All practice questions

1252 questions

All types1,252 Multiple choice644 Multiple select429 True / False47 Matching52 Ordering80

An administrator is configuring a new virtual network named `vnet-prod` in an Azure subscription. The virtual network is assigned the address space $192.168.1.0/24$ .

The administrator needs to deploy the following components:
- A Route-based VPN Gateway that supports future coexistence with ExpressRoute.
- An Azure Bastion host using the minimum supported subnet size.
- An application tier named `subnet-app` that must host at least 60 virtual machines.

Which subnet configuration meets all of these requirements while minimizing IP address waste?

subnet-app:

192.168.1.0/26

; AzureBastionSubnet:

192.168.1.64/26

; GatewaySubnet:

192.168.1.128/27

subnet-app:

192.168.1.0/25

; AzureBastionSubnet:

192.168.1.128/26

; GatewaySubnet:

192.168.1.192/27

subnet-app:

192.168.1.0/25

; AzureBastionSubnet:

192.168.1.128/27

; GatewaySubnet:

192.168.1.160/27

subnet-app:

192.168.1.0/25

; AzureBastionSubnet:

192.168.1.128/26

; GatewaySubnet:

192.168.1.192/30

Show answer & explanation

Answer: subnet-app: $192.168.1.0/25$ ; AzureBastionSubnet: $192.168.1.128/26$ ; GatewaySubnet: $192.168.1.192/27$

Answer

The configuration with subnet-app as

192.168.1.0/25

, AzureBastionSubnet as

192.168.1.128/26

, and GatewaySubnet as

192.168.1.192/27

The correct configuration allocates a /25 prefix for the application subnet to support 60 virtual machines (providing 123 usable IP addresses after accounting for the 5 reserved addresses), a /26 prefix for AzureBastionSubnet (the minimum size required for Azure Bastion), and a /27 prefix for GatewaySubnet (the minimum size required for VPN Gateway and ExpressRoute coexistence). All subnets fit within the 192.168.1.0/24 address space without overlapping.

Step-by-Step Solution

Determine the required size for the application subnet.

A /25 subnet is required.

To host 60 virtual machines, we need at least 60 usable IP addresses. In standard IP networks, a /26 subnet (64 addresses) would work since it has 62 usable addresses. However, Azure reserves 5 IP addresses per subnet (first 4 and last 1 address). A /26 subnet in Azure only has 59 usable IP addresses (

64 - 5 = 59

), which is insufficient. Therefore, a /25 subnet (

128 - 5 = 123

usable addresses) is required.

Determine the required size for the Azure Bastion subnet.

A /26 subnet is required.

Azure Bastion requires a subnet named AzureBastionSubnet with a minimum prefix size of /26.

Determine the required size for the GatewaySubnet.

A /27 subnet is required.

For VPN Gateway and ExpressRoute coexistence, Azure requires a GatewaySubnet with a prefix size of /27 or larger.

Verify subnet boundary alignment and overlap within the 192.168.1.0/24 address space.

All subnets fit sequentially: subnet-app (192.168.1.0 to 192.168.1.127), AzureBastionSubnet (192.168.1.128 to 192.168.1.191), and GatewaySubnet (192.168.1.192 to 192.168.1.223).

The subnets must align with CIDR block boundaries. The /25 block must start at 0 or 128. The /26 block must start at a multiple of 64 (0, 64, 128, 192). The /27 block must start at a multiple of 32 (0, 32, 64, 96, 128, 160, 192, 224). This layout avoids overlapping and minimizes space.

Key Concept

Azure subnet sizing constraints including reserved IP addresses and requirements for specific services like Azure Bastion and GatewaySubnet.

Question 622Question →

An administrator configures the virtual network components in an Azure subscription as shown in the tables below:

Virtual Machines and Subnet Associations:

Virtual Machine	Private IP	Subnet	Network Security Group (NSG)	Application Security Group (ASG)
VM1	10.1.1.4	Subnet1	NSG-NIC1 (NIC-level)	ASG-App
VM2	10.1.2.4	Subnet2	None	ASG-DB

* `Subnet1` is associated with `NSG-Subnet1`.
* `Subnet2` is not associated with any subnet-level NSG.
* `VM2` does not have any NIC-level NSG.

NSG-Subnet1 Inbound Rules:

Priority	Port	Protocol	Source	Destination	Action
110	1433	TCP	10.1.2.0/24	ASG-App	Allow
120	1433	TCP	Any	Any	Deny

NSG-Subnet1 Outbound Rules:

Priority	Port	Protocol	Source	Destination	Action
110	1433	TCP	ASG-App	10.1.2.0/24	Deny
120	1433	TCP	Any	Any	Allow

NSG-NIC1 Inbound Rules:

Priority	Port	Protocol	Source	Destination	Action
150	1433	TCP	10.1.2.4	Any	Deny
160	1433	TCP	Any	Any	Allow

NSG-NIC1 Outbound Rules:

Priority	Port	Protocol	Source	Destination	Action
150	1433	TCP	Any	ASG-DB	Allow
160	1433	TCP	Any	Any	Deny

Which of the following describes the status of the connection attempts on TCP port 1433?

The connection from VM2 to VM1 is allowed, and the connection from VM1 to VM2 is allowed.

The connection from VM2 to VM1 is allowed, and the connection from VM1 to VM2 is denied.

The connection from VM2 to VM1 is denied, and the connection from VM1 to VM2 is allowed.

The connection from VM2 to VM1 is denied, and the connection from VM1 to VM2 is denied.

Show answer & explanation

Answer: The connection from VM2 to VM1 is denied, and the connection from VM1 to VM2 is denied.

Answer

The connection from VM2 to VM1 is denied, and the connection from VM1 to VM2 is denied.

The correct option is that both connections are denied. For the inbound connection from VM2 to VM1, the subnet-level NSG (NSG-Subnet1) allows it, but the NIC-level NSG (NSG-NIC1) denies it. For the outbound connection from VM1 to VM2, the NIC-level NSG allows it, but the subnet-level NSG denies it. Since a connection must be allowed at both the subnet and NIC levels to succeed, both connection attempts fail.

Step-by-Step Solution

Analyze the inbound connection attempt from VM2 (10.1.2.4) to VM1 (10.1.1.4) on TCP port 1433.

For inbound traffic to VM1, the subnet-level NSG (NSG-Subnet1) is processed first, followed by the NIC-level NSG (NSG-NIC1).

Azure evaluates inbound security rules first at the subnet level and then at the network interface (NIC) level.

Evaluate the rules in NSG-Subnet1 and NSG-NIC1 for the inbound connection from VM2 to VM1.

In NSG-Subnet1, Rule 110 allows traffic from 10.1.2.0/24 to ASG-App (VM1). The traffic passes to the NIC level. In NSG-NIC1, Rule 150 denies traffic from 10.1.2.4 to Any. The traffic is blocked.

Since both NSGs are evaluated and NSG-NIC1 denies the traffic, the inbound connection from VM2 to VM1 is denied.

Analyze the outbound connection attempt from VM1 (10.1.1.4) to VM2 (10.1.2.4) on TCP port 1433.

For outbound traffic from VM1, the NIC-level NSG (NSG-NIC1) is processed first, followed by the subnet-level NSG (NSG-Subnet1).

Azure evaluates outbound security rules first at the NIC level and then at the subnet level.

Evaluate the rules in NSG-NIC1 and NSG-Subnet1 for the outbound connection from VM1 to VM2.

In NSG-NIC1, Rule 150 allows outbound traffic from Any to ASG-DB (VM2). The traffic passes to the subnet level. In NSG-Subnet1, Rule 110 denies outbound traffic from ASG-App (VM1) to 10.1.2.0/24. The traffic is blocked.

