Question 450 An inspected request reaches a destination spoke but its response bypasses the hub. Which approach best satisfies the access or connectivity requirement? VNet peering for private backbone connectivity Service chaining return-path validation Allow forwarded traffic on VNet peering Forced-tunnel default route design Explanation Correct Answer B:The intended behavior is to check both forward and return routing when traffic crosses a central firewall or appliance. Service chaining return-path validation is the direct configuration or deployment choice. Incorrect Answers A:This choice connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. It leaves the specific need to check both forward and return routing when traffic crosses a central firewall or appliance unaddressed. C:That approach permits forwarded packets between peered VNets through a hub appliance where appropriate; it does not replace Service chaining return-path validation for the constraint in this scenario. D:Forced-tunnel default route design sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. The current problem instead requires a control that checks both forward and return routing when traffic crosses a central firewall or appliance.
Question 451 An HTTP path containing versioned static files should use edge caching. Which configuration addresses the stated network constraint? Front Door caching configuration Front Door WAF policy association Front Door origin health probe Azure Front Door global application delivery Explanation Correct Answer A:The relevant action is Front Door caching configuration: it caches eligible static web responses at the global edge under explicit policy. Incorrect Answers B:This alternative applies supported application-layer rules at the globally distributed edge, which solves a different networking task. It does not directly cache eligible static web responses at the global edge under explicit policy. C:Although Front Door origin health probe checks origin availability from the edge to exclude unhealthy backends, that is not sufficient to cache eligible static web responses at the global edge under explicit policy in this case. D:Azure Front Door global application delivery is useful when the goal is to provide globally distributed edge entry points with accelerated HTTP/S routing to origins. Here, the required behavior is to cache eligible static web responses at the global edge under explicit policy.
Question 452 A DR test requires proving hybrid application access after disabling one provider connection. Which configuration should the team verify or implement first? ExpressRoute Global Reach ExpressRoute circuit provisioning ExpressRoute provider failover testing ExpressRoute private peering Explanation Correct Answer C:The relevant action is ExpressRoute provider failover testing: it validates routing and application failover across configured independent ExpressRoute paths. Incorrect Answers A:Although ExpressRoute Global Reach connects on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity, that is not sufficient to validate routing and application failover across configured independent ExpressRoute paths in this case. B:ExpressRoute circuit provisioning is useful when the goal is to create the provider-backed private connectivity circuit before linking Azure VNets. Here, the required behavior is to validate routing and application failover across configured independent ExpressRoute paths. D:Although ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit, that is not sufficient to validate routing and application failover across configured independent ExpressRoute paths in this case.
Question 453 A product team chooses service endpoints for an Azure service that does not advertise support. What should the team implement or correct? Service endpoint diagnostic separation Service endpoint unsupported-service review PaaS resource firewall VNet rule VNet service endpoint enablement Explanation Correct Answer B:The intended behavior is to verify whether the selected PaaS resource type supports service endpoints before planning access. Service endpoint unsupported-service review is the direct configuration or deployment choice. Incorrect Answers A:That approach checks source subnet configuration, resource firewall rules and actual service reachability; it does not replace Service endpoint unsupported-service review for the constraint in this scenario. C:PaaS resource firewall VNet rule permits the specified subnet at the target managed service after a service endpoint is enabled. The current problem instead requires a control that verifies whether the selected PaaS resource type supports service endpoints before planning access. D:This alternative extends selected Azure service routing and service identity from an approved VNet subnet, which solves a different networking task. It does not directly verify whether the selected PaaS resource type supports service endpoints before planning access.
Question 454 An outbound policy should permit a vendor domain without opening every Internet address. What is the most appropriate next design decision? Azure Firewall Standard for stateful filtering Azure Firewall application rule Azure Firewall DNS proxy Azure Firewall Policy across regions Explanation Correct Answer B:This choice applies FQDN- or application-aware outbound access controls for supported protocols. Incorrect Answers A:That approach provides managed stateful network and application filtering without Premium-only inspection; it does not replace Azure Firewall application rule for the constraint in this scenario. C:Azure Firewall DNS proxy is useful when the goal is to provide centrally proxied DNS resolution for supported FQDN-based network policy. Here, the required behavior is to apply FQDN- or application-aware outbound access controls for supported protocols. D:This choice centralizes managed firewall settings and reusable rule collections. It leaves the specific need to apply FQDN- or application-aware outbound access controls for supported protocols unaddressed.
