All practice questions

1198 questions

All types1,198 Multiple choice617 Multiple select502 Matching65 Ordering14

An enterprise is designing a hub-and-spoke network topology in Azure to support their application infrastructure. The topology includes the following components:
* A hub virtual network named `vnet-hub-useast` ( $10.100.0.0/16$ ) that hosts a Virtual Network Gateway and an Azure Firewall with the private IP address ` $10.100.1.4$ `.
* A spoke virtual network named `vnet-spoke-app` ( $10.101.0.0/16$ ) that contains two subnets: `snet-web` ( $10.101.1.0/24$ ) and `snet-db` ( $10.101.2.0/24$ ).
* An on-premises network ( $172.16.0.0/12$ ) connected to the hub's Virtual Network Gateway via an ExpressRoute circuit.
* Virtual network peering established between `vnet-hub-useast` and `vnet-spoke-app` with gateway transit enabled.

You are designing a routing solution for the subnets in `vnet-spoke-app` to meet these requirements:
1. All outbound traffic destined for the internet must be inspected by the Azure Firewall.
2. All traffic destined for the on-premises network ( $172.16.0.0/12$ ) must route through the Virtual Network Gateway.
3. Traffic between `snet-web` and `snet-db` must route directly within the spoke virtual network without traversing the hub.
4. The configuration must minimize administrative overhead and avoid using statically defined routes for on-premises address ranges.

Which two configurations should you include in the route table associated with the spoke subnets to meet these requirements?

Select all that apply

A route for

0.0.0.0/0

with a next hop type of Virtual appliance and a next hop IP address of

10.100.1.4

Gateway route propagation enabled on the route table

A route for

10.101.0.0/16

with a next hop type of Virtual appliance and a next hop IP address of

10.100.1.4

A route for

172.16.0.0/12

with a next hop type of Virtual network gateway and gateway route propagation disabled

Show answer & explanation

Answer: A route for $0.0.0.0/0$ with a next hop type of Virtual appliance and a next hop IP address of $10.100.1.4$ ; Gateway route propagation enabled on the route table

Answer

Add a user-defined route for

0.0.0.0/0

pointing to the Azure Firewall private IP address as a Virtual Appliance, and keep virtual network gateway route propagation enabled on the route table associated with the spoke subnets.

The correct configurations are defining a default route (

0.0.0.0/0

) pointing to the Azure Firewall IP address as a Virtual Appliance, and keeping gateway route propagation enabled on the route table. The default route redirects internet traffic to the firewall. Since Azure routes traffic based on the longest prefix match (LPM), the dynamically propagated routes from the ExpressRoute gateway (such as

172.16.0.0/12

) are more specific than

0.0.0.0/0

and will take precedence, directing on-premises traffic to the Virtual Network Gateway. Furthermore, because no user-defined route is created for the local VNet range (

10.101.0.0/16

), traffic between subnets within the spoke VNet will follow the default system local route and route directly, meeting all criteria with minimal administrative effort.

Step-by-Step Solution

Determine the routing mechanism for internet-bound traffic.

Create a User Defined Route (UDR) for

0.0.0.0/0

with the next hop set to the Azure Firewall's private IP address (

10.100.1.4

) as a Virtual Appliance.

This redirects all default traffic (internet) to the firewall for security inspection.

Determine the routing mechanism for on-premises traffic.

Ensure gateway route propagation is enabled on the route table.

This allows the spoke subnets to dynamically learn the

172.16.0.0/12

route from the hub's ExpressRoute gateway, minimizing administrative overhead and avoiding static route configuration.

Verify inter-subnet routing behavior within the spoke VNet.

Ensure no UDR exists for

10.101.0.0/16

pointing to the hub.

This allows the default system route for local traffic to handle communication between `snet-web` and `snet-db` directly within the VNet, preventing traffic from traversing the hub.

Key Concept

Azure Virtual Network routing priorities, specifically how Longest Prefix Match (LPM) dictates that dynamically learned BGP routes from a Virtual Network Gateway take precedence over user-defined default routes (

0.0.0.0/0

), and how UDRs for a local VNet prefix override default system local routing between subnets.

Question 1062Question →

A logistics enterprise is designing the compute architecture for a core dispatch routing service on Azure. The service runs on Azure Virtual Machines and requires a minimum virtual machine uptime SLA of $99.99\%$ to meet business requirements. The architecture must protect the service against localized datacenter failures within the Azure region. Which of the following compute deployment strategies should you recommend to meet these requirements?

Deploy the virtual machines in an Availability Set within a single Azure Availability Zone.

Deploy the virtual machines across multiple Azure Availability Zones within the region.

Deploy the virtual machines as Spot Virtual Machines across multiple Azure Availability Zones.

Deploy the virtual machines within a Proximity Placement Group restricted to a single Azure Availability Zone.

Show answer & explanation

Answer: Deploy the virtual machines across multiple Azure Availability Zones within the region.

Answer

Deploying the virtual machines across multiple Azure Availability Zones within the region.

Deploying virtual machines across multiple Azure Availability Zones in the same region provides a

99.99\%

VM uptime SLA and protects the workload against localized datacenter or zonal failures. Each Availability Zone is a distinct physical location with independent power, cooling, and networking.

Step-by-Step Solution

Analyze the SLA and high availability requirements.

The application requires a virtual machine uptime SLA of at least

99.99\%

and protection against datacenter-level outages.

These parameters dictate the level of physical isolation and redundancy required.

Evaluate the SLA offerings of different Azure compute configurations.

A multi-zone VM deployment offers

99.99\%

SLA, whereas an Availability Set offers

99.95\%

, and Spot VMs offer no SLA.

Understanding Azure SLA commitments is crucial for designing compliant business continuity solutions.

Select the option that meets both the SLA and resilience criteria.

Deploying the VMs across multiple Availability Zones in the region meets the

99.99\%

SLA and protects against localized datacenter outages.

Each zone is an isolated datacenter environment with independent power, cooling, and networking.

Key Concept

Azure Virtual Machine High Availability Options and SLAs

Estimated Time:1m 30s

Question 1063Question →

A logistics company is designing a serverless infrastructure solution for two application workloads:

* A REST API for package tracking that must scale out rapidly to handle sudden spikes in traffic, integrate with an Azure Virtual Network (VNet), and avoid cold-start latency.
* An event-driven invoice processing job that extracts metadata from uploaded documents using OCR. This job can take up to 20 minutes to complete.

You need to recommend the compute services that satisfy these requirements while minimizing operational overhead.

Which two Azure compute solutions should you recommend? (Select TWO.)

Select all that apply

Azure Functions on the Premium plan for the REST API

Azure Container Apps Jobs for the invoice processing job

Azure Functions on the Consumption plan for the invoice processing job

Azure Kubernetes Service (AKS) for the REST API

Show answer & explanation

Answer: Azure Functions on the Premium plan for the REST API; Azure Container Apps Jobs for the invoice processing job

Answer

Azure Functions on the Premium plan for the REST API and Azure Container Apps Jobs for the invoice processing job.