Since both NSGs are evaluated and NSG-Subnet1 denies the traffic, the outbound connection from VM1 to VM2 is denied.

Key Concept

Subnet-level and NIC-level NSG evaluation sequence for inbound and outbound traffic.

Question 623Question →

An organization has an Azure subscription containing two peered virtual networks: `VNet-Corp` (address space $10.150.0.0/16$ ) and `VNet-External` (address space $10.160.0.0/16$ ).

`VNet-Corp` contains three subnets:
- `Subnet-Transit` ( $10.150.1.0/24$ )
- `Subnet-App` ( $10.150.2.0/24$ )
- `Subnet-DB` ( $10.150.3.0/24$ )

A Network Virtual Appliance (NVA) with the private IP address $10.150.1.4$ is deployed in `Subnet-Transit`. IP forwarding is enabled on its network interface.

A route table named `RT-App` is associated with `Subnet-App`. The route table contains the following user-defined routes (UDRs):
- Route 1: Destination $10.150.0.0/16$ , Next hop type: `Virtual appliance`, Next hop: $10.150.1.4$
- Route 2: Destination $10.150.3.0/24$ , Next hop type: `Virtual network`
- Route 3: Destination $0.0.0.0/0$ , Next hop type: `Virtual appliance`, Next hop: $10.150.1.4$

A virtual machine in `Subnet-App` attempts to send traffic to the following destinations:
- Destination 1: $10.150.3.22$ (a database server in `Subnet-DB`)
- Destination 2: $10.160.5.5$ (a server in `VNet-External`)

Which next hops will Azure use to route the traffic to Destination 1 and Destination 2?

Destination 1: Virtual network; Destination 2: VNet peering

Destination 1: Virtual appliance; Destination 2: Virtual appliance

Destination 1: Virtual network; Destination 2: Virtual appliance

Destination 1: Virtual appliance; Destination 2: VNet peering

Show answer & explanation

Answer: Destination 1: Virtual network; Destination 2: VNet peering

Answer

Destination 1: Virtual network; Destination 2: VNet peering

For Destination 1 (10.150.3.22), Route 2 (10.150.3.0/24) has the longest matching prefix (/24), so its next hop type of Virtual network is used. For Destination 2 (10.160.5.5), the peered VNet system route (10.160.0.0/16) has a longer prefix match than the default route (0.0.0.0/0) in Route 3, so the system route wins and its next hop type of VNet peering is used.

Step-by-Step Solution

Analyze matching routes for Destination 1 (10.150.3.22)

Matching prefixes are 10.150.0.0/16 (UDR Route 1), 10.150.3.0/24 (UDR Route 2), and 0.0.0.0/0 (UDR Route 3).

To determine which route is used, we must identify all routes whose destination prefixes encompass the target IP.

Apply Longest Prefix Match (LPM) for Destination 1

The prefix 10.150.3.0/24 (/24) is longer than 10.150.0.0/16 (/16) and 0.0.0.0/0 (/0). The associated next hop is 'Virtual network'.

Azure selects the most specific route based on the longest prefix match algorithm.

Analyze matching routes for Destination 2 (10.160.5.5)

Matching prefixes are the peering system route 10.160.0.0/16 and UDR Route 3 (0.0.0.0/0).

When VNets are peered, Azure automatically adds a system route for the peered VNet's address space. We must evaluate UDRs against this system route.

Apply Longest Prefix Match (LPM) for Destination 2

The prefix 10.160.0.0/16 (/16) is longer than 0.0.0.0/0 (/0). The associated next hop is 'VNet peering'.

Since the peered VNet system route has a longer prefix than the UDR default route, the system route is selected, bypassing the NVA.

Key Concept

Route Selection Precedence and Longest Prefix Match (LPM) in Azure

Question 624Question →

To secure outbound communication, a security administrator associates a Network Security Group (NSG) named `NSG-Outbound` with a subnet. The NSG contains the following custom outbound security rules:

* `Deny-Internet-All`: Priority 180, Destination: `Internet`, Port: `Any`, Protocol: `Any`, Action: Deny
* `Allow-Web-Outbound`: Priority 240, Destination: `Internet`, Port: 443, Protocol: TCP, Action: Allow

A virtual machine residing in the subnet attempts to connect to an external web service over port 443.

What is the status of this outbound connection attempt?

The connection is blocked since the NSG evaluates the rule with priority 180 first, which denies the traffic.

The connection is allowed since the NSG processes rule 240 before rule 180.

The connection is allowed since specific destination port rules override general deny rules.

The connection is blocked since default Azure security rules prevent all custom outbound traffic.

Show answer & explanation

Answer: The connection is blocked since the NSG evaluates the rule with priority 180 first, which denies the traffic.

Answer

The connection is blocked since the NSG evaluates the rule with priority 180 first, which denies the traffic.

The connection is blocked since the NSG evaluates the rule with priority 180 first, which denies the traffic. Azure NSGs process rules in order of priority (lowest numbers first). Once a match is found, processing stops. Because 180 is lower than 240, the deny rule takes precedence.

Step-by-Step Solution

Identify the destination and port of the traffic attempt.

The traffic is outbound to the Internet on TCP port 443.

This helps determine which NSG rules match the traffic criteria.

Find all matching outbound NSG rules and identify their priority values.

Two rules match: `Deny-Internet-All` (Priority 180) and `Allow-Web-Outbound` (Priority 240).

Rules that match the traffic's source, destination, port, and protocol must be compared.

Apply the rule with the lowest priority number (highest precedence).

The rule with priority 180 is applied first, which denies the traffic. The connection is blocked.

Azure NSGs process rules sequentially based on priority numbers, stopping at the first match.

Key Concept

Azure Network Security Group (NSG) rule evaluation order

Estimated Time:45s

Question 625Question →

Your company has an Azure subscription containing a virtual network named `VNet1`. `VNet1` contains two subnets named `Subnet1` and `Subnet2`.

You have the following virtual machines and network configurations:
* `VM1` is in `Subnet1`. Its network interface `NIC1` is associated with an Application Security Group named `ASG-Web`.
* `VM2` is in `Subnet2`. Its network interface `NIC2` is associated with an Application Security Group named `ASG-Database`.
* A Network Security Group named `NSG-Subnet1` is associated with `Subnet1`.
* A Network Security Group named `NSG-NIC1` is associated with `NIC1`.
* A Network Security Group named `NSG-Subnet2` is associated with `Subnet2`.
* A Network Security Group named `NSG-NIC2` is associated with `NIC2`.

The Network Security Groups are configured with the following custom inbound rules:

NSG-Subnet1 Inbound Rules

Priority	Port	Protocol	Source	Destination	Action
100	80	TCP	Any	ASG-Web	Allow

NSG-NIC1 Inbound Rules

Priority	Port	Protocol	Source	Destination	Action
110	80	TCP	Any	Any	Deny
120	80	TCP	Any	ASG-Web	Allow

NSG-Subnet2 Inbound Rules

Priority	Port	Protocol	Source	Destination	Action
130	1433	TCP	ASG-Web	ASG-Database	Allow

NSG-NIC2 Inbound Rules

Priority	Port	Protocol	Source	Destination	Action
140	1433	TCP	Any	Any	Deny
150	1433	TCP	ASG-Web	ASG-Database	Allow

All other settings are at their default configurations.

A user on the internet attempts to establish an HTTP connection to `VM1` on TCP port 80. Simultaneously, `VM1` attempts to establish a SQL Server connection to `VM2` on TCP port 1433.

Which of the following describes the outcome of these connection attempts?

Both the HTTP connection to VM1 and the SQL Server connection to VM2 are blocked.

Both the HTTP connection to VM1 and the SQL Server connection to VM2 are allowed.

The HTTP connection to VM1 is allowed, but the SQL Server connection to VM2 is blocked.

