Question 50 A tunnel establishes only for one subnet pair and fixed selector configuration needs review. Which choice matches the specific technical condition? Policy-based traffic-selector compatibility On-premises VPN device policy matching Route-based site-to-site VPN gateway S2S peer public IP change procedure Explanation Correct Answer A:The relevant action is Policy-based traffic-selector compatibility: it handles a restricted legacy VPN peer that relies on specific address selectors. Incorrect Answers B:This alternative aligns corporate firewall route, access and selector rules with Azure connection design, which solves a different networking task. It does not directly handle a restricted legacy VPN peer that relies on specific address selectors. C:Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. The current problem instead requires a control that handles a restricted legacy VPN peer that relies on specific address selectors. D:S2S peer public IP change procedure updates peer and local network gateway settings together during a branch cutover. The current problem instead requires a control that handles a restricted legacy VPN peer that relies on specific address selectors.
Question 51 An attack surface review must prioritize multi-hop paths rather than isolated findings. Which approach best satisfies the access or connectivity requirement? Network Watcher next hop Cloud Security Explorer asset queries Defender for Cloud Secure Score recommendations Defender for Cloud attack-path analysis Explanation Correct Answer D:Defender for Cloud attack-path analysis is appropriate because it identifies exploitable attack paths that connect exposure and privilege to important assets. Incorrect Answers A:Although Network Watcher next hop determines a VM's effective route and next-hop category to a destination, that is not sufficient to identify exploitable attack paths that connect exposure and privilege to important assets in this case. B:This alternative searches security and resource context to find network assets matching risk conditions, which solves a different networking task. It does not directly identify exploitable attack paths that connect exposure and privilege to important assets. C:Defender for Cloud Secure Score recommendations prioritizes cloud security posture findings including exposed network resources. The current problem instead requires a control that identifies exploitable attack paths that connect exposure and privilege to important assets.
Question 52 A performance test reports packet throughput limits at the current virtual-hub gateway tier. Which configuration should the team verify or implement first? Virtual WAN virtual hub creation Virtual WAN site-to-site VPN gateway Virtual WAN gateway scale-unit planning Virtual WAN hub VNet connection Explanation Correct Answer C:The intended behavior is to size a managed virtual-hub gateway for required bandwidth and connections. Virtual WAN gateway scale-unit planning is the direct configuration or deployment choice. Incorrect Answers A:Although Virtual WAN virtual hub creation deploys a Microsoft-managed regional hub for connectivity, routing and gateway services, that is not sufficient to size a managed virtual-hub gateway for required bandwidth and connections in this case. B:That approach terminates VPN connections from branches within the managed virtual hub; it does not replace Virtual WAN gateway scale-unit planning for the constraint in this scenario. D:This alternative attaches a workload VNet to a managed virtual hub for connectivity and route propagation, which solves a different networking task. It does not directly size a managed virtual-hub gateway for required bandwidth and connections.
Question 53 A hybrid engineer is updating the local network gateway after a site address change. Which Azure control would meet the operational need? On-premises VPN device policy matching Local network gateway configuration S2S peer public IP change procedure BGP route advertisement on VPN Explanation Correct Answer B:Local network gateway configuration records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. Incorrect Answers A:On-premises VPN device policy matching aligns corporate firewall route, access and selector rules with Azure connection design. The current problem instead requires a control that records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. C:Although S2S peer public IP change procedure updates peer and local network gateway settings together during a branch cutover, that is not sufficient to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection in this case. D:This alternative exchanges dynamic network prefixes over a supported route-based VPN configuration, which solves a different networking task. It does not directly record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection.
Question 54 Branch offices need to reach a SQL private endpoint over an existing ExpressRoute connection. What is the most defensible solution for this case? Network-level connectivity prerequisite for remote Private Endpoints Private Endpoint from on-premises via hybrid route Private Endpoint hostname-specific TLS handling Private Endpoint DNS A-record integration Explanation Correct Answer B:The intended behavior is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Private Endpoint from on-premises via hybrid route is the direct configuration or deployment choice. Incorrect Answers A:This alternative requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP, which solves a different networking task. It does not directly use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. C:Private Endpoint hostname-specific TLS handling uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients. The current problem instead requires a control that uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. D:This alternative maps the service's normal FQDN to its private endpoint IP address for authorized clients, which solves a different networking task. It does not directly use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint.
Question 55 A web team needs to configure HTTPS on the proxy frontend, not just the VM servers. Which choice matches the specific technical condition? Application Gateway HTTP listener Application Gateway end-to-end TLS Application Gateway TLS termination Application Gateway for regional HTTP routing Explanation Correct Answer C:The intended behavior is to terminate client HTTPS on the gateway with the appropriate certificate and listener. Application Gateway TLS termination is the direct configuration or deployment choice. Incorrect Answers A:This choice matches incoming protocol, port and optional host name before routing requests. It leaves the specific need to terminate client HTTPS on the gateway with the appropriate certificate and listener unaddressed. B:Although Application Gateway end-to-end TLS re-encrypts or retains HTTPS between the gateway and validated backend endpoints, that is not sufficient to terminate client HTTPS on the gateway with the appropriate certificate and listener in this case. D:Application Gateway for regional HTTP routing provides managed regional Layer 7 routing, TLS termination and web traffic distribution. The current problem instead requires a control that terminates client HTTPS on the gateway with the appropriate certificate and listener.
