Question 340 Network operators must manage the private endpoint NIC's location and associated address. Which network component or setting is the best fit? Private Endpoint for PaaS private IP access Private Endpoint subnet placement Private Endpoint subresource selection Private Endpoint peered-VNet reachability Explanation Correct Answer B:Private Endpoint subnet placement is appropriate because it deploys a supported private endpoint NIC in the correct consumer VNet subnet. Incorrect Answers A:This alternative exposes a supported Azure service through a private IP interface in the consumer VNet, which solves a different networking task. It does not directly deploy a supported private endpoint NIC in the correct consumer VNet subnet. C:That approach targets the correct service resource and subresource in a private endpoint connection; it does not replace Private Endpoint subnet placement for the constraint in this scenario. D:Private Endpoint peered-VNet reachability is useful when the goal is to confirm peering, DNS zone links and security policies for clients in another VNet. Here, the required behavior is to deploy a supported private endpoint NIC in the correct consumer VNet subnet.
Question 341 A migration must verify that newly enrolled laptops can establish the approved tunnel. What is the most defensible solution for this case? Point-to-site VPN for individual users VPN client device deployment validation P2S VPN client profile generation P2S OpenVPN protocol selection Explanation Correct Answer B:VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements. Incorrect Answers A:Point-to-site VPN for individual users provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. The current problem instead requires a control that validates supported OS, client version, tunnel profile and endpoint requirements. C:This choice delivers the correct gateway endpoints, routes and authentication settings to client devices. It leaves the specific need to validate supported OS, client version, tunnel profile and endpoint requirements unaddressed. D:This alternative chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements.
Question 342 The firewall allowlist expects a specific outbound public address but gateway IP settings differ. Which Azure networking capability should be selected? NAT Gateway public IP allocation Azure Route Server for BGP exchange NAT Gateway for predictable outbound SNAT NAT Gateway subnet association Explanation Correct Answer A:The relevant action is NAT Gateway public IP allocation: it assigns supported public IP or public IP prefix resources to the gateway. Incorrect Answers B:Azure Route Server for BGP exchange is useful when the goal is to exchange dynamic routes with supported network virtual appliances over BGP. Here, the required behavior is to assign supported public IP or public IP prefix resources to the gateway. C:This choice provides scalable managed outbound connectivity for private subnet workloads. It leaves the specific need to assign supported public IP or public IP prefix resources to the gateway unaddressed. D:Although NAT Gateway subnet association applies a NAT Gateway's outbound SNAT behavior to a selected subnet, that is not sufficient to assign supported public IP or public IP prefix resources to the gateway in this case.
Question 343 A tiny testing environment needs a compatible inexpensive Azure Firewall tier. What action most directly addresses the documented failure? AzureFirewallSubnet deployment prerequisite Azure Firewall Standard for stateful filtering Firewall forced tunneling via approved next hop Azure Firewall Basic for simple network filtering Explanation Correct Answer D:Azure Firewall Basic for simple network filtering fits eligible smaller workloads when advanced throughput and security features are not required. Incorrect Answers A:This alternative places Azure Firewall in its designated subnet with the required supported size, which solves a different networking task. It does not directly fit eligible smaller workloads when advanced throughput and security features are not required. B:Although Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection, that is not sufficient to fit eligible smaller workloads when advanced throughput and security features are not required in this case. C:This alternative routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge, which solves a different networking task. It does not directly fit eligible smaller workloads when advanced throughput and security features are not required.
Question 344 A database team needs a private address to one supported PaaS resource, rather than subnet service-endpoint access to its public service address. What should it deploy? Private Link service alias distribution Private Endpoint connection state monitoring A Private Endpoint targeting the chosen supported PaaS resource Private Link service access visibility Explanation Correct Answer C:A Private Endpoint creates a private network interface and IP address in the VNet for the specified PaaS resource. Incorrect Answers A:Private Link service alias distribution advertises a publisher-hosted service but does not create the required private IP for this supported PaaS resource. B:Connection-state monitoring shows endpoint approval or health and does not deploy its private address. D:Service access visibility manages eligible consumer subscriptions for a publisher-hosted service; it is not the resource-specific Private Endpoint deployment.
Question 345 A platform team needs diagnostic settings to send Firewall logs to Log Analytics. Which choice matches the specific technical condition? Firewall logs and threat intelligence monitoring Azure Firewall policy rule collection priority Azure Firewall Premium for TLS inspection Firewall forced tunneling via approved next hop Explanation Correct Answer A:The relevant action is Firewall logs and threat intelligence monitoring: it uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. Incorrect Answers B:That approach organizes matching firewall rules with correct ordering and actions; it does not replace Firewall logs and threat intelligence monitoring for the constraint in this scenario. C:Azure Firewall Premium for TLS inspection uses the Premium tier's supported TLS inspection and advanced threat features. The current problem instead requires a control that uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. D:This alternative routes Azure Firewall Internet-bound traffic toward another approved security device or on-premises edge, which solves a different networking task. It does not directly use firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic.
