Question 290 A WAN team must choose an ExpressRoute gateway scale unit when the hub expands. What is the most defensible solution for this case? Virtual WAN gateway scale-unit planning Virtual WAN secure hub with Azure Firewall Virtual WAN site-to-site VPN gateway Virtual WAN hub VNet connection Explanation Correct Answer A:The relevant action is Virtual WAN gateway scale-unit planning: it sizes a managed virtual-hub gateway for required bandwidth and connections. Incorrect Answers B:Although Virtual WAN secure hub with Azure Firewall integrates managed central security inspection into a Virtual WAN virtual hub, that is not sufficient to size a managed virtual-hub gateway for required bandwidth and connections in this case. C:Virtual WAN site-to-site VPN gateway terminates VPN connections from branches within the managed virtual hub. The current problem instead requires a control that sizes a managed virtual-hub gateway for required bandwidth and connections. D:Virtual WAN hub VNet connection is useful when the goal is to attache a workload VNet to a managed virtual hub for connectivity and route propagation. Here, the required behavior is to size a managed virtual-hub gateway for required bandwidth and connections.
Question 291 A partner cannot access the provider subscription but needs an alias for private connection. Which step best addresses this particular situation? Private Link service alias distribution Private Endpoint connection state monitoring Private Link service access visibility Private Link service provider design Explanation Correct Answer A:Private Link service alias distribution gives authorized consumers a service alias to request private endpoints without using the full resource ID. Incorrect Answers B:Although Private Endpoint connection state monitoring inspects connection state and service-side approvals during private-link troubleshooting, that is not sufficient to give authorized consumers a service alias to request private endpoints without using the full resource ID in this case. C:Private Link service access visibility restricts eligible consumers through controlled visibility and approval settings. The current problem instead requires a control that gives authorized consumers a service alias to request private endpoints without using the full resource ID. D:Although Private Link service provider design exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link, that is not sufficient to give authorized consumers a service alias to request private endpoints without using the full resource ID in this case.
Question 292 A network architect wants workloads to query the firewall's DNS proxy for consistent decisions. Which change should the network engineer make? Azure Firewall Policy across regions Azure Firewall Standard for stateful filtering Azure Firewall DNS proxy Azure Firewall network rule Explanation Correct Answer C:The relevant action is Azure Firewall DNS proxy: it provides centrally proxied DNS resolution for supported FQDN-based network policy. Incorrect Answers A:Azure Firewall Policy across regions centralizes managed firewall settings and reusable rule collections. The current problem instead requires a control that provides centrally proxied DNS resolution for supported FQDN-based network policy. B:Although Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection, that is not sufficient to provide centrally proxied DNS resolution for supported FQDN-based network policy in this case. D:Azure Firewall network rule permits or denies supported IP-based TCP or UDP flows by addresses and ports. The current problem instead requires a control that provides centrally proxied DNS resolution for supported FQDN-based network policy.
Question 293 The network team must design a separate subnet before enabling managed browser-based VM access. Which implementation most directly resolves this requirement? AzureFirewallSubnet sizing Dedicated AzureBastionSubnet Subnet size and reserved IP planning Service-specific subnet isolation Explanation Correct Answer B:The relevant action is Dedicated AzureBastionSubnet: it reserves the specifically named subnet required for Azure Bastion. Incorrect Answers A:AzureFirewallSubnet sizing provides the reserved firewall subnet for the managed Azure Firewall deployment. The current problem instead requires a control that reserves the specifically named subnet required for Azure Bastion. C:Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that reserves the specifically named subnet required for Azure Bastion. D:That approach keeps dedicated platform subnets separate from shared workload subnets; it does not replace Dedicated AzureBastionSubnet for the constraint in this scenario.
Question 294 A central workspace must receive supported VNet traffic flow telemetry. Which implementation most directly resolves this requirement? VNet flow log collection IP flow verify for NSG traffic decision NSG subnet association NSG rule priority and first-match evaluation Explanation Correct Answer A:The intended behavior is to capture supported virtual network flow data for operational and security analysis. VNet flow log collection is the direct configuration or deployment choice. Incorrect Answers B:IP flow verify for NSG traffic decision tests a specified source/destination/port and reports the allowing or blocking NSG rule. The current problem instead requires a control that captures supported virtual network flow data for operational and security analysis. C:NSG subnet association is useful when the goal is to apply a network security group to all eligible network interfaces in a selected subnet. Here, the required behavior is to capture supported virtual network flow data for operational and security analysis. D:This alternative ensures a more specific permitted or denied flow is evaluated in the intended priority order, which solves a different networking task. It does not directly capture supported virtual network flow data for operational and security analysis.
