Question 420 A data center has two VPN devices and Azure must remain connected during one device failure. What is the most appropriate next design decision? Active-active VPN gateway design Zone-redundant VPN Gateway VPN gateway SKU throughput planning On-premises VPN device policy matching Explanation Correct Answer A:Active-active VPN gateway design uses multiple gateway instances and connections for supported VPN link resiliency. Incorrect Answers B:Zone-redundant VPN Gateway is useful when the goal is to place a supported VPN gateway across availability zones for regional resilience. Here, the required behavior is to use multiple gateway instances and connections for supported VPN link resiliency. C:VPN gateway SKU throughput planning selects a supported VPN gateway tier sized for aggregate tunnels and traffic. The current problem instead requires a control that uses multiple gateway instances and connections for supported VPN link resiliency. D:That approach aligns corporate firewall route, access and selector rules with Azure connection design; it does not replace Active-active VPN gateway design for the constraint in this scenario.
Question 421 An application needs a WAF rule blocking a malicious request header pattern. What is the most appropriate next design decision? WAF prevention mode for active blocking WAF diagnostic logging and investigation Custom WAF rule for scoped conditions Managed WAF rule set selection Explanation Correct Answer C:The relevant action is Custom WAF rule for scoped conditions: it matches an application-specific condition such as an approved IP, header or path and applies policy. Incorrect Answers A:WAF prevention mode for active blocking blocks HTTP requests that match configured WAF enforcement rules. The current problem instead requires a control that matches an application-specific condition such as an approved IP, header or path and applies policy. B:WAF diagnostic logging and investigation is useful when the goal is to correlate WAF rule IDs, policy actions and client requests to investigate web filtering. Here, the required behavior is to match an application-specific condition such as an approved IP, header or path and applies policy. D:Managed WAF rule set selection uses a supported managed web attack signature rule set for common application threats. The current problem instead requires a control that matches an application-specific condition such as an approved IP, header or path and applies policy.
Question 422 A branch network must avoid a single tunnel endpoint during planned maintenance. Which network component or setting is the best fit? Active-active VPN gateway design BGP route advertisement on VPN Zone-redundant VPN Gateway Virtual network gateway deployment Explanation Correct Answer A:This choice uses multiple gateway instances and connections for supported VPN link resiliency. Incorrect Answers B:BGP route advertisement on VPN is useful when the goal is to exchange dynamic network prefixes over a supported route-based VPN configuration. Here, the required behavior is to use multiple gateway instances and connections for supported VPN link resiliency. C:Although Zone-redundant VPN Gateway places a supported VPN gateway across availability zones for regional resilience, that is not sufficient to use multiple gateway instances and connections for supported VPN link resiliency in this case. D:Virtual network gateway deployment is useful when the goal is to provision the Azure-managed VPN gateway attached to the target VNet. Here, the required behavior is to use multiple gateway instances and connections for supported VPN link resiliency.
Question 423 An engineer must verify if SYN requests leave a VM and responses return. Which choice matches the specific technical condition? Network Watcher effective security rules Network Watcher packet capture Network Watcher connection monitor Network Watcher IP flow verify Explanation Correct Answer B:The relevant action is Network Watcher packet capture: it captures scoped packet evidence from a supported VM for protocol troubleshooting. Incorrect Answers A:Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface. The current problem instead requires a control that captures scoped packet evidence from a supported VM for protocol troubleshooting. C:Network Watcher connection monitor is useful when the goal is to continuously track network reachability and performance between configured endpoints. Here, the required behavior is to capture scoped packet evidence from a supported VM for protocol troubleshooting. D:Although Network Watcher IP flow verify identifies an NSG rule that allows or denies a specified VM traffic flow, that is not sufficient to capture scoped packet evidence from a supported VM for protocol troubleshooting in this case.
Question 424 A UDR change causes asymmetric paths across a pair of peered VNets. Which configuration should the team verify or implement first? Service chaining return-path validation Gateway transit on hub peering User-defined route to virtual appliance Allow forwarded traffic on VNet peering Explanation Correct Answer A:The intended behavior is to check both forward and return routing when traffic crosses a central firewall or appliance. Service chaining return-path validation is the direct configuration or deployment choice. Incorrect Answers B:This alternative lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway, which solves a different networking task. It does not directly check both forward and return routing when traffic crosses a central firewall or appliance. C:Although User-defined route to virtual appliance directs selected subnet traffic to a nominated next-hop NVA address, that is not sufficient to check both forward and return routing when traffic crosses a central firewall or appliance in this case. D:Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. The current problem instead requires a control that checks both forward and return routing when traffic crosses a central firewall or appliance.
Question 425 A mid-sized enterprise wants a managed outbound firewall with threat-intelligence filtering. Which approach best satisfies the access or connectivity requirement? Azure Firewall Standard for stateful filtering Azure Firewall DNS proxy Azure Firewall Premium for TLS inspection Azure Firewall Basic for simple network filtering Explanation Correct Answer A:The intended behavior is to provide managed stateful network and application filtering without Premium-only inspection. Azure Firewall Standard for stateful filtering is the direct configuration or deployment choice. Incorrect Answers B:Azure Firewall DNS proxy is useful when the goal is to provide centrally proxied DNS resolution for supported FQDN-based network policy. Here, the required behavior is to provide managed stateful network and application filtering without Premium-only inspection. C:Azure Firewall Premium for TLS inspection is useful when the goal is to use the Premium tier's supported TLS inspection and advanced threat features. Here, the required behavior is to provide managed stateful network and application filtering without Premium-only inspection. D:Although Azure Firewall Basic for simple network filtering fits eligible smaller workloads when advanced throughput and security features are not required, that is not sufficient to provide managed stateful network and application filtering without Premium-only inspection in this case.
