Question 80 A custom domain exists but is not associated with the route for its service. Which change should the network engineer make? Front Door origin group priority failover Front Door Private Link to supported origin Front Door route and origin mapping Front Door custom domain binding Explanation Correct Answer C:Front Door route and origin mapping is appropriate because it connects the matching frontend domain/path to the intended origin group. Incorrect Answers A:Front Door origin group priority failover selects healthy primary and secondary origins using configured priority and health. The current problem instead requires a control that connects the matching frontend domain/path to the intended origin group. B:This choice connects an eligible Front Door Premium origin privately without exposing it broadly. It leaves the specific need to connect the matching frontend domain/path to the intended origin group unaddressed. D:Front Door custom domain binding configures an approved domain, DNS validation and certificate for the edge endpoint. The current problem instead requires a control that connects the matching frontend domain/path to the intended origin group.
Question 81 A new spoke VNet address space is missing from installed client routes. Which configuration addresses the stated network constraint? P2S route distribution to clients P2S gateway SKU and concurrent-user limits P2S VPN client profile generation P2S client address pool planning Explanation Correct Answer A:The intended behavior is to advertise or includes the correct private destination prefixes in remote-user VPN profiles. P2S route distribution to clients is the direct configuration or deployment choice. Incorrect Answers B:P2S gateway SKU and concurrent-user limits sizes point-to-site connectivity for the expected simultaneous remote clients. The current problem instead requires a control that advertises or includes the correct private destination prefixes in remote-user VPN profiles. C:That approach delivers the correct gateway endpoints, routes and authentication settings to client devices; it does not replace P2S route distribution to clients for the constraint in this scenario. D:That approach allocates remote-user tunnel addresses without overlapping VNet and on-premises ranges; it does not replace P2S route distribution to clients for the constraint in this scenario.
Question 82 An organization replaces its branch firewall IP and must update the Azure peer definition. Which implementation most directly resolves this requirement? S2S peer public IP change procedure Local network gateway configuration BGP route advertisement on VPN Virtual network gateway deployment Explanation Correct Answer B:The relevant action is Local network gateway configuration: it records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. Incorrect Answers A:S2S peer public IP change procedure is useful when the goal is to update peer and local network gateway settings together during a branch cutover. Here, the required behavior is to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. C:Although BGP route advertisement on VPN exchanges dynamic network prefixes over a supported route-based VPN configuration, that is not sufficient to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection in this case. D:That approach provisions the Azure-managed VPN gateway attached to the target VNet; it does not replace Local network gateway configuration for the constraint in this scenario.
Question 83 A hybrid application fails, and engineers must distinguish down tunnel from routing failure. Which Azure control would meet the operational need? IPsec/IKE policy interoperability Local network gateway configuration VPN connection status and tunnel diagnostics S2S reachability verification beyond tunnel state Explanation Correct Answer C:The relevant action is VPN connection status and tunnel diagnostics: it inspects tunnel state, negotiated parameters and gateway logs before changing routes. Incorrect Answers A:That approach aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device; it does not replace VPN connection status and tunnel diagnostics for the constraint in this scenario. B:This alternative records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, which solves a different networking task. It does not directly inspect tunnel state, negotiated parameters and gateway logs before changing routes. D:Although S2S reachability verification beyond tunnel state validates routing, NSGs and return paths after IPsec reports connected, that is not sufficient to inspect tunnel state, negotiated parameters and gateway logs before changing routes in this case.
Question 84 A corporate data center wants storage private endpoints accessible over a VPN. What should the administrator change or deploy? Private Endpoint from on-premises via hybrid route Private Endpoint peered-VNet reachability Private Endpoint hostname-specific TLS handling Network-level connectivity prerequisite for remote Private Endpoints Explanation Correct Answer A:This choice uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. Incorrect Answers B:Although Private Endpoint peered-VNet reachability confirms peering, DNS zone links and security policies for clients in another VNet, that is not sufficient to use VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint in this case. C:Private Endpoint hostname-specific TLS handling uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients. The current problem instead requires a control that uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint. D:That approach requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP; it does not replace Private Endpoint from on-premises via hybrid route for the constraint in this scenario.
Question 85 An organization requires point-to-site authentication through its RADIUS policy service. Which Azure control would meet the operational need? P2S VPN client profile generation P2S client-side authentication troubleshooting RADIUS authentication for P2S VPN Microsoft Entra ID P2S authentication Explanation Correct Answer C:This choice uses an existing supported RADIUS server for VPN user authentication. Incorrect Answers A:This choice delivers the correct gateway endpoints, routes and authentication settings to client devices. It leaves the specific need to use an existing supported RADIUS server for VPN user authentication unaddressed. B:Although P2S client-side authentication troubleshooting checks identity, certificates and local profile logs before changing gateway routes, that is not sufficient to use an existing supported RADIUS server for VPN user authentication in this case. D:That approach authenticates supported VPN clients using the organization's Entra identity platform; it does not replace RADIUS authentication for P2S VPN for the constraint in this scenario.
