Question 300 A regional migration needs new address space while preserving reachability to existing prefixes. What action most directly addresses the documented failure? Address-prefix growth and readdress planning Subnet size and reserved IP planning Custom IP Prefix for bring-your-own-IP Nonoverlapping VNet CIDR planning Explanation Correct Answer A:Address-prefix growth and readdress planning is appropriate because it expands address capacity while managing dependencies and routing effects. Incorrect Answers B:Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that expands address capacity while managing dependencies and routing effects. C:This choice onboards an organization's eligible public IPv4 address block into Azure. It leaves the specific need to expand address capacity while managing dependencies and routing effects unaddressed. D:Although Nonoverlapping VNet CIDR planning prevents address collisions between Azure networks and corporate routes, that is not sufficient to expand address capacity while managing dependencies and routing effects in this case.
Question 301 An Azure Storage workload subnet already has Microsoft.Storage service endpoints enabled, but the approved storage service endpoint policy is not associated with that subnet. What action is required? Service endpoint policy subnet binding Service endpoint diagnostic separation Service endpoint policy for storage resource scope PaaS resource firewall VNet rule Explanation Correct Answer A:Associate the reviewed service endpoint policy with the Microsoft.Storage endpoint-enabled subnet so approved storage-resource restrictions apply to its service traffic. Incorrect Answers B:Diagnostic separation helps investigate existing service endpoint failures but does not associate the missing approved policy. C:Defining which Storage resources the policy allows is necessary, but the question states the reviewed policy already exists and its missing step is subnet association. D:A Storage account’s firewall VNet rule authorizes a subnet at the resource, but does not attach the required subnet-side service endpoint policy.
Question 302 On-premises routing fails because client VPN addresses collide with branch prefixes. Which network component or setting is the best fit? P2S gateway SKU and concurrent-user limits P2S client address pool planning Point-to-site VPN for individual users P2S route distribution to clients Explanation Correct Answer B:The relevant action is P2S client address pool planning: it allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges. Incorrect Answers A:This alternative sizes point-to-site connectivity for the expected simultaneous remote clients, which solves a different networking task. It does not directly allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges. C:Although Point-to-site VPN for individual users provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel, that is not sufficient to allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges in this case. D:This alternative advertises or includes the correct private destination prefixes in remote-user VPN profiles, which solves a different networking task. It does not directly allocate remote-user tunnel addresses without overlapping VNet and on-premises ranges.
Question 303 An architect evaluates a supported FastPath option for high-throughput branch-to-VM traffic. Which implementation most directly resolves this requirement? ExpressRoute circuit bandwidth and SKU design ExpressRoute gateway on VNet ExpressRoute Direct ExpressRoute FastPath Explanation Correct Answer D:ExpressRoute FastPath is appropriate because it improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic. Incorrect Answers A:ExpressRoute circuit bandwidth and SKU design is useful when the goal is to select supported capacity, metering and reach based on enterprise traffic needs. Here, the required behavior is to improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic. B:That approach connects a VNet to an ExpressRoute circuit through the managed gateway; it does not replace ExpressRoute FastPath for the constraint in this scenario. C:ExpressRoute Direct is useful when the goal is to provide dedicated high-capacity direct ports at a supported peering location. Here, the required behavior is to improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic.
Question 304 A security migration requires consistent approved IPsec algorithms on both peers. Which network component or setting is the best fit? S2S reachability verification beyond tunnel state On-premises VPN device policy matching Route-based site-to-site VPN gateway IPsec/IKE policy interoperability Explanation Correct Answer D:IPsec/IKE policy interoperability aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. Incorrect Answers A:That approach validates routing, NSGs and return paths after IPsec reports connected; it does not replace IPsec/IKE policy interoperability for the constraint in this scenario. B:On-premises VPN device policy matching aligns corporate firewall route, access and selector rules with Azure connection design. The current problem instead requires a control that aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. C:Although Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device, that is not sufficient to align matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device in this case.
Question 305 A global network requires appropriate circuit tier for regional reach requirements. What is the most defensible solution for this case? ExpressRoute circuit bandwidth and SKU design ExpressRoute Direct ExpressRoute FastPath ExpressRoute circuit authorization Explanation Correct Answer A:The intended behavior is to select supported capacity, metering and reach based on enterprise traffic needs. ExpressRoute circuit bandwidth and SKU design is the direct configuration or deployment choice. Incorrect Answers B:This choice provides dedicated high-capacity direct ports at a supported peering location. It leaves the specific need to select supported capacity, metering and reach based on enterprise traffic needs unaddressed. C:ExpressRoute FastPath improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic. The current problem instead requires a control that selects supported capacity, metering and reach based on enterprise traffic needs. D:ExpressRoute circuit authorization is useful when the goal is to allow an approved cross-subscription connection to an ExpressRoute circuit. Here, the required behavior is to select supported capacity, metering and reach based on enterprise traffic needs.
