Question 690 A change process must reduce duplicated manual firewall rule maintenance. Which implementation most directly resolves this requirement? Azure Firewall Standard for stateful filtering Azure Firewall Policy across regions Azure Firewall DNS proxy Secure Virtual WAN hub with Azure Firewall Explanation Correct Answer B:Azure Firewall Policy across regions is appropriate because it centralizes managed firewall settings and reusable rule collections. Incorrect Answers A:Azure Firewall Standard for stateful filtering provides managed stateful network and application filtering without Premium-only inspection. The current problem instead requires a control that centralizes managed firewall settings and reusable rule collections. C:That approach provides centrally proxied DNS resolution for supported FQDN-based network policy; it does not replace Azure Firewall Policy across regions for the constraint in this scenario. D:Although Secure Virtual WAN hub with Azure Firewall deploys Azure Firewall into a supported Virtual WAN virtual hub for managed inspection, that is not sufficient to centralize managed firewall settings and reusable rule collections in this case.
Question 691 An on-premises client resolves a private endpoint name to a public destination unexpectedly. Which approach best satisfies the access or connectivity requirement? Azure DNS Private Resolver outbound endpoint DNS private endpoint record validation Private DNS zone auto-registration link Azure DNS Private Resolver inbound endpoint Explanation Correct Answer B:DNS private endpoint record validation is appropriate because it confirms private service FQDNs resolve to the intended private endpoint addresses. Incorrect Answers A:Although Azure DNS Private Resolver outbound endpoint sends selected Azure DNS queries toward other DNS servers through managed forwarding, that is not sufficient to confirm private service FQDNs resolve to the intended private endpoint addresses in this case. C:Private DNS zone auto-registration link is useful when the goal is to register eligible VM DNS records automatically in a linked private DNS zone. Here, the required behavior is to confirm private service FQDNs resolve to the intended private endpoint addresses. D:This alternative accepts DNS queries arriving from on-premises or connected networks into Azure resolution, which solves a different networking task. It does not directly confirm private service FQDNs resolve to the intended private endpoint addresses.
Question 692 A business-critical database appears reachable through chained identity and network weaknesses. What should the administrator change or deploy? Cloud Security Explorer asset queries Network Watcher packet capture Defender for Cloud attack-path analysis Defender for Cloud Secure Score recommendations Explanation Correct Answer C:Defender for Cloud attack-path analysis is appropriate because it identifies exploitable attack paths that connect exposure and privilege to important assets. Incorrect Answers A:Cloud Security Explorer asset queries is useful when the goal is to searche security and resource context to find network assets matching risk conditions. Here, the required behavior is to identify exploitable attack paths that connect exposure and privilege to important assets. B:Network Watcher packet capture is useful when the goal is to capture scoped packet evidence from a supported VM for protocol troubleshooting. Here, the required behavior is to identify exploitable attack paths that connect exposure and privilege to important assets. D:This choice prioritizes cloud security posture findings including exposed network resources. It leaves the specific need to identify exploitable attack paths that connect exposure and privilege to important assets unaddressed.
Question 693 Network security wants user identity governance applied to remote-access sessions. Which configuration should the team verify or implement first? Microsoft Entra ID P2S authentication P2S route distribution to clients RADIUS authentication for P2S VPN P2S client-side authentication troubleshooting Explanation Correct Answer A:Microsoft Entra ID P2S authentication is appropriate because it authenticates supported VPN clients using the organization's Entra identity platform. Incorrect Answers B:P2S route distribution to clients advertises or includes the correct private destination prefixes in remote-user VPN profiles. The current problem instead requires a control that authenticates supported VPN clients using the organization's Entra identity platform. C:This alternative uses an existing supported RADIUS server for VPN user authentication, which solves a different networking task. It does not directly authenticate supported VPN clients using the organization's Entra identity platform. D:This choice checks identity, certificates and local profile logs before changing gateway routes. It leaves the specific need to authenticate supported VPN clients using the organization's Entra identity platform unaddressed.
Question 694 A regional subnet must use a dedicated outbound gateway instead of relying on default egress. Which step best addresses this particular situation? NAT Gateway subnet association Azure Virtual Network Manager connectivity groups NAT Gateway public IP allocation NAT Gateway for predictable outbound SNAT Explanation Correct Answer D:This choice provides scalable managed outbound connectivity for private subnet workloads. Incorrect Answers A:This choice applies a NAT Gateway's outbound SNAT behavior to a selected subnet. It leaves the specific need to provide scalable managed outbound connectivity for private subnet workloads unaddressed. B:Although Azure Virtual Network Manager connectivity groups centrally coordinates VNet connectivity topology across many subscriptions, that is not sufficient to provide scalable managed outbound connectivity for private subnet workloads in this case. C:This alternative assigns supported public IP or public IP prefix resources to the gateway, which solves a different networking task. It does not directly provide scalable managed outbound connectivity for private subnet workloads.
Question 695 An architect must distribute approved client flows across healthy regional L4 deployments. What is the most appropriate next design decision? Regional Azure Load Balancer for L4 traffic Load Balancer load-balancing rule Cross-region Azure Load Balancer design Load Balancer HA ports Explanation Correct Answer C:The relevant action is Cross-region Azure Load Balancer design: it uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. Incorrect Answers A:Regional Azure Load Balancer for L4 traffic is useful when the goal is to distribute TCP or UDP flows to healthy backend instances in an Azure region. Here, the required behavior is to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency. B:Although Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections, that is not sufficient to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency in this case. D:Load Balancer HA ports is useful when the goal is to enable a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. Here, the required behavior is to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency.
Question 696 An existing internal load balancer cannot serve approved Internet clients directly. Which Azure networking capability should be selected? Load Balancer load-balancing rule Cross-region Azure Load Balancer design Internal Load Balancer frontend Public Load Balancer frontend Explanation Correct Answer D:The intended behavior is to provide an Internet-routable Layer 4 frontend for approved external clients. Public Load Balancer frontend is the direct configuration or deployment choice. Incorrect Answers A:Although Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections, that is not sufficient to provide an Internet-routable Layer 4 frontend for approved external clients in this case. B:Cross-region Azure Load Balancer design uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. The current problem instead requires a control that provides an Internet-routable Layer 4 frontend for approved external clients. C:Although Internal Load Balancer frontend exposes a private VNet IP address for a load-balanced service rather than a public endpoint, that is not sufficient to provide an Internet-routable Layer 4 frontend for approved external clients in this case.
Question 697 A latency-sensitive public TCP application spans regions and needs cross-region failover. Which Azure control would meet the operational need? Cross-region Azure Load Balancer design Public Load Balancer frontend Load Balancer load-balancing rule Regional Azure Load Balancer for L4 traffic Explanation Correct Answer A:Cross-region Azure Load Balancer design uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. Incorrect Answers B:Public Load Balancer frontend provides an Internet-routable Layer 4 frontend for approved external clients. The current problem instead requires a control that uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. C:Although Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections, that is not sufficient to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency in this case. D:That approach distributes TCP or UDP flows to healthy backend instances in an Azure region; it does not replace Cross-region Azure Load Balancer design for the constraint in this scenario.
Question 698 A user imported the wrong client configuration for the gateway protocol. What action most directly addresses the documented failure? P2S OpenVPN protocol selection VPN client device deployment validation P2S client address pool planning P2S VPN client profile generation Explanation Correct Answer B:The relevant action is VPN client device deployment validation: it validates supported OS, client version, tunnel profile and endpoint requirements. Incorrect Answers A:This alternative chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements. C:Although P2S client address pool planning allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges, that is not sufficient to validate supported OS, client version, tunnel profile and endpoint requirements in this case. D:This alternative delivers the correct gateway endpoints, routes and authentication settings to client devices, which solves a different networking task. It does not directly validate supported OS, client version, tunnel profile and endpoint requirements.
Question 699 A third regional site requires a new virtual hub resource in a global WAN. What is the most appropriate next design decision? Virtual WAN hub VNet connection Virtual WAN hub routing table association Virtual WAN gateway scale-unit planning Virtual WAN virtual hub creation Explanation Correct Answer D:This choice deploys a Microsoft-managed regional hub for connectivity, routing and gateway services. Incorrect Answers A:This choice attaches a workload VNet to a managed virtual hub for connectivity and route propagation. It leaves the specific need to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services unaddressed. B:Virtual WAN hub routing table association is useful when the goal is to control which route table a hub connection uses for its forwarding decisions. Here, the required behavior is to deploy a Microsoft-managed regional hub for connectivity, routing and gateway services. C:This alternative sizes a managed virtual-hub gateway for required bandwidth and connections, which solves a different networking task. It does not directly deploy a Microsoft-managed regional hub for connectivity, routing and gateway services.
Question 700 A spoke sends packets through a hub firewall but the peering blocks forwarded traffic. Which network component or setting is the best fit? VNet address-space peering sync VNet peering for private backbone connectivity Gateway transit on hub peering Allow forwarded traffic on VNet peering Explanation Correct Answer D:Allow forwarded traffic on VNet peering is appropriate because it permits forwarded packets between peered VNets through a hub appliance where appropriate. Incorrect Answers A:This alternative updates peering awareness after VNet address-space changes, which solves a different networking task. It does not directly permit forwarded packets between peered VNets through a hub appliance where appropriate. B:Although VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance, that is not sufficient to permit forwarded packets between peered VNets through a hub appliance where appropriate in this case. C:Gateway transit on hub peering is useful when the goal is to let an eligible peered spoke use a hub's VPN or ExpressRoute gateway. Here, the required behavior is to permit forwarded packets between peered VNets through a hub appliance where appropriate.