The HTTP connection to VM1 is blocked, but the SQL Server connection to VM2 is allowed.

Show answer & explanation

Answer: Both the HTTP connection to VM1 and the SQL Server connection to VM2 are blocked.

Answer

Both the HTTP connection to VM1 and the SQL Server connection to VM2 are blocked.

For the HTTP connection to VM1, the inbound traffic is first allowed by the subnet-level NSG (NSG-Subnet1) via priority 100, but then evaluated by the NIC-level NSG (NSG-NIC1) where the Deny rule (priority 110) takes precedence over the Allow rule (priority 120). For the SQL Server connection to VM2, the outbound traffic from VM1 is allowed by default. However, when the traffic reaches VM2, the subnet-level NSG (NSG-Subnet2) allows it via priority 130, but the NIC-level NSG (NSG-NIC2) blocks it because the Deny rule (priority 140) takes precedence over the Allow rule (priority 150).

Step-by-Step Solution

Analyze the HTTP inbound traffic flow to VM1 on TCP port 80.

The traffic is first evaluated by the subnet-level NSG (NSG-Subnet1), where Rule 100 allows it because the destination matches ASG-Web. It then reaches the NIC-level NSG (NSG-NIC1), where the Deny rule (priority 110) is evaluated before the Allow rule (priority 120) because 110 is a lower priority number. The traffic is blocked at the NIC.

Inbound traffic is processed first by the subnet NSG and then by the NIC NSG. Within each NSG, rules are processed in order of priority (lowest number first).

Analyze the SQL Server outbound traffic flow from VM1.

The traffic is evaluated by the NIC-level NSG and subnet-level NSG outbound rules. Since no custom outbound rules are defined, the default outbound rules apply, which permit all virtual network traffic (AllowVnetOutbound).

Traffic between subnets in the same virtual network is allowed by default at the outbound level.

Analyze the SQL Server inbound traffic flow to VM2 on TCP port 1433.

The inbound traffic is first evaluated by the subnet-level NSG (NSG-Subnet2), where Rule 130 allows it because the source is ASG-Web and destination is ASG-Database. It then reaches the NIC-level NSG (NSG-NIC2), where the Deny rule (priority 140) is processed before the Allow rule (priority 150). The traffic is blocked at the NIC.

Inbound traffic to VM2 must pass both NSG-Subnet2 and NSG-NIC2. The NIC-level NSG blocks the traffic due to the priority order.

Key Concept

Network Security Group rule evaluation logic and precedence for inbound traffic using Application Security Groups.

Question 626Question →

An administrator plans to configure Azure File Sync. The environment contains the following resources:

* A Storage Sync Service named SyncService1
* An Azure Storage account named sa1 that contains two Azure file shares: shareA and shareB
* Two registered on-premises Windows servers: Server1 and Server2

The administrator must configure synchronization to meet the following requirements:

* Files in the folder Docs on Server1 must synchronize with shareA.
* Files in the folder Data on Server2 must synchronize with shareB.

Which of the following actions are required to configure the synchronization? (Select two.)

Select all that apply

Create a sync group named SyncGroup1, add shareA as the cloud endpoint, and add the folder Docs on Server1 as a server endpoint.

Create a sync group named SyncGroup2, add shareB as the cloud endpoint, and add the folder Data on Server2 as a server endpoint.

Create a single sync group named SyncGroup1, add both shareA and shareB as cloud endpoints, and add both server paths as server endpoints.

Assign the Storage Blob Data Contributor role to Server1 and Server2 to authenticate the File Sync agent to the storage account.

Show answer & explanation

Answer: Create a sync group named SyncGroup1, add shareA as the cloud endpoint, and add the folder Docs on Server1 as a server endpoint.; Create a sync group named SyncGroup2, add shareB as the cloud endpoint, and add the folder Data on Server2 as a server endpoint.

Answer

Create two separate sync groups, mapping each Azure file share as a cloud endpoint and each server folder path as a server endpoint to its respective sync group.

Each Azure File Sync sync group can only contain a single cloud endpoint (Azure File Share). Since synchronization is required between two different file shares and two different server paths, two separate sync groups must be created. Each sync group will link one file share as the cloud endpoint and the corresponding server path as a server endpoint.

Step-by-Step Solution

Determine the cloud endpoints needed for synchronization.

Identify that two separate Azure File Shares (shareA and shareB) must act as cloud endpoints.

Azure File Sync requires a cloud endpoint to represent the Azure File Share in a sync group.

Determine the sync group topology.

Identify that two separate sync groups must be created.

A sync group can contain only one cloud endpoint, so syncing to two different file shares requires two distinct sync groups.

Define the server endpoints within each sync group.

Associate the folder Docs on Server1 with SyncGroup1, and the folder Data on Server2 with SyncGroup2.

Server endpoints specify the path on a registered server that should be synchronized with the cloud endpoint of that sync group.

Key Concept

Azure File Sync Topology and Sync Group Constraints

Question 627Question →

You are deploying a containerized batch-processing utility to Azure Container Instances (ACI). The utility has the following requirements:
- It must run to completion, processing objects from an Azure storage queue.
- If the utility encounters an error during execution and terminates with a non-zero exit code, it must attempt to restart and run again.
- Once the utility completes processing successfully, it must shut down and not restart.
- The ACI container group must run inside a private virtual network named VNet1.

Which of the following configuration options should you select to meet these requirements? (Select TWO.)

Select all that apply

Set the restart policy of the container group to OnFailure.

Deploy the container group into a subnet in VNet1 delegated to Microsoft.ContainerInstance/containerGroups.

Set the restart policy of the container group to Always.

Set the restart policy of the container group to Never.

Deploy the container group into a subnet in VNet1 delegated to Microsoft.Web/serverFarms.

Show answer & explanation

Answer: Set the restart policy of the container group to OnFailure.; Deploy the container group into a subnet in VNet1 delegated to Microsoft.ContainerInstance/containerGroups.

Answer

Select the restart policy of the container group to OnFailure, and deploy the container group into a subnet in VNet1 delegated to Microsoft.ContainerInstance/containerGroups.

The requirement for the container to restart only on failure indicates that the OnFailure restart policy must be chosen. For integrating the ACI deployment into a private virtual network, Azure Container Instances requires a dedicated subnet that is explicitly delegated to the Microsoft.ContainerInstance/containerGroups service resource type.

Step-by-Step Solution

Analyze the container lifecycle requirements.

The workload is a batch utility that runs to completion but needs to retry on error, meaning it should not restart under normal completion (exit code 0) but must restart on failure (non-zero exit code).

This requirement determines the restart policy choice.

Select the correct ACI restart policy.

The OnFailure restart policy meets this condition. Always would cause infinite restarts on success, and Never would prevent retries on failure.

Only OnFailure behaves differently based on the exit code of the container.

Determine ACI network integration requirements.

ACI VNet integration requires deploying the container group into a subnet delegated specifically to Microsoft.ContainerInstance/containerGroups.

ACI cannot be deployed into a subnet delegated to other services or a subnet without delegation if VNet integration is configured.

Key Concept

Configuring restart policies and virtual network integration for Azure Container Instances (ACI).

Estimated Time:2m 0s

Question 628Question →

An administrator is designing a virtual network routing solution. A virtual network contains two subnets named `SubnetA` and `SubnetB`. A firewall virtual machine named `NVA1` is deployed in `SubnetB`. The administrator wants to route all outbound internet traffic from the virtual machines in `SubnetA` through `NVA1` for inspection before it reaches the internet.

Which two actions must the administrator perform to achieve this goal?

Select all that apply

Create a route table containing a route with the destination `0.0.0.0/0` and next hop type of Virtual appliance pointing to the private IP address of `NVA1`, and associate the route table with `SubnetA`.