The REST API requires rapid scaling, VNet integration, and no cold starts, which are all key features provided by the Azure Functions Premium plan. The invoice processing job runs for up to 20 minutes, which exceeds the timeout limits of the Consumption plan. Azure Container Apps Jobs is the ideal serverless choice for this run-to-completion, event-driven task, as it supports execution runtimes of up to several hours without VM management overhead.

Step-by-Step Solution

Analyze the requirements for the REST API component, including virtual network integration, rapid scaling, and cold-start avoidance.

Identify that Azure Functions Premium plan supports pre-warmed instances to avoid cold starts and provides VNet integration.

This meets all requirements for the API while keeping operational overhead low.

Evaluate the execution duration constraints for the event-driven invoice processing job.

Identify that the job runs up to 20 minutes, which exceeds the 10-minute maximum limit of Azure Functions on a Consumption plan.

A plan or service supporting longer runtimes, such as Azure Container Apps Jobs, is required to prevent timeout failures.

Minimize administrative overhead by selecting serverless options over fully managed Kubernetes clusters.

Determine that AKS is overly complex for these workloads, whereas Azure Functions Premium and Azure Container Apps Jobs are serverless and low-maintenance.

Designing for low operational overhead is a core requirement of the scenario.

Key Concept

Selecting appropriate serverless hosting plans based on execution limits, virtual network integration, latency profiles, and operational complexity.

Question 1064Question →

An enterprise is designing a secure hybrid network topology in Azure. The design includes a hub virtual network named `vnet-hub-prod` ( $10.50.0.0/16$ ) that contains an Azure VPN Gateway connected to an on-premises datacenter. A spoke virtual network named `vnet-spoke-app` ( $10.60.0.0/16$ ) is peered with `vnet-hub-prod`. The spoke network contains a subnet named `subnet-app` ( $10.60.1.0/24$ ).

The enterprise requires that all outbound internet traffic from `subnet-app` is redirected to the on-premises datacenter for security inspection. Resources within `vnet-spoke-app` must retain the ability to communicate directly with each other.

Which three configuration steps should you recommend to meet these requirements?

Select all that apply

On the virtual network peering from vnet-hub-prod to vnet-spoke-app, enable the Allow gateway transit option.

On the virtual network peering from vnet-spoke-app to vnet-hub-prod, enable the Use the remote virtual network's gateway or Route Server option.

Associate a route table with subnet-app that contains a route for

0.0.0.0/0

with a next hop type of Virtual network gateway.

Associate a route table with subnet-app that contains a route for

10.60.0.0/16

with a next hop type of Virtual network gateway.

Associate a route table with subnet-app that contains a route for

10.50.0.0/16

with a next hop type of Internet.

Show answer & explanation

Answer: On the virtual network peering from vnet-hub-prod to vnet-spoke-app, enable the Allow gateway transit option.; On the virtual network peering from vnet-spoke-app to vnet-hub-prod, enable the Use the remote virtual network's gateway or Route Server option.; Associate a route table with subnet-app that contains a route for $0.0.0.0/0$ with a next hop type of Virtual network gateway.

Answer

To meet the requirements, you must enable Allow gateway transit on the peering link from the hub, enable Use the remote virtual network's gateway or Route Server on the peering link from the spoke, and associate a route table with the spoke subnet containing a route for

0.0.0.0/0

with a next hop type of Virtual network gateway.

To route spoke traffic through a hub gateway, the hub-side peering must have 'Allow gateway transit' enabled, and the spoke-side peering must have 'Use the remote virtual network's gateway or Route Server' enabled. Additionally, to force all internet-bound traffic to on-premises via this gateway, a default route (

0.0.0.0/0

) must be defined in a route table associated with the spoke subnet, with the next hop set to the Virtual network gateway.

Step-by-Step Solution

Enable gateway transit on the hub virtual network peering.

Allows the hub virtual network's VPN gateway to be shared with the peered spoke virtual network.

By default, virtual network peering is non-transitive. Enabling gateway transit allows peered spokes to route traffic through the hub's gateway.

Configure the spoke virtual network peering to use the remote gateway.

Permits the spoke virtual network to send and receive traffic via the peered hub's gateway.

This configuration establishes the link necessary for spoke resources to forward traffic to the hub's gateway.

Create and associate a route table with the spoke subnet featuring a default route pointing to the gateway.

Forces all outbound internet traffic (

0.0.0.0/0

) to be directed to the VPN gateway (which forwards it to on-premises) while preserving local virtual network routing.

A user-defined route for

0.0.0.0/0

with next hop type Virtual network gateway overrides the default Azure system route that sends internet traffic directly to the public internet, satisfying the forced tunneling requirement.

Key Concept

Forced tunneling and gateway transit in virtual network peering

Question 1065Question →

An organization is designing a secure network environment for a microservices application hosted on Azure Virtual Machine Scale Sets in a dedicated subnet. The application must connect to an Azure Key Vault and an Azure Storage account. Corporate security policy requires restricting outbound traffic to the internet, and the design must minimize administrative effort to maintain security rules as Azure services evolve. Which two actions should you include in the network security design? (Select two.)

Select all that apply

Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the AzureKeyVault service tag.

Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the Storage service tag.

Query the Azure IP Ranges and Service Tags public JSON file weekly, and update individual IP address outbound rules in the Network Security Group (NSG) for Key Vault and Storage endpoints.

Create a User Defined Route (UDR) for the subnet that redirects all

0.0.0.0/0

traffic directly to the Storage account public IP addresses to bypass default system routing.

Associate a Basic SKU Public IP address directly to the backend Virtual Machine Scale Sets to allow them to communicate directly with Standard Load Balancer outbound rules.

Show answer & explanation

Answer: Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the AzureKeyVault service tag.; Configure an outbound security rule in the Network Security Group (NSG) associated with the subnet that allows traffic to the Storage service tag.

Answer

Configure outbound security rules in the Network Security Group (NSG) associated with the subnet that allow traffic to the AzureKeyVault and Storage service tags.

The correct configurations involve using Network Security Group (NSG) outbound rules with the AzureKeyVault and Storage service tags. Service tags represent groups of IP address prefixes from Azure services, which Microsoft manages automatically. This satisfies the security requirement to restrict outbound traffic while meeting the constraint to minimize administrative effort, as you do not need to manually track or update IP ranges.

Step-by-Step Solution

Identify the target services requiring connection security controls.

The application must establish outbound connections to Azure Key Vault and Azure Storage.

Determines the destination service endpoints that must be defined in the network security rules.

Evaluate the rule management overhead constraint.

Determine that Service Tags are the optimal choice to represent IP groups for Azure services since Microsoft manages their updates automatically.

Satisfies the design constraint to minimize administrative effort as Azure IP addresses change.

Formulate the correct NSG rules using the appropriate service tags.

