Question 670 A hybrid application requires both private DNS forwarding and network routes for Private Link. Which approach best satisfies the access or connectivity requirement? Private Endpoint DNS A-record integration Private Endpoint from on-premises via hybrid route Network-level connectivity prerequisite for remote Private Endpoints Private Endpoint peered-VNet reachability Explanation Correct Answer B:Private Endpoint from on-premises via hybrid route is appropriate because it uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Incorrect Answers A:Although Private Endpoint DNS A-record integration maps the service's normal FQDN to its private endpoint IP address for authorized clients, that is not sufficient to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint in this case. C:That approach requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP; it does not replace Private Endpoint from on-premises via hybrid route for the constraint in this scenario. D:Private Endpoint peered-VNet reachability is useful when the goal is to confirm peering, DNS zone links and security policies for clients in another VNet. Here, the required behavior is to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint.
Question 671 A load balancer exists yet clients cannot reach the intended backend listener port. What action most directly addresses the documented failure? Load Balancer backend pool membership Load Balancer inbound NAT rule Cross-region Azure Load Balancer design Load Balancer load-balancing rule Explanation Correct Answer D:Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections. Incorrect Answers A:Although Load Balancer backend pool membership selects the intended backend network interfaces or IPs that receive distributed traffic, that is not sufficient to define a frontend protocol/port and backend pool mapping for distributed connections in this case. B:Although Load Balancer inbound NAT rule maps a selected frontend IP and port to an individual backend VM and port, that is not sufficient to define a frontend protocol/port and backend pool mapping for distributed connections in this case. C:This choice uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. It leaves the specific need to define a frontend protocol/port and backend pool mapping for distributed connections unaddressed.
Question 672 An inspected flow returning through the hub fails due to peering forwarded-traffic settings. Which choice matches the specific technical condition? User-defined route to virtual appliance Private DNS zone access for peered VNets Allow forwarded traffic on VNet peering Gateway transit on hub peering Explanation Correct Answer C:Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. Incorrect Answers A:Although User-defined route to virtual appliance directs selected subnet traffic to a nominated next-hop NVA address, that is not sufficient to permit forwarded packets between peered VNets through a hub appliance where appropriate in this case. B:This alternative links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution, which solves a different networking task. It does not directly permit forwarded packets between peered VNets through a hub appliance where appropriate. D:Although Gateway transit on hub peering lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway, that is not sufficient to permit forwarded packets between peered VNets through a hub appliance where appropriate in this case.
Question 673 Operations needs ongoing latency observations between a branch and Azure workload. Which Azure networking capability should be selected? Network Watcher IP flow verify Network Watcher connection troubleshoot Azure Monitor network resource metrics Network Watcher connection monitor Explanation Correct Answer D:The relevant action is Network Watcher connection monitor: it continuously tracks network reachability and performance between configured endpoints. Incorrect Answers A:Network Watcher IP flow verify identifies an NSG rule that allows or denies a specified VM traffic flow. The current problem instead requires a control that continuously tracks network reachability and performance between configured endpoints. B:That approach tests end-to-end reachability, latency and network obstacles between source and destination; it does not replace Network Watcher connection monitor for the constraint in this scenario. C:That approach collects performance and health signals for Azure networking resources; it does not replace Network Watcher connection monitor for the constraint in this scenario.
Question 674 Governance needs consistent network security administration at scale rather than one-off subnet rules. Which configuration should the team verify or implement first? Azure Virtual Network Manager security admin rules Azure Virtual Network Manager connectivity groups User-defined route to virtual appliance VNet peering for private backbone connectivity Explanation Correct Answer A:Azure Virtual Network Manager security admin rules is appropriate because it centrally enforces supported security policies across network groups before workload NSGs. Incorrect Answers B:This choice centrally coordinates VNet connectivity topology across many subscriptions. It leaves the specific need to centrally enforce supported security policies across network groups before workload NSGs unaddressed. C:User-defined route to virtual appliance directs selected subnet traffic to a nominated next-hop NVA address. The current problem instead requires a control that centrally enforces supported security policies across network groups before workload NSGs. D:VNet peering for private backbone connectivity is useful when the goal is to connect two Azure virtual networks over the Microsoft backbone without a VPN appliance. Here, the required behavior is to centrally enforce supported security policies across network groups before workload NSGs.
