Question 70 An audit requires consistent NSG protection for every VM in a sensitive tier. Which Azure networking capability should be selected? NSG subnet association NSG effective rule inspection Application Security Group membership NSG network interface association Explanation Correct Answer A:The intended behavior is to apply a network security group to all eligible network interfaces in a selected subnet. NSG subnet association is the direct configuration or deployment choice. Incorrect Answers B:NSG effective rule inspection reads merged effective rules after both subnet and NIC associations. The current problem instead requires a control that applies a network security group to all eligible network interfaces in a selected subnet. C:This choice groups VM interfaces by application role for NSG rule targeting. It leaves the specific need to apply a network security group to all eligible network interfaces in a selected subnet unaddressed. D:NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that applies a network security group to all eligible network interfaces in a selected subnet.
Question 71 A hybrid network must send Internet-bound traffic to an approved corporate security edge. Which choice matches the specific technical condition? Route table association to subnet User-defined route to virtual appliance Effective routes and next-hop diagnosis Forced-tunnel default route design Explanation Correct Answer D:Forced-tunnel default route design sends Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. Incorrect Answers A:This alternative applies a defined user route collection to the workload subnet, which solves a different networking task. It does not directly send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. B:User-defined route to virtual appliance is useful when the goal is to direct selected subnet traffic to a nominated next-hop NVA address. Here, the required behavior is to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop. C:This choice reveals which system, BGP or user route determines an actual VM next hop. It leaves the specific need to send Internet-bound 0.0.0.0/0 traffic to an approved inspection or on-premises next hop unaddressed.
Question 72 An engineer needs to identify broadly open management ports flagged by Defender for Cloud. What is the most appropriate next design decision? Defender for Cloud Secure Score recommendations Defender for Cloud attack-path analysis Network Watcher effective security rules Cloud Security Explorer asset queries Explanation Correct Answer A:This choice prioritizes cloud security posture findings including exposed network resources. Incorrect Answers B:This choice identifies exploitable attack paths that connect exposure and privilege to important assets. It leaves the specific need to prioritize cloud security posture findings including exposed network resources unaddressed. C:Although Network Watcher effective security rules lists the combined network security rules effective on an Azure VM interface, that is not sufficient to prioritize cloud security posture findings including exposed network resources in this case. D:This choice searches security and resource context to find network assets matching risk conditions. It leaves the specific need to prioritize cloud security posture findings including exposed network resources unaddressed.
Question 73 The service is behind a Standard Load Balancer and must be published to private-link consumers. What should the team implement or correct? Private Link service provider design Private Endpoint resource-specific authorization Private Endpoint for PaaS private IP access Private Link service access visibility Explanation Correct Answer A:Private Link service provider design is appropriate because it exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. Incorrect Answers B:This alternative scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions, which solves a different networking task. It does not directly expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. C:This choice exposes a supported Azure service through a private IP interface in the consumer VNet. It leaves the specific need to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link unaddressed. D:Although Private Link service access visibility restricts eligible consumers through controlled visibility and approval settings, that is not sufficient to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link in this case.
Question 74 A security team wants to block malicious HTTP patterns across all regions at the edge. Which Azure networking capability should be selected? Front Door Rules Engine redirect Azure Front Door global application delivery Front Door WAF policy association Front Door Private Link to supported origin Explanation Correct Answer C:Front Door WAF policy association applies supported application-layer rules at the globally distributed edge. Incorrect Answers A:Front Door Rules Engine redirect returns an HTTP redirect to the client for an approved URL transformation. The current problem instead requires a control that applies supported application-layer rules at the globally distributed edge. B:This alternative provides globally distributed edge entry points with accelerated HTTP/S routing to origins, which solves a different networking task. It does not directly apply supported application-layer rules at the globally distributed edge. D:Front Door Private Link to supported origin is useful when the goal is to connect an eligible Front Door Premium origin privately without exposing it broadly. Here, the required behavior is to apply supported application-layer rules at the globally distributed edge.
Question 75 A private WAN needs rapid detection of failed BGP forwarding connectivity. What should the administrator change or deploy? ExpressRoute BFD for rapid failure detection ExpressRoute redundancy planning ExpressRoute provider failover testing ExpressRoute private peering Explanation Correct Answer A:ExpressRoute BFD for rapid failure detection uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. Incorrect Answers B:Although ExpressRoute redundancy planning uses redundant circuits or locations as required to survive equipment and site failures, that is not sufficient to use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone in this case. C:ExpressRoute provider failover testing validates routing and application failover across configured independent ExpressRoute paths. The current problem instead requires a control that uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. D:This choice provides private routing to VNet private address spaces over an ExpressRoute circuit. It leaves the specific need to use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone unaddressed.
