Question 660 A legacy backend needs a URL prefix rewritten without changing application code. Which approach best satisfies the access or connectivity requirement? Application Gateway path-based routing rule Application Gateway custom health probe Application Gateway URL rewrite rule Application Gateway for regional HTTP routing Explanation Correct Answer C:The relevant action is Application Gateway URL rewrite rule: it modifies a supported request or response header or URL before upstream routing. Incorrect Answers A:This choice selects different backends based on URL path patterns. It leaves the specific need to modify a supported request or response header or URL before upstream routing unaddressed. B:Application Gateway custom health probe checks an application-specific path and expected response before including backends. The current problem instead requires a control that modifies a supported request or response header or URL before upstream routing. D:Application Gateway for regional HTTP routing is useful when the goal is to provide managed regional Layer 7 routing, TLS termination and web traffic distribution. Here, the required behavior is to modify a supported request or response header or URL before upstream routing.
Question 661 A Virtual WAN deployment has insufficient gateway capacity for new sites. Which network component or setting is the best fit? Virtual WAN hub routing table association Virtual WAN gateway scale-unit planning Virtual WAN virtual hub creation Virtual WAN site-to-site VPN gateway Explanation Correct Answer B:The relevant action is Virtual WAN gateway scale-unit planning: it sizes a managed virtual-hub gateway for required bandwidth and connections. Incorrect Answers A:Although Virtual WAN hub routing table association controls which route table a hub connection uses for its forwarding decisions, that is not sufficient to size a managed virtual-hub gateway for required bandwidth and connections in this case. C:That approach deploys a Microsoft-managed regional hub for connectivity, routing and gateway services; it does not replace Virtual WAN gateway scale-unit planning for the constraint in this scenario. D:This choice terminates VPN connections from branches within the managed virtual hub. It leaves the specific need to size a managed virtual-hub gateway for required bandwidth and connections unaddressed.
Question 662 Network architects need a subnet plan that will not collide with branch networks. What should the administrator change or deploy? Dedicated AzureBastionSubnet Address-prefix growth and readdress planning Address and subnet allocation inventory Nonoverlapping VNet CIDR planning Explanation Correct Answer D:This choice prevents address collisions between Azure networks and corporate routes. Incorrect Answers A:Although Dedicated AzureBastionSubnet reserves the specifically named subnet required for Azure Bastion, that is not sufficient to prevent address collisions between Azure networks and corporate routes in this case. B:That approach expands address capacity while managing dependencies and routing effects; it does not replace Nonoverlapping VNet CIDR planning for the constraint in this scenario. C:Address and subnet allocation inventory tracks CIDR ownership, free space and subnet relationships before deployment. The current problem instead requires a control that prevents address collisions between Azure networks and corporate routes.
Question 663 A threat intelligence policy appears to block a destination and engineers need evidence. Which implementation most directly resolves this requirement? Azure Firewall policy rule collection priority Azure Firewall Premium for TLS inspection Azure Firewall Policy across regions Firewall logs and threat intelligence monitoring Explanation Correct Answer D:Firewall logs and threat intelligence monitoring uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. Incorrect Answers A:Azure Firewall policy rule collection priority organizes matching firewall rules with correct ordering and actions. The current problem instead requires a control that uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. B:Azure Firewall Premium for TLS inspection is useful when the goal is to use the Premium tier's supported TLS inspection and advanced threat features. Here, the required behavior is to use firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic. C:That approach centralizes managed firewall settings and reusable rule collections; it does not replace Firewall logs and threat intelligence monitoring for the constraint in this scenario.
Question 664 FQDN network rules are unreliable because spoke clients and firewall resolve names differently. Which network component or setting is the best fit? Azure Firewall Manager for fleet governance Azure Firewall network rule Azure Firewall DNS proxy Azure Firewall application rule Explanation Correct Answer C:This choice provides centrally proxied DNS resolution for supported FQDN-based network policy. Incorrect Answers A:That approach manages and monitors multiple cloud firewalls and supported secure hubs centrally; it does not replace Azure Firewall DNS proxy for the constraint in this scenario. B:This alternative permits or denies supported IP-based TCP or UDP flows by addresses and ports, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy. D:This alternative applies FQDN- or application-aware outbound access controls for supported protocols, which solves a different networking task. It does not directly provide centrally proxied DNS resolution for supported FQDN-based network policy.
