Question 710 A remote site requires the matching on-premises route toward the Azure prefix. Which network component or setting is the best fit? IPsec/IKE policy interoperability Route-based site-to-site VPN gateway Active-active VPN gateway design On-premises VPN device policy matching Explanation Correct Answer D:The intended behavior is to align corporate firewall route, access and selector rules with Azure connection design. On-premises VPN device policy matching is the direct configuration or deployment choice. Incorrect Answers A:This alternative aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device, which solves a different networking task. It does not directly align corporate firewall route, access and selector rules with Azure connection design. B:Although Route-based site-to-site VPN gateway supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device, that is not sufficient to align corporate firewall route, access and selector rules with Azure connection design in this case. C:Active-active VPN gateway design is useful when the goal is to use multiple gateway instances and connections for supported VPN link resiliency. Here, the required behavior is to align corporate firewall route, access and selector rules with Azure connection design.
Question 711 An Azure Private Endpoint and private DNS are already configured, but the office LAN has no VPN or ExpressRoute connection to the Azure VNet. Which next action enables the office to reach the private IP? Private Endpoint for PaaS private IP access Create additional Private Endpoint DNS records without a network connection Private Endpoint NSG and route policy support Establish site-to-site VPN or ExpressRoute routing between the office and Azure VNet Explanation Correct Answer D:The office needs network-layer connectivity via an appropriate site-to-site VPN or ExpressRoute path to reach the existing Private Endpoint private IP. Incorrect Answers A:Another Private Endpoint for the same service would not create a route from the office LAN to Azure. B:More private DNS records cannot transport packets from an office with no hybrid route to the VNet. C:Private Endpoint NSG policies filter reachable traffic; they do not provision the missing hybrid connection.
Question 712 After peering, an application's preferred route no longer matches its route table. Which change should the network engineer make? Effective routes and next-hop diagnosis Route table association to subnet Azure Route Server for BGP exchange Gateway transit on hub peering Explanation Correct Answer A:The intended behavior is to reveal which system, BGP or user route determines an actual VM next hop. Effective routes and next-hop diagnosis is the direct configuration or deployment choice. Incorrect Answers B:That approach applies a defined user route collection to the workload subnet; it does not replace Effective routes and next-hop diagnosis for the constraint in this scenario. C:This alternative exchanges dynamic routes with supported network virtual appliances over BGP, which solves a different networking task. It does not directly reveal which system, BGP or user route determines an actual VM next hop. D:This choice lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway. It leaves the specific need to reveal which system, BGP or user route determines an actual VM next hop unaddressed.
Question 713 Private VMs need outbound Internet access through a known set of public IPs. Which network component or setting is the best fit? NAT Gateway for predictable outbound SNAT VNet peering for private backbone connectivity NAT Gateway subnet association NAT Gateway public IP allocation Explanation Correct Answer A:NAT Gateway for predictable outbound SNAT provides scalable managed outbound connectivity for private subnet workloads. Incorrect Answers B:This choice connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. It leaves the specific need to provide scalable managed outbound connectivity for private subnet workloads unaddressed. C:NAT Gateway subnet association applies a NAT Gateway's outbound SNAT behavior to a selected subnet. The current problem instead requires a control that provides scalable managed outbound connectivity for private subnet workloads. D:This choice assigns supported public IP or public IP prefix resources to the gateway. It leaves the specific need to provide scalable managed outbound connectivity for private subnet workloads unaddressed.
Question 714 A provider-managed API should accept approved private endpoint connections from customers. Which configuration addresses the stated network constraint? Private Endpoint for PaaS private IP access Private Link service access visibility Private Link service provider design Private Link service alias distribution Explanation Correct Answer C:Private Link service provider design exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. Incorrect Answers A:This choice exposes a supported Azure service through a private IP interface in the consumer VNet. It leaves the specific need to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link unaddressed. B:Although Private Link service access visibility restricts eligible consumers through controlled visibility and approval settings, that is not sufficient to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link in this case. D:Private Link service alias distribution is useful when the goal is to give authorized consumers a service alias to request private endpoints without using the full resource ID. Here, the required behavior is to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link.
