Question 980 A regulated service needs outbound HTTPS decrypted and scanned by the managed firewall. Which change should the network engineer make? Firewall logs and threat intelligence monitoring Azure Firewall application rule Azure Firewall Standard for stateful filtering Azure Firewall Premium for TLS inspection Explanation Correct Answer D:The relevant action is Azure Firewall Premium for TLS inspection: it uses the Premium tier's supported TLS inspection and advanced threat features. Incorrect Answers A:This alternative uses firewall diagnostic events and threat intelligence signals to investigate blocked and allowed traffic, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features. B:This choice applies FQDN- or application-aware outbound access controls for supported protocols. It leaves the specific need to use the Premium tier's supported TLS inspection and advanced threat features unaddressed. C:This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly use the Premium tier's supported TLS inspection and advanced threat features.
Question 981 A DNS operator needs to change target DNS server IPs for a forwarded domain. What action most directly addresses the documented failure? DNS forwarding ruleset and rules Azure DNS Private Resolver inbound endpoint Custom DNS server settings on VNet Azure DNS Private Resolver outbound endpoint Explanation Correct Answer A:DNS forwarding ruleset and rules is appropriate because it matches a domain suffix and forwards queries to designated DNS target servers. Incorrect Answers B:That approach accepts DNS queries arriving from on-premises or connected networks into Azure resolution; it does not replace DNS forwarding ruleset and rules for the constraint in this scenario. C:Custom DNS server settings on VNet is useful when the goal is to direct VNet-resident clients to selected DNS servers for specialized resolution. Here, the required behavior is to match a domain suffix and forwards queries to designated DNS target servers. D:This alternative sends selected Azure DNS queries toward other DNS servers through managed forwarding, which solves a different networking task. It does not directly match a domain suffix and forwards queries to designated DNS target servers.
Question 982 The VPN status is Connected but branch users cannot reach a VM subnet. What is the most defensible solution for this case? Local network gateway configuration Route-based site-to-site VPN gateway IPsec/IKE policy interoperability S2S reachability verification beyond tunnel state Explanation Correct Answer D:The relevant action is S2S reachability verification beyond tunnel state: it validates routing, NSGs and return paths after IPsec reports connected. Incorrect Answers A:Local network gateway configuration is useful when the goal is to record on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. Here, the required behavior is to validate routing, NSGs and return paths after IPsec reports connected. B:That approach supports dynamic routing-based IPsec connectivity between Azure and a corporate VPN device; it does not replace S2S reachability verification beyond tunnel state for the constraint in this scenario. C:IPsec/IKE policy interoperability is useful when the goal is to align matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. Here, the required behavior is to validate routing, NSGs and return paths after IPsec reports connected.
Question 983 The branch ISP changes its address and the Azure peer configuration must be reconciled. Which configuration should the team verify or implement first? Local network gateway configuration BGP route advertisement on VPN S2S peer public IP change procedure Policy-based traffic-selector compatibility Explanation Correct Answer C:S2S peer public IP change procedure updates peer and local network gateway settings together during a branch cutover. Incorrect Answers A:Local network gateway configuration records on-premises VPN endpoint addresses and remote prefixes for an Azure S2S connection. The current problem instead requires a control that updates peer and local network gateway settings together during a branch cutover. B:BGP route advertisement on VPN is useful when the goal is to exchange dynamic network prefixes over a supported route-based VPN configuration. Here, the required behavior is to update peer and local network gateway settings together during a branch cutover. D:Although Policy-based traffic-selector compatibility handles a restricted legacy VPN peer that relies on specific address selectors, that is not sufficient to update peer and local network gateway settings together during a branch cutover in this case.
Question 984 A migration approval requires evidence that planned Azure subnet addresses are unallocated. Which approach best satisfies the access or connectivity requirement? Private IP allocation consistency across NICs Address and subnet allocation inventory Nonoverlapping VNet CIDR planning Subnet size and reserved IP planning Explanation Correct Answer B:Address and subnet allocation inventory tracks CIDR ownership, free space and subnet relationships before deployment. Incorrect Answers A:Private IP allocation consistency across NICs is useful when the goal is to ensure private addresses belong to the selected subnet and interface configuration. Here, the required behavior is to track CIDR ownership, free space and subnet relationships before deployment. C:That approach prevents address collisions between Azure networks and corporate routes; it does not replace Address and subnet allocation inventory for the constraint in this scenario. D:Subnet size and reserved IP planning is useful when the goal is to account for Azure-reserved addresses and workload growth in each subnet. Here, the required behavior is to track CIDR ownership, free space and subnet relationships before deployment.