Question 665 The security team needs to attach a group to a single interface rather than the subnet. Which Azure networking capability should be selected? NSG rule priority and first-match evaluation ASG-based NSG access rule NSG network interface association NSG outbound rule destination and port Explanation Correct Answer C:The intended behavior is to apply additional instance-specific NSG rules to a selected network interface. NSG network interface association is the direct configuration or deployment choice. Incorrect Answers A:NSG rule priority and first-match evaluation ensures a more specific permitted or denied flow is evaluated in the intended priority order. The current problem instead requires a control that applies additional instance-specific NSG rules to a selected network interface. B:ASG-based NSG access rule references application security groups as source or destination in supported NSG rules. The current problem instead requires a control that applies additional instance-specific NSG rules to a selected network interface. D:This choice restricts workloads initiating network connections toward disallowed destinations. It leaves the specific need to apply additional instance-specific NSG rules to a selected network interface unaddressed.
Question 666 A legacy public URL must permanently redirect users to a replacement domain. What is the most appropriate next design decision? Front Door Rules Engine rewrite Front Door WAF policy association Azure Front Door global application delivery Front Door Rules Engine redirect Explanation Correct Answer D:Front Door Rules Engine redirect is appropriate because it returns an HTTP redirect to the client for an approved URL transformation. Incorrect Answers A:This choice changes the upstream URL path while the client's visible URL remains stable. It leaves the specific need to return an HTTP redirect to the client for an approved URL transformation unaddressed. B:Front Door WAF policy association applies supported application-layer rules at the globally distributed edge. The current problem instead requires a control that returns an HTTP redirect to the client for an approved URL transformation. C:Azure Front Door global application delivery provides globally distributed edge entry points with accelerated HTTP/S routing to origins. The current problem instead requires a control that returns an HTTP redirect to the client for an approved URL transformation.
Question 667 A WAF policy has no managed attack-rule set enabled for web exploits. Which network component or setting is the best fit? Managed WAF rule set selection WAF false-positive exclusion tuning Custom WAF rule for scoped conditions WAF on Application Gateway for regional web protection Explanation Correct Answer A:The intended behavior is to use a supported managed web attack signature rule set for common application threats. Managed WAF rule set selection is the direct configuration or deployment choice. Incorrect Answers B:This choice narrows a proven harmless match while retaining the remainder of managed protections. It leaves the specific need to use a supported managed web attack signature rule set for common application threats unaddressed. C:Custom WAF rule for scoped conditions matches an application-specific condition such as an approved IP, header or path and applies policy. The current problem instead requires a control that uses a supported managed web attack signature rule set for common application threats. D:WAF on Application Gateway for regional web protection inspects HTTP/S requests at a regional application gateway using supported WAF policies. The current problem instead requires a control that uses a supported managed web attack signature rule set for common application threats.
Question 668 An administrator must activate the NAT gateway on the private subnet holding the clients. What is the most defensible solution for this case? Route table association to subnet NAT Gateway subnet association User-defined route to virtual appliance NAT Gateway public IP allocation Explanation Correct Answer B:NAT Gateway subnet association applies a NAT Gateway's outbound SNAT behavior to a selected subnet. Incorrect Answers A:That approach applies a defined user route collection to the workload subnet; it does not replace NAT Gateway subnet association for the constraint in this scenario. C:User-defined route to virtual appliance directs selected subnet traffic to a nominated next-hop NVA address. The current problem instead requires a control that applies a NAT Gateway's outbound SNAT behavior to a selected subnet. D:NAT Gateway public IP allocation assigns supported public IP or public IP prefix resources to the gateway. The current problem instead requires a control that applies a NAT Gateway's outbound SNAT behavior to a selected subnet.
Question 669 An application subnet has a default Internet route but policy requires hub inspection. Which configuration should the team verify or implement first? User-defined route to virtual appliance Forced-tunnel default route design Effective routes and next-hop diagnosis Allow forwarded traffic on VNet peering Explanation Correct Answer B:This choice sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. Incorrect Answers A:User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. C:That approach reveals which system, BGP or user route determines an actual VM next hop; it does not replace Forced-tunnel default route design for the constraint in this scenario. D:Although Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate, that is not sufficient to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop in this case.
Question 670 A hybrid application requires both private DNS forwarding and network routes for Private Link. Which approach best satisfies the access or connectivity requirement? Private Endpoint DNS A-record integration Private Endpoint from on-premises via hybrid route Network-level connectivity prerequisite for remote Private Endpoints Private Endpoint peered-VNet reachability Explanation Correct Answer B:Private Endpoint from on-premises via hybrid route is appropriate because it uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Incorrect Answers A:Although Private Endpoint DNS A-record integration maps the service's normal FQDN to its private endpoint IP address for authorized clients, that is not sufficient to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint in this case. C:That approach requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP; it does not replace Private Endpoint from on-premises via hybrid route for the constraint in this scenario. D:Private Endpoint peered-VNet reachability is useful when the goal is to confirm peering, DNS zone links and security policies for clients in another VNet. Here, the required behavior is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint.