Enable IP forwarding on the network interface (NIC) of the `NVA1` virtual machine.

Create a route table containing a route with the destination `0.0.0.0/0` and next hop type of Virtual network gateway pointing to the public IP address of `NVA1`, and associate the route table with `SubnetA`.

Enable IP forwarding on the network interfaces (NICs) of all virtual machines deployed in `SubnetA`.

Show answer & explanation

Answer: Create a route table containing a route with the destination `0.0.0.0/0` and next hop type of Virtual appliance pointing to the private IP address of `NVA1`, and associate the route table with `SubnetA`.; Enable IP forwarding on the network interface (NIC) of the `NVA1` virtual machine.

Answer

To route internet-bound traffic from SubnetA through a network virtual appliance (NVA) in SubnetB, the administrator must create a route table with a default route (0.0.0.0/0) where the next hop type is set to Virtual appliance and the next hop IP address is the private IP address of NVA1. This route table must be associated with SubnetA. Additionally, the administrator must enable IP forwarding on the network interface (NIC) of NVA1 to allow it to forward traffic destined for other locations.

To route SubnetA's internet traffic through NVA1, a route table must be created with a route for 0.0.0.0/0 pointing to the private IP of NVA1 as a Virtual appliance next hop type, and this route table must be associated with SubnetA. In addition, the NVA's network interface must have IP forwarding enabled so Azure allows it to receive and process traffic destined for other IP addresses.

Step-by-Step Solution

Define the user-defined route (UDR) for internet-bound traffic.

A route with address prefix 0.0.0.0/0 is configured with a next hop type of Virtual appliance and the next hop IP address set to the private IP address of NVA1.

This tells Azure to override the default system route for internet traffic and direct it to the NVA.

Associate the route table with SubnetA.

The route table is applied to SubnetA.

The UDR is only applied to VMs within subnets associated with the route table.

Enable IP forwarding on the NVA's network interface.

IP forwarding is enabled in Azure for the NIC of NVA1.

By default, Azure drops traffic sent to a VM that is not destined for that VM's IP address. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Key Concept

Configuring custom routing through a Network Virtual Appliance (NVA) using route tables and IP forwarding.

Question 629Question →

Your company has an Azure environment with three virtual networks in the East US region:

* VNet-Hub ( $10.10.0.0/16$ ) contains a Virtual Network Gateway configured for ExpressRoute. A virtual machine named VM-Hub is deployed in a subnet within VNet-Hub.
* VNet-SpokeA ( $10.20.0.0/16$ ) contains a virtual machine named VM-SpokeA deployed in a subnet within VNet-SpokeA.
* VNet-SpokeB ( $10.30.0.0/16$ ) contains a virtual machine named VM-SpokeB deployed in a subnet within VNet-SpokeB.

You configure virtual network peering between VNet-Hub and VNet-SpokeA, and between VNet-Hub and VNet-SpokeB.

You have the following requirements:
1. VM-SpokeA must be able to communicate with on-premises resources via the ExpressRoute gateway in VNet-Hub.
2. VM-SpokeB must NOT be able to communicate with on-premises resources, but must still communicate directly with VM-Hub.

Which two configurations should you perform to meet these requirements? (Select two.)

Select all that apply

In the virtual network peering configuration from VNet-SpokeA to VNet-Hub, select Use the remote virtual network's gateway or Route Server.

In the virtual network peering configuration from VNet-Hub to VNet-SpokeA, select Use this virtual network's gateway or Route Server.

In the virtual network peering configuration from VNet-SpokeB to VNet-Hub, select Use the remote virtual network's gateway or Route Server.

In the virtual network peering configuration from VNet-Hub to VNet-SpokeB, select Use this virtual network's gateway or Route Server.

Show answer & explanation

Answer: In the virtual network peering configuration from VNet-SpokeA to VNet-Hub, select Use the remote virtual network's gateway or Route Server.; In the virtual network peering configuration from VNet-Hub to VNet-SpokeA, select Use this virtual network's gateway or Route Server.

Answer

To configure gateway transit selectively, you must enable 'Use this virtual network's gateway or Route Server' on the peering link from VNet-Hub to VNet-SpokeA, and enable 'Use the remote virtual network's gateway or Route Server' on the peering link from VNet-SpokeA to VNet-Hub. You must not enable these gateway settings on the peering configurations between VNet-Hub and VNet-SpokeB.

To satisfy the requirements, gateway transit must be configured specifically for the peering between the hub VNet (VNet-Hub) and the authorized spoke VNet (VNet-SpokeA). This is achieved by enabling 'Use this virtual network's gateway or Route Server' on the peering link from the hub to the spoke, and enabling 'Use the remote virtual network's gateway or Route Server' on the peering link from the spoke to the hub. Since VNet-SpokeB must not access on-premises networks, gateway transit settings must not be enabled on the peering links between VNet-Hub and VNet-SpokeB, keeping the gateway isolated from VNet-SpokeB while maintaining VNet peering connectivity.

Step-by-Step Solution

Enable gateway transit on the hub side of the peering link with VNet-SpokeA.

The peering link from VNet-Hub to VNet-SpokeA is configured with 'Use this virtual network's gateway or Route Server' enabled.

This configuration allows the Virtual Network Gateway in VNet-Hub to be shared with VNet-SpokeA.

Configure the spoke side of the peering link to use the remote gateway in VNet-Hub.

The peering link from VNet-SpokeA to VNet-Hub is configured with 'Use the remote virtual network's gateway or Route Server' enabled.

This configuration directs traffic from VNet-SpokeA destined for on-premises to route through the gateway in VNet-Hub.

Verify gateway transit settings are disabled on the peering link between VNet-Hub and VNet-SpokeB.

The peering links between VNet-Hub and VNet-SpokeB remain peering-active but have 'Use this virtual network's gateway or Route Server' and 'Use the remote virtual network's gateway or Route Server' disabled.

This configuration prevents VM-SpokeB from using the virtual network gateway in VNet-Hub to reach on-premises networks while preserving direct peering communication between VM-Hub and VM-SpokeB.

Key Concept

Gateway transit in virtual network peering allows peered virtual networks to share a virtual network gateway or Route Server, which can be selectively configured per peering link to control which spokes have transit connectivity to on-premises networks.

Estimated Time:3m 0s

Question 630Question →

An administrator manages an Azure environment with the following resource hierarchy:

* A management group named `Tenant-MG`.
* An Azure subscription named `Sub-Development` that is a child of `Tenant-MG`.
* A resource group named `RG-ProdMock` in `Sub-Development`.
* A resource group named `RG-Scratch` in `Sub-Development`.

The administrator applies the following policy assignments:

* Assignment 1: An Azure Policy definition that restricts allowed virtual machine SKUs to `Standard_D2s_v3` (using the `Deny` effect) is assigned to `Tenant-MG`. The assignment includes `RG-Scratch` in its Exclusions list.
* Assignment 2: An Azure Policy definition that requires the tag `Dept` (using the `Deny` effect) is assigned to `Sub-Development`. No exclusions are configured.

Which of the following virtual machine deployments will be successfully created? (Select TWO)

Select all that apply

A Standard_D2s_v3 virtual machine with the tag Dept=Finance deployed in RG-ProdMock

A Standard_E4s_v3 virtual machine with the tag Dept=Engineering deployed in RG-Scratch

A Standard_E4s_v3 virtual machine with the tag Dept=Sales deployed in RG-ProdMock

A Standard_D2s_v3 virtual machine without the Dept tag deployed in RG-Scratch

Show answer & explanation

Answer: A Standard_D2s_v3 virtual machine with the tag Dept=Finance deployed in RG-ProdMock; A Standard_E4s_v3 virtual machine with the tag Dept=Engineering deployed in RG-Scratch

Answer

The deployments that will succeed are a Standard_D2s_v3 virtual machine with the tag Dept=Finance deployed in RG-ProdMock, and a Standard_E4s_v3 virtual machine with the tag Dept=Engineering deployed in RG-Scratch.

