Question 890 A hub plan mistakenly puts the VPN gateway inside an application subnet. What should the team implement or correct? Subnet size and reserved IP planning Subnet network policy placement GatewaySubnet for virtual network gateway Static private NIC IP configuration Explanation Correct Answer C:The relevant action is GatewaySubnet for virtual network gateway: it allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. Incorrect Answers A:That approach accounts for Azure-reserved addresses and workload growth in each subnet; it does not replace GatewaySubnet for virtual network gateway for the constraint in this scenario. B:Subnet network policy placement places security and routing policies on the workload subnet rather than assuming a public IP defines security. The current problem instead requires a control that allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways. D:Static private NIC IP configuration assigns an intended stable private address to a VM network interface within its subnet. The current problem instead requires a control that allocates the reserved gateway subnet used by Azure VPN or ExpressRoute gateways.
Question 891 A scale-out app exhausts ephemeral outbound translation ports on another egress path. What action most directly addresses the documented failure? Private DNS zone access for peered VNets NAT Gateway for predictable outbound SNAT NAT Gateway subnet association Azure Virtual Network Manager connectivity groups Explanation Correct Answer B:This choice provides scalable managed outbound connectivity for private subnet workloads. Incorrect Answers A:This choice links the private DNS zone to the VNet where clients need its records rather than assuming VNet peering provides name resolution. It leaves the specific need to provide scalable managed outbound connectivity for private subnet workloads unaddressed. C:This alternative applies a NAT Gateway's outbound SNAT behavior to a selected subnet, which solves a different networking task. It does not directly provide scalable managed outbound connectivity for private subnet workloads. D:This choice centrally coordinates VNet connectivity topology across many subscriptions. It leaves the specific need to provide scalable managed outbound connectivity for private subnet workloads unaddressed.
Question 892 Two peered VNets must use one approved Private Endpoint. One client has a blocked effective route and the other resolves the service FQDN publicly. Which plan addresses both missing prerequisites? Deploy an office VPN without correcting Azure routes or internal private DNS Link a DNS zone in the second VNet while leaving the first client on its blocked route Correct the peered-VNet effective route and provide private DNS zone links or equivalent resolver forwarding for both clients Change a single NSG rule without checking the route or incorrect DNS answer Explanation Correct Answer C:Reaching the shared private endpoint requires permitted packet routing to its private IP and the service FQDN resolving privately in each consuming network. Incorrect Answers A:A remote office VPN would not repair the given Azure VNet routing and DNS problems. B:Fixing the public DNS response alone leaves the other VNet with its known blocked route to the endpoint. D:A security rule alone does not correct the separately identified missing route and public DNS mapping.
Question 893 An organization moves a private service to a new account while retaining the normal FQDN pattern. Which configuration addresses the stated network constraint? Private Endpoint migration cutover Private DNS zone group on private endpoint Private Endpoint DNS A-record integration Private Endpoint subresource selection Explanation Correct Answer A:The intended behavior is to update endpoint connections, DNS and service firewall settings together during a resource move. Private Endpoint migration cutover is the direct configuration or deployment choice. Incorrect Answers B:Private DNS zone group on private endpoint is useful when the goal is to integrate an endpoint with the appropriate private DNS zone records where supported. Here, the required behavior is to update endpoint connections, DNS and service firewall settings together during a resource move. C:Private Endpoint DNS A-record integration is useful when the goal is to map the service's normal FQDN to its private endpoint IP address for authorized clients. Here, the required behavior is to update endpoint connections, DNS and service firewall settings together during a resource move. D:Private Endpoint subresource selection targets the correct service resource and subresource in a private endpoint connection. The current problem instead requires a control that updates endpoint connections, DNS and service firewall settings together during a resource move.
Question 894 An organization adds new subscriptions that should inherit approved hub connectivity. Which configuration should the team verify or implement first? NAT Gateway for predictable outbound SNAT Azure Virtual Network Manager connectivity groups Azure Route Server for BGP exchange Azure Virtual Network Manager security admin rules Explanation Correct Answer B:This choice centrally coordinates VNet connectivity topology across many subscriptions. Incorrect Answers A:This alternative provides scalable managed outbound connectivity for private subnet workloads, which solves a different networking task. It does not directly centrally coordinate VNet connectivity topology across many subscriptions. C:This choice exchanges dynamic routes with supported network virtual appliances over BGP. It leaves the specific need to centrally coordinate VNet connectivity topology across many subscriptions unaddressed. D:This alternative centrally enforces supported security policies across network groups before workload NSGs, which solves a different networking task. It does not directly centrally coordinate VNet connectivity topology across many subscriptions.
Question 895 A deployment team must distribute a supported Azure VPN client configuration package. Which network component or setting is the best fit? P2S OpenVPN protocol selection P2S VPN client profile generation P2S route distribution to clients P2S client-side authentication troubleshooting Explanation Correct Answer B:P2S VPN client profile generation is appropriate because it delivers the correct gateway endpoints, routes and authentication settings to client devices. Incorrect Answers A:This choice chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility. It leaves the specific need to deliver the correct gateway endpoints, routes and authentication settings to client devices unaddressed. C:P2S route distribution to clients is useful when the goal is to advertise or includes the correct private destination prefixes in remote-user VPN profiles. Here, the required behavior is to deliver the correct gateway endpoints, routes and authentication settings to client devices. D:That approach checks identity, certificates and local profile logs before changing gateway routes; it does not replace P2S VPN client profile generation for the constraint in this scenario.