Question 346 A security review notes that dedicated private routing is not the same as end-to-end encryption. What should the administrator change or deploy? ExpressRoute encryption over private connectivity ExpressRoute circuit bandwidth and SKU design ExpressRoute circuit provisioning ExpressRoute private peering Explanation Correct Answer A:The intended behavior is to add a supported encryption overlay when private circuit transport alone is insufficient. ExpressRoute encryption over private connectivity is the direct configuration or deployment choice. Incorrect Answers B:That approach selects supported capacity, metering and reach based on enterprise traffic needs; it does not replace ExpressRoute encryption over private connectivity for the constraint in this scenario. C:Although ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets, that is not sufficient to add a supported encryption overlay when private circuit transport alone is insufficient in this case. D:This alternative provides private routing to VNet private address spaces over an ExpressRoute circuit, which solves a different networking task. It does not directly add a supported encryption overlay when private circuit transport alone is insufficient.
Question 347 A procurement team needs explicit bandwidth commitments before approving private WAN connectivity. What is the most defensible solution for this case? ExpressRoute circuit bandwidth and SKU design ExpressRoute Direct ExpressRoute circuit provisioning ExpressRoute circuit authorization Explanation Correct Answer A:The relevant action is ExpressRoute circuit bandwidth and SKU design: it selects supported capacity, metering and reach based on enterprise traffic needs. Incorrect Answers B:This choice provides dedicated high-capacity direct ports at a supported peering location. It leaves the specific need to select supported capacity, metering and reach based on enterprise traffic needs unaddressed. C:ExpressRoute circuit provisioning creates the provider-backed private connectivity circuit before linking Azure VNets. The current problem instead requires a control that selects supported capacity, metering and reach based on enterprise traffic needs. D:ExpressRoute circuit authorization is useful when the goal is to allow an approved cross-subscription connection to an ExpressRoute circuit. Here, the required behavior is to select supported capacity, metering and reach based on enterprise traffic needs.
Question 348 A compliance application needs resource-specific private connectivity rather than broad public service routes. Which Azure control would meet the operational need? Private Endpoint hostname-specific TLS handling Private Endpoint for PaaS private IP access Private Endpoint subnet placement Private Endpoint DNS A-record integration Explanation Correct Answer B:Private Endpoint for PaaS private IP access is appropriate because it exposes a supported Azure service through a private IP interface in the consumer VNet. Incorrect Answers A:This alternative uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients, which solves a different networking task. It does not directly expose a supported Azure service through a private IP interface in the consumer VNet. C:This alternative deploys a supported private endpoint NIC in the correct consumer VNet subnet, which solves a different networking task. It does not directly expose a supported Azure service through a private IP interface in the consumer VNet. D:That approach maps the service's normal FQDN to its private endpoint IP address for authorized clients; it does not replace Private Endpoint for PaaS private IP access for the constraint in this scenario.
Question 349 An architect claims that enabling a Microsoft.Storage service endpoint automatically deploys a private endpoint NIC in the application subnet. Which correction is accurate? A service endpoint creates a read-only private NIC for each storage account listed in the resource firewall. Enabling a service endpoint changes every associated Storage account hostname to an RFC1918 address. Service endpoint setup automatically creates a separate user-managed VPN gateway for Storage traffic. A service endpoint extends the subnet identity for service access but does not create a private resource NIC; that is a Private Endpoint feature. Explanation Correct Answer D:Private Endpoints provide private interface addresses for specific resources, whereas service endpoints retain the supported Azure service public address with virtual-network identity. Incorrect Answers A:A service endpoint adds supported service routing and subnet identity; no resource-specific private endpoint NIC is deployed in the application VNet. B:Service endpoint configuration keeps the Azure service addressing in use and does not create new private DNS records for every target account. C:A service endpoint does not provision an IPsec VPN or customer VPN gateway; Azure routes supported service traffic across its backbone.
Question 350 A retail site has unpredictable traffic surges and manually set instances are insufficient. What should the team implement or correct? Application Gateway TLS termination Application Gateway end-to-end TLS Application Gateway HTTP settings Application Gateway autoscale Explanation Correct Answer D:The relevant action is Application Gateway autoscale: it adjusts supported v2 gateway capacity automatically to demand within configured boundaries. Incorrect Answers A:Application Gateway TLS termination terminates client HTTPS on the gateway with the appropriate certificate and listener. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries. B:Application Gateway end-to-end TLS re-encrypts or retains HTTPS between the gateway and validated backend endpoints. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries. C:Application Gateway HTTP settings configures supported backend protocol, port, host-name and session behavior. The current problem instead requires a control that adjusts supported v2 gateway capacity automatically to demand within configured boundaries.
