Question 620 The asset inventory needs to locate resources sharing an exposed configuration pattern. Which implementation most directly resolves this requirement? Azure Monitor network resource metrics Defender for Cloud attack-path analysis Cloud Security Explorer asset queries Network Watcher effective security rules Explanation Correct Answer C:The relevant action is Cloud Security Explorer asset queries: it searches security and resource context to find network assets matching risk conditions. Incorrect Answers A:Azure Monitor network resource metrics collects performance and health signals for Azure networking resources. The current problem instead requires a control that searches security and resource context to find network assets matching risk conditions. B:Defender for Cloud attack-path analysis is useful when the goal is to identify exploitable attack paths that connect exposure and privilege to important assets. Here, the required behavior is to searche security and resource context to find network assets matching risk conditions. D:Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to searche security and resource context to find network assets matching risk conditions in this case.
Question 621 A backend migration replaces NICs and needs correct pool membership associations. Which change should the network engineer make? Load Balancer load-balancing rule Load Balancer inbound NAT rule Load Balancer backend pool membership Regional Azure Load Balancer for L4 traffic Explanation Correct Answer C:The intended behavior is to select the intended backend network interfaces or IPs that receive distributed traffic. Load Balancer backend pool membership is the direct configuration or deployment choice. Incorrect Answers A:Although Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections, that is not sufficient to select the intended backend network interfaces or IPs that receive distributed traffic in this case. B:This choice maps a selected frontend IP and port to an individual backend VM and port. It leaves the specific need to select the intended backend network interfaces or IPs that receive distributed traffic unaddressed. D:Regional Azure Load Balancer for L4 traffic distributes TCP or UDP flows to healthy backend instances in an Azure region. The current problem instead requires a control that selects the intended backend network interfaces or IPs that receive distributed traffic.
Question 622 A corporate DNS server needs a reachable target in Azure for conditional forwarding. What is the most defensible solution for this case? Azure DNS Private Resolver inbound endpoint Azure DNS Private Resolver outbound endpoint Azure private DNS zone Azure DNS public zone delegation Explanation Correct Answer A:This choice accepts DNS queries arriving from on-premises or connected networks into Azure resolution. Incorrect Answers B:Azure DNS Private Resolver outbound endpoint sends selected Azure DNS queries toward other DNS servers through managed forwarding. The current problem instead requires a control that accepts DNS queries arriving from on-premises or connected networks into Azure resolution. C:This choice stores DNS records visible through linked private-network resolution rather than public DNS. It leaves the specific need to accept DNS queries arriving from on-premises or connected networks into Azure resolution unaddressed. D:Azure DNS public zone delegation is useful when the goal is to host authoritative public DNS records under an internet-resolvable zone. Here, the required behavior is to accept DNS queries arriving from on-premises or connected networks into Azure resolution.
Question 623 An internet service needs advanced DDoS protection beyond built-in infrastructure safeguards. Which Azure control would meet the operational need? Azure DDoS Protection deployment Network Watcher effective security rules Network Watcher connection troubleshoot Azure Monitor network resource metrics Explanation Correct Answer A:Azure DDoS Protection deployment adds managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses. Incorrect Answers B:This choice lists the combined network security rules effective on an Azure VM interface. It leaves the specific need to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses unaddressed. C:This choice tests end-to-end reachability, latency and network obstacles between source and destination. It leaves the specific need to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses unaddressed. D:This choice collects performance and health signals for Azure networking resources. It leaves the specific need to add managed enhanced DDoS mitigation and telemetry for protected virtual network public addresses unaddressed.
Question 624 The on-premises appliance is replaced and Azure still targets the retired IP. What action most directly addresses the documented failure? Local network gateway configuration S2S peer public IP change procedure Policy-based traffic-selector compatibility S2S reachability verification beyond tunnel state Explanation Correct Answer B:This choice updates peer and local network gateway settings together during a branch cutover. Incorrect Answers A:This alternative records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, which solves a different networking task. It does not directly update peer and local network gateway settings together during a branch cutover. C:Although Policy-based traffic-selector compatibility handles a restricted legacy VPN peer that relies on specific address selectors, that is not sufficient to update peer and local network gateway settings together during a branch cutover in this case. D:S2S reachability verification beyond tunnel state validates routing, NSGs and return paths after IPsec reports connected. The current problem instead requires a control that updates peer and local network gateway settings together during a branch cutover.