Question 306 The change team needs a preflight verdict for one inbound client tuple. Which choice matches the specific technical condition? IP flow verify for NSG traffic decision NSG inbound rule source and port NSG rule priority and first-match evaluation ASG-based NSG access rule Explanation Correct Answer A:This choice tests a specified source/destination/port and reports the allowing or blocking NSG rule. Incorrect Answers B:NSG inbound rule source and port is useful when the goal is to restrict traffic entering a NIC or subnet by source, destination and service port. Here, the required behavior is to test a specified source/destination/port and reports the allowing or blocking NSG rule. C:This choice ensures a more specific permitted or denied flow is evaluated in the intended priority order. It leaves the specific need to test a specified source/destination/port and reports the allowing or blocking NSG rule unaddressed. D:This choice references application security groups as source or destination in supported NSG rules. It leaves the specific need to test a specified source/destination/port and reports the allowing or blocking NSG rule unaddressed.
Question 307 A P2S VPN deployment needs RADIUS shared-secret and server connectivity configuration. Which change should the network engineer make? P2S VPN client profile generation P2S route distribution to clients Microsoft Entra ID P2S authentication RADIUS authentication for P2S VPN Explanation Correct Answer D:The intended behavior is to use an existing supported RADIUS server for VPN user authentication. RADIUS authentication for P2S VPN is the direct configuration or deployment choice. Incorrect Answers A:P2S VPN client profile generation delivers the correct gateway endpoints, routes and authentication settings to client devices. The current problem instead requires a control that uses an existing supported RADIUS server for VPN user authentication. B:This alternative advertises or includes the correct private destination prefixes in remote-user VPN profiles, which solves a different networking task. It does not directly use an existing supported RADIUS server for VPN user authentication. C:Microsoft Entra ID P2S authentication authenticates supported VPN clients using the organization's Entra identity platform. The current problem instead requires a control that uses an existing supported RADIUS server for VPN user authentication.
Question 308 An auditor wants to verify security actions through recorded firewall policy matches. What action most directly addresses the documented failure? Firewall forced tunneling via approved next hop Firewall logs and threat intelligence monitoring Azure Firewall Premium for TLS inspection Azure Firewall Policy across regions Explanation Correct Answer B:Firewall logs and threat intelligence monitoring uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. Incorrect Answers A:Firewall forced tunneling via approved next hop routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge. The current problem instead requires a control that uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. C:Azure Firewall Premium for TLS inspection is useful when the goal is to use the Premium tier's supported TLS inspection and advanced threat features. Here, the required behavior is to use firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. D:That approach centralizes managed firewall settings and reusable rule collections; it does not replace Firewall logs and threat intelligence monitoring for the constraint in this scenario.
Question 309 A production hybrid WAN cannot rely on a single provider or physical path. What is the most defensible solution for this case? ExpressRoute BFD for rapid failure detection ExpressRoute Global Reach ExpressRoute circuit authorization ExpressRoute redundancy planning Explanation Correct Answer D:ExpressRoute redundancy planning is appropriate because it uses redundant circuits or locations as required to survive equipment and site failures. Incorrect Answers A:This alternative uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone, which solves a different networking task. It does not directly use redundant circuits or locations as required to survive equipment and site failures. B:This alternative connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity, which solves a different networking task. It does not directly use redundant circuits or locations as required to survive equipment and site failures. C:Although ExpressRoute circuit authorization allows an approved cross-subscription connection to an ExpressRoute circuit, that is not sufficient to use redundant circuits or locations as required to survive equipment and site failures in this case.
Question 310 The private endpoint in hub VNet A has an approved connection and correct private DNS for the client in peered VNet B. A user-defined route in VNet B incorrectly sends the endpoint prefix to an unavailable appliance. What should the engineer correct? Recreate the private DNS zone group even though DNS already resolves correctly Deploy a site-to-site VPN to an unrelated office network instead of fixing the Azure route Repair the effective route or UDR for the private endpoint prefix from VNet B Move the already approved private endpoint into VNet B without correcting its route Explanation Correct Answer C:The route table or effective route must deliver packets from VNet B to the reachable private endpoint prefix instead of an unavailable next hop. Incorrect Answers A:The hostname already resolves to the intended private IP; replacing the DNS zone group will not correct the failed next hop. B:An on-premises VPN is unrelated to the broken route between the existing peered Azure VNets. D:A private endpoint can be reached from a peered VNet; relocating it does not solve the stated incorrect effective route.