Select AzureKeyVault and Storage service tags for the outbound rules.

Allows traffic directly to the target services safely while blocking other unauthorized outbound internet traffic.

Key Concept

Azure Service Tags simplify network security group management by representing groups of IP address prefixes from specific Azure services managed by Microsoft.

Estimated Time:2m 0s

Question 1066Question →

An organization is designing a serverless solution for a new application that processes user-uploaded medical images. The solution contains two workloads:

1. An API frontend that receives image upload events and metadata. This API experiences highly volatile traffic patterns with long periods of idle time and must scale to zero to minimize hosting costs.
2. A background worker that performs computational analysis on the uploaded images. Each analysis task takes approximately 15 minutes to complete.

You need to select the compute resources that minimize operational overhead and hosting costs while ensuring that all processing tasks complete successfully.

Which two Azure hosting options should you recommend? (Select two.)

Select all that apply

Azure Functions on a Consumption plan to host the API frontend

Azure Container Apps Jobs to run the background worker

Azure Functions on a Consumption plan to host the background worker

An Azure Kubernetes Service (AKS) cluster to host both the API frontend and the background worker

Show answer & explanation

Answer: Azure Functions on a Consumption plan to host the API frontend; Azure Container Apps Jobs to run the background worker

Answer

Azure Functions on a Consumption plan to host the API frontend, and Azure Container Apps Jobs to run the background worker

Azure Functions on a Consumption plan is ideal for the API frontend because it scales dynamically to zero during idle periods, handles volatile traffic efficiently, and minimizes hosting costs. Azure Container Apps Jobs are suitable for the background worker because they can execute tasks that run for longer than 10 minutes (such as the 15-minute image analysis) while scaling to zero when no jobs are active, thus minimizing cost and administrative overhead.

Step-by-Step Solution

Analyze the API frontend requirements.

The API frontend has highly volatile traffic, must scale to zero to minimize costs during idle periods, and processes lightweight requests (HTTP trigger). Azure Functions on a Consumption plan matches these needs perfectly and minimizes management overhead.

Understanding workload patterns helps identify the most cost-effective scaling model.

Analyze the background worker requirements and execution duration constraints.

The worker processes computational tasks taking 15 minutes. Azure Functions Consumption plan has a 10-minute maximum timeout limit and is unsuitable. Azure Container Apps Jobs allow containerized tasks to run to completion without strict execution duration limits and support event-driven scaling to zero.

Evaluating runtime duration limits prevents application failure due to platform timeouts.

Evaluate operational overhead and complexity constraints.

Using Azure Kubernetes Service (AKS) would introduce excessive administrative overhead, setup complexity, and ongoing maintenance duties, which fails the requirement to minimize operational overhead.

Comparing management overhead ensures the simplest serverless solution is chosen.

Key Concept

Selecting appropriate serverless hosting options based on execution limits, scaling needs, and operational overhead.

Question 1067Question →

An organization is designing the compute layer for a telemetry processing workload. The workload will run on Azure Virtual Machines.

The design must meet the following requirements:
- Provide a virtual machine uptime SLA of $99.99\%$ .
- Protect the workload against localized datacenter outages within an Azure region.
- Minimize network latency between the virtual machine instances.

Which two actions should you include in the design? (Select two.)

Select all that apply

Deploy the virtual machines across two or more Availability Zones.

Associate the virtual machines with a Proximity Placement Group.

Deploy the virtual machines within a single Availability Zone using an Availability Set.

Deploy the virtual machines as Spot Virtual Machines.

Show answer & explanation

Answer: Deploy the virtual machines across two or more Availability Zones.; Associate the virtual machines with a Proximity Placement Group.

Answer

Deploy the virtual machines across two or more Availability Zones and associate the virtual machines with a Proximity Placement Group.

To achieve a

99.99\%

SLA and ensure protection against a datacenter-level outage, the virtual machines must be distributed across two or more Availability Zones. To minimize network latency between the virtual machines, a Proximity Placement Group should be used to co-locate the resources as closely as possible.

Step-by-Step Solution

Analyze the SLA and high availability requirements.

The requirement for a

99.99\%

uptime SLA and protection against physical datacenter outages means the virtual machines must be distributed across multiple Azure Availability Zones.

Azure guarantees a

99.99\%

uptime SLA only when two or more VM instances are deployed across two or more Availability Zones in the same region.

Analyze the network latency requirement.

The virtual machines must be associated with a Proximity Placement Group (PPG).

A Proximity Placement Group is a logical grouping capability used to ensure that Azure compute resources are physically located close to each other, minimizing network latency.

Key Concept

Designing High Availability and Low Latency for Azure Virtual Machines using Availability Zones and Proximity Placement Groups.

Question 1068Question →

A financial services company is designing a serverless solution to process end-of-day transaction reconciliation files. The reconciliation process runs once daily, parses large files containing transaction records, validates the data, and writes the results to a database. The process typically takes 25 minutes to complete. The company wants to minimize administrative overhead and ensure they only pay for compute resources while the process is running. Which hosting solution should you recommend?

Azure Container Apps Jobs

Azure Functions on a Consumption plan

Azure Kubernetes Service (AKS) cluster with virtual nodes

Azure Virtual Machines using Spot instances

Show answer & explanation

Answer: Azure Container Apps Jobs

Answer

Azure Container Apps Jobs

Azure Container Apps Jobs is the ideal solution because it is designed for run-to-completion, serverless batch tasks. It supports execution times beyond the 10-minute limit of the Azure Functions Consumption plan, automatically scales to zero when not running to ensure costs are only incurred during execution, and operates with minimal administrative overhead.

Step-by-Step Solution

Analyze the execution duration requirement of the reconciliation process.

The process takes 25 minutes to run.

Azure Functions on a Consumption plan has a strict maximum execution limit of 10 minutes, making it unsuitable for tasks exceeding this threshold.

Evaluate the requirement for administrative overhead and cost efficiency.

The solution must minimize administrative overhead and charge only for active execution time.

Hosting options like Azure Kubernetes Service (AKS) require managing cluster control planes and upgrades, which increases operational complexity. Furthermore, standard virtual machines incur ongoing costs even when idle.

Compare the remaining options against the requirements.

Azure Container Apps Jobs is selected.

Azure Container Apps Jobs is designed for run-to-completion batch tasks, supports execution times extending to multiple hours, scales to zero when not running, and operates as a fully managed serverless platform with minimal administrative overhead.

Key Concept

Designing serverless hosting solutions for long-running batch workloads while minimizing cost and administrative overhead.

Estimated Time:1m 30s

Question 1069Question →

An enterprise is implementing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-prod-hub` ( $10.10.0.0/16$ ), hosts a firewall at $10.10.1.4$ . The spoke virtual network, `vnet-prod-spoke` ( $10.20.0.0/16$ ), contains two subnets named `subnet-web` ( $10.20.1.0/24$ ) and `subnet-app` ( $10.20.2.0/24$ ). To inspect traffic between the two spoke subnets, an administrator creates a route table and associates it with both subnets in `vnet-prod-spoke`. The route table contains a user-defined route (UDR) with the address prefix $10.20.0.0/16$ and a next hop of the firewall at $10.10.1.4$ . After this change, virtual machines within `subnet-web` can no longer communicate with each other, nor with virtual machines in `subnet-app`. Which of the following describes the cause of this connectivity failure?

