Question 320 An Azure service's VNet integration reports that its subnet has not been delegated. Which Azure control would meet the operational need? Subnet size and reserved IP planning IP configuration for multiple VM addresses Subnet delegation for PaaS integration Service-specific subnet isolation Explanation Correct Answer C:This choice delegates a subnet to a supported service so the platform can manage its integration requirements. Incorrect Answers A:This alternative accounts for Azure-reserved addresses and workload growth in each subnet, which solves a different networking task. It does not directly delegate a subnet to a supported service so the platform can manage its integration requirements. B:IP configuration for multiple VM addresses is useful when the goal is to use multiple supported IP configurations on a network interface for distinct service addresses. Here, the required behavior is to delegate a subnet to a supported service so the platform can manage its integration requirements. D:This alternative keeps dedicated platform subnets separate from shared workload subnets, which solves a different networking task. It does not directly delegate a subnet to a supported service so the platform can manage its integration requirements.
Question 321 An architect wants one private-IP entry point to a supported managed Azure service. Which network component or setting is the best fit? Private Endpoint DNS A-record integration Private Endpoint subnet placement Private Endpoint for PaaS private IP access Private Link service provider design Explanation Correct Answer C:The intended behavior is to expose a supported Azure service through a private IP interface in the consumer VNet. Private Endpoint for PaaS private IP access is the direct configuration or deployment choice. Incorrect Answers A:This alternative maps the service's normal FQDN to its private endpoint IP address for authorized clients, which solves a different networking task. It does not directly expose a supported Azure service through a private IP interface in the consumer VNet. B:Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet. The current problem instead requires a control that exposes a supported Azure service through a private IP interface in the consumer VNet. D:Although Private Link service provider design exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link, that is not sufficient to expose a supported Azure service through a private IP interface in the consumer VNet in this case.
Question 322 An auditor wants evidence of network flow patterns over a selected period. Which network component or setting is the best fit? Azure Virtual Network Manager security admin policy VNet flow log collection NSG subnet association NSG network interface association Explanation Correct Answer B:VNet flow log collection is appropriate because it captures supported virtual network flow data for operational and security analysis. Incorrect Answers A:This choice governs supported high-priority security admin rules across centrally managed VNets. It leaves the specific need to capture supported virtual network flow data for operational and security analysis unaddressed. C:NSG subnet association applies a network security group to all eligible network interfaces in a selected subnet. The current problem instead requires a control that captures supported virtual network flow data for operational and security analysis. D:NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that captures supported virtual network flow data for operational and security analysis.
Question 323 An architect wants managed inbound DNS queries without creating DNS forwarder VMs. Which step best addresses this particular situation? Azure private DNS zone Azure DNS Private Resolver outbound endpoint Azure DNS Private Resolver inbound endpoint DNS private endpoint record validation Explanation Correct Answer C:The intended behavior is to accept DNS queries arriving from on-premises or connected networks into Azure resolution. Azure DNS Private Resolver inbound endpoint is the direct configuration or deployment choice. Incorrect Answers A:Azure private DNS zone is useful when the goal is to store DNS records visible through linked private-network resolution rather than public DNS. Here, the required behavior is to accept DNS queries arriving from on-premises or connected networks into Azure resolution. B:This alternative sends selected Azure DNS queries toward other DNS servers through managed forwarding, which solves a different networking task. It does not directly accept DNS queries arriving from on-premises or connected networks into Azure resolution. D:This choice confirms private service FQDNs resolve to the intended private endpoint addresses. It leaves the specific need to accept DNS queries arriving from on-premises or connected networks into Azure resolution unaddressed.
Question 324 A website should use West Europe only if its primary East US origin fails. What should the administrator change or deploy? Front Door end-to-end TLS Front Door origin group priority failover Front Door origin weighting for load distribution Front Door route and origin mapping Explanation Correct Answer B:The intended behavior is to select healthy primary and secondary origins using configured priority and health. Front Door origin group priority failover is the direct configuration or deployment choice. Incorrect Answers A:Front Door end-to-end TLS protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings. The current problem instead requires a control that selects healthy primary and secondary origins using configured priority and health. C:Front Door origin weighting for load distribution is useful when the goal is to balance requests among equally prioritized healthy origins using configured weights. Here, the required behavior is to select healthy primary and secondary origins using configured priority and health. D:This alternative connects the matching frontend domain/path to the intended origin group, which solves a different networking task. It does not directly select healthy primary and secondary origins using configured priority and health.