Question 896 A business is standardizing firewall policies across regional Virtual WAN hubs. Which step best addresses this particular situation? Azure Firewall Manager for fleet governance Secure Virtual WAN hub with Azure Firewall Azure Firewall Premium for TLS inspection Azure Firewall DNS proxy Explanation Correct Answer A:This choice manages and monitors multiple cloud firewalls and supported secure hubs centrally. Incorrect Answers B:Secure Virtual WAN hub with Azure Firewall is useful when the goal is to deploy Azure Firewall into a supported Virtual WAN virtual hub for managed inspection. Here, the required behavior is to manage and monitors multiple cloud firewalls and supported secure hubs centrally. C:Azure Firewall Premium for TLS inspection is useful when the goal is to use the Premium tier's supported TLS inspection and advanced threat features. Here, the required behavior is to manage and monitors multiple cloud firewalls and supported secure hubs centrally. D:That approach provides centrally proxied DNS resolution for supported FQDN-based network policy; it does not replace Azure Firewall Manager for fleet governance for the constraint in this scenario.
Question 897 A regulated workload may reach only named storage accounts through service endpoint routes. What should the administrator change or deploy? Service endpoint diagnostic separation Service endpoint policy for storage resource scope Service endpoint policy subnet binding Service endpoint public address distinction Explanation Correct Answer B:The intended behavior is to restrict supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. Service endpoint policy for storage resource scope is the direct configuration or deployment choice. Incorrect Answers A:That approach checks source subnet configuration, resource firewall rules and actual service reachability; it does not replace Service endpoint policy for storage resource scope for the constraint in this scenario. C:Service endpoint policy subnet binding associates an approved service endpoint policy with the intended endpoint-enabled workload subnet. The current problem instead requires a control that restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources. D:Service endpoint public address distinction retains public service endpoint addressing while changing private subnet routing and service firewall identity. The current problem instead requires a control that restricts supported endpoint traffic from a subnet to specifically allowed Azure Storage resources.
Question 898 The company wants to protect encrypted branch connectivity against an AZ outage. Which step best addresses this particular situation? Zone-redundant VPN Gateway VPN gateway SKU throughput planning Local network gateway configuration Active-active VPN gateway design Explanation Correct Answer A:The relevant action is Zone-redundant VPN Gateway: it places a supported VPN gateway across availability zones for regional resilience. Incorrect Answers B:VPN gateway SKU throughput planning selects a supported VPN gateway tier sized for aggregate tunnels and traffic. The current problem instead requires a control that places a supported VPN gateway across availability zones for regional resilience. C:This alternative records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection, which solves a different networking task. It does not directly place a supported VPN gateway across availability zones for regional resilience. D:Although Active-active VPN gateway design uses multiple gateway instances and connections for supported VPN link resiliency, that is not sufficient to place a supported VPN gateway across availability zones for regional resilience in this case.
Question 899 A service endpoint-enabled subnet remains unauthorized at a restricted storage service. Which network component or setting is the best fit? Service endpoint policy subnet binding Service endpoint diagnostic separation PaaS resource firewall VNet rule Private Endpoint for hybrid private-service consumers Explanation Correct Answer C:The intended behavior is to permit the specified subnet at the target managed service after a service endpoint is enabled. PaaS resource firewall VNet rule is the direct configuration or deployment choice. Incorrect Answers A:Service endpoint policy subnet binding associates an approved service endpoint policy with the intended endpoint-enabled workload subnet. The current problem instead requires a control that permits the specified subnet at the target managed service after a service endpoint is enabled. B:This alternative checks source subnet configuration, resource firewall rules and actual service reachability, which solves a different networking task. It does not directly permit the specified subnet at the target managed service after a service endpoint is enabled. D:Private Endpoint for hybrid private-service consumers uses an approved private endpoint with hybrid DNS and VPN/ExpressRoute reachability when on-premises clients require private PaaS access. The current problem instead requires a control that permits the specified subnet at the target managed service after a service endpoint is enabled.
Question 900 The VPN gateway rejects a valid-looking client certificate because its root is not trusted. Which configuration should the team verify or implement first? VPN client device deployment validation Microsoft Entra ID P2S authentication RADIUS authentication for P2S VPN P2S root certificate trust configuration Explanation Correct Answer D:The relevant action is P2S root certificate trust configuration: it validates certificate-authenticated VPN clients against an uploaded trusted root. Incorrect Answers A:VPN client device deployment validation is useful when the goal is to validate supported OS, client version, tunnel profile and endpoint requirements. Here, the required behavior is to validate certificate-authenticated VPN clients against an uploaded trusted root. B:This alternative authenticates supported VPN clients using the organization's Entra identity platform, which solves a different networking task. It does not directly validate certificate-authenticated VPN clients against an uploaded trusted root. C:That approach uses an existing supported RADIUS server for VPN user authentication; it does not replace P2S root certificate trust configuration for the constraint in this scenario.