Question 56 An auditor must evaluate how NSG priorities determine first matching action. Which configuration should the team verify or implement first? Azure Virtual Network Manager security admin policy NSG rule priority and first-match evaluation IP flow verify for NSG traffic decision VNet flow log collection Explanation Correct Answer B:NSG rule priority and first-match evaluation is appropriate because it ensures a more specific permitted or denied flow is evaluated in the intended priority order. Incorrect Answers A:This alternative governs supported high-priority security admin rules across centrally managed VNets, which solves a different networking task. It does not directly ensure a more specific permitted or denied flow is evaluated in the intended priority order. C:This choice tests a specified source/destination/port and reports the allowing or blocking NSG rule. It leaves the specific need to ensure a more specific permitted or denied flow is evaluated in the intended priority order unaddressed. D:This alternative captures supported virtual network flow data for operational and security analysis, which solves a different networking task. It does not directly ensure a more specific permitted or denied flow is evaluated in the intended priority order.
Question 57 A site migrates its /billing section to a dedicated application server group. Which Azure control would meet the operational need? Application Gateway custom health probe Application Gateway URL rewrite rule Application Gateway multi-site routing Application Gateway path-based routing rule Explanation Correct Answer D:Application Gateway path-based routing rule selects different backends based on URL path patterns. Incorrect Answers A:Although Application Gateway custom health probe checks an application-specific path and expected response before including backends, that is not sufficient to select different backends based on URL path patterns in this case. B:This choice modifies a supported request or response header or URL before upstream routing. It leaves the specific need to select different backends based on URL path patterns unaddressed. C:Application Gateway multi-site routing uses host-based listeners to select application backends for different domain names. The current problem instead requires a control that selects different backends based on URL path patterns.
Question 58 An Azure service firewall should use trusted subnet identity over the Azure backbone. Which implementation most directly resolves this requirement? VNet service endpoint enablement PaaS resource firewall VNet rule Service endpoint public address distinction Service endpoint policy subnet binding Explanation Correct Answer A:VNet service endpoint enablement is appropriate because it extends selected Azure service routing and service identity from an approved VNet subnet. Incorrect Answers B:PaaS resource firewall VNet rule permits the specified subnet at the target managed service after a service endpoint is enabled. The current problem instead requires a control that extends selected Azure service routing and service identity from an approved VNet subnet. C:Service endpoint public address distinction retains public service endpoint addressing while changing private subnet routing and service firewall identity. The current problem instead requires a control that extends selected Azure service routing and service identity from an approved VNet subnet. D:Service endpoint policy subnet binding is useful when the goal is to associate an approved service endpoint policy with the intended endpoint-enabled workload subnet. Here, the required behavior is to extend selected Azure service routing and service identity from an approved VNet subnet.
Question 59 An active-active VPN design requires BGP peer addresses for two connections. What should the administrator change or deploy? BGP route advertisement on VPN Route-based site-to-site VPN gateway On-premises VPN device policy matching Local network gateway configuration Explanation Correct Answer A:This choice exchanges dynamic network prefixes over a supported route-based VPN configuration. Incorrect Answers B:Although Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device, that is not sufficient to exchange dynamic network prefixes over a supported route-based VPN configuration in this case. C:On-premises VPN device policy matching is useful when the goal is to align corporate firewall route, access and selector rules with Azure connection design. Here, the required behavior is to exchange dynamic network prefixes over a supported route-based VPN configuration. D:Local network gateway configuration records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. The current problem instead requires a control that exchanges dynamic network prefixes over a supported route-based VPN configuration.
Question 60 An audit must confirm Azure Firewall is isolated in its own required subnet. Which configuration should the team verify or implement first? Azure Firewall Basic for simple network filtering AzureFirewallSubnet deployment prerequisite Secure Virtual WAN hub with Azure Firewall Azure Firewall application rule Explanation Correct Answer B:AzureFirewallSubnet deployment prerequisite places Azure Firewall in its designated subnet with the required supported size. Incorrect Answers A:Azure Firewall Basic for simple network filtering fits eligible smaller workloads when advanced throughput and security features are not required. The current problem instead requires a control that places Azure Firewall in its designated subnet with the required supported size. C:This alternative deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection, which solves a different networking task. It does not directly place Azure Firewall in its designated subnet with the required supported size. D:This choice applies FQDN- or application-aware outbound access controls for supported protocols. It leaves the specific need to place Azure Firewall in its designated subnet with the required supported size unaddressed.