Question 426 A service owner wants the exact NSG rule name behind an observed packet verdict. Which configuration addresses the stated network constraint? IP flow verify for NSG traffic decision ASG-based NSG access rule NSG rule priority and first-match evaluation NSG outbound rule destination and port Explanation Correct Answer A:IP flow verify for NSG traffic decision is appropriate because it tests a specified source/destination/port and reports the allowing or blocking NSG rule. Incorrect Answers B:This alternative references application security groups as source or destination in supported NSG rules, which solves a different networking task. It does not directly test a specified source/destination/port and reports the allowing or blocking NSG rule. C:This choice ensures a more specific permitted or denied flow is evaluated in the intended priority order. It leaves the specific need to test a specified source/destination/port and reports the allowing or blocking NSG rule unaddressed. D:That approach restricts workloads initiating network connections toward disallowed destinations; it does not replace IP flow verify for NSG traffic decision for the constraint in this scenario.
Question 427 A new DNS deployment returns NXDOMAIN despite a record existing in an unlinked zone. What should the administrator change or deploy? Azure DNS public zone delegation DNS answer-path troubleshooting Private DNS zone VNet link Private DNS zone auto-registration link Explanation Correct Answer B:DNS answer-path troubleshooting is appropriate because it tests authoritative records, zone links and conditional forwarding in the proper order. Incorrect Answers A:Although Azure DNS public zone delegation hosts authoritative public DNS records under an internet-resolvable zone, that is not sufficient to test authoritative records, zone links and conditional forwarding in the proper order in this case. C:This alternative permits a selected VNet's resolver to query records in a private DNS zone, which solves a different networking task. It does not directly test authoritative records, zone links and conditional forwarding in the proper order. D:This choice registers eligible VM DNS records automatically in a linked private DNS zone. It leaves the specific need to test authoritative records, zone links and conditional forwarding in the proper order unaddressed.
Question 428 A custom route sends all application traffic directly to Internet instead of hub inspection. What is the most defensible solution for this case? User-defined route to virtual appliance Forced-tunnel default route design Route table association to subnet NAT Gateway subnet association Explanation Correct Answer A:The intended behavior is to direct selected subnet traffic to a nominated next-hop NVA address. User-defined route to virtual appliance is the direct configuration or deployment choice. Incorrect Answers B:This choice sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. It leaves the specific need to direct selected subnet traffic to a nominated next-hop NVA address unaddressed. C:This choice applies a defined user route collection to the workload subnet. It leaves the specific need to direct selected subnet traffic to a nominated next-hop NVA address unaddressed. D:This alternative applies a NAT Gateway's outbound SNAT behavior to a selected subnet, which solves a different networking task. It does not directly direct selected subnet traffic to a nominated next-hop NVA address.
Question 429 A label-based route configuration does not include a new VNet's prefixes. Which network component or setting is the best fit? Virtual WAN site-to-site VPN gateway Virtual WAN hub routing table association Virtual WAN hub VNet connection Virtual WAN route propagation and labels Explanation Correct Answer D:The intended behavior is to define which routes are advertised into selected hub route tables and connection groups. Virtual WAN route propagation and labels is the direct configuration or deployment choice. Incorrect Answers A:Although Virtual WAN site-to-site VPN gateway terminates VPN connections from branches within the managed virtual hub, that is not sufficient to define which routes are advertised into selected hub route tables and connection groups in this case. B:Although Virtual WAN hub routing table association controls which route table a hub connection uses for its forwarding decisions, that is not sufficient to define which routes are advertised into selected hub route tables and connection groups in this case. C:Virtual WAN hub VNet connection is useful when the goal is to attache a workload VNet to a managed virtual hub for connectivity and route propagation. Here, the required behavior is to define which routes are advertised into selected hub route tables and connection groups.
Question 430 Remote Windows and non-Windows clients need a common supported tunnel protocol. Which configuration should the team verify or implement first? P2S client-side authentication troubleshooting VPN client device deployment validation P2S OpenVPN protocol selection RADIUS authentication for P2S VPN Explanation Correct Answer C:This choice chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility. Incorrect Answers A:This alternative checks identity, certificates and local profile logs before changing gateway routes, which solves a different networking task. It does not directly choose a supported SSL/TLS-based VPN client protocol for broad client compatibility. B:This alternative validates supported OS, client version, tunnel profile and endpoint requirements, which solves a different networking task. It does not directly choose a supported SSL/TLS-based VPN client protocol for broad client compatibility. D:This choice uses an existing supported RADIUS server for VPN user authentication. It leaves the specific need to choose a supported SSL/TLS-based VPN client protocol for broad client compatibility unaddressed.
