Question 780 A subnet can reach more storage accounts than its data-egress policy allows. What action most directly addresses the documented failure? PaaS resource firewall VNet rule VNet service endpoint enablement Service endpoint policy for storage resource scope Service endpoint diagnostic separation Explanation Correct Answer C:Service endpoint policy for storage resource scope is appropriate because it restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. Incorrect Answers A:This alternative permits the specified subnet at the target managed service after a service endpoint is enabled, which solves a different networking task. It does not directly restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. B:VNet service endpoint enablement is useful when the goal is to extend selected Azure service routing and service identity from an approved VNet subnet. Here, the required behavior is to restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. D:That approach checks source subnet configuration, resource firewall rules and actual service reachability; it does not replace Service endpoint policy for storage resource scope for the constraint in this scenario.
Question 781 A VM has two NICs and the team associated the public IP with the wrong interface. What action most directly addresses the documented failure? Public IP Prefix for contiguous outbound allocation IP configuration for multiple VM addresses NIC-level public IP association Standard Public IP for internet-facing VM Explanation Correct Answer C:The relevant action is NIC-level public IP association: it attaches the public IP to the correct network interface IP configuration. Incorrect Answers A:Public IP Prefix for contiguous outbound allocation reserves a managed contiguous block of standard public addresses for public IP resources. The current problem instead requires a control that attaches the public IP to the correct network interface IP configuration. B:That approach uses multiple supported IP configurations on a network interface for distinct service addresses; it does not replace NIC-level public IP association for the constraint in this scenario. D:Although Standard Public IP for internet-facing VM assigns a routable public endpoint to a specified Azure resource when direct exposure is justified, that is not sufficient to attache the public IP to the correct network interface IP configuration in this case.
Question 782 Users authenticate to the VPN but have no route to the intended private subnet. What is the most appropriate next design decision? P2S VPN client profile generation P2S client address pool planning RADIUS authentication for P2S VPN P2S route distribution to clients Explanation Correct Answer D:The relevant action is P2S route distribution to clients: it advertises or includes the correct private destination prefixes in remote-user VPN profiles. Incorrect Answers A:That approach delivers the correct gateway endpoints, routes and authentication settings to client devices; it does not replace P2S route distribution to clients for the constraint in this scenario. B:That approach allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges; it does not replace P2S route distribution to clients for the constraint in this scenario. C:RADIUS authentication for P2S VPN uses an existing supported RADIUS server for VPN user authentication. The current problem instead requires a control that advertises or includes the correct private destination prefixes in remote-user VPN profiles.
Question 783 A VM NIC has an IP configuration outside the VNet subnet range. Which step best addresses this particular situation? Private IP allocation consistency across NICs Static private NIC IP configuration IP configuration for multiple VM addresses Subnet size and reserved IP planning Explanation Correct Answer A:Private IP allocation consistency across NICs ensures private addresses belong to the selected subnet and interface configuration. Incorrect Answers B:Static private NIC IP configuration is useful when the goal is to assign an intended stable private address to a VM network interface within its subnet. Here, the required behavior is to ensure private addresses belong to the selected subnet and interface configuration. C:That approach uses multiple supported IP configurations on a network interface for distinct service addresses; it does not replace Private IP allocation consistency across NICs for the constraint in this scenario. D:Although Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet, that is not sufficient to ensure private addresses belong to the selected subnet and interface configuration in this case.
Question 784 A company wants portal-based SSH to workloads without deploying a jump-box VM. Which Azure networking capability should be selected? Application Security Group membership ASG-based NSG access rule Azure Bastion for browser-based VM administration Azure Virtual Network Manager security admin policy Explanation Correct Answer C:The relevant action is Azure Bastion for browser-based VM administration: it provides managed remote VM access without exposing RDP or SSH public IPs on each VM. Incorrect Answers A:This alternative groups VM interfaces by application role for NSG rule targeting, which solves a different networking task. It does not directly provide managed remote VM access without exposing RDP or SSH public IPs on each VM. B:ASG-based NSG access rule is useful when the goal is to reference application security groups as source or destination in supported NSG rules. Here, the required behavior is to provide managed remote VM access without exposing RDP or SSH public IPs on each VM. D:Azure Virtual Network Manager security admin policy governs supported high-priority security admin rules across centrally managed VNets. The current problem instead requires a control that provides managed remote VM access without exposing RDP or SSH public IPs on each VM.