The subnets require individual security rules for each virtual machine interface IP address instead of using Service Tags within the associated Network Security Groups.

The user-defined route for the spoke address space overrides the default system route for the local virtual network, causing all local traffic to be forwarded to the firewall.

The virtual machines are connected to a Basic Load Balancer, which prevents the route table from applying next hop rules to the subnets.

The user-defined route conflicts with system routes because it does not define a separate, non-overlapping subnet route to prioritize local VNet routing.

Show answer & explanation

Answer: The user-defined route for the spoke address space overrides the default system route for the local virtual network, causing all local traffic to be forwarded to the firewall.

Answer

The user-defined route for the spoke address space overrides the default system route for the local virtual network, causing all local traffic to be forwarded to the firewall.

The correct answer is correct because Azure route selection prioritizes user-defined routes (UDRs) over default system routes when the prefixes are identical. By configuring a UDR with the prefix

10.20.0.0/16

(which matches the spoke VNet address space) and setting the next hop to the firewall, all traffic within the VNet (including intra-subnet traffic) is forwarded to the firewall. Since the firewall is not designed to receive, process, and return traffic destined for the same local subnet without complex configurations, internal communication breaks.

Step-by-Step Solution

Analyze the user-defined route prefix configured in the route table.

The route table has a route for

10.20.0.0/16

pointing to the firewall at

10.10.1.4

To identify the destination and next hop of the user-defined route.

Compare the route prefix with the local virtual network address space.

The prefix matches the address space of `vnet-prod-spoke` (

10.20.0.0/16

) exactly.

To determine how the route interacts with the default local system route.

Apply Azure routing precedence rules.

UDRs take precedence over default system routes. The route to

10.20.0.0/16

via the firewall overrides the default 'Vnet' route.

To identify why intra-subnet and inter-subnet traffic within the spoke is diverted to the firewall, causing communication to break.

Key Concept

User-defined route overrides for local virtual network traffic

Question 1070Question →

A digital publishing company is migrating its content management and rendering platforms to Azure. The system requires two compute tiers:

1. Editorial Backend: A stateful web application that runs continuously, requires a $99.99\%$ availability SLA, and must be isolated on dedicated physical hardware due to compliance requirements.
2. Rendering Workers: A stateless batch video-rendering workload that can tolerate interruptions and must run at the absolute lowest cost.

Which compute virtualization solution should you recommend to meet these requirements?

Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend, and Azure Virtual Machine Scale Sets using Spot Virtual Machines for the Rendering Workers.

Azure Virtual Machine Scale Sets using Spot Virtual Machines for the Editorial Backend, and Azure Dedicated Hosts for the Rendering Workers.

Azure Dedicated Hosts deployed in a single Availability Zone for the Editorial Backend, and Azure Virtual Machine Scale Sets using Spot Virtual Machines for the Rendering Workers.

Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend, and Azure Virtual Machine Scale Sets using Spot Virtual Machines with Locally Redundant Storage (LRS) configured for regional disaster resilience for the Rendering Workers.

Show answer & explanation

Answer: Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend, and Azure Virtual Machine Scale Sets using Spot Virtual Machines for the Rendering Workers.

Answer

Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend, and Azure Virtual Machine Scale Sets using Spot Virtual Machines for the Rendering Workers.

The correct option configuration uses Azure Dedicated Hosts deployed across multiple Availability Zones for the Editorial Backend and Azure Virtual Machine Scale Sets using Spot VMs for the Rendering Workers. Dedicated Hosts satisfy the regulatory requirement for physical isolation. Spreading them across multiple zones ensures that the virtual machines can meet the

99.99\%

availability SLA. Using Spot VMs in a Virtual Machine Scale Set satisfies the requirement for running the stateless, interruptible batch video-rendering workload at the lowest possible cost.

Step-by-Step Solution

Analyze the Editorial Backend requirements: continuous execution,

99.99\%

availability SLA, and dedicated physical hardware isolation.

Identify that Azure Dedicated Hosts are required for physical isolation, and they must be deployed across multiple Availability Zones to meet the

99.99\%

SLA.

Dedicated Hosts provide single-tenant physical servers, and multi-zone deployment ensures high availability against datacenter outages.

Analyze the Rendering Workers requirements: stateless batch video-rendering, interruptible, and lowest possible cost.

Identify that Azure Virtual Machine Scale Sets using Spot VMs are the most suitable and cost-effective option.

Spot VMs offer significant discounts by utilizing unused Azure capacity, which matches the fault-tolerant and stateless nature of batch rendering.

Evaluate the combined choices to select the correct configuration.

Select the option specifying Dedicated Hosts across multiple zones for the Editorial Backend and Virtual Machine Scale Sets with Spot VMs for the Rendering Workers.

This is the only option that satisfies all technical, compliance, SLA, and cost constraints.

Key Concept

Selecting and configuring Azure compute virtualization solutions based on availability, isolation, and cost requirements.

Question 1071Question →

An enterprise architecture team is implementing a hub-and-spoke virtual network topology in Azure for a secure payment application. The hub virtual network hosts an Azure Firewall with the private IP address $10.0.0.4$ . A spoke virtual network named `VNet1` contains two subnets:

* `Subnet1` ( $10.1.1.0/24$ ): Contains Azure Virtual Machines hosting the payment application.
* `Subnet2` ( $10.1.2.0/24$ ): Contains a Private Endpoint (IP address $10.1.2.4$ ) for a secure Azure SQL Database.

You must ensure that all traffic from the Virtual Machines in `Subnet1` to the SQL Database Private Endpoint in `Subnet2` is inspected by the Azure Firewall. The design must also enforce network security group (NSG) rules on both subnets.

Which two actions should you perform? (Select two.)

Select all that apply

Enable private endpoint network policies for route tables and network security groups on Subnet2.

Associate a route table to Subnet1 containing a route to the private endpoint IP address, and associate a route table to Subnet2 containing a route to Subnet1, with both route tables pointing to the Azure Firewall as the next hop.

Manually configure individual outbound security rules in the Network Security Group (NSG) associated with Subnet1 for each database server IP address to allow traffic.

Associate an Azure SQL service endpoint policy to Subnet1 to restrict outbound traffic to only the permitted SQL Database.

Configure a user-defined route (UDR) in Subnet1 that routes traffic destined for the SQL database to the Azure Firewall, but keep the private endpoint network policies disabled on Subnet2 to prevent routing loops.

Configure a route table associated with Subnet2 with a default route (

0.0.0.0/0

) pointing to the Azure Firewall, without enabling private endpoint network policies on Subnet2.