The deployment of a Standard_D2s_v3 VM with the Dept tag in RG-ProdMock succeeds because it conforms to both assignments. The deployment of a Standard_E4s_v3 VM with the Dept tag in RG-Scratch succeeds because RG-Scratch is excluded from the SKU-restricting policy assignment, and it satisfies the tag requirement.

Step-by-Step Solution

Evaluate the virtual machine SKU policy assignment.

The SKU restriction is assigned at the Tenant-MG scope, enforcing Standard_D2s_v3. Since RG-Scratch is excluded, only resources inside RG-Scratch can use other SKUs (like Standard_E4s_v3), while resources in RG-ProdMock must use Standard_D2s_v3.

Policy assignments are inherited down the resource hierarchy unless explicit exclusions are defined at the assignment scope.

Evaluate the tag policy assignment.

The Dept tag policy is assigned at the Sub-Development scope with no exclusions. All resources in both RG-ProdMock and RG-Scratch must have the Dept tag.

Exclusions from one policy assignment do not apply to other assignments.

Combine the evaluations to determine the status of each deployment choice.

The Standard_D2s_v3 virtual machine with Dept=Finance in RG-ProdMock satisfies both policies. The Standard_E4s_v3 virtual machine with Dept=Engineering in RG-Scratch satisfies both policies because the SKU policy is bypassed via exclusion and the tag is present. The other options fail due to violating one of the policies.

For a deployment to succeed, it must comply with all applicable policies assigned at its level or inherited from parent scopes.

Key Concept

Azure Policy assignments are inherited down the resource hierarchy, and exclusions only apply to the specific assignment on which they are configured.

Question 631Question →

Your Azure subscription contains a virtual network named `VNet1` with two subnets: `Subnet-Web` and `Subnet-Data`. An NSG named `NSG-Data` is associated with `Subnet-Data`. `NSG-Data` contains the following custom inbound security rule:

* Priority: $150$
* Source: `*`
* Destination: `*`
* Destination Port Range: `*`
* Protocol: Any
* Action: Deny

You have a virtual machine named `VM-Web` in `Subnet-Web` associated with an Application Security Group (ASG) named `ASG-Web`.

You have a virtual machine named `VM-SQL` in `Subnet-Data` associated with an ASG named `ASG-SQL`.

You need to allow database traffic (TCP port $1433$ ) and management traffic (TCP port $443$ ) from `VM-Web` to `VM-SQL`. The solution must enforce the principle of least privilege.

Which two inbound security rules should you add to `NSG-Data`?

Select all that apply

A rule with Priority

100

, Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range:

1433

, Protocol: TCP, Action: Allow

A rule with Priority

110

, Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range:

443

, Protocol: TCP, Action: Allow

A rule with Priority

200

, Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range:

1433

, Protocol: TCP, Action: Allow

A rule with Priority

210

, Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range:

443

, Protocol: TCP, Action: Allow

Show answer & explanation

Answer: A rule with Priority $100$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range: $1433$ , Protocol: TCP, Action: Allow; A rule with Priority $110$ , Source: `ASG-Web`, Destination: `ASG-SQL`, Destination Port Range: $443$ , Protocol: TCP, Action: Allow

Answer

Configure two inbound rules with priorities lower than

150

(such as

100

and

110

) using ASG-Web as the source, ASG-SQL as the destination, and TCP ports

1433

and

443

respectively with the Allow action.

To allow the requested traffic while maintaining security, the allow rules must be evaluated before the existing custom deny rule at priority

150

. Because NSG rules are evaluated in ascending order of their priority numbers, the new rules must have priority numbers lower than

150

(such as

100

and

110

). Furthermore, referencing ASG-Web as the source and ASG-SQL as the destination ensures that only the relevant virtual machines can communicate, which adheres to the principle of least privilege.

Step-by-Step Solution

Analyze the existing NSG rules in the destination subnet.

The existing rule at priority

150

denies all inbound traffic.

Any new rule designed to permit traffic must be assigned a lower priority value than

150

to be evaluated first, since NSG rules are processed in ascending order of their priority numbers.

Specify the source and destination endpoints using the principle of least privilege.

Set the source to ASG-Web and the destination to ASG-SQL.

Using Application Security Groups (ASGs) limits rule application to the specific virtual machines associated with them, rather than opening ports for the entire subnet.

Configure the rules for the required ports.

Create one rule for TCP port

1433

(priority

100

) and a second rule for TCP port

443

(priority

110

This allows the database and management traffic to reach the SQL VM while blocking all other traffic.

Key Concept

NSG rules are processed sequentially by priority number (lowest first). When a generic deny rule has a specific priority, allow rules must have lower priority numbers (higher precedence) to take effect. Using Application Security Groups (ASGs) simplifies rule configuration by defining security policies based on application workloads instead of IP addresses.

Question 632Question →

Your company has a Microsoft Entra ID tenant that contains both cloud-only users and hybrid users synced from an on-premises Active Directory Domain Services (AD DS) domain. The tenant contains a mix of Microsoft Entra ID Free and Microsoft Entra ID P1 licenses.

You need to configure Self-Service Password Reset (SSPR) to meet the following requirements:
1. All hybrid users must be able to reset their passwords, and the changes must synchronize back to the on-premises AD DS.
2. Standard cloud-only users must be subject to a two-gate SSPR policy that requires two authentication methods to reset their passwords.

Which of the following statements describe the licensing and configuration requirements to support this SSPR setup? Select two.

Select all that apply

Each hybrid user who resets their password using SSPR must be assigned a Microsoft Entra ID P1 or higher license to support password writeback.

Standard cloud-only users must be assigned a Microsoft Entra ID P1 or higher license to use a two-gate SSPR policy.

Standard cloud-only users can use the two-gate SSPR policy under the Microsoft Entra ID Free tier, provided the selected authentication methods are limited to email and mobile app notification.

You can create separate SSPR policies with different authentication method counts for hybrid users and cloud-only users by targeting different Administrative Units.

Show answer & explanation

Answer: Each hybrid user who resets their password using SSPR must be assigned a Microsoft Entra ID P1 or higher license to support password writeback.; Standard cloud-only users must be assigned a Microsoft Entra ID P1 or higher license to use a two-gate SSPR policy.

Answer

Each hybrid user utilizing SSPR with writeback must have a Microsoft Entra ID P1 or higher license, and standard cloud-only users must also have a Microsoft Entra ID P1 or higher license to be subject to a two-gate SSPR policy.

The correct options state that hybrid users utilizing password writeback need a Microsoft Entra ID P1 (or higher) license, and standard cloud-only users need a Microsoft Entra ID P1 (or higher) license to use a two-gate SSPR policy. Password writeback is a premium hybrid identity feature requiring P1/P2. Additionally, standard users are limited to a single-gate SSPR policy on the Free tier, meaning that a two-gate policy requires premium licenses.

Step-by-Step Solution

Determine the licensing requirement for password writeback.

Password writeback synchronizes cloud password changes back to an on-premises AD DS environment. This capability requires a Microsoft Entra ID P1 or P2 license.

On-premises synchronization features are not included in the Free tier.

Evaluate SSPR gate constraints for Free vs. P1 licenses.

The Microsoft Entra ID Free license only supports a single-gate SSPR policy (1 method required) for standard cloud-only users. Enforcing a two-gate policy (2 methods required) requires Microsoft Entra ID P1 or P2.

Advanced policy configurations, such as multiple gates, are restricted to premium licensing tiers.