Question 675 An internal-facing website needs supported WAF controls with a regional gateway frontend. Which step best addresses this particular situation? WAF prevention mode for active blocking Managed WAF rule set selection WAF on Azure Front Door for global edge protection WAF on Application Gateway for regional web protection Explanation Correct Answer D:This choice inspects HTTP/S requests at a regional application gateway using supported WAF policies. Incorrect Answers A:Although WAF prevention mode for active blocking blocks HTTP requests that match configured WAF enforcement rules, that is not sufficient to inspect HTTP/S requests at a regional application gateway using supported WAF policies in this case. B:This choice uses a supported managed web attack signature rule set for common application threats. It leaves the specific need to inspect HTTP/S requests at a regional application gateway using supported WAF policies unaddressed. C:WAF on Azure Front Door for global edge protection inspects web traffic at Microsoft's global edge before it reaches regional origins. The current problem instead requires a control that inspects HTTP/S requests at a regional application gateway using supported WAF policies.
Question 676 A payroll database tier must be reachable only through private Azure networking. What is the most defensible solution for this case? Public Load Balancer frontend Internal Load Balancer frontend Load Balancer HA ports Load Balancer health probe Explanation Correct Answer B:The intended behavior is to expose a private VNet IP address for a load-balanced service rather than a public endpoint. Internal Load Balancer frontend is the direct configuration or deployment choice. Incorrect Answers A:Public Load Balancer frontend is useful when the goal is to provide an Internet-routable Layer 4 frontend for approved external clients. Here, the required behavior is to expose a private VNet IP address for a load-balanced service rather than a public endpoint. C:This choice enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. It leaves the specific need to expose a private VNet IP address for a load-balanced service rather than a public endpoint unaddressed. D:Load Balancer health probe is useful when the goal is to test a configured probe endpoint or port to determine eligible healthy backends. Here, the required behavior is to expose a private VNet IP address for a load-balanced service rather than a public endpoint.
Question 677 A hub needs centralized FQDN and network filtering but no TLS decryption requirement. Which implementation most directly resolves this requirement? Azure Firewall Basic for simple network filtering Azure Firewall Standard for stateful filtering Azure Firewall Premium for TLS inspection Secure Virtual WAN hub with Azure Firewall Explanation Correct Answer B:The intended behavior is to provide managed stateful network and application filtering without Premium-only inspection. Azure Firewall Standard for stateful filtering is the direct configuration or deployment choice. Incorrect Answers A:Although Azure Firewall Basic for simple network filtering fits eligible smaller workloads when advanced throughput and security features are not required, that is not sufficient to provide managed stateful network and application filtering without Premium-only inspection in this case. C:Although Azure Firewall Premium for TLS inspection uses the Premium tier's supported TLS inspection and advanced threat features, that is not sufficient to provide managed stateful network and application filtering without Premium-only inspection in this case. D:This alternative deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection, which solves a different networking task. It does not directly provide managed stateful network and application filtering without Premium-only inspection.
Question 678 A firewall deployment needs an HA-ports rule rather than hundreds of per-port mappings. Which change should the network engineer make? Regional Azure Load Balancer for L4 traffic Load Balancer HA ports Load Balancer outbound rule Internal Load Balancer frontend Explanation Correct Answer B:This choice enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. Incorrect Answers A:This choice distributes TCP or UDP flows to healthy backend instances in an Azure region. It leaves the specific need to enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios unaddressed. C:This alternative controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend, which solves a different networking task. It does not directly enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. D:Internal Load Balancer frontend exposes a private VNet IP address for a load-balanced service rather than a public endpoint. The current problem instead requires a control that enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios.
Question 679 A gateway marks VMs unhealthy because it probes a path that requires login. Which network component or setting is the best fit? Application Gateway path-based routing rule Application Gateway autoscale Application Gateway custom health probe Application Gateway multi-site routing Explanation Correct Answer C:This choice checks an application-specific path and expected response before including backends. Incorrect Answers A:This alternative selects different backends based on URL path patterns, which solves a different networking task. It does not directly check an application-specific path and expected response before including backends. B:Application Gateway autoscale adjusts supported v2 gateway capacity automatically to demand within configured boundaries. The current problem instead requires a control that checks an application-specific path and expected response before including backends. D:Although Application Gateway multi-site routing uses host-based listeners to select application backends for different domain names, that is not sufficient to check an application-specific path and expected response before including backends in this case.
Question 680 A firewall-approved app must expose TCP connections through several backend VMs. Which configuration should the team verify or implement first? Public Load Balancer frontend Internal Load Balancer frontend Load Balancer outbound rule Cross-region Azure Load Balancer design Explanation Correct Answer A:This choice provides an Internet-routable Layer 4 frontend for approved external clients. Incorrect Answers B:This choice exposes a private VNet IP address for a load-balanced service rather than a public endpoint. It leaves the specific need to provide an Internet-routable Layer 4 frontend for approved external clients unaddressed. C:Load Balancer outbound rule controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend. The current problem instead requires a control that provides an Internet-routable Layer 4 frontend for approved external clients. D:This alternative uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, which solves a different networking task. It does not directly provide an Internet-routable Layer 4 frontend for approved external clients.