Show answer & explanation

Answer: Enable private endpoint network policies for route tables and network security groups on Subnet2.; Associate a route table to Subnet1 containing a route to the private endpoint IP address, and associate a route table to Subnet2 containing a route to Subnet1, with both route tables pointing to the Azure Firewall as the next hop.

Answer

Enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2), and configure route tables on both Subnet1 (destination private endpoint IP via the firewall) and Subnet2 (destination Subnet1 IP via the firewall) to ensure symmetric traffic inspection.

To force traffic destined for the private endpoint through Azure Firewall, we must configure a user-defined route (UDR) on the source subnet (Subnet1) pointing to the firewall. However, because Azure Firewall is stateful, the return traffic from the private endpoint back to the VMs must also go through the firewall. This requires a corresponding UDR on the destination subnet (Subnet2) pointing to the firewall. For this UDR and any NSG rules to be active and applied to the private endpoint network interface, we must enable private endpoint network policies on the subnet hosting the private endpoint (Subnet2).

Step-by-Step Solution

Enable network policies for private endpoints on Subnet2.

Allows User-Defined Routes (UDRs) and Network Security Groups (NSGs) to be evaluated and applied to traffic going to or coming from the private endpoint.

By default, system routes override custom routes for private endpoints, and network policies are disabled on subnets containing private endpoints, which bypasses custom routing and NSG rules.

Configure routing from the application VMs to the private endpoint.

Associate a route table with Subnet1 containing a route for the private endpoint IP address (

10.1.2.4/32

) with the next hop set to the Azure Firewall (

10.0.0.4

This configuration overrides the default virtual network routing for traffic bound for the private endpoint, sending it to the firewall for security inspection.

Configure routing for return traffic from the private endpoint.

Associate a route table with Subnet2 containing a route for Subnet1 (

10.1.1.0/24

) with the next hop set to the Azure Firewall (

10.0.0.4

Since the firewall is a stateful device, the return traffic must pass back through the same firewall instance. Without this route, return traffic would take the default direct local virtual network route back to Subnet1, resulting in asymmetric routing and connection drop.

Key Concept

Enforcing security inspection and NSG rules on Private Endpoints in Azure requires enabling private endpoint network policies on the hosting subnet, and configuring symmetric user-defined routes on both the source and destination subnets.

Alternative Method

Instead of using Azure Firewall for inspection, you could use a third-party Network Virtual Appliance (NVA) deployed in the hub virtual network, which would require the same UDR and private endpoint network policy configurations on the subnets.

Estimated Time:3m 0s

Question 1072Question →

Solaris Energy operates a distributed workload on Azure Virtual Machines within a subnet named BackendSubnet. The application running on these virtual machines must securely connect to Azure Key Vault to retrieve database credentials and certificate keys. The network team must implement a security design that restricts outbound traffic from the virtual machines to ONLY Azure Key Vault, blocking all other internet-bound traffic. Which network security configuration should you recommend to meet these requirements with the least administrative effort?

Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to the AzureKeyVault service tag with an Allow action, followed by a lower-priority rule blocking outbound traffic to the Internet.

Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to a custom list of individual IP address ranges corresponding to the regional Azure Key Vault endpoints.

Create a custom route table with a user-defined route (UDR) that overrides all default system routes to direct traffic destined for Azure services through a public load balancer.

Deploy an Azure Basic Load Balancer within the subnet and configure inbound NAT rules to forward outbound requests specifically to Azure Key Vault endpoints.

Show answer & explanation

Answer: Configure an outbound security rule in a Network Security Group (NSG) associated with the subnet, setting the destination to the AzureKeyVault service tag with an Allow action, followed by a lower-priority rule blocking outbound traffic to the Internet.

Answer

Using the AzureKeyVault service tag as the destination in an NSG outbound rule allows the network security group to dynamically manage the underlying IP addresses for the service. This, combined with a rule to deny outbound traffic to the Internet, satisfies the security constraint with minimal administrative overhead.

Step-by-Step Solution

Identify the destination service that needs to be reached securely (Azure Key Vault).

Confirming the destination allows selection of the appropriate Service Tag.

Using Service Tags is the standard recommended method to specify destination categories instead of individual IP addresses.

Add an outbound NSG security rule allowing traffic to the service tag.

Created a rule with destination set to AzureKeyVault and action set to Allow.

This permits legitimate outbound traffic to all Azure Key Vault endpoints in the region.

Add a lower-priority rule blocking outbound traffic to the Internet destination.

Created a deny rule with destination set to Internet.

This blocks all other outbound internet traffic while allowing the higher-priority Key Vault rule to function.

Key Concept

Using Network Security Group Service Tags to simplify and maintain outbound access control to Azure services without managing individual IP addresses.

Question 1073Question →

A retail company is designing the compute infrastructure for a new customer loyalty portal. The portal must run on Azure Virtual Machines and requires at least two VM instances to handle traffic. The architecture must guarantee a compute SLA of $99.99\%$ and protect against the failure of an entire datacenter. Which VM deployment configuration meets the requirements?

Deploy the virtual machines within a single Availability Set.

Deploy the virtual machines as Azure Spot Virtual Machines across multiple Availability Zones.

Deploy the virtual machines across two or more Availability Zones in the same Azure region.

Deploy the virtual machines in a single Availability Zone using a Proximity Placement Group.

Show answer & explanation

Answer: Deploy the virtual machines across two or more Availability Zones in the same Azure region.

Answer

Deploy the virtual machines across two or more Availability Zones in the same Azure region.

Deploying two or more virtual machines across multiple Availability Zones guarantees a

99.99\%

SLA for VM uptime and provides protection against datacenter-level failures, as each zone consists of one or more datacenters equipped with independent power, cooling, and networking.

Step-by-Step Solution

Analyze the SLA and high availability requirements.

The workload requires a

99.99\%

SLA and resilience against datacenter outages.

Establishing these constraints narrows down the Azure deployment options to those that span physical zones.

Evaluate the SLA of different VM deployment options in Azure.

Availability Zones provide a

99.99\%

SLA for VMs, whereas Availability Sets provide a

99.95\%

SLA. Spot VMs have no SLA.

Matching the options against the

99.99\%

threshold ensures compliance with the target SLA.

Verify datacenter-level resilience.

Availability Zones are physically separate datacenter locations within an Azure region, whereas Availability Sets and single-zone Proximity Placement Groups are contained within a single zone or datacenter.

Selecting Availability Zones ensures the system can tolerate the complete failure of a single datacenter.

Key Concept

Designing virtual machine configurations to meet specific SLA and redundancy requirements using Azure Availability Zones.

Estimated Time:1m 30s

Question 1074Question →

A biotechnology firm is designing the Azure compute virtualization infrastructure for two workloads:
- Genomic Sequencing Analyzer: A batch processing job that executes for up to $45$ minutes per run. It is highly resource-intensive, interruptible, can save progress to a checkpoint database, and must be optimized for the lowest possible compute costs.
- Customer Operations Portal: A steady-state web application database backend that requires a $99.99\%$ availability SLA and is critical to business continuity.