Verify if multiple SSPR policies can be scoped within a single tenant.

SSPR configuration is a single tenant-wide settings policy. Although the policy enablement can be scoped to 'All', 'None', or a single 'Selected' group, the authentication methods and gate count parameters apply globally to all enabled users.

SSPR does not support multiple configurations or scoping settings (like gate count) via Administrative Units or different group-based policies.

Key Concept

Microsoft Entra ID SSPR licensing capabilities and global policy structure

Question 633Question →

You manage an Azure Storage account named datashareprod that contains a blob container named exports. A partner company requires access to download files from the container. You must grant access that meets the following security requirements:
- The partner must only be allowed to read blobs.
- Access must be restricted to the public IP address $198.51.100.42$ .
- You must be able to revoke the access immediately if needed, without rotating the storage account access keys and without affecting other applications that access the storage account.
Which configuration should you use to generate the shared access signature (SAS)?

A service SAS associated with a stored access policy defined on the container

An account SAS with the permissions and IP address restriction defined directly in the SAS token

A user delegation SAS signed using an Entra ID user account assigned the Storage Blob Data Reader role

A service SAS that relies on the 'Allow trusted Microsoft services to access this storage account' firewall bypass setting

Show answer & explanation

Answer: A service SAS associated with a stored access policy defined on the container

Answer

A service SAS associated with a stored access policy defined on the container

A service SAS associated with a stored access policy is the correct choice because stored access policies allow you to manage the lifetime and permissions of the SAS. If the SAS needs to be revoked immediately, the administrator can simply delete or modify the stored access policy on the container. This invalidates the SAS without requiring a rotation of the storage account keys, thereby leaving other applications unaffected.

Step-by-Step Solution

Analyze the requirement for immediate revocation without rotating storage account keys.

Identify that the SAS must be manageable via a stored access policy, as deleting or modifying the policy immediately invalidates the associated SAS.

Ad-hoc SAS tokens (whether service or account SAS) cannot be revoked individually without rotating the storage account access keys used to sign them.

Determine the SAS type compatibility with stored access policies.

Stored access policies are supported only on resource-level service SAS (such as Blob containers or File shares), but not on account SAS or user delegation SAS.

This rules out using an account SAS or user delegation SAS for the revocation requirement.

Evaluate the IP security and permission constraints.

The service SAS can be generated with read-only permissions and restricted to the specified IP address (

198.51.100.42

) while being bound to the stored access policy.

This satisfies all of the stated requirements under the principle of least privilege.

Key Concept

Stored access policies provide a way to group shared access signatures and provide additional lifecycle management, including immediate revocation, for service SAS tokens.

Estimated Time:1m 30s

Question 634Question →

You have two virtual networks named VNet-Prod ( $10.100.0.0/16$ ) and VNet-Dev ( $10.200.0.0/16$ ) with virtual machines deployed in their subnets. When configuring virtual network peering between VNet-Prod and VNet-Dev, you must enable 'Allow gateway transit', 'Use remote gateways', and 'Allow forwarded traffic' to establish basic bidirectional IP connectivity between the virtual machines. Is this statement true or false?

True

False

Show answer & explanation

Answer: False

Answer

The statement is false.

The correct answer is false because basic virtual network peering between two networks allows direct, bidirectional IP connectivity by default without requiring gateway transit, remote gateways, or forwarded traffic configurations.

Step-by-Step Solution

Identify the requirements for basic virtual network peering.

Virtual network peering provides direct, low-latency, bidirectional IP connectivity between VMs in peered networks using Azure's backbone network.

To establish basic peering, you only need to configure the peering link between the two networks (which creates reciprocal links in both directions) with the default settings.

Evaluate the purpose of 'Allow gateway transit' and 'Use remote gateways'.

These settings are used for gateway sharing, allowing resources in one VNet to use a virtual network gateway located in the peered VNet.

Since neither VNet requires a gateway for direct spoke-to-spoke communication, these settings are not needed for basic connectivity.

Evaluate the purpose of 'Allow forwarded traffic'.

This setting allows a virtual network to receive traffic that did not originate from the peered virtual network itself (e.g., traffic forwarded by a firewall or NVA).

Basic direct communication between the two VNets involves traffic originating directly from VMs within the peered networks, so forwarded traffic settings are not required.

Key Concept

Basic virtual network peering allows direct, bidirectional communication by default without requiring gateway sharing or forwarded traffic settings.

Question 635Question →

Your company has an Azure subscription that contains a virtual network named `VNet1` in the East US region. `VNet1` is configured with the address space of ` $10.10.0.0/16$ `. You plan to deploy the following resources to `VNet1`:

- An Azure Bastion host to provide secure administrative access to your virtual machines.
- A web application tier that requires at least ` $27$ ` usable IP addresses.

You need to configure the subnets for these resources while minimizing the allocated address space for each subnet. Which two of the following subnet configurations should you recommend? (Select two.)

Select all that apply

`AzureBastionSubnet` with an address space of `

10.10.1.0/26

`subnet-web` with an address space of `

10.10.2.0/27

`BastionSubnet` with an address space of `

10.10.1.0/26

`AzureBastionSubnet` with an address space of `

10.10.1.0/27

`subnet-web` with an address space of `

10.10.2.0/28

Show answer & explanation

Answer: `AzureBastionSubnet` with an address space of ` $10.10.1.0/26$ `; `subnet-web` with an address space of ` $10.10.2.0/27$ `

Answer

To support the requirements while minimizing address space, you must configure `AzureBastionSubnet` with an address space of `

10.10.1.0/26

` and `subnet-web` with an address space of `

10.10.2.0/27

The correct configurations are to use the naming convention `AzureBastionSubnet` with a minimum prefix of `

/26

` for Azure Bastion, and `subnet-web` with a `

/27

` prefix for the web application. A `

/27

` subnet allocates `

32

` total addresses, which yields exactly the required `

27

` usable addresses after deducting the `

5

` addresses reserved by Azure. This satisfies the host requirement while minimizing address space waste.

Step-by-Step Solution

Determine the constraints for the Azure Bastion subnet.

The subnet must be named exactly `AzureBastionSubnet` and have a prefix of `

/26

` or larger.

Azure Bastion has strict naming and minimum prefix requirements for deployment.

Calculate the host capacity needed for the web application tier, accounting for Azure-reserved IPs.

Azure reserves `

5

` IP addresses in every subnet. Therefore, to get `

27

` usable IP addresses, the subnet must have a total size of at least `

27 + 5 = 32

` IP addresses.

Azure reserves the first four and the last IP address of any subnet for its internal services.

Map the required IP capacity to the smallest CIDR subnet mask.

A `

/27

` subnet mask provides exactly `

32

` addresses, satisfying the requirement.

A smaller subnet like `

/28

` only offers `

16

` total addresses (which means `

11

` usable), which is insufficient.

Key Concept

Azure-specific subnet constraints require accounting for five reserved IP addresses per subnet and specific naming and minimum size prefixes for platform services like Azure Bastion.

Question 636Question →

You have an Azure subscription containing three peered virtual networks:

* `VNet-Hub` ( $10.10.0.0/16$ ) containing a subnet named `Subnet-NVA` ( $10.10.1.0/24$ )
* `VNet-Spoke1` ( $10.20.0.0/16$ ) containing a subnet named `Subnet-Web` ( $10.20.1.0/24$ )
* `VNet-Spoke2` ( $10.30.0.0/16$ ) containing two subnets named `Subnet-DB` ( $10.30.1.0/24$ ) and `Subnet-Mgmt` ( $10.30.2.0/24$ )

A Network Virtual Appliance (NVA) is deployed in `Subnet-NVA` with the IP address $10.10.1.4$ .

