Question 970 A migration project must review suspicious WAF matches while keeping detection-only behavior. Which configuration addresses the stated network constraint? WAF detection mode for tuning WAF on Azure Front Door for global edge protection WAF false-positive exclusion tuning WAF diagnostic logging and investigation Explanation Correct Answer A:The relevant action is WAF detection mode for tuning: it logs matching malicious patterns without blocking legitimate traffic during a controlled baseline. Incorrect Answers B:This choice inspects web traffic at Microsoft's global edge before it reaches regional origins. It leaves the specific need to log matching malicious patterns without blocking legitimate traffic during a controlled baseline unaddressed. C:This alternative narrows a proven harmless match while retaining the remainder of managed protections, which solves a different networking task. It does not directly log matching malicious patterns without blocking legitimate traffic during a controlled baseline. D:This alternative correlates WAF rule IDs, policy actions and client requests to investigate web filtering, which solves a different networking task. It does not directly log matching malicious patterns without blocking legitimate traffic during a controlled baseline.
Question 971 A route needs a URL path changed before forwarding to the origin. Which choice matches the specific technical condition? Front Door origin health probe Front Door route and origin mapping Front Door Rules Engine rewrite Front Door Rules Engine redirect Explanation Correct Answer C:Front Door Rules Engine rewrite changes the upstream URL path while the client's visible URL remains stable. Incorrect Answers A:This alternative checks origin availability from the edge to exclude unhealthy backends, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable. B:This alternative connects the matching frontend domain/path to the intended origin group, which solves a different networking task. It does not directly change the upstream URL path while the client's visible URL remains stable. D:Front Door Rules Engine redirect returns an HTTP redirect to the client for an approved URL transformation. The current problem instead requires a control that changes the upstream URL path while the client's visible URL remains stable.
Question 972 A VM remains blocked although an allow rule was created in its subnet NSG. What action most directly addresses the documented failure? NSG network interface association NSG subnet association NSG effective rule inspection ASG-based NSG access rule Explanation Correct Answer C:The relevant action is NSG effective rule inspection: it reads merged effective rules after both subnet and NIC associations. Incorrect Answers A:Although NSG network interface association applies additional instance-specific NSG rules to a selected network interface, that is not sufficient to read merged effective rules after both subnet and NIC associations in this case. B:This alternative applies a network security group to all eligible network interfaces in a selected subnet, which solves a different networking task. It does not directly read merged effective rules after both subnet and NIC associations. D:ASG-based NSG access rule references application security groups as source or destination in supported NSG rules. The current problem instead requires a control that reads merged effective rules after both subnet and NIC associations.
Question 973 A service engineer needs to exclude an unhealthy decommissioned VM from the LB backend. What should the administrator change or deploy? Regional Azure Load Balancer for L4 traffic Azure Traffic Manager DNS routing Load Balancer load-balancing rule Load Balancer backend pool membership Explanation Correct Answer D:Load Balancer backend pool membership selects the intended backend network interfaces or IPs that receive distributed traffic. Incorrect Answers A:This alternative distributes TCP or UDP flows to healthy backend instances in an Azure region, which solves a different networking task. It does not directly select the intended backend network interfaces or IPs that receive distributed traffic. B:That approach chooses between geographically distributed public endpoints through DNS responses; it does not replace Load Balancer backend pool membership for the constraint in this scenario. C:Although Load Balancer load-balancing rule defines a frontend protocol/port and backend pool mapping for distributed connections, that is not sufficient to select the intended backend network interfaces or IPs that receive distributed traffic in this case.
Question 974 A failover test requires a healthy secondary destination to be selected by Traffic Manager. What is the most defensible solution for this case? Cross-region Azure Load Balancer design Traffic Manager endpoint health monitoring Azure Traffic Manager DNS routing Internal Load Balancer frontend Explanation Correct Answer B:This choice uses endpoint status probes to determine which DNS endpoints remain eligible. Incorrect Answers A:This alternative uses supported regional frontends beneath a global load balancing layer for L4 regional resiliency, which solves a different networking task. It does not directly use endpoint status probes to determine which DNS endpoints remain eligible. C:This choice chooses between geographically distributed public endpoints through DNS responses. It leaves the specific need to use endpoint status probes to determine which DNS endpoints remain eligible unaddressed. D:Internal Load Balancer frontend is useful when the goal is to expose a private VNet IP address for a load-balanced service rather than a public endpoint. Here, the required behavior is to use endpoint status probes to determine which DNS endpoints remain eligible.