Which two compute solutions should you recommend to meet these requirements? (Select two).

Select all that apply

Deploy the Genomic Sequencing Analyzer on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines.

Deploy the Customer Operations Portal across multiple Azure Availability Zones using Virtual Machine Scale Sets in Flexible orchestration mode.

Deploy the Customer Operations Portal on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines to reduce ongoing operational costs.

Deploy all virtual machine instances for the Customer Operations Portal within a single Azure Availability Zone to simplify network routing.

Run the Genomic Sequencing Analyzer on Azure Functions under a Consumption plan to eliminate compute cost when idle.

Show answer & explanation

Answer: Deploy the Genomic Sequencing Analyzer on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines.; Deploy the Customer Operations Portal across multiple Azure Availability Zones using Virtual Machine Scale Sets in Flexible orchestration mode.

Answer

Deploy the Genomic Sequencing Analyzer on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines, and deploy the Customer Operations Portal across multiple Azure Availability Zones using Virtual Machine Scale Sets in Flexible orchestration mode.

The correct solution recommends utilizing Azure Spot VMs on Virtual Machine Scale Sets for the genomic sequencing analyzer because it is a cost-effective, interruptible batch workload that can resume from checkpoints. It also recommends deploying the customer operations portal across multiple Availability Zones in Flexible orchestration mode to ensure high availability and redundancy to meet the

99.99\%

uptime SLA.

Step-by-Step Solution

Analyze the Genomic Sequencing Analyzer requirements: runs up to

45

minutes, resource-intensive, interruptible (checkpointed), and requires lowest cost.

Identify that Azure Spot VMs on Virtual Machine Scale Sets are appropriate. Eliminate the Azure Functions Consumption plan because its

10

-minute limit would cause timeout failures.

Spot VMs offer significant discounts for interruptible workloads, whereas the Functions Consumption plan has a hard timeout limit.

Analyze the Customer Operations Portal database requirements: steady-state,

99.99\%

availability SLA, critical to business continuity.

Determine that standard VM instances must be deployed across multiple Availability Zones to ensure high availability. Eliminate the Spot VM option and single zone deployment.

Spot VMs are subject to eviction and cannot guarantee an SLA, and a single availability zone does not provide regional redundancy.

Key Concept

Selecting Azure compute resources based on workload characteristics, SLA, cost, and availability requirements.

Estimated Time:2m 0s

Question 1075Question →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The topology consists of a hub virtual network named `vnet-hub-prod` ( $10.100.0.0/16$ ), a spoke virtual network named `vnet-spoke-app` ( $10.101.0.0/16$ ), and a spoke virtual network named `vnet-spoke-db` ( $10.102.0.0/16$ ). The hub virtual network contains an Azure Firewall deployed at $10.100.2.4$ . Virtual network peering is established between the hub and each spoke virtual network.

The following routing requirements must be met:
- All traffic between `vnet-spoke-app` and `vnet-spoke-db` must transit through the Azure Firewall in the hub.
- All outbound internet traffic from the spokes must be routed through the Azure Firewall.
- Virtual machines within `vnet-spoke-app` must communicate directly with each other without sending traffic to the firewall.

Which of the following routing configurations should you implement to satisfy these requirements? (Select TWO.)

Select all that apply

Associate a route table to the subnets in `vnet-spoke-app` containing a route for

10.102.0.0/16

and a route for

0.0.0.0/0

, both with a next hop type of Virtual Appliance pointing to

10.100.2.4

Associate a route table to the subnets in `vnet-spoke-db` containing a route for

10.101.0.0/16

and a route for

0.0.0.0/0

, both with a next hop type of Virtual Appliance pointing to

10.100.2.4

Associate a route table to the subnets in `vnet-spoke-app` containing a route for

10.101.0.0/16

with a next hop type of Virtual Appliance pointing to

10.100.2.4

Associate a route table to the subnets in `vnet-spoke-db` containing a route for

10.102.0.0/16

with a next hop type of Virtual Appliance pointing to

10.100.2.4

Show answer & explanation

Answer: Associate a route table to the subnets in `vnet-spoke-app` containing a route for $10.102.0.0/16$ and a route for $0.0.0.0/0$ , both with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .; Associate a route table to the subnets in `vnet-spoke-db` containing a route for $10.101.0.0/16$ and a route for $0.0.0.0/0$ , both with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .

Answer

The correct configurations are to associate a route table to the subnets in the application spoke containing a route for the database prefix and a route for the default route pointing to the firewall IP, and to associate a route table to the subnets in the database spoke containing a route for the application prefix and a route for the default route pointing to the firewall IP.

Routing between spoke virtual networks in a hub-and-spoke architecture requires User Defined Routes (UDRs) because virtual network peering is not transitive. To send traffic from the application spoke to the database spoke, a UDR for the database subnet prefix (

10.102.0.0/16

) pointing to the firewall is required. Similarly, a UDR for the internet destination (

0.0.0.0/0

) pointing to the firewall satisfies the secure egress requirement. The same logic applies in reverse for the database spoke routing to the application spoke. Because local traffic within a spoke relies on the default system route (VnetLocal) which is implicit, leaving the local prefix out of the UDR ensures that intra-VNet communication does not transit the firewall.

Step-by-Step Solution

Identify the address spaces and firewall IP address details.

Hub VNet uses

10.100.0.0/16

, Spoke A uses

10.101.0.0/16

, Spoke B uses

10.102.0.0/16

, and Azure Firewall IP is

10.100.2.4

Establishes the exact prefixes and next-hop parameters needed to define User Defined Routes (UDRs).

Determine the required route table entries for the application spoke.

Create a route table associated with the subnets in the application spoke. Add a route for

10.102.0.0/16

(database spoke) and a route for

0.0.0.0/0

(internet), both pointing to the virtual appliance at

10.100.2.4

. Do not add a route for the local

10.101.0.0/16

range.

This configuration correctly directs inter-spoke and egress traffic to the firewall while allowing local VNet communication to remain direct by utilizing the implicit, lower-priority VnetLocal system route.

Determine the required route table entries for the database spoke.

Create a route table associated with the subnets in the database spoke. Add a route for

10.101.0.0/16

(application spoke) and a route for

0.0.0.0/0

(internet), both pointing to the virtual appliance at

10.100.2.4

. Do not add a route for the local

10.102.0.0/16

range.

This mirroring configuration directs return and egress traffic from the database spoke to the firewall while ensuring local database VMs communicate directly using the VnetLocal system route.

Key Concept

Azure Virtual Network routing priorities dictate that User Defined Routes (UDRs) override system routes. When configuring transit routing through an NVA/Firewall, defining a UDR matching the local virtual network's address space overrides the default VnetLocal system route and disrupts intra-VNet local communications.

