. Which implementation most directly resolves this requirement? Custom IP Prefix for bring-your-own-IP Public IP Prefix for contiguous outbound allocation Public IP SKU and zone suitability NIC-level public IP association Explanation Correct Answer A:Custom IP Prefix for bring-your-own-IP is appropriate because it onboards an organization's eligible public IPv4 address block into Azure. Incorrect Answers B:This alternative reserves a managed contiguous block of standard public addresses for public IP resources, which solves a different networking task. It does not directly onboard an organization's eligible public IPv4 address block into Azure. C:This choice selects the supported public IP SKU and zone behavior for the intended resource and region. It leaves the specific need to onboard an organization's eligible public IPv4 address block into Azure unaddressed. D:This alternative attaches the public IP to the correct network interface IP configuration, which solves a different networking task. It does not directly onboard an organization's eligible public IPv4 address block into Azure.
Question 221 A one-time diagnostic is insufficient for a recurring intermittent network failure. Which choice matches the specific technical condition? Network Watcher connection troubleshoot Azure Monitor network resource metrics Network Watcher next hop Network Watcher connection monitor Explanation Correct Answer D:Network Watcher connection monitor continuously tracks network reachability and performance between configured endpoints. Incorrect Answers A:This alternative tests end-to-end reachability, latency and network obstacles between source and destination, which solves a different networking task. It does not directly continuously track network reachability and performance between configured endpoints. B:This alternative collects performance and health signals for Azure networking resources, which solves a different networking task. It does not directly continuously track network reachability and performance between configured endpoints. C:Network Watcher next hop determines a VM's effective route and next-hop category to a destination. The current problem instead requires a control that continuously tracks network reachability and performance between configured endpoints.
Question 222 After peering, a team assumes private zone records are automatically visible in every VNet. What should the administrator change or deploy? Custom DNS server settings on VNet Azure private DNS zone Private DNS zone auto-registration link Private DNS zone VNet link Explanation Correct Answer D:The intended behavior is to permit a selected VNet's resolver to query records in a private DNS zone. Private DNS zone VNet link is the direct configuration or deployment choice. Incorrect Answers A:Custom DNS server settings on VNet directs VNet-resident clients to selected DNS servers for specialized resolution. The current problem instead requires a control that permits a selected VNet's resolver to query records in a private DNS zone. B:This alternative stores DNS records visible through linked private-network resolution rather than public DNS, which solves a different networking task. It does not directly permit a selected VNet's resolver to query records in a private DNS zone. C:This alternative registers eligible VM DNS records automatically in a linked private DNS zone, which solves a different networking task. It does not directly permit a selected VNet's resolver to query records in a private DNS zone.
Question 223 A public IP resource exists but the intended VM is not reachable because it is unattached. What is the most appropriate next design decision? IP configuration for multiple VM addresses Public IP Prefix for contiguous outbound allocation NIC-level public IP association Static private NIC IP configuration Explanation Correct Answer C:This choice attaches the public IP to the correct network interface IP configuration. Incorrect Answers A:IP configuration for multiple VM addresses uses multiple supported IP configurations on a network interface for distinct service addresses. The current problem instead requires a control that attaches the public IP to the correct network interface IP configuration. B:That approach reserves a managed contiguous block of standard public addresses for public IP resources; it does not replace NIC-level public IP association for the constraint in this scenario. D:Static private NIC IP configuration is useful when the goal is to assign an intended stable private address to a VM network interface within its subnet. Here, the required behavior is to attache the public IP to the correct network interface IP configuration.
Question 224 A DR exercise moves site-to-site connectivity to a different corporate edge. What should the team implement or correct? S2S reachability verification beyond tunnel state Virtual network gateway deployment S2S peer public IP change procedure Local network gateway configuration Explanation Correct Answer C:S2S peer public IP change procedure is appropriate because it updates peer and local network gateway settings together during a branch cutover. Incorrect Answers A:S2S reachability verification beyond tunnel state is useful when the goal is to validate routing, NSGs and return paths after IPsec reports connected. Here, the required behavior is to update peer and local network gateway settings together during a branch cutover. B:Virtual network gateway deployment provisions the Azure-managed VPN gateway attached to the target VNet. The current problem instead requires a control that updates peer and local network gateway settings together during a branch cutover. D:This choice records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. It leaves the specific need to update peer and local network gateway settings together during a branch cutover unaddressed.