Question 625 A gateway configuration change requires users to download an updated VPN profile. Which change should the network engineer make? VPN client device deployment validation P2S client-side authentication troubleshooting P2S route distribution to clients P2S VPN client profile generation Explanation Correct Answer D:P2S VPN client profile generation is appropriate because it delivers the correct gateway endpoints, routes and authentication settings to client devices. Incorrect Answers A:VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements. The current problem instead requires a control that delivers the correct gateway endpoints, routes and authentication settings to client devices. B:P2S client-side authentication troubleshooting is useful when the goal is to check identity, certificates and local profile logs before changing gateway routes. Here, the required behavior is to deliver the correct gateway endpoints, routes and authentication settings to client devices. C:P2S route distribution to clients is useful when the goal is to advertise or includes the correct private destination prefixes in remote-user VPN profiles. Here, the required behavior is to deliver the correct gateway endpoints, routes and authentication settings to client devices.
Question 626 A team mistakenly tries to use a traditional VNet gateway inside a Virtual WAN hub. What action most directly addresses the documented failure? Virtual WAN gateway scale-unit planning Standard Virtual WAN for advanced transit Virtual WAN site-to-site VPN gateway Virtual WAN secure hub with Azure Firewall Explanation Correct Answer C:The relevant action is Virtual WAN site-to-site VPN gateway: it terminates VPN connections from branches within the managed virtual hub. Incorrect Answers A:This alternative sizes a managed virtual-hub gateway for required bandwidth and connections, which solves a different networking task. It does not directly terminate VPN connections from branches within the managed virtual hub. B:That approach supports site-to-site, point-to-site, ExpressRoute and transitive VNet hubs in one managed topology; it does not replace Virtual WAN site-to-site VPN gateway for the constraint in this scenario. D:This alternative integrates managed central security inspection into a Virtual WAN virtual hub, which solves a different networking task. It does not directly terminate VPN connections from branches within the managed virtual hub.
Question 627 A BGP advertisement appears to override expected system routes. Which choice matches the specific technical condition? Azure Route Server for BGP exchange Route table association to subnet Effective routes and next-hop diagnosis VNet peering for private backbone connectivity Explanation Correct Answer C:Effective routes and next-hop diagnosis reveals which system, BGP or user route determines an actual VM next hop. Incorrect Answers A:That approach exchanges dynamic routes with supported network virtual appliances over BGP; it does not replace Effective routes and next-hop diagnosis for the constraint in this scenario. B:This choice applies a defined user route collection to the workload subnet. It leaves the specific need to reveal which system, BGP or user route determines an actual VM next hop unaddressed. D:VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. The current problem instead requires a control that reveals which system, BGP or user route determines an actual VM next hop.
Question 628 A web farm requires request-level routing and HTTP health probes within one region. Which Azure control would meet the operational need? Application Gateway TLS termination Application Gateway for regional HTTP routing Application Gateway HTTP listener Application Gateway path-based routing rule Explanation Correct Answer B:Application Gateway for regional HTTP routing provides managed regional Layer 7 routing, TLS termination and web traffic distribution. Incorrect Answers A:Application Gateway TLS termination is useful when the goal is to terminate client HTTPS on the gateway with the appropriate certificate and listener. Here, the required behavior is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. C:Application Gateway HTTP listener is useful when the goal is to match incoming protocol, port and optional host name before routing requests. Here, the required behavior is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. D:This alternative selects different backends based on URL path patterns, which solves a different networking task. It does not directly provide managed regional Layer 7 routing, TLS termination and web traffic distribution.
Question 629 Traffic forwarded by a central NVA does not traverse a peering as expected. What is the most appropriate next design decision? Private DNS zone access for peered VNets VNet address-space peering sync Allow forwarded traffic on VNet peering Gateway transit on hub peering Explanation Correct Answer C:This choice permits forwarded packets between peered VNets through a hub appliance where appropriate. Incorrect Answers A:Private DNS zone access for peered VNets is useful when the goal is to link the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution. Here, the required behavior is to permit forwarded packets between peered VNets through a hub appliance where appropriate. B:VNet address-space peering sync updates peering awareness after VNet address-space changes. The current problem instead requires a control that permits forwarded packets between peered VNets through a hub appliance where appropriate. D:This alternative lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway, which solves a different networking task. It does not directly permit forwarded packets between peered VNets through a hub appliance where appropriate.
Question 630 A branch-to-spoke transit design should route through a secure managed virtual hub. Which implementation most directly resolves this requirement? Secure Virtual WAN hub with Azure Firewall Azure Firewall Standard for stateful filtering Azure Firewall Premium for TLS inspection AzureFirewallSubnet deployment prerequisite Explanation Correct Answer A:The intended behavior is to deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. Secure Virtual WAN hub with Azure Firewall is the direct configuration or deployment choice. Incorrect Answers B:This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. C:This choice uses the Premium tier's supported TLS inspection and advanced threat features. It leaves the specific need to deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection unaddressed. D:AzureFirewallSubnet deployment prerequisite places Azure Firewall in its designated subnet with the required supported size. The current problem instead requires a control that deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection.