Question 1076Question →

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-useast-hub` ( $10.100.0.0/16$ ), contains an Azure Firewall deployed at $10.100.3.4$ in the `AzureFirewallSubnet` ( $10.100.3.0/24$ ). The spoke virtual network, `vnet-useast-prod` ( $10.101.0.0/16$ ), contains two subnets: `snet-prod-web` ( $10.101.1.0/24$ ) and `snet-prod-db` ( $10.101.2.0/24$ ). The two virtual networks are peered. You need to design a routing solution for the route table associated with `snet-prod-web` to meet the following requirements:
- All traffic destined for the internet must be routed through the Azure Firewall.
- All traffic destined for `snet-prod-db` must be routed through the Azure Firewall.
- Traffic between virtual machines within the same `snet-prod-web` subnet must bypass the Azure Firewall and communicate directly.
- The configuration must minimize administrative maintenance when new subnets are added to `vnet-useast-prod` in the future.

Which configuration should you use for the route table associated with `snet-prod-web`?

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; a route for

10.101.0.0/16

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.1.0/24

with a next hop type of Virtual Network.

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.0.0/16

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.2.0/24

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.0.0/16

with a next hop type of Virtual Network.

Show answer & explanation

Answer: A route for $0.0.0.0/0$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; a route for $10.101.0.0/16$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; and a route for $10.101.1.0/24$ with a next hop type of Virtual Network.

Answer

The configuration containing a route for

0.0.0.0/0

pointing to the Virtual Appliance, a route for

10.101.0.0/16

pointing to the Virtual Appliance, and a route for

10.101.1.0/24

pointing to Virtual Network.

In Azure routing, if you define a User Defined Route (UDR) that overlaps with the system-defined local virtual network route (such as

10.101.0.0/16

), the UDR will override the system route. To prevent intra-subnet traffic (

10.101.1.0/24

) from being sent to the firewall, you must define a more specific route for the local subnet with a next hop type of Virtual Network. Because Azure routing uses the Longest Prefix Match (LPM) algorithm, traffic destined for the local subnet (

10.101.1.0/24

) matches the

/24

route and is routed directly within the virtual network. Traffic destined for other subnets in the VNet (e.g.,

10.101.2.0/24

) or future subnets will match the

/16

route and be sent to the Azure Firewall. Internet traffic will match the

0.0.0.0/0

route and also go to the firewall. This minimizes administrative overhead because adding new subnets does not require updating the route table.

Step-by-Step Solution

Analyze Azure routing precedence and Longest Prefix Match (LPM) behavior.

Azure routes traffic based on the most specific prefix (longest prefix match). When two routes have the same prefix, User-Defined Routes (UDRs) override system routes.

We must understand how to override the system-defined VNet route (

10.101.0.0/16

) while preserving local subnet routing.

Design routes to force internet and cross-subnet traffic through the firewall.

Add a default route (

0.0.0.0/0

) pointing to the firewall (

10.100.3.4

) and a VNet-wide route (

10.101.0.0/16

) pointing to the firewall.

This sends all external traffic and any traffic destined for other subnets in the spoke VNet to the firewall.

Introduce a more specific route for the local subnet to prevent intra-subnet traffic from being diverted.

Add a route for

10.101.1.0/24

with the next hop type set to Virtual Network.

Since

/24

is more specific than

/16

, VMs in the same subnet will communicate directly using the Virtual Network next hop, preventing local connectivity failure.

Key Concept

Azure User-Defined Routing (UDR) and Longest Prefix Match (LPM) overriding system routes

Estimated Time:2m 30s

Question 1077Question →

An organization plans to migrate an on-premises web application to Azure. The environment consists of:
- Four web servers running Apache Tomcat on VMware vSphere VMs.
- An Oracle Database running on two physical Red Hat Enterprise Linux (RHEL) servers configured in a hardware-level cluster.

The organization has the following requirements:
- Map network dependencies between the Tomcat VMs and the physical database servers to ensure no components are left behind.
- Minimize administrative overhead for the hybrid identity solution. Federated authentication is not required.
- Identify database compatibility and determine the correct target Azure service for the Oracle database workload.

Which two actions should you include in the migration assessment and strategy? (Choose two.)

Select all that apply

Perform agentless dependency analysis for the VMware VMs and agent-based dependency analysis for the physical RHEL servers.

Select Microsoft Entra Connect with Password Hash Synchronization (PHS) to synchronize user accounts.

Deploy Active Directory Federation Services (AD FS) to federate on-premises user accounts with Microsoft Entra ID.

Group the Tomcat VMs and RHEL servers into migration waves based on hostname patterns without performing network dependency analysis.

Recommend migrating the Oracle Database directly to a single database tier in Azure SQL Database without prior schema conversion.

Show answer & explanation

Answer: Perform agentless dependency analysis for the VMware VMs and agent-based dependency analysis for the physical RHEL servers.; Select Microsoft Entra Connect with Password Hash Synchronization (PHS) to synchronize user accounts.

Answer

The migration assessment strategy must include performing agentless dependency analysis for the VMware VMs and agent-based dependency analysis for the physical servers, as well as implementing Microsoft Entra Connect with Password Hash Synchronization (PHS).

To analyze dependencies in a hybrid environment where some servers are virtualized on VMware and others are physical servers (such as RHEL bare-metal), Azure Migrate requires different dependency mapping strategies: agentless dependency analysis is supported for VMware VMs, whereas physical servers require agent-based dependency mapping using the Dependency Agent and Log Analytics agent. Additionally, to minimize administrative overhead for identity synchronization when federation is not required, Microsoft Entra Connect with Password Hash Synchronization (PHS) is the most appropriate option.

Step-by-Step Solution

Analyze dependency mapping requirements for a mixed environment of VMware VMs and physical servers.

Identify that VMware VMs can use agentless dependency analysis, while physical RHEL servers require the installation of agents (Dependency Agent and Log Analytics agent) for dependency mapping.

To ensure all application components are discovered and correctly grouped into migration waves without missing network dependencies.

Determine the optimal identity synchronization mechanism based on the constraint of minimizing administrative overhead without requiring federated authentication.

Select Password Hash Synchronization (PHS) using Microsoft Entra Connect.

PHS provides hybrid identity with the lowest management and infrastructure overhead, avoiding the complexity of Active Directory Federation Services (AD FS).

Evaluate the database target and rule out incorrect migration paths.

Reject direct migration of Oracle Database to Azure SQL Database without schema conversion, as Azure SQL Database does not natively run Oracle workloads.

To ensure database compatibility and avoid application failures post-migration.

Key Concept

Designing a migration assessment strategy that handles mixed virtualization environments, performs proper dependency mapping to avoid connection failures, and optimizes hybrid identity synchronization based on business requirements.

