Question 490 A VM has a public IP but SSH is blocked by the NSG. Which statement is correct? Any public IP automatically permits every TCP port A public IP changes the VM's guest OS password A public address alone does not override network security rules An NSG is only a resource-tagging mechanism Explanation Correct Answer C:IP routability and permitted traffic are separate requirements. Incorrect Answers A:NSG and host firewall rules still apply. B:Network addressing doesn't manage credentials. D:NSGs filter traffic.
Question 491 A partner's firewall allowlist requires a stable Azure-hosted service address. Which property should the team consider? A resource tag that contains the old address Using a VM's private ephemeral disk name A supported static public IP allocation for the ingress endpoint Changing the Azure portal navigation language Explanation Correct Answer C:An intended stable address avoids unplanned endpoint changes. Incorrect Answers A:Tags don't allocate or reserve IP addresses. B:Disk names don't provide public address stability. D:Language preferences aren't IP allocations.
Question 492 A managed API uses a public endpoint and HTTPS. Which security principle still applies? The API must store all secrets in query strings A TLS certificate makes every caller a trusted administrator Any public endpoint disables network access controls Authentication and authorization must be configured for protected operations Explanation Correct Answer D:TLS secures transport but doesn't decide who may call an API. Incorrect Answers A:HTTPS doesn't require unsafe secret placement. B:Encryption does not grant identity roles. C:Firewalls and other policies can still restrict access.
Question 493 A team needs to distribute requests among healthy web servers, not connect its office LAN to Azure. Which category of service is appropriate? An Azure VPN Gateway as the application load balancer An Azure load-balancing service A storage firewall IP list only An ExpressRoute circuit to customers' browsers Explanation Correct Answer B:Load balancers provide traffic distribution across application instances. Incorrect Answers A:VPN Gateway connects private networks but isn't a general web server load balancer. C:Storage restrictions do not distribute web requests. D:A circuit is a private WAN, not HTTP pool routing.
Question 494 A service needs to distribute TCP connections among several VM instances using transport-level rules. Which Azure component is designed for this? Use an Application Gateway HTTP-routing rule for a simple arbitrary TCP service Azure Purview catalog scans Azure Load Balancer Azure Backup Explanation Correct Answer C:Azure Load Balancer distributes layer-4 TCP/UDP connections based on frontend/backend configuration. Incorrect Answers A:An HTTP layer-7 routing policy does not replace the appropriate layer-4 Azure Load Balancer behavior. B:Data discovery doesn't direct TCP flows. D:Backup doesn't select healthy connection backends.
Question 495 A website needs host-based routing and web application firewall integration at the HTTP layer. Which Azure service should the team evaluate? An Azure Files share Azure Application Gateway with relevant WAF capabilities A single Azure public IP without a gateway A raw Azure VPN Gateway Explanation Correct Answer B:Application Gateway provides layer-7 HTTP routing and optional web application firewall features. Incorrect Answers A:Shared files are not an HTTP reverse proxy. C:An address alone doesn't route HTTP requests by path. D:VPN tunnels do not interpret web host/path routes.
Question 496 A load balancer keeps sending traffic to a failed VM even after its app stops accepting connections. Which setting should operators review? The backend health probe path, port, and thresholds The VM resource group description The subscription billing period The storage account's archive tier Explanation Correct Answer A:Health probes help the load balancer stop choosing failed backends. Incorrect Answers B:A description cannot check application availability. C:Billing dates don't detect unhealthy HTTP servers. D:Data temperature doesn't assess backend health.
Question 497 An organization serves users on multiple continents and wants a global HTTP entry point that can route based on performance and health. Which Azure offering is relevant? A storage account access key Use an Azure Load Balancer for global HTTP application routing without considering layer-7 requirements Azure Front Door A single VM availability set in one region Explanation Correct Answer C:Front Door offers global entry and acceleration/routing for web applications. Incorrect Answers A:An account key cannot distribute HTTP traffic globally. B:Load Balancer is primarily layer 4 and does not provide the full global HTTP entry and routing feature set. D:An availability set doesn't provide a global web entry.
Question 498 A VM's private IP can ping a nearby server, but TCP 443 fails. Which diagnostic direction is most suitable? Buy more storage bandwidth Rename the VM to include 'https' Add a second management group Check effective security rules, routes and application listener for TCP 443 Explanation Correct Answer D:Packet filtering and listener availability can differ by protocol and port. Incorrect Answers A:Disk throughput doesn't allow blocked ports. B:Names don't open TCP sockets. C:Governance hierarchy isn't a TCP listener.
Question 499 An administrator needs to diagnose Azure VM connectivity and effective network routes. Which Azure service category can help? Azure Cost Analysis Azure Policy compliance score alone Azure Data Box shipping Azure Network Watcher diagnostic tools Explanation Correct Answer D:Network Watcher includes relevant network troubleshooting and inspection capabilities. Incorrect Answers A:Costs don't show effective NIC routing and packet restrictions. B:A compliance report isn't a packet-path diagnosis. C:Offline transport doesn't troubleshoot VNet traffic.
Question 500 A team adds an NSG resource with correct rules but no effect on the application's traffic. What essential deployment step should it verify? Associate the NSG with the intended subnet or network interface Upgrade the VM's OS disk tier Place the NSG in the same alphabetical resource group order Configure an NSG name in a route table without associating the NSG to its target scope Explanation Correct Answer A:An unattached NSG does not filter the target traffic. Incorrect Answers B:Disk performance doesn't attach security rules. C:Names and ordering don't create associations. D:An NSG must be associated to supported subnet or NIC resources to enforce its traffic rules.