Question 975 An application needs a secondary private IP configuration without provisioning a new VM. Which step best addresses this particular situation? Subnet size and reserved IP planning Private IP allocation consistency across NICs NIC-level public IP association IP configuration for multiple VM addresses Explanation Correct Answer D:The intended behavior is to use multiple supported IP configurations on a network interface for distinct service addresses. IP configuration for multiple VM addresses is the direct configuration or deployment choice. Incorrect Answers A:Although Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet, that is not sufficient to use multiple supported IP configurations on a network interface for distinct service addresses in this case. B:This choice ensures private addresses belong to the selected subnet and interface configuration. It leaves the specific need to use multiple supported IP configurations on a network interface for distinct service addresses unaddressed. C:NIC-level public IP association is useful when the goal is to attache the public IP to the correct network interface IP configuration. Here, the required behavior is to use multiple supported IP configurations on a network interface for distinct service addresses.
Question 976 An outage review shows slow BGP failure recognition across private connectivity. Which choice matches the specific technical condition? ExpressRoute redundancy planning ExpressRoute provider failover testing ExpressRoute Direct ExpressRoute BFD for rapid failure detection Explanation Correct Answer D:ExpressRoute BFD for rapid failure detection uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. Incorrect Answers A:Although ExpressRoute redundancy planning uses redundant circuits or locations as required to survive equipment and site failures, that is not sufficient to use supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone in this case. B:ExpressRoute provider failover testing validates routing and application failover across configured independent ExpressRoute paths. The current problem instead requires a control that uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone. C:ExpressRoute Direct provides dedicated high-capacity direct ports at a supported peering location. The current problem instead requires a control that uses supported Bidirectional Forwarding Detection to detect link failure faster than routing timers alone.
Question 977 An address range expansion must be coordinated with route advertisements and peerings. What should the team implement or correct? Address and subnet allocation inventory Subnet size and reserved IP planning Custom IP Prefix for bring-your-own-IP Address-prefix growth and readdress planning Explanation Correct Answer D:Address-prefix growth and readdress planning expands address capacity while managing dependencies and routing effects. Incorrect Answers A:This alternative tracks CIDR ownership, free space and subnet relationships before deployment, which solves a different networking task. It does not directly expand address capacity while managing dependencies and routing effects. B:Although Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet, that is not sufficient to expand address capacity while managing dependencies and routing effects in this case. C:Custom IP Prefix for bring-your-own-IP is useful when the goal is to onboard an organization's eligible public IPv4 address block into Azure. Here, the required behavior is to expand address capacity while managing dependencies and routing effects.
Question 978 A support ticket provides a precise TCP flow and asks for the rule that denied it. Which implementation most directly resolves this requirement? VNet flow log collection ASG-based NSG access rule IP flow verify for NSG traffic decision NSG inbound rule source and port Explanation Correct Answer C:This choice tests a specified source/destination/port and reports the allowing or blocking NSG rule. Incorrect Answers A:Although VNet flow log collection captures supported virtual network flow data for operational and security analysis, that is not sufficient to test a specified source/destination/port and reports the allowing or blocking NSG rule in this case. B:This alternative references application security groups as source or destination in supported NSG rules, which solves a different networking task. It does not directly test a specified source/destination/port and reports the allowing or blocking NSG rule. D:That approach restricts traffic entering a NIC or subnet by source, destination and service port; it does not replace IP flow verify for NSG traffic decision for the constraint in this scenario.
Question 979 Administrators need RDP to private VMs but security forbids direct public management ports. What is the most appropriate next design decision? Application Security Group membership ASG-based NSG access rule Azure Bastion for browser-based VM administration NSG network interface association Explanation Correct Answer C:This choice provides managed remote VM access without exposing RDP or SSH public IPs on each VM. Incorrect Answers A:This alternative groups VM interfaces by application role for NSG rule targeting, which solves a different networking task. It does not directly provide managed remote VM access without exposing RDP or SSH public IPs on each VM. B:ASG-based NSG access rule is useful when the goal is to reference application security groups as source or destination in supported NSG rules. Here, the required behavior is to provide managed remote VM access without exposing RDP or SSH public IPs on each VM. D:NSG network interface association applies additional instance-specific NSG rules to a selected network interface. The current problem instead requires a control that provides managed remote VM access without exposing RDP or SSH public IPs on each VM.
Question 980 A regulated service needs outbound HTTPS decrypted and scanned by the managed firewall. Which change should the network engineer make? Firewall logs and threat intelligence monitoring Azure Firewall application rule Azure Firewall Standard for stateful filtering Azure Firewall Premium for TLS inspection Explanation Correct Answer D:The relevant action is Azure Firewall Premium for TLS inspection: it uses the Premium tier's supported TLS inspection and advanced threat features. Incorrect Answers A:This alternative uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features. B:This choice applies FQDN- or application-aware outbound access controls for supported protocols. It leaves the specific need to use the Premium tier's supported TLS inspection and advanced threat features unaddressed. C:This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features.