Question 295 A latency-sensitive migration needs capacity planning before choosing the VPN SKU. Which step best addresses this particular situation? Zone-redundant VPN Gateway Route-based site-to-site VPN gateway Virtual network gateway deployment VPN gateway SKU throughput planning Explanation Correct Answer D:VPN gateway SKU throughput planning selects a supported VPN gateway tier sized for aggregate tunnels and traffic. Incorrect Answers A:Zone-redundant VPN Gateway is useful when the goal is to place a supported VPN gateway across availability zones for regional resilience. Here, the required behavior is to select a supported VPN gateway tier sized for aggregate tunnels and traffic. B:This alternative supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device, which solves a different networking task. It does not directly select a supported VPN gateway tier sized for aggregate tunnels and traffic. C:Virtual network gateway deployment provisions the Azure-managed VPN gateway attached to the target VNet. The current problem instead requires a control that selects a supported VPN gateway tier sized for aggregate tunnels and traffic.
Question 296 An app must privately reach Azure Storage account A, not a different account in the same region. Which resource must its new Private Endpoint target? Private Link service access visibility Private Endpoint approval workflow Private Link service provider design Create a Private Endpoint whose private-link resource ID identifies storage account A Explanation Correct Answer D:Target the exact approved storage account’s resource ID and appropriate subresource when creating the Private Endpoint; other regional accounts remain separate resources. Incorrect Answers A:Private Link service access visibility controls publisher-consumer visibility, not which existing storage account the Private Endpoint resolves to. B:The approval workflow can authorize a connection but does not replace the need to select the correct storage-account resource ID. C:Designing a provider-hosted Private Link service is unnecessary when consuming a supported Azure Storage account directly.
Question 297 DNS and routes look correct but a private endpoint connection shows Rejected. What is the most defensible solution for this case? Private Endpoint connection state monitoring Private Endpoint subresource selection Private Endpoint approval workflow Private Endpoint resource-specific authorization Explanation Correct Answer A:Private Endpoint connection state monitoring inspects connection state and service-side approvals during private-link troubleshooting. Incorrect Answers B:Although Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection, that is not sufficient to inspect connection state and service-side approvals during private-link troubleshooting in this case. C:Private Endpoint approval workflow is useful when the goal is to require the service owner to authorize pending private endpoint connections when necessary. Here, the required behavior is to inspect connection state and service-side approvals during private-link troubleshooting. D:Although Private Endpoint resource-specific authorization scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, that is not sufficient to inspect connection state and service-side approvals during private-link troubleshooting in this case.
Question 298 A private endpoint subnet needs explicit network policy settings for controlled traffic. Which network component or setting is the best fit? Private Endpoint subresource selection Private Endpoint subnet placement Private Endpoint NSG and route policy support Private Endpoint from on-premises via hybrid route Explanation Correct Answer C:Private Endpoint NSG and route policy support is appropriate because it applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed. Incorrect Answers A:Although Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection, that is not sufficient to apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed in this case. B:This alternative deploys a supported private endpoint NIC in the correct consumer VNet subnet, which solves a different networking task. It does not directly apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed. D:Private Endpoint from on-premises via hybrid route is useful when the goal is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Here, the required behavior is to apply enabled private endpoint network policies when traffic inspection or subnet filtering is needed.
Question 299 An engineer must separate gateway infrastructure from application hosts. Which change should the network engineer make? GatewaySubnet for virtual network gateway Dedicated AzureBastionSubnet Subnet network policy placement Subnet size and reserved IP planning Explanation Correct Answer A:GatewaySubnet for virtual network gateway is appropriate because it allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. Incorrect Answers B:This choice reserves the specifically named subnet required for Azure Bastion. It leaves the specific need to allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways unaddressed. C:This alternative places security and routing policies on the workload subnet rather than assuming a public IP defines security, which solves a different networking task. It does not directly allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. D:This alternative accounts for Azure-reserved addresses and workload growth in each subnet, which solves a different networking task. It does not directly allocate the reserved gateway subnet used by Azure VPN or ExpressRoute gateways.
Question 300 A regional migration needs new address space while preserving reachability to existing prefixes. What action most directly addresses the documented failure? Address-prefix growth and readdress planning Subnet size and reserved IP planning Custom IP Prefix for bring-your-own-IP Nonoverlapping VNet CIDR planning Explanation Correct Answer A:Address-prefix growth and readdress planning is appropriate because it expands address capacity while managing dependencies and routing effects. Incorrect Answers B:Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that expands address capacity while managing dependencies and routing effects. C:This choice onboards an organization's eligible public IPv4 address block into Azure. It leaves the specific need to expand address capacity while managing dependencies and routing effects unaddressed. D:Although Nonoverlapping VNet CIDR planning prevents address collisions between Azure networks and corporate routes, that is not sufficient to expand address capacity while managing dependencies and routing effects in this case.