Question 985 A new hub VNet overlaps an existing data-center prefix before a VPN link is deployed. Which Azure control would meet the operational need? Subnet size and reserved IP planning Custom IP Prefix for bring-your-own-IP Address and subnet allocation inventory Nonoverlapping VNet CIDR planning Explanation Correct Answer D:The relevant action is Nonoverlapping VNet CIDR planning: it prevents address collisions between Azure networks and corporate routes. Incorrect Answers A:Subnet size and reserved IP planning accounts for Azure-reserved addresses and workload growth in each subnet. The current problem instead requires a control that prevents address collisions between Azure networks and corporate routes. B:This choice onboards an organization's eligible public IPv4 address block into Azure. It leaves the specific need to prevent address collisions between Azure networks and corporate routes unaddressed. C:Although Address and subnet allocation inventory tracks CIDR ownership, free space and subnet relationships before deployment, that is not sufficient to prevent address collisions between Azure networks and corporate routes in this case.
Question 986 A storage application hard-codes the endpoint NIC's IP and breaks its expected HTTPS hostname. Which network component or setting is the best fit? Private Endpoint peered-VNet reachability Private Endpoint from on-premises via hybrid route Private Endpoint hostname-specific TLS handling Private Endpoint for PaaS private IP access Explanation Correct Answer C:The relevant action is Private Endpoint hostname-specific TLS handling: it uses the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients. Incorrect Answers A:This choice confirms peering, DNS zone links and security policies for clients in another VNet. It leaves the specific need to use the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients unaddressed. B:This alternative uses VPN or ExpressRoute reachability and DNS so private clients can access a private endpoint, which solves a different networking task. It does not directly use the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients. D:Private Endpoint for PaaS private IP access is useful when the goal is to expose a supported Azure service through a private IP interface in the consumer VNet. Here, the required behavior is to use the service's expected DNS name and certificate rather than replacing it with a raw private IP in clients.
Question 987 The security team wants web destination controls based on FQDN in Azure Firewall. Which change should the network engineer make? Azure Firewall network rule Azure Firewall Standard for stateful filtering Azure Firewall policy rule collection priority Azure Firewall application rule Explanation Correct Answer D:Azure Firewall application rule applies FQDN- or application-aware outbound access controls for supported protocols. Incorrect Answers A:Although Azure Firewall network rule permits or denies supported IP-based TCP or UDP flows by addresses and ports, that is not sufficient to apply FQDN- or application-aware outbound access controls for supported protocols in this case. B:This alternative provides managed stateful network and application filtering without Premium-only inspection, which solves a different networking task. It does not directly apply FQDN- or application-aware outbound access controls for supported protocols. C:Azure Firewall policy rule collection priority is useful when the goal is to organize matching firewall rules with correct ordering and actions. Here, the required behavior is to apply FQDN- or application-aware outbound access controls for supported protocols.
Question 988 A roaming consultant must reach one internal application over an encrypted client connection. Which choice matches the specific technical condition? P2S gateway SKU and concurrent-user limits P2S OpenVPN protocol selection VPN client device deployment validation Point-to-site VPN for individual users Explanation Correct Answer D:Point-to-site VPN for individual users is appropriate because it provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. Incorrect Answers A:P2S gateway SKU and concurrent-user limits sizes point-to-site connectivity for the expected simultaneous remote clients. The current problem instead requires a control that provides encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. B:This alternative chooses a supported SSL/TLS-based VPN client protocol for broad client compatibility, which solves a different networking task. It does not directly provide encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel. C:Although VPN client device deployment validation validates supported OS, client version, tunnel profile and endpoint requirements, that is not sufficient to provide encrypted client-to-VNet connectivity without establishing a site-to-site office tunnel in this case.
Question 989 A new public service needs its authoritative records managed within Azure. What should the team implement or correct? Azure DNS public zone delegation Azure DNS Private Resolver outbound endpoint Private DNS zone VNet link Private DNS zone auto-registration link Explanation Correct Answer A:The relevant action is Azure DNS public zone delegation: it hosts authoritative public DNS records under an internet-resolvable zone. Incorrect Answers B:That approach sends selected Azure DNS queries toward other DNS servers through managed forwarding; it does not replace Azure DNS public zone delegation for the constraint in this scenario. C:Although Private DNS zone VNet link permits a selected VNet's resolver to query records in a private DNS zone, that is not sufficient to host authoritative public DNS records under an internet-resolvable zone in this case. D:This alternative registers eligible VM DNS records automatically in a linked private DNS zone, which solves a different networking task. It does not directly host authoritative public DNS records under an internet-resolvable zone.
Question 990 Azure shows a live tunnel but the branch device blocks traffic to one prefix. What is the most defensible solution for this case? On-premises VPN device policy matching IPsec/IKE policy interoperability BGP route advertisement on VPN Policy-based traffic-selector compatibility Explanation Correct Answer A:On-premises VPN device policy matching aligns corporate firewall route, access and selector rules with Azure connection design. Incorrect Answers B:This choice aligns matching tunnel cryptographic parameters between Azure gateway and on-premises VPN device. It leaves the specific need to align corporate firewall route, access and selector rules with Azure connection design unaddressed. C:This alternative exchanges dynamic network prefixes over a supported route-based VPN configuration, which solves a different networking task. It does not directly align corporate firewall route, access and selector rules with Azure connection design. D:This choice handles a restricted legacy VPN peer that relies on specific address selectors. It leaves the specific need to align corporate firewall route, access and selector rules with Azure connection design unaddressed.
