Question 440 Users can reach a service by IP but not by its hostname. Which aspect of networking needs investigation? The VM size's GPU count The Azure region pair mapping The storage account billing tier DNS record and resolution configuration Explanation Correct Answer D:Correct IP routing with failed hostnames points toward name resolution. Incorrect Answers A:Accelerators are unrelated to DNS. B:A pair doesn't fix an incorrect A or CNAME record. C:Storage prices do not make a hostname resolvable.
Question 441 A database VM must receive SQL traffic only from an approved application subnet. Which control can help filter subnet or NIC traffic? A resource tag named SQL-only A network security group with appropriate inbound rules An Azure Price Calculator estimate A blob lifecycle policy Explanation Correct Answer B:NSG rules can permit relevant sources/ports and deny unwanted traffic. Incorrect Answers A:Labels do not enforce packet filtering. C:A cost forecast is not a firewall. D:Storage aging rules cannot filter database packets.
Question 442 An application server can receive approved inbound calls but must not send traffic to a prohibited destination. Which NSG rule direction should be assessed? Attach an Azure route table alone and assume it enforces every port filter Only an inbound security rule on a different VM A management-group display name Outbound security rules on the relevant subnet or NIC Explanation Correct Answer D:Outbound rules can restrict egress sources, destinations and ports. Incorrect Answers A:Route tables steer traffic; NSGs evaluate applicable inbound and outbound allow/deny rules. B:Unrelated inbound restrictions don't govern the app's outgoing path. C:Governance hierarchy naming doesn't enforce specific egress packets.
Question 443 An NSG has a broad allow rule and a more specific deny rule with different priorities. Which fact determines which matching rule applies? Rule priority order for matching traffic The storage account that hosts VM logs The user who last visited the portal Alphabetical sorting of rule names Explanation Correct Answer A:Lower-numbered priority rules are evaluated before higher-numbered ones. Incorrect Answers B:Logging storage does not order NSG rules. C:Portal session order doesn't set network filtering priority. D:Names do not determine rule evaluation order.
Question 444 Traffic from a protected subnet must pass through a network virtual appliance rather than follow default routing. What Azure construct can steer that path? A user-defined route associated with the subnet A subscription cost center tag A resource lock on the VM Use only an NSG allow rule to select the next-hop network appliance Explanation Correct Answer A:A route table can direct matching destinations to a next hop such as a virtual appliance. Incorrect Answers B:Tags cannot steer network packets. C:Locks don't select packet next hops. D:NSGs filter flows; a user-defined route sets the routing next hop for traffic.
Question 445 A company wants centralized stateful inspection of internet-bound traffic from several Azure subnets. Which managed Azure product might it evaluate? Azure Data Box Azure Cost Management alone Azure Firewall with suitable routing and policies Azure Files Explanation Correct Answer C:Azure Firewall supplies managed network filtering and central policy controls. Incorrect Answers A:Offline data movement is not a firewall. B:Cost analysis does not inspect traffic. D:A file share cannot inspect VNet packets.
Question 446 An architect designs a very small Azure subnet and assumes every address in its range is assignable to VM NICs. What correction is important? A VNet has no private-address reservations Every address in the subnet is automatically a public IP Azure reserves certain addresses in each subnet Subnet size is determined by the resource group tag count Explanation Correct Answer C:Not all IPs in an Azure subnet CIDR are assignable to tenant NICs. Incorrect Answers A:The platform reserves addresses for networking. B:Private address space remains private. D:Metadata does not alter CIDR capacity.
Question 447 A storage account permits traffic from selected VNets using supported service endpoints. What is the core idea? Extend VNet identity to supported Azure service access over Microsoft's backbone Add a service hostname alias without enabling a supported service endpoint or private path Publish a new public VM on every subnet Create a private IP NIC for the service inside each subnet Explanation Correct Answer A:Service endpoints enable service firewall rules to recognize selected subnets. Incorrect Answers B:Name aliases do not establish a supported network service endpoint or its access restrictions. C:VM public exposure isn't service endpoint configuration. D:Private endpoints, not service endpoints, introduce private service NICs.
Question 448 A web tier in VNet A needs low-latency private IP communication with a database in VNet B. What Azure networking feature connects them directly? Assign the two VNets identical resource-group tags instead of configuring peering Virtual network peering with appropriate permissions and rules Configuring VM availability sets in both VNets Changing both VNets to the same resource group Explanation Correct Answer B:Peering enables private connectivity between nonoverlapping VNets. Incorrect Answers A:Tags classify resources but do not provide packet routing between distinct VNets. C:Fault-domain distribution doesn't connect networks. D:Grouping doesn't establish routing.
Question 449 Two nonoverlapping VNets in the same Azure region need direct private connectivity. Which option is normally suitable? Two Azure storage containers with identical names An Azure Data Box shipment Regional VNet peering A policy assignment that tags both VNets Connected Explanation Correct Answer C:Peering connects address spaces without requiring a customer-owned WAN device. Incorrect Answers A:Container names don't create VNet connectivity. B:An offline transfer appliance does not route live IP traffic. D:Policy metadata cannot exchange packets.
Question 450 An application uses separate VNets in different Azure regions and requires private VNet-to-VNet connectivity. Which mechanism is specifically designed for this? An availability set spanning both regions Create route-table entries without the required network connection or peering A single subnet deployed in both regions Global virtual network peering where supported Explanation Correct Answer D:Global peering connects eligible VNets across Azure regions. Incorrect Answers A:Availability sets are not region-spanning VNet connections. B:Routes alone do not establish cross-region VNet peering connectivity between unconnected virtual networks. C:Subnets belong to regional VNets.