Question 785 An outage review shows no alternate path despite paying for redundant circuits. Which network component or setting is the best fit? ExpressRoute Global Reach ExpressRoute provider failover testing ExpressRoute private peering ExpressRoute gateway on VNet Explanation Correct Answer B:ExpressRoute provider failover testing is appropriate because it validates routing and application failover across configured independent ExpressRoute paths. Incorrect Answers A:ExpressRoute Global Reach is useful when the goal is to connect on-premises sites via their ExpressRoute circuits through provider-enabled private connectivity. Here, the required behavior is to validate routing and application failover across configured independent ExpressRoute paths. C:This alternative provides private routing to VNet private address spaces over an ExpressRoute circuit, which solves a different networking task. It does not directly validate routing and application failover across configured independent ExpressRoute paths. D:ExpressRoute gateway on VNet is useful when the goal is to connect a VNet to an ExpressRoute circuit through the managed gateway. Here, the required behavior is to validate routing and application failover across configured independent ExpressRoute paths.
Question 786 A production hybrid hub needs zone-redundant VPN gateway infrastructure. What action most directly addresses the documented failure? Zone-redundant VPN Gateway IPsec/IKE policy interoperability VPN gateway SKU throughput planning Virtual network gateway deployment Explanation Correct Answer A:The intended behavior is to place a supported VPN gateway across availability zones for regional resilience. Zone-redundant VPN Gateway is the direct configuration or deployment choice. Incorrect Answers B:IPsec/IKE policy interoperability aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. The current problem instead requires a control that places a supported VPN gateway across availability zones for regional resilience. C:This choice selects a supported VPN gateway tier sized for aggregate tunnels and traffic. It leaves the specific need to place a supported VPN gateway across availability zones for regional resilience unaddressed. D:This choice provisions the Azure-managed VPN gateway attached to the target VNet. It leaves the specific need to place a supported VPN gateway across availability zones for regional resilience unaddressed.
Question 787 A peered network is unexpectedly routed through a gateway and effective next hop is unclear. Which network component or setting is the best fit? Azure Monitor network resource metrics Network Watcher next hop Network Watcher effective security rules Network Watcher connection troubleshoot Explanation Correct Answer B:Network Watcher next hop is appropriate because it determines a VM's effective route and next-hop category to a destination. Incorrect Answers A:Although Azure Monitor network resource metrics collects performance and health signals for Azure networking resources, that is not sufficient to determine a VM's effective route and next-hop category to a destination in this case. C:This choice lists the combined network security rules effective on an Azure VM interface. It leaves the specific need to determine a VM's effective route and next-hop category to a destination unaddressed. D:This choice tests end-to-end reachability, latency and network obstacles between source and destination. It leaves the specific need to determine a VM's effective route and next-hop category to a destination unaddressed.
Question 788 A VNet connected to ExpressRoute wants the optimized supported data route rather than the gateway data plane. What is the most defensible solution for this case? ExpressRoute gateway on VNet ExpressRoute FastPath ExpressRoute encryption over private connectivity ExpressRoute Direct Explanation Correct Answer B:The relevant action is ExpressRoute FastPath: it improves data path behavior by bypassing the gateway for supported ExpressRoute data traffic. Incorrect Answers A:Although ExpressRoute gateway on VNet connects a VNet to an ExpressRoute circuit through the managed gateway, that is not sufficient to improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic in this case. C:That approach adds a supported encryption overlay when private circuit transport alone is insufficient; it does not replace ExpressRoute FastPath for the constraint in this scenario. D:Although ExpressRoute Direct provides dedicated high-capacity direct ports at a supported peering location, that is not sufficient to improve data path behavior by bypassing the gateway for supported ExpressRoute data traffic in this case.
Question 789 A regulated workload must not egress directly to the Internet from its spoke. Which network component or setting is the best fit? Effective routes and next-hop diagnosis Allow forwarded traffic on VNet peering Route table association to subnet Forced-tunnel default route design Explanation Correct Answer D:The relevant action is Forced-tunnel default route design: it sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. Incorrect Answers A:Although Effective routes and next-hop diagnosis reveals which system, BGP or user route determines an actual VM next hop, that is not sufficient to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop in this case. B:Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. The current problem instead requires a control that sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. C:This alternative applies a defined user route collection to the workload subnet, which solves a different networking task. It does not directly send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop.
Question 790 A data-processing VM must not open network connections to unrelated database networks. Which choice matches the specific technical condition? NSG network interface association NSG outbound rule destination and port ASG-based NSG access rule NSG inbound rule source and port Explanation Correct Answer B:NSG outbound rule destination and port is appropriate because it restricts workloads initiating network connections toward disallowed destinations. Incorrect Answers A:This choice applies additional instance-specific NSG rules to a selected network interface. It leaves the specific need to restrict workloads initiating network connections toward disallowed destinations unaddressed. C:This choice references application security groups as source or destination in supported NSG rules. It leaves the specific need to restrict workloads initiating network connections toward disallowed destinations unaddressed. D:Although NSG inbound rule source and port restricts traffic entering a NIC or subnet by source, destination and service port, that is not sufficient to restrict workloads initiating network connections toward disallowed destinations in this case.
