Question 460 A team wants a public hostname to resolve directly to an IPv4 address. Which DNS record type ordinarily represents that mapping? An A record An MX record An SRV record A TXT record Explanation Correct Answer A:A records map DNS names to IPv4 addresses. Incorrect Answers B:MX identifies mail exchange hosts, not the basic address mapping. C:SRV locates services by protocol and port, not a basic A mapping. D:TXT stores arbitrary text, not the ordinary hostname-to-IPv4 mapping.
Question 461 The marketing site hostname www.example.com should alias an existing canonical hostname managed elsewhere. Which DNS record is appropriate at the alias name? An NS record on www for this simple alias purpose An MX record A CNAME record where DNS rules permit An SPF TXT record Explanation Correct Answer C:A CNAME makes one name an alias of another canonical name. Incorrect Answers A:NS records delegate authority rather than point a host alias. B:MX routes domain email and isn't a web host alias. D:Sender policy data doesn't alias an HTTP host.
Question 462 A private endpoint has been created for an Azure service but clients still resolve the service name to its public address. Which integration may be missing? A backup policy on the endpoint NIC Private DNS resolution configured for the service's private endpoint Another VM availability set A resource lock on the storage account Explanation Correct Answer B:Private DNS commonly maps the service name to the endpoint's private IP. Incorrect Answers A:Recovery rules don't fix DNS resolution. C:Fault-domain placement doesn't change service DNS. D:A lock doesn't create private DNS records.
Question 463 An application must accept connections from Internet clients through an Azure VM. What addressing component can support a public-facing entry point? An Azure public IP assigned to an appropriate frontend or VM NIC with security controls A VNet peering link to a private network only A private IP only inside an isolated subnet A resource group tag named Public Explanation Correct Answer A:Public addresses permit Internet routing when correctly exposed. Incorrect Answers B:Peering alone doesn't provide public Internet publication. C:Private addressing isn't directly reachable from the public Internet. D:Metadata does not create Internet ingress.
Question 464 A managed Azure service is configured with a public endpoint. Which network characteristic describes client access? The service has a reachable public-facing network address, subject to authentication and firewall rules Every caller automatically receives data-reader permissions The service cannot use TLS encryption The endpoint necessarily becomes a private subnet NIC Explanation Correct Answer A:Public network exposure is distinct from authorization to use the service. Incorrect Answers B:Public routing does not grant identity privileges. C:Public endpoints can still use HTTPS or other encryption. D:That describes a private endpoint.
Question 465 A security team wants Azure Storage access using a private IP in its VNet rather than relying on the public storage service endpoint. Which feature fits? Azure Private Endpoint for the supported storage subresource A VPN Gateway without configuring the storage private endpoint A resource group lock Create a public service endpoint without a private endpoint NIC in the VNet Explanation Correct Answer A:Private Link uses a private address within the VNet to reach the service. Incorrect Answers B:VPN connectivity alone does not create a private storage-service NIC. C:Locks do not move data traffic into a VNet private address. D:Public reachability is different from a private endpoint connection placed in the private address space.
Question 466 An analyst says a storage account private endpoint makes Entra permissions unnecessary. What is the correct distinction? Private networking limits the connection path, while data authentication and authorization still apply Every private endpoint turns off encryption A private IP automatically grants subscription Owner to callers Private endpoints are only billing labels Explanation Correct Answer A:Private Link does not bypass storage access controls. Incorrect Answers B:TLS still applies where supported. C:Addressing doesn't assign RBAC. D:They create network interfaces for supported service connectivity.
Question 467 A datacenter client connects over a VPN to an Azure VNet and must reach a storage private endpoint there. What additional design topic is important? Assigning the storage service a second public IP instead Increasing the resource group name length Enabling Azure Virtual Desktop for every client Routing and DNS resolution for the endpoint's private IP from the on-premises client Explanation Correct Answer D:Both the network path and name-to-private-IP resolution must work. Incorrect Answers A:A second public path doesn't satisfy private endpoint connectivity. B:Names don't repair private network routes. C:Desktop virtualization isn't required for storage traffic.
Question 468 A company wants an encrypted connection between its on-premises network gateway and an Azure virtual network across the Internet. Which Azure service is designed for this? Azure Blob Archive Use a public load balancer alone to connect an office router to an Azure VNet Azure VPN Gateway configured for site-to-site VPN A VM availability set Explanation Correct Answer C:A site-to-site VPN carries encrypted network traffic between gateways. Incorrect Answers A:An object tier cannot transport live private packets. B:A load balancer does not establish an encrypted site-to-site tunnel between on-premises and Azure networks. D:Fault-domain grouping isn't a VPN termination service.
Question 469 Employees working from home need secure client-device connectivity to a company Azure VNet. Which VPN design is relevant? Only a site-to-site VPN between two corporate routers Point-to-site VPN via Azure VPN Gateway Azure Data Box over courier An NSG rule without a tunnel Explanation Correct Answer B:P2S allows supported individual client connections into the virtual network. Incorrect Answers A:S2S doesn't by itself enroll roaming laptop clients. C:Offline shipment is not live client network access. D:A network rule alone doesn't establish remote encrypted connectivity.
Question 470 A team believes a site-to-site VPN is equivalent to a private dedicated telecom circuit that avoids the public Internet. Which statement is accurate? VPN has no cryptographic protection VPN Gateway guarantees dedicated physical fiber into every office A VPN gateway only stores backup files A VPN typically encrypts traffic across an Internet-based connection Explanation Correct Answer D:VPN protects the packets but ordinarily relies on a public transport path. Incorrect Answers A:Encryption is central to supported VPN tunnel use. B:A dedicated circuit is a separate connectivity service. C:It is a live network connectivity component.