Question 1078Question →

An enterprise is designing a virtual network routing architecture in Azure to support their workload migration. The architecture consists of a hub virtual network named `vnet-prod-hub` ( $10.100.0.0/16$ ) that contains a Virtual Network Gateway (`vgw-prod-hub`) in the `GatewaySubnet` ( $10.100.0.0/24$ ), and a spoke virtual network named `vnet-prod-spoke1` ( $10.101.0.0/16$ ) hosting an application subnet named `snet-app` ( $10.101.1.0/24$ ). You need to design a routing solution that forces all internet-bound traffic from the VMs in `snet-app` to go through `vgw-prod-hub` to the on-premises network, while ensuring that VMs within `vnet-prod-spoke1` can communicate directly with each other without routing through the hub. Which two configurations should you include in the design? Select two.

Select all that apply

Configure the virtual network peering from `vnet-prod-spoke1` to `vnet-prod-hub` to use the remote virtual network's gateway, and configure the peering from `vnet-prod-hub` to `vnet-prod-spoke1` to allow gateway transit.

Create and associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for

0.0.0.0/0

and a next hop type of Virtual network gateway.

Associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for

10.101.0.0/16

and a next hop type of Virtual appliance pointing to the hub gateway.

Associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for the Azure DNS service IP address (

168.63.129.16/32

) with a next hop type of Virtual network gateway.

Show answer & explanation

Answer: Configure the virtual network peering from `vnet-prod-spoke1` to `vnet-prod-hub` to use the remote virtual network's gateway, and configure the peering from `vnet-prod-hub` to `vnet-prod-spoke1` to allow gateway transit.; Create and associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for $0.0.0.0/0$ and a next hop type of Virtual network gateway.

Answer

Configure the virtual network peering from the spoke to the hub to use the remote gateway, configure the peering from the hub to the spoke to allow gateway transit, and associate a route table to the application subnet with a route for

0.0.0.0/0

pointing to the Virtual network gateway.

To successfully route all internet-bound traffic from a spoke virtual network to an on-premises network via a hub gateway (forced tunneling), you must configure the virtual network peering to allow gateway transit on the hub virtual network and configure the spoke virtual network to use the remote virtual network's gateway. Additionally, you must associate a route table containing a route for

0.0.0.0/0

with a next hop type of Virtual network gateway to the spoke subnet to override the default system route that sends internet traffic directly to the internet.

Step-by-Step Solution

Enable gateway transit on the virtual network peering link on the hub VNet, and configure the spoke VNet to use the remote gateway.

The spoke virtual network is authorized and configured to route traffic through the Virtual Network Gateway located in the hub virtual network.

This establishes the network path required for the spoke virtual network to access the gateway resource.

Create a route table, add a route for

0.0.0.0/0

with a next hop type of Virtual network gateway, and associate the route table with the application subnet in the spoke.

The default system route to the Internet is overridden, forcing all internet-bound traffic from the subnet to transit the peered gateway.

By default, Azure routes internet-bound traffic directly to the Internet. A UDR is required to steer this traffic to the gateway.

Key Concept

Forced tunneling in Azure hub-and-spoke topologies requires configuring gateway transit on the peering links and deploying a UDR for

0.0.0.0/0

pointing to the Virtual network gateway without overriding local subnet or infrastructure routes.

Question 1079Question →

AeroSpace Dynamics is designing the network security for a subnet named ProcessingSubnet that hosts Azure Virtual Machines. The virtual machines require outbound access to Azure Storage and Azure Key Vault to process data. All other outbound internet access from the subnet must be blocked. The design must minimize administrative maintenance.

Which two outbound configurations should you recommend for the Network Security Group (NSG) associated with ProcessingSubnet?

Select all that apply

An outbound security rule that allows traffic to the Storage service tag

An outbound security rule that allows traffic to the AzureKeyVault service tag

Individual outbound security rules that allow traffic to the specific public IP address ranges of the Azure Storage and Azure Key Vault endpoints

A custom route table with user-defined routes (UDRs) that direct Storage and Key Vault traffic to the Internet gateway, overriding the default Azure system routes

Show answer & explanation

Answer: An outbound security rule that allows traffic to the Storage service tag; An outbound security rule that allows traffic to the AzureKeyVault service tag

Answer

Configure outbound NSG security rules that allow traffic to the Storage and AzureKeyVault service tags.

Using service tags like Storage and AzureKeyVault in outbound NSG rules allows the virtual machines to reach the respective Azure services. Azure manages the IP address prefixes under these service tags automatically, minimizing administrative maintenance while enforcing the required outbound security boundary.

Step-by-Step Solution

Identify the destination services.

Azure Storage and Azure Key Vault are identified as the target destinations.

Outbound connectivity needs to be restricted to only these two services.

Evaluate the mechanism to allow access while minimizing administrative effort.

Service tags represent a group of IP address prefixes from a given Azure service, managed automatically by Azure.

Using service tags avoids the need to manually update and maintain individual IP address rules as Azure changes public IP ranges.

Determine the required NSG rules.

Add outbound security rules with destination set to the Storage service tag and the AzureKeyVault service tag, followed by a rule to block all other outbound internet traffic.

This configuration satisfies the security and administrative requirements.

Key Concept

Azure Network Security Group (NSG) Service Tags simplify outbound security rule management by grouping IP address prefixes for Azure services.

Question 1080Question →

A university is designing the compute infrastructure for a student registration portal that will run on Azure Virtual Machines. The registration portal experiences high seasonal traffic and must remain resilient during infrastructure updates or datacenter-level disruptions. The portal requires a virtual machine uptime SLA of at least $99.99\%$ .

Which two actions should you include in the design? (Select two.)

Select all that apply

Deploy at least two virtual machines for the portal.

Distribute the virtual machines across two or more Availability Zones in the same Azure region.

Deploy all virtual machines within a single Availability Zone.

Deploy the virtual machines in an Availability Set.

Show answer & explanation

Answer: Deploy at least two virtual machines for the portal.; Distribute the virtual machines across two or more Availability Zones in the same Azure region.

Answer

To meet the requirement, you should deploy at least two virtual machines for the portal and distribute the virtual machines across two or more Availability Zones in the same Azure region.

To achieve a

99.99\%

uptime SLA for Azure Virtual Machines, you must deploy two or more instances across two or more Availability Zones in the same region. This ensures that even if one datacenter or zone undergoes an outage, the application remains available on the instances in the other zone(s).

Step-by-Step Solution

Analyze the SLA requirement of

99.99\%

The architecture must support zone-redundant high availability.

An SLA of

99.99\%

is only offered by Azure when virtual machines are distributed across multiple Availability Zones in the same region.

Evaluate the minimum instance count.

A minimum of two VM instances is required.

A single VM cannot meet the multi-instance zone SLA, even if configured with premium storage.

Reject single zone and Availability Set options.

Discard deployment of VMs in a single Availability Zone or an Availability Set.

Availability Sets only guarantee a

99.95\%

SLA, and single-zone deployments do not protect against datacenter outages, violating the SLA and availability requirements.

Key Concept

Azure VM High Availability SLA

PreviousPage 54 / 60Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution