Question 240 A network change adds a specific exception that must take precedence over general rules. What should the team implement or correct? Azure Firewall policy rule collection priority Azure Firewall network rule Azure Firewall Policy across regions Azure Firewall DNS proxy Explanation Correct Answer A:The intended behavior is to organize matching firewall rules with correct ordering and actions. Azure Firewall policy rule collection priority is the direct configuration or deployment choice. Incorrect Answers B:Azure Firewall network rule permits or denies supported IP-based TCP or UDP flows by addresses and ports. The current problem instead requires a control that organizes matching firewall rules with correct ordering and actions. C:That approach centralizes managed firewall settings and reusable rule collections; it does not replace Azure Firewall policy rule collection priority for the constraint in this scenario. D:Although Azure Firewall DNS proxy provides centrally proxied DNS resolution for supported FQDN-based network policy, that is not sufficient to organize matching firewall rules with correct ordering and actions in this case.
Question 241 An incident requires centrally enforced baseline network blocks across managed VNets. Which step best addresses this particular situation? Azure Route Server for BGP exchange Azure Virtual Network Manager security admin rules Azure Virtual Network Manager connectivity groups Route table association to subnet Explanation Correct Answer B:Azure Virtual Network Manager security admin rules is appropriate because it centrally enforces supported security policies across network groups before workload NSGs. Incorrect Answers A:Azure Route Server for BGP exchange is useful when the goal is to exchange dynamic routes with supported network virtual appliances over BGP. Here, the required behavior is to centrally enforce supported security policies across network groups before workload NSGs. C:Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions. The current problem instead requires a control that centrally enforces supported security policies across network groups before workload NSGs. D:This choice applies a defined user route collection to the workload subnet. It leaves the specific need to centrally enforce supported security policies across network groups before workload NSGs unaddressed.
Question 242 An engineer created an endpoint to the wrong Azure Storage subresource. Which Azure control would meet the operational need? Private Endpoint migration cutover Private Endpoint connection state monitoring Private Endpoint subnet placement Private Endpoint subresource selection Explanation Correct Answer D:Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection. Incorrect Answers A:Although Private Endpoint migration cutover updates endpoint connections, DNS and service firewall settings together during a resource move, that is not sufficient to target the correct service resource and subresource in a private endpoint connection in this case. B:That approach inspects connection state and service-side approvals during private-link troubleshooting; it does not replace Private Endpoint subresource selection for the constraint in this scenario. C:Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet. The current problem instead requires a control that targets the correct service resource and subresource in a private endpoint connection.
Question 243 After creating a private endpoint, a client still queries a public endpoint address. Which Azure networking capability should be selected? Private Endpoint hostname-specific TLS handling Private Endpoint DNS A-record integration Private Endpoint subresource selection Private Endpoint from on-premises via hybrid route Explanation Correct Answer B:This choice maps the service's normal FQDN to its private endpoint IP address for authorized clients. Incorrect Answers A:That approach uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients; it does not replace Private Endpoint DNS A-record integration for the constraint in this scenario. C:This choice targets the correct service resource and subresource in a private endpoint connection. It leaves the specific need to map the service's normal FQDN to its private endpoint IP address for authorized clients unaddressed. D:That approach uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint; it does not replace Private Endpoint DNS A-record integration for the constraint in this scenario.
Question 244 A network change needs updated BGP advertisements rather than replacing the ExpressRoute circuit. What is the most appropriate next design decision? ExpressRoute Global Reach Microsoft peering requirements on ExpressRoute ExpressRoute BGP prefix advertisement ExpressRoute peering and connection diagnostics Explanation Correct Answer C:The intended behavior is to exchange approved on-premises routes over correct BGP peer sessions. ExpressRoute BGP prefix advertisement is the direct configuration or deployment choice. Incorrect Answers A:That approach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity; it does not replace ExpressRoute BGP prefix advertisement for the constraint in this scenario. B:Microsoft peering requirements on ExpressRoute is useful when the goal is to enable approved Microsoft service access over Microsoft peering rather than private VNet routes. Here, the required behavior is to exchange approved on-premises routes over correct BGP peer sessions. D:Although ExpressRoute peering and connection diagnostics checks provider provisioning, BGP state and Azure connection health before making changes, that is not sufficient to exchange approved on-premises routes over correct BGP peer sessions in this case.
Question 245 A customer reports a private endpoint connection in an approval-required state. Which implementation most directly resolves this requirement? Private Endpoint resource-specific authorization Private Endpoint approval workflow Private Endpoint from on-premises via hybrid route Private Endpoint migration cutover Explanation Correct Answer B:The relevant action is Private Endpoint approval workflow: it requires the service owner to authorize pending private endpoint connections when necessary. Incorrect Answers A:That approach scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions; it does not replace Private Endpoint approval workflow for the constraint in this scenario. C:Private Endpoint from on-premises via hybrid route is useful when the goal is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Here, the required behavior is to require the service owner to authorize pending private endpoint connections when necessary. D:Although Private Endpoint migration cutover updates endpoint connections, DNS and service firewall settings together during a resource move, that is not sufficient to require the service owner to authorize pending private endpoint connections when necessary in this case.
Question 246 A global company needs branch VPN, remote user VPN and ExpressRoute in its Virtual WAN. What is the most defensible solution for this case? Virtual WAN virtual hub creation Virtual WAN hub VNet connection Standard Virtual WAN for advanced transit Virtual WAN site-to-site VPN gateway Explanation Correct Answer C:This choice supports site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology. Incorrect Answers A:This alternative deploys a Microsoft-managed regional hub for connectivity, routing and gateway services, which solves a different networking task. It does not directly support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology. B:This alternative attaches a workload VNet to a managed virtual hub for connectivity and route propagation, which solves a different networking task. It does not directly support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology. D:Virtual WAN site-to-site VPN gateway is useful when the goal is to terminate VPN connections from branches within the managed virtual hub. Here, the required behavior is to support site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology.
Question 247 A VM cannot receive TCP 443 and operators need the precise matching security rule. What should the team implement or correct? Network Watcher next hop Network Watcher IP flow verify Network Watcher effective security rules Network Watcher connection monitor Explanation Correct Answer B:The intended behavior is to identify an NSG rule that allows or denies a specified VM traffic flow. Network Watcher IP flow verify is the direct configuration or deployment choice. Incorrect Answers A:Network Watcher next hop determines a VM's effective route and next-hop category to a destination. The current problem instead requires a control that identifies an NSG rule that allows or denies a specified VM traffic flow. C:Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface. The current problem instead requires a control that identifies an NSG rule that allows or denies a specified VM traffic flow. D:This alternative continuously tracks network reachability and performance between configured endpoints, which solves a different networking task. It does not directly identify an NSG rule that allows or denies a specified VM traffic flow.
Question 248 A hybrid network needs an IPsec-based encryption plan over private connectivity. Which step best addresses this particular situation? ExpressRoute private peering ExpressRoute Global Reach ExpressRoute circuit authorization ExpressRoute encryption over private connectivity Explanation Correct Answer D:ExpressRoute encryption over private connectivity adds a supported encryption overlay when private circuit transport alone is insufficient. Incorrect Answers A:Although ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit, that is not sufficient to add a supported encryption overlay when private circuit transport alone is insufficient in this case. B:This choice connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity. It leaves the specific need to add a supported encryption overlay when private circuit transport alone is insufficient unaddressed. C:This alternative allows an approved cross-subscription connection to an ExpressRoute circuit, which solves a different networking task. It does not directly add a supported encryption overlay when private circuit transport alone is insufficient.
Question 249 A network provider is ready but the Azure ExpressRoute circuit has not been ordered. Which step best addresses this particular situation? ExpressRoute Global Reach ExpressRoute circuit provisioning ExpressRoute circuit authorization ExpressRoute encryption over private connectivity Explanation Correct Answer B:The intended behavior is to create the provider-backed private connectivity circuit before linking Azure VNets. ExpressRoute circuit provisioning is the direct configuration or deployment choice. Incorrect Answers A:This choice connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity. It leaves the specific need to create the provider-backed private connectivity circuit before linking Azure VNets unaddressed. C:ExpressRoute circuit authorization is useful when the goal is to allow an approved cross-subscription connection to an ExpressRoute circuit. Here, the required behavior is to create the provider-backed private connectivity circuit before linking Azure VNets. D:ExpressRoute encryption over private connectivity adds a supported encryption overlay when private circuit transport alone is insufficient. The current problem instead requires a control that creates the provider-backed private connectivity circuit before linking Azure VNets.
Question 250 Remote employees need secure access to Azure private VMs from their laptops. Which configuration addresses the stated network constraint? VPN client device deployment validation P2S client address pool planning Point-to-site VPN for individual users P2S gateway SKU and concurrent-user limits Explanation Correct Answer C:This choice provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. Incorrect Answers A:VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. B:P2S client address pool planning allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. D:P2S gateway SKU and concurrent-user limits sizes point-to-site connectivity for the expected simultaneous remote clients. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel.