Question 86 An auditor asks for an interactive query of Azure resource exposure properties. Which configuration addresses the stated network constraint? Network Watcher effective security rules Defender for Cloud Secure Score recommendations Azure Monitor network resource metrics Cloud Security Explorer asset queries Explanation Correct Answer D:The intended behavior is to searche security and resource context to find network assets matching risk conditions. Cloud Security Explorer asset queries is the direct configuration or deployment choice. Incorrect Answers A:Network Watcher effective security rules is useful when the goal is to list the combined network security rules effective on an Azure VM interface. Here, the required behavior is to searche security and resource context to find network assets matching risk conditions. B:That approach prioritizes cloud security posture findings including exposed network resources; it does not replace Cloud Security Explorer asset queries for the constraint in this scenario. C:Azure Monitor network resource metrics is useful when the goal is to collect performance and health signals for Azure networking resources. Here, the required behavior is to searche security and resource context to find network assets matching risk conditions.
Question 87 An engineer must distinguish private endpoint network policies from unrelated workload NSG associations. Which step best addresses this particular situation? Private Endpoint from on-premises via hybrid route Private Endpoint subnet placement Network-level connectivity prerequisite for remote Private Endpoints Private Endpoint NSG and route policy support Explanation Correct Answer D:This choice applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed. Incorrect Answers A:That approach uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint; it does not replace Private Endpoint NSG and route policy support for the constraint in this scenario. B:Private Endpoint subnet placement deploys a supported private endpoint NIC in the correct consumer VNet subnet. The current problem instead requires a control that applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed. C:Network-level connectivity prerequisite for remote Private Endpoints requires appropriate VPN, ExpressRoute or peering connectivity before remote networks can route to a private endpoint IP. The current problem instead requires a control that applies enabled private endpoint network policies when traffic inspection or subnet filtering is needed.
Question 88 An Azure-hosted service needs a Private Link service on the provider side rather than merely a consumer endpoint. Which Azure control would meet the operational need? Private Endpoint resource-specific authorization Private Link service alias distribution Private Link service provider design Private Endpoint for PaaS private IP access Explanation Correct Answer C:Private Link service provider design is appropriate because it exposes a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. Incorrect Answers A:This choice scopes a private-link connection to the intended service instance and applies provider-side approval and service access restrictions. It leaves the specific need to expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link unaddressed. B:This alternative gives authorized consumers a service alias to request private endpoints without using the full resource ID, which solves a different networking task. It does not directly expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link. D:This alternative exposes a supported Azure service through a private IP interface in the consumer VNet, which solves a different networking task. It does not directly expose a customer-hosted service behind a supported Azure Standard Load Balancer through Private Link.
Question 89 A new S2S tunnel needs the on-premises VPN peer and network prefixes specified in Azure. Which network component or setting is the best fit? On-premises VPN device policy matching Virtual network gateway deployment S2S peer public IP change procedure Local network gateway configuration Explanation Correct Answer D:The intended behavior is to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. Local network gateway configuration is the direct configuration or deployment choice. Incorrect Answers A:This choice aligns corporate firewall route, access and selector rules with Azure connection design. It leaves the specific need to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection unaddressed. B:Virtual network gateway deployment provisions the Azure-managed VPN gateway attached to the target VNet. The current problem instead requires a control that records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. C:S2S peer public IP change procedure is useful when the goal is to update peer and local network gateway settings together during a branch cutover. Here, the required behavior is to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection.
Question 90 An engineer distinguishes server-side rewrite from an external 301 redirection. Which Azure control would meet the operational need? Front Door Rules Engine redirect Front Door WAF policy association Front Door Rules Engine rewrite Front Door route and origin mapping Explanation Correct Answer C:The intended behavior is to change the upstream URL path while the client's visible URL remains stable. Front Door Rules Engine rewrite is the direct configuration or deployment choice. Incorrect Answers A:This alternative returns an HTTP redirect to the client for an approved URL transformation, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable. B:This choice applies supported application-layer rules at the globally distributed edge. It leaves the specific need to change the upstream URL path while the client's visible URL remains stable unaddressed. D:This alternative connects the matching frontend domain/path to the intended origin group, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable.
