Question 440 A provider-based small circuit cannot satisfy a required dedicated-port connectivity design. Which choice matches the specific technical condition? Microsoft peering requirements on ExpressRoute ExpressRoute Direct ExpressRoute circuit bandwidth and SKU design ExpressRoute private peering Explanation Correct Answer B:This choice provides dedicated high-capacity direct ports at a supported peering location. Incorrect Answers A:Microsoft peering requirements on ExpressRoute is useful when the goal is to enable approved Microsoft service access over Microsoft peering rather than private VNet routes. Here, the required behavior is to provide dedicated high-capacity direct ports at a supported peering location. C:This choice selects supported capacity, metering and reach based on enterprise traffic needs. It leaves the specific need to provide dedicated high-capacity direct ports at a supported peering location unaddressed. D:Although ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit, that is not sufficient to provide dedicated high-capacity direct ports at a supported peering location in this case.
Question 441 A NAT gateway resource exists but VMs in the target subnet still use another outbound path. Which choice matches the specific technical condition? NAT Gateway subnet association NAT Gateway for predictable outbound SNAT NAT Gateway public IP allocation Route table association to subnet Explanation Correct Answer A:NAT Gateway subnet association applies a NAT Gateway's outbound SNAT behavior to a selected subnet. Incorrect Answers B:NAT Gateway for predictable outbound SNAT is useful when the goal is to provide scalable managed outbound connectivity for private subnet workloads. Here, the required behavior is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet. C:NAT Gateway public IP allocation assigns supported public IP or public IP prefix resources to the gateway. The current problem instead requires a control that applies a NAT Gateway's outbound SNAT behavior to a selected subnet. D:Route table association to subnet is useful when the goal is to apply a defined user route collection to the workload subnet. Here, the required behavior is to apply a NAT Gateway's outbound SNAT behavior to a selected subnet.
Question 442 An application team asks whether blocked requests were prevented by WAF or denied upstream. What is the most appropriate next design decision? WAF policy association to listener or domain WAF on Application Gateway for regional web protection Managed WAF rule set selection WAF diagnostic logging and investigation Explanation Correct Answer D:WAF diagnostic logging and investigation is appropriate because it correlates WAF rule IDs, policy actions and client requests to investigate web filtering. Incorrect Answers A:WAF policy association to listener or domain is useful when the goal is to bind the WAF policy to the supported application gateway listener or edge domain. Here, the required behavior is to correlate WAF rule IDs, policy actions and client requests to investigate web filtering. B:This alternative inspects HTTP/S requests at a regional application gateway using supported WAF policies, which solves a different networking task. It does not directly correlate WAF rule IDs, policy actions and client requests to investigate web filtering. C:Managed WAF rule set selection is useful when the goal is to use a supported managed web attack signature rule set for common application threats. Here, the required behavior is to correlate WAF rule IDs, policy actions and client requests to investigate web filtering.
Question 443 The Azure Storage account firewall already allows a specific application subnet, but the subnet has no Microsoft.Storage service endpoint enabled. The design retains Storage public endpoint addressing. Which missing subnet feature should the administrator enable? Service endpoint policy subnet binding Service endpoint public address distinction Service endpoint unsupported-service review VNet service endpoint enablement Explanation Correct Answer D:Enabling the Microsoft.Storage virtual network service endpoint on that subnet establishes the requested subnet-based service access path. Incorrect Answers A:Service endpoint policy binding further restricts which Storage accounts a subnet may use; it is optional and does not fix the missing base service endpoint enablement in this case. B:The fact that the Storage FQDN retains a public address explains service endpoint behavior, but it is not the missing configuration action. C:The selected Microsoft.Storage service supports service endpoints, so checking other unsupported services is not the remedy.
Question 444 A small single-VNet lab needs the default Azure resolver rather than dedicated servers. Which change should the network engineer make? Azure DNS public zone delegation Azure DNS Private Resolver outbound endpoint Private DNS zone VNet link Azure-provided DNS for VNet hostnames Explanation Correct Answer D:Azure-provided DNS for VNet hostnames resolves supported internal hostnames using default Azure DNS within a VNet. Incorrect Answers A:This alternative hosts authoritative public DNS records under an internet-resolvable zone, which solves a different networking task. It does not directly resolve supported internal hostnames using default Azure DNS within a VNet. B:Azure DNS Private Resolver outbound endpoint is useful when the goal is to send selected Azure DNS queries toward other DNS servers through managed forwarding. Here, the required behavior is to resolve supported internal hostnames using default Azure DNS within a VNet. C:This choice permits a selected VNet's resolver to query records in a private DNS zone. It leaves the specific need to resolve supported internal hostnames using default Azure DNS within a VNet unaddressed.
