Question 500 A team adds an NSG resource with correct rules but no effect on the application's traffic. What essential deployment step should it verify? Associate the NSG with the intended subnet or network interface Upgrade the VM's OS disk tier Place the NSG in the same alphabetical resource group order Configure an NSG name in a route table without associating the NSG to its target scope Explanation Correct Answer A:An unattached NSG does not filter the target traffic. Incorrect Answers B:Disk performance doesn't attach security rules. C:Names and ordering don't create associations. D:An NSG must be associated to supported subnet or NIC resources to enforce its traffic rules.
Question 501 An outbound HTTPS connection is permitted by an NSG, and response traffic comes back. What NSG behavior is relevant? Every response requires a separate manual inbound allow for the ephemeral port NSGs inspect application code for malicious logic Open a separate rule for every return packet as if NSGs lacked connection state NSGs are stateful and track permitted flows for corresponding return traffic Explanation Correct Answer D:Return packets of an established permitted flow aren't governed like an unrelated new inbound connection. Incorrect Answers A:Stateful processing handles return traffic. B:NSGs filter network properties, not application source. C:Azure NSGs use stateful connection flow tracking; return packets of allowed traffic do not require an independent mirrored rule.
Question 502 Two office sites need private network access into Azure over encrypted tunnels, while remote users also need connectivity. What design detail must distinguish the solutions? Site-to-site tunnels versus separately configured point-to-site client access Subscription tag colors for each user Using a public web app as a VPN concentrator without configuration An availability set as a substitute for network gateway Explanation Correct Answer A:Gateway connectivity modes support different endpoint types and authentication patterns. Incorrect Answers B:Tags don't identify tunnel peers. C:Public hosting isn't an Azure VPN solution. D:Compute redundancy doesn't terminate tunnels.
Question 503 An on-premises application needs to resolve a private Azure service name linked to a private DNS zone. What design component may be required? Increase VM CPU size without changing resolvers Use ExpressRoute circuit names as DNS host records Appropriate conditional forwarding or a supported Azure DNS Private Resolver path Only a public DNS MX record Explanation Correct Answer C:On-premises resolvers need a route to the private DNS namespace. Incorrect Answers A:Compute isn't the missing name-resolution path. B:Circuit labels aren't a DNS forwarding configuration. D:Mail records don't forward private service lookups.
Question 504 A team attempts peering between individual subnets instead of VNets. Which scope is correct? Every subnet can create its own ExpressRoute circuit without a gateway Availability sets connect individual subnets A storage account's file share determines peering scope VNet peering connects the virtual networks, with subnet rules applied as needed Explanation Correct Answer D:Peering is configured between VNets, not directly between two subnet objects. Incorrect Answers A:A subnet isn't an ExpressRoute circuit. B:Availability sets are VM fault-domain placement objects. C:File shares aren't VNet peering endpoints.
Question 505 A firewall appliance sits in the hub VNet and application spoke traffic must traverse it. What additional aspect may be required besides peering? Add an NSG allow rule without configuring the required route to the appliance A resource lock on every spoke subnet Configured user-defined routes and suitable peering/gateway settings Rename the hub resource group to 'secure' Explanation Correct Answer C:Peering doesn't by itself force traffic through an inspection appliance. Incorrect Answers A:Allowing traffic does not direct it to a virtual appliance; a user-defined route supplies the next hop. B:Locks don't create forwarding routes. D:Metadata doesn't steer flows.
Question 506 An enterprise creates separate spoke VNets for test and production to isolate IP spaces. Which design concern remains? Use nonoverlapping ranges and controlled routing/security boundaries Peering all spokes to one hub automatically enables unrestricted spoke-to-spoke transit Every spoke must share the same CIDR to be manageable Adding identical tags makes test traffic private automatically Explanation Correct Answer A:Logical separation only helps when network paths and filtering support the intended isolation. Incorrect Answers B:Transit requires deliberate routing and controls. C:Overlapping ranges impede connectivity planning. D:Tags don't enforce segmentation.
Question 507 A company has the same internal application name but wants internal clients to receive a private IP and external clients to see a public front end. What design choice fits? Choose an Azure region pair and ignore records Use a public zone for private-only endpoint addresses and assume VNet resolution is automatic Put an internal-only A record in the public zone and expect it to become private Separate public and private DNS resolution views with appropriate linkage Explanation Correct Answer D:Split-horizon name resolution can return different addresses for internal and Internet clients. Incorrect Answers A:Geography doesn't define DNS responses. B:Public DNS and private VNet-linked DNS have different visibility and integration requirements. C:Public DNS publication doesn't enforce network access.
Question 508 A website is deployed in two regions and must direct clients to a healthy regional endpoint when one fails. Which service concept should be evaluated? An availability set in the primary region only An Azure resource group lock A storage account object lifecycle rule Health-aware traffic routing, such as Azure Traffic Manager for DNS-based choices Explanation Correct Answer D:A routing profile can steer new DNS answers toward a healthy endpoint. Incorrect Answers A:A regional set doesn't route clients to a different region. B:Locks don't select a healthy customer destination. C:Blob tiering doesn't route clients.
Question 509 An application has a redundant VM in the same subnet but global users complain of high latency. What distinction should the architect recognize? A region pair automatically moves each client's HTTP request to its nearest site Choose the cheapest remote region without measuring latency or designing zone resilience Local compute redundancy doesn't automatically choose a nearer geographic serving region Adding a second VM halves all cross-continental round-trip time Explanation Correct Answer C:Latency and instance resilience are different architecture questions. Incorrect Answers A:Region pairing isn't a global router. B:Low unit price alone does not satisfy network proximity and failure-domain reliability requirements. D:Duplicate servers in one region don't shorten distance.
Question 510 A solution needs private customer-office connectivity into Azure but not public HTTP access. Which resource-selection distinction is important? Use private networking such as VPN/ExpressRoute rather than a public web front end A storage lifecycle policy can replace encrypted network connectivity Assume a valid virtual network name automatically creates a private WAN circuit A public Application Gateway alone provides an office VPN tunnel Explanation Correct Answer A:Enterprise network connectivity and public application publishing solve different requirements. Incorrect Answers B:Storage rules aren't live network tunnels. C:Naming an Azure VNet does not provision ExpressRoute or a site-to-site VPN to an office network. D:An HTTP reverse proxy isn't a site-to-site VPN.