Question 325 A VNet with mission-critical public IPs needs a documented enhanced DDoS posture. Which configuration addresses the stated network constraint? Azure diagnostic settings to Log Analytics Network Watcher effective security rules Azure DDoS Protection deployment Azure Monitor network resource metrics Explanation Correct Answer C:Azure DDoS Protection deployment is appropriate because it adds managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses. Incorrect Answers A:Azure diagnostic settings to Log Analytics sends supported network resource logs to a workspace for query and retention. The current problem instead requires a control that adds managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses. B:Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses in this case. D:Although Azure Monitor network resource metrics collects performance and health signals for Azure networking resources, that is not sufficient to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses in this case.
Question 326 An intermittent hybrid flow needs measured round-trip latency and reachability findings. What should the administrator change or deploy? Network Watcher connection troubleshoot Network Watcher effective security rules Network Watcher next hop Network Watcher connection monitor Explanation Correct Answer A:The intended behavior is to test end-to-end reachability, latency and network obstacles between source and destination. Network Watcher connection troubleshoot is the direct configuration or deployment choice. Incorrect Answers B:This choice lists the combined network security rules effective on an Azure VM interface. It leaves the specific need to test end-to-end reachability, latency and network obstacles between source and destination unaddressed. C:Network Watcher next hop determines a VM's effective route and next-hop category to a destination. The current problem instead requires a control that tests end-to-end reachability, latency and network obstacles between source and destination. D:Although Network Watcher connection monitor continuously tracks network reachability and performance between configured endpoints, that is not sufficient to test end-to-end reachability, latency and network obstacles between source and destination in this case.
Question 327 A network appliance requires more than one configured private IP on a supported interface. Which approach best satisfies the access or connectivity requirement? NIC-level public IP association Subnet size and reserved IP planning Static private NIC IP configuration IP configuration for multiple VM addresses Explanation Correct Answer D:IP configuration for multiple VM addresses is appropriate because it uses multiple supported IP configurations on a network interface for distinct service addresses. Incorrect Answers A:NIC-level public IP association attaches the public IP to the correct network interface IP configuration. The current problem instead requires a control that uses multiple supported IP configurations on a network interface for distinct service addresses. B:Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that uses multiple supported IP configurations on a network interface for distinct service addresses. C:Static private NIC IP configuration assigns an intended stable private address to a VM network interface within its subnet. The current problem instead requires a control that uses multiple supported IP configurations on a network interface for distinct service addresses.
Question 328 A troubleshooting task must identify the NSG attached directly to a VM NIC. Which network component or setting is the best fit? NSG rule priority and first-match evaluation NSG network interface association NSG outbound rule destination and port NSG subnet association Explanation Correct Answer B:This choice applies additional instance-specific NSG rules to a selected network interface. Incorrect Answers A:NSG rule priority and first-match evaluation is useful when the goal is to ensure a more specific permitted or denied flow is evaluated in the intended priority order. Here, the required behavior is to apply additional instance-specific NSG rules to a selected network interface. C:That approach restricts workloads initiating network connections toward disallowed destinations; it does not replace NSG network interface association for the constraint in this scenario. D:This alternative applies a network security group to all eligible network interfaces in a selected subnet, which solves a different networking task. It does not directly apply additional instance-specific NSG rules to a selected network interface.
Question 329 A service owner wants historical trend alerts for connectivity between two endpoints. Which implementation most directly resolves this requirement? Network Watcher packet capture Azure Monitor network resource metrics Network Watcher connection troubleshoot Network Watcher connection monitor Explanation Correct Answer D:Network Watcher connection monitor is appropriate because it continuously tracks network reachability and performance between configured endpoints. Incorrect Answers A:This alternative captures scoped packet evidence from a supported VM for protocol troubleshooting, which solves a different networking task. It does not directly continuously track network reachability and performance between configured endpoints. B:That approach collects performance and health signals for Azure networking resources; it does not replace Network Watcher connection monitor for the constraint in this scenario. C:Network Watcher connection troubleshoot tests end-to-end reachability, latency and network obstacles between source and destination. The current problem instead requires a control that continuously tracks network reachability and performance between configured endpoints.
Question 330 A regulated app needs server certificate validation on its gateway backend connection. Which Azure control would meet the operational need? Application Gateway HTTP settings Application Gateway TLS termination Application Gateway end-to-end TLS Application Gateway for regional HTTP routing Explanation Correct Answer C:Application Gateway end-to-end TLS re-encrypts or retains HTTPS between the gateway and validated backend endpoints. Incorrect Answers A:Although Application Gateway HTTP settings configures supported backend protocol, port, host-name and session behavior, that is not sufficient to re-encrypt or retains HTTPS between the gateway and validated backend endpoints in this case. B:Application Gateway TLS termination is useful when the goal is to terminate client HTTPS on the gateway with the appropriate certificate and listener. Here, the required behavior is to re-encrypt or retains HTTPS between the gateway and validated backend endpoints. D:Application Gateway for regional HTTP routing is useful when the goal is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. Here, the required behavior is to re-encrypt or retains HTTPS between the gateway and validated backend endpoints.