Question 225 A hub's firewall must steer Internet destinations to an approved upstream gateway. What action most directly addresses the documented failure? Azure Firewall Policy across regions Firewall forced tunneling via approved next hop Azure Firewall DNAT rule Azure Firewall Basic for simple network filtering Explanation Correct Answer B:Firewall forced tunneling via approved next hop is appropriate because it routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge. Incorrect Answers A:Although Azure Firewall Policy across regions centralizes managed firewall settings and reusable rule collections, that is not sufficient to route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge in this case. C:This alternative translates an approved public destination address and port to a protected internal service, which solves a different networking task. It does not directly route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge. D:This choice fits eligible smaller workloads when advanced throughput and security features are not required. It leaves the specific need to route Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge unaddressed.
Question 226 A vendor exposes one Private Link Service instance, and a new customer Private Endpoint connection request remains pending approval. Which action grants this specific connection? Approve the pending Private Endpoint connection on the intended provider service instance Private Link service access visibility Private Endpoint connection state monitoring Private Endpoint subresource selection Explanation Correct Answer A:The service provider approves the customer’s pending Private Endpoint request to that particular published Private Link Service instance. Incorrect Answers B:Changing service access visibility affects which subscriptions may discover/request the service, but does not approve this pending connection. C:Connection-state monitoring reports whether a connection is pending or approved; it cannot authorize the request. D:Private Endpoint subresource selection is relevant to supported multi-subresource Azure services and is not the pending provider approval action.
Question 227 A newly built subnet requires normal Azure DNS behavior without an external forwarder. Which implementation most directly resolves this requirement? Azure DNS Private Resolver outbound endpoint Azure-provided DNS for VNet hostnames Custom DNS server settings on VNet Azure DNS Private Resolver inbound endpoint Explanation Correct Answer B:Azure-provided DNS for VNet hostnames is appropriate because it resolves supported internal hostnames using default Azure DNS within a VNet. Incorrect Answers A:This choice sends selected Azure DNS queries toward other DNS servers through managed forwarding. It leaves the specific need to resolve supported internal hostnames using default Azure DNS within a VNet unaddressed. C:This alternative directs VNet-resident clients to selected DNS servers for specialized resolution, which solves a different networking task. It does not directly resolve supported internal hostnames using default Azure DNS within a VNet. D:Although Azure DNS Private Resolver inbound endpoint accepts DNS queries arriving from on-premises or connected networks into Azure resolution, that is not sufficient to resolve supported internal hostnames using default Azure DNS within a VNet in this case.
Question 228 A custom domain CNAME points to Front Door but ownership validation is unfinished. What action most directly addresses the documented failure? Front Door WAF policy association Front Door custom domain binding Front Door Rules Engine redirect Front Door route and origin mapping Explanation Correct Answer B:This choice configures an approved domain, DNS validation and certificate for the edge endpoint. Incorrect Answers A:Although Front Door WAF policy association applies supported application-layer rules at the globally distributed edge, that is not sufficient to configure an approved domain, DNS validation and certificate for the edge endpoint in this case. C:Front Door Rules Engine redirect returns an HTTP redirect to the client for an approved URL transformation. The current problem instead requires a control that configures an approved domain, DNS validation and certificate for the edge endpoint. D:That approach connects the matching frontend domain/path to the intended origin group; it does not replace Front Door custom domain binding for the constraint in this scenario.
Question 229 Two teams propose the same RFC1918 range for separate peered VNets. What should the team implement or correct? Custom IP Prefix for bring-your-own-IP Address and subnet allocation inventory Address-prefix growth and readdress planning Nonoverlapping VNet CIDR planning Explanation Correct Answer D:Nonoverlapping VNet CIDR planning is appropriate because it prevents address collisions between Azure networks and corporate routes. Incorrect Answers A:Although Custom IP Prefix for bring-your-own-IP onboards an organization's eligible public IPv4 address block into Azure, that is not sufficient to prevent address collisions between Azure networks and corporate routes in this case. B:This alternative tracks CIDR ownership, free space and subnet relationships before deployment, which solves a different networking task. It does not directly prevent address collisions between Azure networks and corporate routes. C:This alternative expands address capacity while managing dependencies and routing effects, which solves a different networking task. It does not directly prevent address collisions between Azure networks and corporate routes.
Question 230 A private endpoint is visible but the provider changed the connection to Disconnected. Which network component or setting is the best fit? Private Endpoint subresource selection Private Link service alias distribution Private Endpoint connection state monitoring Private Link service provider design Explanation Correct Answer C:The relevant action is Private Endpoint connection state monitoring: it inspects connection state and service-side approvals during private-link troubleshooting. Incorrect Answers A:Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection. The current problem instead requires a control that inspects connection state and service-side approvals during private-link troubleshooting. B:Private Link service alias distribution is useful when the goal is to give authorized consumers a service alias to request private endpoints without using the full resource ID. Here, the required behavior is to inspect connection state and service-side approvals during private-link troubleshooting. D:This alternative exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link, which solves a different networking task. It does not directly inspect connection state and service-side approvals during private-link troubleshooting.