Question 76 An IPAM register lacks the owners of VNet and subnet allocations for a hub rollout. What should the team implement or correct? Address and subnet allocation inventory Private IP allocation consistency across NICs Nonoverlapping VNet CIDR planning AzureFirewallSubnet sizing Explanation Correct Answer A:The intended behavior is to track CIDR ownership, free space and subnet relationships before deployment. Address and subnet allocation inventory is the direct configuration or deployment choice. Incorrect Answers B:That approach ensures private addresses belong to the selected subnet and interface configuration; it does not replace Address and subnet allocation inventory for the constraint in this scenario. C:Although Nonoverlapping VNet CIDR planning prevents address collisions between Azure networks and corporate routes, that is not sufficient to track CIDR ownership, free space and subnet relationships before deployment in this case. D:Although AzureFirewallSubnet sizing provides the reserved firewall subnet for the managed Azure Firewall deployment, that is not sufficient to track CIDR ownership, free space and subnet relationships before deployment in this case.
Question 77 A Private Endpoint to one storage account is approved, but a user assumes that private network reachability automatically grants read rights to that storage data and unrelated accounts. What must remain separately enforced? Storage authorization/RBAC and explicit resource scope, independent of Private Endpoint connectivity Private Link service provider design Private Link service access visibility Private Endpoint connection state monitoring Explanation Correct Answer A:A Private Endpoint restricts the network path to its target; storage authentication, RBAC and the intended resource scope must still be enforced independently. Incorrect Answers B:Private Link service provider design describes exposing a custom private service and does not grant or deny storage data-plane permissions. C:Service access visibility defines which consumers see a provider’s private link offering; it does not replace storage identity and data authorization. D:Connection-state monitoring observes whether the endpoint is approved and healthy; it is not a data-permissions system.
Question 78 A site-to-site gateway must continue carrying hybrid traffic during an instance disruption. What is the most appropriate next design decision? Route-based site-to-site VPN gateway Active-active VPN gateway design Zone-redundant VPN Gateway VPN gateway SKU throughput planning Explanation Correct Answer B:Active-active VPN gateway design is appropriate because it uses multiple gateway instances and connections for supported VPN link resiliency. Incorrect Answers A:Route-based site-to-site VPN gateway is useful when the goal is to support dynamic routing-based IPsec connectivity between Azure and a corporate VPN device. Here, the required behavior is to use multiple gateway instances and connections for supported VPN link resiliency. C:Zone-redundant VPN Gateway places a supported VPN gateway across availability zones for regional resilience. The current problem instead requires a control that uses multiple gateway instances and connections for supported VPN link resiliency. D:That approach selects a supported VPN gateway tier sized for aggregate tunnels and traffic; it does not replace Active-active VPN gateway design for the constraint in this scenario.
Question 79 A hub-spoke routing design requires proper forwarded-traffic peering flags. Which Azure control would meet the operational need? Private DNS zone access for peered VNets Gateway transit on hub peering VNet peering for private backbone connectivity Allow forwarded traffic on VNet peering Explanation Correct Answer D:Allow forwarded traffic on VNet peering permits forwarded packets between peered VNets through a hub appliance where appropriate. Incorrect Answers A:That approach links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution; it does not replace Allow forwarded traffic on VNet peering for the constraint in this scenario. B:This alternative lets an eligible peered spoke use a hub's VPN or ExpressRoute gateway, which solves a different networking task. It does not directly permit forwarded packets between peered VNets through a hub appliance where appropriate. C:VNet peering for private backbone connectivity connects two Azure virtual networks over the Microsoft backbone without a VPN appliance. The current problem instead requires a control that permits forwarded packets between peered VNets through a hub appliance where appropriate.
Question 80 A custom domain exists but is not associated with the route for its service. Which change should the network engineer make? Front Door origin group priority failover Front Door Private Link to supported origin Front Door route and origin mapping Front Door custom domain binding Explanation Correct Answer C:Front Door route and origin mapping is appropriate because it connects the matching frontend domain/path to the intended origin group. Incorrect Answers A:Front Door origin group priority failover selects healthy primary and secondary origins using configured priority and health. The current problem instead requires a control that connects the matching frontend domain/path to the intended origin group. B:This choice connects an eligible Front Door Premium origin privately without exposing it broadly. It leaves the specific need to connect the matching frontend domain/path to the intended origin group unaddressed. D:Front Door custom domain binding configures an approved domain, DNS validation and certificate for the edge endpoint. The current problem instead requires a control that connects the matching frontend domain/path to the intended origin group.