Question 455 An organization needs ExpressRoute connectivity to supported Microsoft public-service endpoints. Which step best addresses this particular situation? ExpressRoute gateway on VNet Microsoft peering requirements on ExpressRoute ExpressRoute BGP prefix advertisement ExpressRoute private peering Explanation Correct Answer B:The intended behavior is to enable approved Microsoft service access over Microsoft peering rather than private VNet routes. Microsoft peering requirements on ExpressRoute is the direct configuration or deployment choice. Incorrect Answers A:ExpressRoute gateway on VNet is useful when the goal is to connect a VNet to an ExpressRoute circuit through the managed gateway. Here, the required behavior is to enable approved Microsoft service access over Microsoft peering rather than private VNet routes. C:This alternative exchanges approved on-premises routes over correct BGP peer sessions, which solves a different networking task. It does not directly enable approved Microsoft service access over Microsoft peering rather than private VNet routes. D:Although ExpressRoute private peering provides private routing to VNet private address spaces over an ExpressRoute circuit, that is not sufficient to enable approved Microsoft service access over Microsoft peering rather than private VNet routes in this case.
Question 456 A private storage endpoint exists but clients still resolve the public service address. Which Azure networking capability should be selected? DNS private endpoint record validation Azure private DNS zone Azure DNS Private Resolver outbound endpoint Private DNS zone VNet link Explanation Correct Answer A:DNS private endpoint record validation confirms private service FQDNs resolve to the intended private endpoint addresses. Incorrect Answers B:That approach stores DNS records visible through linked private-network resolution rather than public DNS; it does not replace DNS private endpoint record validation for the constraint in this scenario. C:This choice sends selected Azure DNS queries toward other DNS servers through managed forwarding. It leaves the specific need to confirm private service FQDNs resolve to the intended private endpoint addresses unaddressed. D:That approach permits a selected VNet's resolver to query records in a private DNS zone; it does not replace DNS private endpoint record validation for the constraint in this scenario.
Question 457 An instance responds to application traffic but is excluded because its health probe fails. Which implementation most directly resolves this requirement? Load Balancer inbound NAT rule Load Balancer health probe Internal Load Balancer frontend Traffic Manager endpoint health monitoring Explanation Correct Answer B:The intended behavior is to test a configured probe endpoint or port to determine eligible healthy backends. Load Balancer health probe is the direct configuration or deployment choice. Incorrect Answers A:Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port. The current problem instead requires a control that tests a configured probe endpoint or port to determine eligible healthy backends. C:This choice exposes a private VNet IP address for a load-balanced service rather than a public endpoint. It leaves the specific need to test a configured probe endpoint or port to determine eligible healthy backends unaddressed. D:This choice uses endpoint status probes to determine which DNS endpoints remain eligible. It leaves the specific need to test a configured probe endpoint or port to determine eligible healthy backends unaddressed.
Question 458 A developer creates a Private Endpoint in one VNet and assumes that this connects an unrelated partner VNet. What must be configured to provide VNet-to-VNet traffic reachability? Private Endpoint DNS A-record integration Private Endpoint approval workflow Establish authorized VNet peering or another supported network route between the VNets Private Endpoint from on-premises via hybrid route Explanation Correct Answer C:The partner network needs a valid inter-VNet route, such as authorized VNet peering, before private IP packets can reach the endpoint VNet. Incorrect Answers A:Private DNS alone resolves a service name but supplies no transport route from the partner VNet. B:Approving a Private Endpoint connection authorizes that service link, not connectivity between two VNets. D:Hybrid on-premises Private Endpoint routing addresses remote-site access; it does not itself connect unrelated Azure VNets.
Question 459 A new caching rule must avoid caching personalized responses. What action most directly addresses the documented failure? Front Door WAF policy association Front Door end-to-end TLS Front Door caching configuration Front Door Private Link to supported origin Explanation Correct Answer C:Front Door caching configuration is appropriate because it caches eligible static web responses at the global edge under explicit policy. Incorrect Answers A:Although Front Door WAF policy association applies supported application-layer rules at the globally distributed edge, that is not sufficient to cache eligible static web responses at the global edge under explicit policy in this case. B:That approach protects client-to-edge and edge-to-origin traffic with compatible HTTPS settings; it does not replace Front Door caching configuration for the constraint in this scenario. D:Front Door Private Link to supported origin connects an eligible Front Door Premium origin privately without exposing it broadly. The current problem instead requires a control that caches eligible static web responses at the global edge under explicit policy.
Question 460 A team attached an NSG to one NIC but new VMs on the subnet are not covered by that association. What is the most defensible solution for this case? VNet flow log collection NSG subnet association Application Security Group membership NSG network interface association Explanation Correct Answer B:The relevant action is NSG subnet association: it applies a network security group to all eligible network interfaces in a selected subnet. Incorrect Answers A:This choice captures supported virtual network flow data for operational and security analysis. It leaves the specific need to apply a network security group to all eligible network interfaces in a selected subnet unaddressed. C:Application Security Group membership groups VM interfaces by application role for NSG rule targeting. The current problem instead requires a control that applies a network security group to all eligible network interfaces in a selected subnet. D:This choice applies additional instance-specific NSG rules to a selected network interface. It leaves the specific need to apply a network security group to all eligible network interfaces in a selected subnet unaddressed.