Question 445 New corporate network ranges fail to appear in Azure after being added to the branch router. Which configuration should the team verify or implement first? Active-active VPN gateway design Route-based site-to-site VPN gateway Local network gateway configuration BGP route advertisement on VPN Explanation Correct Answer D:The relevant action is BGP route advertisement on VPN: it exchanges dynamic network prefixes over a supported route-based VPN configuration. Incorrect Answers A:Active-active VPN gateway design is useful when the goal is to use multiple gateway instances and connections for supported VPN link resiliency. Here, the required behavior is to exchange dynamic network prefixes over a supported route-based VPN configuration. B:This alternative supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device, which solves a different networking task. It does not directly exchange dynamic network prefixes over a supported route-based VPN configuration. C:This alternative records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, which solves a different networking task. It does not directly exchange dynamic network prefixes over a supported route-based VPN configuration.
Question 446 A two-node fleet requires different external management ports translated to each VM. What is the most defensible solution for this case? Load Balancer health probe Load Balancer load-balancing rule Internal Load Balancer frontend Load Balancer inbound NAT rule Explanation Correct Answer D:Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port. Incorrect Answers A:This choice tests a configured probe endpoint or port to determine eligible healthy backends. It leaves the specific need to map a selected frontend IP and port to an individual backend VM and port unaddressed. B:Although Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections, that is not sufficient to map a selected frontend IP and port to an individual backend VM and port in this case. C:That approach exposes a private VNet IP address for a load-balanced service rather than a public endpoint; it does not replace Load Balancer inbound NAT rule for the constraint in this scenario.
Question 447 An application reports outages although DNS traffic distribution profile exists. Which choice matches the specific technical condition? Load Balancer health probe Traffic Manager endpoint health monitoring Internal Load Balancer frontend Azure Traffic Manager DNS routing Explanation Correct Answer B:The relevant action is Traffic Manager endpoint health monitoring: it uses endpoint status probes to determine which DNS endpoints remain eligible. Incorrect Answers A:That approach tests a configured probe endpoint or port to determine eligible healthy backends; it does not replace Traffic Manager endpoint health monitoring for the constraint in this scenario. C:Although Internal Load Balancer frontend exposes a private VNet IP address for a load-balanced service rather than a public endpoint, that is not sufficient to use endpoint status probes to determine which DNS endpoints remain eligible in this case. D:Azure Traffic Manager DNS routing is useful when the goal is to choose between geographically distributed public endpoints through DNS responses. Here, the required behavior is to use endpoint status probes to determine which DNS endpoints remain eligible.
Question 448 Multiple peered VNets can already reach a shared Private Endpoint IP, but only the hub VNet resolves the service FQDN privately; clients in the other VNets receive the public address. What configuration is missing? Set up an on-premises VPN even though the clients are already in peered Azure VNets Link the appropriate Private DNS zone to the consumer VNets or use an approved central resolver forwarding path Create a new Private Endpoint for every client VM instead of sharing the approved endpoint Change the target storage subresource although the approved endpoint already serves the correct resource Explanation Correct Answer B:The consumer VNets must resolve the service FQDN to the shared Private Endpoint private IP through zone links or a supported resolver forwarding configuration. Incorrect Answers A:A VPN to a remote site does not fix DNS resolution for Azure VNet clients that already have routed private IP reachability. C:One private endpoint can serve authorized clients in peered VNets when connectivity and DNS are correct; one per client VM is unnecessary. D:Changing the connected subresource does not supply missing DNS-zone visibility to additional VNets.
Question 449 Network operations need to adjust where learned VPN and ExpressRoute routes propagate. Which implementation most directly resolves this requirement? Virtual WAN gateway scale-unit planning Virtual WAN route propagation and labels Virtual WAN hub VNet connection Virtual WAN hub routing table association Explanation Correct Answer B:Virtual WAN route propagation and labels defines which routes are advertised into selected hub route tables and connection groups. Incorrect Answers A:This alternative sizes a managed virtual-hub gateway for required bandwidth and connections, which solves a different networking task. It does not directly define which routes are advertised into selected hub route tables and connection groups. C:This alternative attaches a workload VNet to a managed virtual hub for connectivity and route propagation, which solves a different networking task. It does not directly define which routes are advertised into selected hub route tables and connection groups. D:Virtual WAN hub routing table association controls which route table a hub connection uses for its forwarding decisions. The current problem instead requires a control that defines which routes are advertised into selected hub route tables and connection groups.
Question 450 An inspected request reaches a destination spoke but its response bypasses the hub. Which approach best satisfies the access or connectivity requirement? VNet peering for private backbone connectivity Service chaining return-path validation Allow forwarded traffic on VNet peering Forced-tunnel default route design Explanation Correct Answer B:The intended behavior is to check both forward and return routing when traffic crosses a central firewall or appliance. Service chaining return-path validation is the direct configuration or deployment choice. Incorrect Answers A:This choice connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. It leaves the specific need to check both forward and return routing when traffic crosses a central firewall or appliance unaddressed. C:That approach permits forwarded packets between peered VNets through a hub appliance where appropriate; it does not replace Service chaining return-path validation for the constraint in this scenario. D:Forced-tunnel default route design sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. The current problem instead requires a control that checks both forward and return routing when traffic crosses a central firewall or appliance.