You have already configured a route table associated with `Subnet-Web` that contains a route for $10.30.0.0/16$ with a next hop of the NVA at $10.10.1.4$ .

You need to ensure that:

1. Traffic from `Subnet-Web` to `Subnet-DB` is routed through the NVA.
2. Traffic from `Subnet-Web` to `Subnet-Mgmt` bypasses the NVA and is routed directly across the peered virtual networks.
3. The NVA can successfully receive and forward packets that are not destined for itself.

Which two configurations should you perform? (Select two.)

Select all that apply

In the route table associated with Subnet-Web, add a route for

10.30.2.0/24

with a next hop type of Virtual network.

Enable IP forwarding on the Azure network interface of the NVA virtual machine.

In the route table associated with Subnet-Web, add a route for

10.30.2.0/24

with a next hop type of Virtual Network Gateway.

Enable IP forwarding on the Azure network interfaces of the virtual machines in Subnet-Web.

Associate the route table containing the NVA route with Subnet-NVA.

Show answer & explanation

Answer: In the route table associated with Subnet-Web, add a route for $10.30.2.0/24$ with a next hop type of Virtual network.; Enable IP forwarding on the Azure network interface of the NVA virtual machine.

Answer

The correct configurations are: adding a route for

10.30.2.0/24

with a next hop type of Virtual network in the route table associated with Subnet-Web, and enabling IP forwarding on the network interface of the NVA virtual machine.

Adding a route for

10.30.2.0/24

with a next hop type of Virtual network uses the Longest Prefix Match (LPM) mechanism. Since this prefix is more specific than the existing

10.30.0.0/16

route, traffic to Subnet-Mgmt will match this route and be forwarded using the direct virtual network peering system routes. Additionally, the NVA must have IP forwarding enabled on its Azure network interface (NIC) so that it does not drop packets that are addressed to other destinations.

Step-by-Step Solution

Analyze the existing route table on Subnet-Web

The route table has a route for

10.30.0.0/16

pointing to the NVA (

10.10.1.4

). This currently intercepts all traffic to both Subnet-DB (

10.30.1.0/24

) and Subnet-Mgmt (

10.30.2.0/24

To understand how traffic to VNet-Spoke2 is currently being routed.

Determine how to bypass the NVA for Subnet-Mgmt using Longest Prefix Match (LPM)

Create a more specific route for

10.30.2.0/24

than the broad

10.30.0.0/16

route.

Azure routing selects the route with the longest prefix match. A route for

10.30.2.0/24

will override the

10.30.0.0/16

route for traffic destined to Subnet-Mgmt.

Identify the correct next hop type for direct peered routing

Select 'Virtual network' as the next hop type for the

10.30.2.0/24

route.

This tells Azure to use the default system route for peered virtual networks instead of redirecting the traffic elsewhere.

Address the packet forwarding requirement on the NVA

Enable IP forwarding on the Azure network interface (NIC) of the NVA VM.

By default, Azure VMs drop packets where the destination IP does not match the VM's IP. The NVA must have IP forwarding enabled to process and route transit traffic.

Key Concept

User-Defined Routes (UDR) next hop configurations and Longest Prefix Match (LPM) precedence rules in Azure.

Question 637Question →

Your company has an on-premises Windows Server named Server-Lon1 that is registered to a Storage Sync Service named SyncService-UK in the UK South region. You deploy a new Storage Sync Service named SyncService-EU in the West Europe region, which is linked to a new Azure file share. You need to synchronize a local folder on Server-Lon1 with the new Azure file share in West Europe using SyncService-EU. What should you do first?

Create a new sync group in SyncService-EU and add the local path on Server-Lon1 directly as a server endpoint.

Assign the Contributor role on SyncService-EU to the managed identity of Server-Lon1.

Unregister Server-Lon1 from SyncService-UK, and then register Server-Lon1 to SyncService-EU.

Configure the storage account firewall for the West Europe storage account to bypass restrictions for Server-Lon1 as a trusted Microsoft service.

Show answer & explanation

Answer: Unregister Server-Lon1 from SyncService-UK, and then register Server-Lon1 to SyncService-EU.

Answer

Unregister Server-Lon1 from SyncService-UK, and then register Server-Lon1 to SyncService-EU.

A server can only be registered to one Storage Sync Service at any given time. Because Server-Lon1 is already registered to SyncService-UK, it must be unregistered from it before it can be registered to SyncService-EU.

Step-by-Step Solution

Identify the current registration status of the server.

Server-Lon1 is currently registered to SyncService-UK.

Before using a server with a Storage Sync Service, it must be registered. You must check which service it is registered to currently.

Apply the Azure File Sync registration constraint rule.

Determine that a single server cannot be registered to more than one Storage Sync Service simultaneously.

An individual server cannot belong to multiple Storage Sync Services. Attempting to register it to a second service directly will fail.

Perform the unregistration and registration sequence.

Unregister the server from the UK service, and then register it to the EU service.

This frees the server from its current registration boundary, allowing it to register with the new Storage Sync Service and join the new sync group.

Key Concept

Azure File Sync Server Registration Constraints

Estimated Time:1m 30s

Question 638Question →

An administrator is configuring routing in an Azure hub-and-spoke virtual network topology. The hub virtual network contains a VPN gateway and a Network Virtual Appliance (NVA) at IP address $10.10.1.10$ . A spoke virtual network contains a subnet named `Workload-Subnet` ( $10.20.1.0/24$ ).

A route table named `RT-Workload` is associated with `Workload-Subnet`, and gateway route propagation is enabled. The VPN gateway propagates two routes learned via BGP from an on-premises network:
- $172.16.4.0/23$ with the next hop pointing to the VPN gateway
- $172.16.4.0/24$ with the next hop pointing to the VPN gateway

To route traffic through the NVA, the administrator adds the following User-Defined Routes (UDRs) to `RT-Workload`:
- Route A: Prefix $172.16.0.0/16$ , Next Hop: Virtual Appliance ( $10.10.1.10$ )
- Route B: Prefix $172.16.4.0/24$ , Next Hop: Virtual Appliance ( $10.10.1.10$ )

A virtual machine in `Workload-Subnet` attempts to transmit packets to a database server at $172.16.5.9$ and a web server at $172.16.4.22$ .

Which next hops will Azure use to route the traffic, and what configuration is required on the NVA to ensure packets are not dropped?

Database server: VPN gateway; Web server: Virtual Appliance (

10.10.1.10

). Additionally, IP forwarding must be enabled on the NVA's network interface.

Database server: Virtual Appliance (

10.10.1.10

); Web server: Virtual Appliance (

10.10.1.10

). Additionally, IP forwarding must be enabled on the NVA's network interface.

Database server: VPN gateway; Web server: VPN gateway. Additionally, IP forwarding must be disabled on the NVA's network interface.

Database server: Virtual Appliance (

10.10.1.10

); Web server: VPN gateway. Additionally, IP forwarding must be enabled on the VPN gateway's network interface.

Show answer & explanation

Answer: Database server: VPN gateway; Web server: Virtual Appliance ( $10.10.1.10$ ). Additionally, IP forwarding must be enabled on the NVA's network interface.

Answer

The database server traffic is routed to the VPN gateway, and the web server traffic is routed to the Virtual Appliance (

10.10.1.10

). Additionally, IP forwarding must be enabled on the NVA's network interface.

The correct answer identifies that the database server traffic goes to the VPN gateway because the BGP route (

172.16.4.0/23

) has a longer prefix match than the UDR (

172.16.0.0/16

). For the web server, both the UDR (

172.16.4.0/24

) and the BGP route (

172.16.4.0/24

) match with the same prefix length. Since they are identical, the UDR takes precedence, routing the traffic to the Virtual Appliance. Finally, IP forwarding must be enabled on the NVA network interface so that Azure does not drop the forwarded packets.

