Question 430 A team asks whether managed AKS means Microsoft deploys and secures all code and worker workloads automatically. What remains the customer's responsibility? Configure and secure cluster workloads, permissions and appropriate node pools Treat every AKS worker node as the cluster control-plane API endpoint All user application authorization is automatically granted by Microsoft AKS automatically patches every custom image's third-party packages Explanation Correct Answer A:Managed Kubernetes reduces control-plane work but does not remove tenant application responsibility. Incorrect Answers B:AKS separates managed orchestration control plane components from tenant worker nodes. C:Application identities and privileges remain customer decisions. D:Image maintenance requires appropriate supply-chain controls.
Question 431 An AKS deployment has fluctuating pods, and the worker-node pool remains too small. Which complementary scaling mechanisms might help? Increase a storage account's retention period Increase DNS cache expiration rather than configure pod and node autoscaling Turn off cluster health monitoring Horizontal Pod Autoscaler and cluster/node-pool autoscaling where supported Explanation Correct Answer D:Pods and node capacity can scale at different layers of the Kubernetes stack. Incorrect Answers A:Retention doesn't add nodes. B:DNS caching does not add Kubernetes pod replicas or capacity-constrained worker nodes. C:Less telemetry won't relieve capacity pressure.
Question 432 A team deploys three application tiers in Azure and wants a private address space for communication between its resources. Which Azure network resource is foundational? An Azure network security group by itself An ExpressRoute circuit alone A subscription billing profile An Azure virtual network Explanation Correct Answer D:A VNet supplies a logical private network and address space for Azure workloads. Incorrect Answers A:An NSG evaluates allowed traffic but does not allocate the VNet address space that hosts the private subnets. B:A private WAN link doesn't replace the Azure VNet that hosts resources. C:Billing does not provision a network.
Question 433 Two departments create VNets that may later be peered, but both use overlapping address ranges. What should they reconsider? Use nonoverlapping IP address spaces for planned VNet connectivity Create identical subnets in each network as a prerequisite Add more tags to both VNets Change only VNet display names Explanation Correct Answer A:Overlapping address spaces prevent ordinary peering and create ambiguous routes. Incorrect Answers B:Duplicate ranges worsen addressing conflicts. C:Tags cannot make duplicate addresses routable. D:Names do not resolve overlapping IP routes.
Question 434 A three-tier application needs separate logical IP segments for web and database VMs within one VNet. Which concept should be used? Subnets with the intended address ranges and controls A storage account container name Separate cost tags only Availability sets Explanation Correct Answer A:Subnets segment a VNet into addressable network portions. Incorrect Answers B:Blob namespaces have no role in IP subnet segmentation. C:Cost metadata does not create network segments. D:VM placement sets do not define IP subnets.
Question 435 A new Azure subnet cannot accommodate the planned number of VM interfaces. What should the engineer revisit? The VM OS disk tier The subscription's friendly name The billing currency setting The subnet CIDR size and Azure-reserved addresses Explanation Correct Answer D:Usable IP capacity depends on address range size and platform reservations. Incorrect Answers A:Disk performance doesn't increase subnet capacity. B:Names do not allocate IP addresses. C:Invoice currency doesn't change IP arithmetic.
Question 436 An Azure VM NIC is assigned a private IP from a subnet. Which relationship is correct? The subnet is a child of an Azure cost budget The subnet belongs to a virtual network that provides its address space The VM must have a public IP to use its private subnet Subnets are automatically separate Azure subscriptions Explanation Correct Answer B:The NIC's subnet determines its private network placement. Incorrect Answers A:Budgets do not own IP networks. C:A VM can communicate privately without a public IP. D:Subnets subdivide a VNet address space and do not create billing or governance subscriptions.
Question 437 Two VMs in subnets of the same Azure VNet should exchange private traffic. What normally makes that possible, assuming no deny rules or custom route obstacles? Default VNet routing between its subnets Create an ExpressRoute circuit to the same VNet Use Azure DNS records as though they forwarded every IP packet between subnets Assign a new public IP to both VMs Explanation Correct Answer A:Azure provides system routes for normal VNet connectivity. Incorrect Answers B:A private WAN circuit isn't needed for local VNet routes. C:Name resolution translates names; IP routing and virtual networking transport the actual traffic. D:Public IPs are not required for intra-VNet private communication.
Question 438 A team expects one Azure virtual network to span arbitrary unrelated Azure regions. What placement limitation should be understood? A VNet is regional, and cross-region connectivity uses appropriate networking mechanisms The VNet name determines physical regions Every subnet automatically spans the entire global Azure network An availability set extends a VNet into more regions Explanation Correct Answer A:Separate regional VNets can connect through supported peering or other network paths. Incorrect Answers B:Names cannot change network scope. C:Subnets belong to their regional VNet. D:Fault-domain placement is not cross-region network expansion.
Question 439 A VM has only a private NIC and no configured public ingress. Which inference is most accurate? Every private IP is globally routable over the Internet It is not automatically reachable as a public Internet endpoint A virtual network is always disconnected from every outbound service Azure Policy automatically creates an Internet-facing load balancer Explanation Correct Answer B:Public access requires an appropriate public-facing path and security configuration. Incorrect Answers A:Private addressing is not Internet-routable by definition. C:Private inbound does not mean no outbound path can be configured. D:Policy isn't an automatic ingress publisher.
Question 440 Users can reach a service by IP but not by its hostname. Which aspect of networking needs investigation? The VM size's GPU count The Azure region pair mapping The storage account billing tier DNS record and resolution configuration Explanation Correct Answer D:Correct IP routing with failed hostnames points toward name resolution. Incorrect Answers A:Accelerators are unrelated to DNS. B:A pair doesn't fix an incorrect A or CNAME record. C:Storage prices do not make a hostname resolvable.