Question 715 A hybrid DNS plan needs different destinations for two private namespace suffixes. Which configuration addresses the stated network constraint? Ruleset VNet association Azure DNS Private Resolver outbound endpoint DNS forwarding ruleset and rules Custom DNS server settings on VNet Explanation Correct Answer C:DNS forwarding ruleset and rules is appropriate because it matches a domain suffix and forwards queries to designated DNS target servers. Incorrect Answers A:Ruleset VNet association links a forwarding ruleset to the VNets that need to use it. The current problem instead requires a control that matches a domain suffix and forwards queries to designated DNS target servers. B:This choice sends selected Azure DNS queries toward other DNS servers through managed forwarding. It leaves the specific need to match a domain suffix and forwards queries to designated DNS target servers unaddressed. D:This alternative directs VNet-resident clients to selected DNS servers for specialized resolution, which solves a different networking task. It does not directly match a domain suffix and forwards queries to designated DNS target servers.
Question 716 An administrator distinguishes original VNet packets from NVA-forwarded transit packets. What is the most defensible solution for this case? VNet peering for private backbone connectivity Allow forwarded traffic on VNet peering Private DNS zone access for peered VNets User-defined route to virtual appliance Explanation Correct Answer B:Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. Incorrect Answers A:Although VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance, that is not sufficient to permit forwarded packets between peered VNets through a hub appliance where appropriate in this case. C:This alternative links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution, which solves a different networking task. It does not directly permit forwarded packets between peered VNets through a hub appliance where appropriate. D:This alternative directs selected subnet traffic to a nominated next-hop NVA address, which solves a different networking task. It does not directly permit forwarded packets between peered VNets through a hub appliance where appropriate.
Question 717 A S2S connection points to the wrong public address of a corporate VPN device. What should the administrator change or deploy? IPsec/IKE policy interoperability S2S peer public IP change procedure On-premises VPN device policy matching Local network gateway configuration Explanation Correct Answer D:The relevant action is Local network gateway configuration: it records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. Incorrect Answers A:Although IPsec/IKE policy interoperability aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device, that is not sufficient to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection in this case. B:S2S peer public IP change procedure is useful when the goal is to update peer and local network gateway settings together during a branch cutover. Here, the required behavior is to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. C:On-premises VPN device policy matching aligns corporate firewall route, access and selector rules with Azure connection design. The current problem instead requires a control that records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection.
Question 718 A network architect avoids unsupported Basic SKU behavior in a new service. Which Azure networking capability should be selected? Load Balancer HA ports Load Balancer outbound rule Standard Load Balancer for modern workloads Load Balancer health probe Explanation Correct Answer C:Standard Load Balancer for modern workloads is appropriate because it uses the current supported load balancer SKU with configurable health and security behavior. Incorrect Answers A:This alternative enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios, which solves a different networking task. It does not directly use the current supported load balancer SKU with configurable health and security behavior. B:This alternative controls SNAT for backend VMs that require outbound connectivity using a load-balancer frontend, which solves a different networking task. It does not directly use the current supported load balancer SKU with configurable health and security behavior. D:Load Balancer health probe is useful when the goal is to test a configured probe endpoint or port to determine eligible healthy backends. Here, the required behavior is to use the current supported load balancer SKU with configurable health and security behavior.
Question 719 A firewall team assumes a corporate VPN address has the same service-endpoint identity as a VNet subnet. Which Azure control would meet the operational need? VNet service endpoint enablement Service endpoint public address distinction Service endpoint unsupported-service review Private Endpoint for hybrid private-service consumers Explanation Correct Answer D:This choice uses an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access. Incorrect Answers A:VNet service endpoint enablement extends selected Azure service routing and service identity from an approved VNet subnet. The current problem instead requires a control that uses an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access. B:Service endpoint public address distinction retains public service endpoint addressing while changing private subnet routing and service firewall identity. The current problem instead requires a control that uses an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access. C:This alternative verifies whether the selected PaaS resource type supports service endpoints before planning access, which solves a different networking task. It does not directly use an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access.
Question 720 A network designer evaluates a supported cross-region load-balancing tier over regional LBs. Which step best addresses this particular situation? Cross-region Azure Load Balancer design Standard Load Balancer for modern workloads Regional Azure Load Balancer for L4 traffic Load Balancer HA ports Explanation Correct Answer A:Cross-region Azure Load Balancer design is appropriate because it uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency. Incorrect Answers B:This alternative uses the current supported load balancer SKU with configurable health and security behavior, which solves a different networking task. It does not directly use supported regional frontends beneath a global load balancing layer for L4 regional resiliency. C:Regional Azure Load Balancer for L4 traffic is useful when the goal is to distribute TCP or UDP flows to healthy backend instances in an Azure region. Here, the required behavior is to use supported regional frontends beneath a global load balancing layer for L4 regional resiliency. D:Load Balancer HA ports enables a supported internal load balancer to handle a range of all TCP and UDP ports for NVA scenarios. The current problem instead requires a control that uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency.