Step-by-Step Solution

Analyze the matching routes for the database server IP address (

172.16.5.9

The matching routes are Route A (UDR

172.16.0.0/16

with next hop NVA) and BGP Route 1 (

172.16.4.0/23

with next hop VPN gateway).

The database server's IP address falls within the subnet ranges of both routes.

Determine the winning route for the database server using Azure route selection precedence.

BGP Route 1 (

172.16.4.0/23

) is selected.

Azure evaluates Longest Prefix Match (LPM) first. A prefix length of 23 (

/23

) is longer than 16 (

/16

), so the BGP route wins over the UDR.

Analyze the matching routes for the web server IP address (

172.16.4.22

The matching routes are Route A (UDR

172.16.0.0/16

), Route B (UDR

172.16.4.0/24

), BGP Route 1 (

172.16.4.0/23

), and BGP Route 2 (

172.16.4.0/24

The web server's IP address falls within the subnet ranges of all four routes.

Determine the winning route for the web server using Azure route selection precedence.

Route B (UDR

172.16.4.0/24

) is selected.

The longest prefix length is 24 (

/24

), shared by Route B and BGP Route 2. When prefix lengths are identical, User-Defined Routes (UDRs) take precedence over BGP-propagated routes.

Determine the required NVA interface configuration.

IP forwarding must be enabled on the network interface of the NVA in Azure.

By default, Azure virtual machines only accept packets addressed to their own interface IPs. Enabling IP forwarding allows the NVA to receive and forward transit traffic.

Key Concept

Azure route selection rules prioritize the Longest Prefix Match (LPM) first. When two matching routes have the same prefix length, User-Defined Routes (UDRs) take precedence over BGP routes, which in turn take precedence over system routes. Additionally, NVAs must have IP forwarding enabled on their Azure network interfaces to route transit traffic.

Estimated Time:3m 0s

Question 639Question →

You plan to deploy two Azure virtual machines named VM1 and VM2 to host a two-tier application. The deployment must meet the following requirements:
- Protect the virtual machines against localized hardware failures, such as power or network outages, within a single datacenter.
- Keep the virtual machines in close physical proximity to maintain the lowest possible network latency between the tiers.
- Minimize costs associated with inter-zone data transfer.

Which availability option should you configure when creating the virtual machines?

Availability Zones

Availability Set

Virtual Machine Scale Set with autoscale rules

Azure App Service plan in the Premium tier

Show answer & explanation

Answer: Availability Set

Answer

An Availability Set should be configured when creating the virtual machines.

An Availability Set ensures that the virtual machines are distributed across multiple fault domains (racks with shared power and network) and update domains within the same datacenter. This meets the requirement of localized hardware failure protection while keeping the virtual machines physically close to minimize latency and eliminate inter-zone data transfer costs.

Step-by-Step Solution

Analyze the high availability requirement.

The application requires protection against localized hardware failures (power/network) inside a single datacenter.

This rules out single-instance virtual machine configurations with no availability options configured.

Evaluate the latency and cost constraints.

The virtual machines must remain in close physical proximity to maintain low latency and avoid inter-zone data transfer costs.

This rules out Availability Zones, which distribute virtual machines across different physical datacenters within a region.

Select the appropriate availability feature.

An Availability Set distributes the virtual machines across multiple fault and update domains within a single datacenter, satisfying all constraints.

This provides localized hardware fault tolerance without crossing datacenter boundaries or incurring extra zone transit costs.

Key Concept

Azure Virtual Machine Availability Options

Estimated Time:2m 0s

Question 640Question →

You have an Azure subscription that contains a virtual network named `VNet1`. `VNet1` contains a single subnet named `Subnet1`.

`Subnet1` contains two virtual machines: `VM1` and `VM2`.
- The network interface of `VM1` is associated with an Application Security Group named `ASG-Web`.
- The network interface of `VM2` is associated with an Application Security Group named `ASG-DB`.

A Network Security Group named `NSG1` is associated with `Subnet1`. No other Network Security Groups are deployed.
`NSG1` contains the rules shown in the following tables:

Inbound Security Rules

Priority	Source	Destination	Port	Protocol	Action
$120$	Any	ASG-DB	$1433$	TCP	Deny
$220$	ASG-Web	ASG-DB	$1433$	TCP	Allow

Outbound Security Rules

Priority	Source	Destination	Port	Protocol	Action
$130$	ASG-Web	Any	$1433$	TCP	Allow
$230$	ASG-Web	ASG-DB	$1433$	TCP	Deny

A database application running on `VM2` listens on TCP port $1433$ . `VM1` attempts to establish a connection to `VM2` on TCP port $1433$ .

What is the result of the connection attempt?

The connection is blocked inbound because the inbound rule at priority 120 takes precedence over the rule at priority 220.

The connection is allowed because the inbound rule at priority 220 has a higher priority number, indicating it has higher precedence.

The connection is blocked outbound because the rule at priority 230 is more specific and overrides the wildcard rule at priority 130.

The connection is allowed because the outbound rule at priority 130 permits the traffic, and inbound rules are bypassed for intra-subnet communication.

Show answer & explanation

Answer: The connection is blocked inbound because the inbound rule at priority 120 takes precedence over the rule at priority 220.

Answer

The connection is blocked inbound because the inbound rule at priority 120 takes precedence over the rule at priority 220.

The correct answer is correct because Azure NSGs evaluate rules in order of priority, where lower numbers have higher precedence. For intra-subnet traffic, subnet-level NSG rules are evaluated twice: outbound from the source VM and inbound to the destination VM. Outbound, the rule at priority 130 (Allow) takes precedence over the rule at priority 230 (Deny). Inbound, the rule at priority 120 (Deny) takes precedence over the rule at priority 220 (Allow), resulting in the connection being blocked inbound.

Step-by-Step Solution

Determine the traffic path and identify which NSG rules apply to the source and destination virtual machines.

Traffic flows from VM1 (source) to VM2 (destination) within Subnet1. Subnet1 is associated with NSG1. Therefore, NSG1 rules are evaluated for both outbound traffic from VM1 and inbound traffic to VM2.

Since both virtual machines reside in the same subnet and share the same subnet-level NSG, the NSG rules must be evaluated for both outbound and inbound directions of the intra-subnet communication.

Evaluate the outbound rules of NSG1 for VM1's outbound traffic.

Rule 130 (Allow, Priority 130) and Rule 230 (Deny, Priority 230) both match the traffic profile (Source: ASG-Web, Destination: Any/ASG-DB, Port: 1433). Rule 130 has a lower priority number (

130

230

) and therefore takes precedence, allowing the traffic outbound.

Azure NSG rules are evaluated in ascending order of priority. Lower numbers have higher precedence, and the first matching rule determines the outcome.

Evaluate the inbound rules of NSG1 for VM2's inbound traffic.

Rule 120 (Deny, Priority 120) and Rule 220 (Allow, Priority 220) both match the inbound traffic profile (Source: ASG-Web/Any, Destination: ASG-DB, Port: 1433). Rule 120 has a lower priority number (

120

220

) and therefore takes precedence, denying the traffic inbound.

Lower priority numbers represent higher precedence in Azure NSGs. The Deny rule at priority 120 takes precedence over the Allow rule at priority 220.

Combine the outbound and inbound evaluation results to determine the final connection state.

Although the traffic is allowed outbound from VM1, it is blocked inbound at VM2 by the priority 120 inbound rule. The connection attempt fails.

For a network connection to succeed in Azure, traffic must be allowed by both the outbound NSG rules of the source and the inbound NSG rules of the destination.

Key Concept

Subnet-level NSG rule evaluation for intra-subnet traffic and priority-based rule precedence.

Estimated Time:3m 0s

PreviousPage 32 / 63Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept