HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
The subscription contains the virtual machines shown in the following table.
 
Each virtual machine contains only a private IP address.
You create an Azure bastion for VNet1 as shown in the following exhibit.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
The subscription contains the subnets shown in the following table.
 
The subscription contains the storage accounts shown in the following table.
 
You create a service endpoint policy named Policy1 in the South Central US Azure region to allow connectivity to all the storage accounts in the subscription.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

You have an Azure virtual network named VNet1 that contains the following settings:
• IPv4 address space: 172.16.10.0/24
• Subnet name: Subnet1
• Subnet address range: 172.16.10.0/25
What is the maximum number of virtual machines that can connect to Subnet1?

A. 24

B. 25

C. 123

D. 128

E. 251

You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1.
You plan to create an Azure container instance named container1.
You need to be able to configure DNS name label scope reuse for container1.
What should you configure for container1?

A. the private networking type

B. the public networking type

C. a new subnet on VNet1

D. a confidential SKU

HOTSPOT
-
You have the Azure virtual machines shown in the following table.
 
VNET1, VNET2, and VNET3 are peered.
VM4 has a DNS server that is authoritative for a zone named contoso.com and contains the records shown in the following table.
 
The virtual networks are configured to use the DNS servers shown in the following table.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

DRAG DROP
-
You have an Azure subscription that contains a resource group named RG1.
You plan to create an Azure Resource Manager (ARM) template to deploy a new virtual machine named VM1. VM1 must support the capture of performance data.
You need to specify resource dependencies for the ARM template.
In which order should you deploy the resources? To answer, move all resources from the list of resources to the answer area and arrange them in the correct order.
 

HOTSPOT
-
You plan to deploy the following Azure Resource Manager (ARM) template.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Disabled

B. Idle Time-out (minutes) to 20

C. a health probe

D. Session persistence to Client IP

You have an Azure subscription that contains a storage account. The account stores website data.
You need to ensure that inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's location.
What should you configure?

A. private endpoints

B. Azure Firewall rules

C. Routing preference

D. load balancing

You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1.
You need to prevent VM1 from accessing VM2 on port 3389.
What should you do?

A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.

B. Configure Azure Bastion in VNet1.

C. Create a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1.

D. Create a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1.

You have an Azure subscription that contains the resources shown in the following table.
 
You need to manage outbound traffic from VNET1 by using Firewall1.
What should you do first?

A. Configure the Hybrid Connection Manager.

B. Upgrade ASP1 to the Premium SKU.

C. Create a route table.

D. Create an Azure Network Watcher.

You have an Azure subscription that contains the resources shown in the following table.
 
All the resources connect to a virtual network named VNet1.
You plan to deploy an Azure Bastion host named Bastion1 to VNet1.
Which resources can be protected by using Bastion1?

A. VM1 only

B. contoso.com only

C. App1 and contoso.com only

D. VM1 and contoso.com only

E. VM1, App1, and contoso.com

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Session persistence to None

B. a health probe

C. Session persistence to Client IP and protocol

D. Idle Time-out (minutes) to 20

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. a health probe

B. Floating IP (direct server return) to Enabled

C. Session persistence to Client IP and protocol

D. Protocol to UDP

You have an Azure subscription that contains 10 virtual machines and the resources shown in the following table.
 
You need to ensure that Bastion1 can support 100 concurrent SSH users. The solution must minimize administrative effort.
What should you do first?

A. Resize the subnet of Bastion1

B. Configure host scaling.

C. Create a network security group (NSG)

D. Upgrade Bastion1 to the Standard SKU

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Session persistence to Client IP and protocol

B. Protocol to UDP

C. Session persistence to None

D. Floating IP (direct server return) to Disabled

DRAG DROP
-
You have a Windows 11 device named Device and an Azure subscription that contains the resources shown in the following table.
 
Device1 has Azure PowerShell and Azure Command-Line Interface (CLI) installed.
From Device1, you need to establish a Remote Desktop connection to VM1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
 

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Enabled

B. Session persistence to Client IP

C. Protocol to UDP

D. Idle Time-out (minutes) to 20

You have an Azure subscription that has the public IP addresses shown in the following table.
 
You plan to deploy an Azure Bastion Basic SKU host named Bastion1.
Which IP addresses can you use?

A. IP1 only

B. IP1 and IP2 only

C. IP3, IP4, and IP5 only

D. IP1, IP2, IP4, and IP5 only

E. IP1, IP2, IP3, IP4, and IP5

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Disabled

B. Floating IP (direct server return) to Enabled

C. a health probe

D. Session persistence to Client IP

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Session persistence to None

B. a health probe

C. Session persistence to Client IP

D. Idle Time-out (minutes) to 20

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Enabled

B. Idle Time-out (minutes) to 20

C. a health probe

D. Session persistence to Client IP

You have an Azure subscription that contains the virtual networks shown in the following table.
 
You need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region.
To which virtual networks can you deploy AF1?

A. VNET1, VNET2, VNET3, and VNET4

B. VNET1 and VNET2 only

C. VNET1 only

D. VNET1, VNET2, and VNET4 only

E. VNET1 and VNET4 only

You have two Azure subscriptions named Sub1 and Sub2.
Sub1 contains a virtual machine named VM1 and a storage account named storage1.
VM1 is associated to the resources shown in the following table.
 
You need to move VM1 to Sub2.
Which resources should you move to Sub2?

A. VM1, Disk1, and NetInt1 only

B. VM1, Disk1, and VNet1 only

C. VM1, Disk1, and storage1 only

D. VM1, Disk1, NetInt1, and VNet1

You have an on-premises network.
You have an Azure subscription that contains three virtual networks named VNET1. VNET2. and VNET3. The virtual networks are peered and connected to the on-premises network. The subscription contains the virtual machines shown in the following table.
 
You need to monitor connectivity between the virtual machines and the on-premises network by using Connection Monitor.
What is the minimum number of connection monitors you should deploy?

A. 1

B. 2

C. 3

D. 4

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Session persistence to Client IP and protocol

B. Idle Time-out (minutes) to 20

C. Session persistence to None

D. Floating IP (direct server return) to Enabled

You have an on-premises datacenter and an Azure subscription.
You plan to connect the datacenter to Azure by using ExpressRoute.
You need to deploy an ExpressRoute gateway. The solution must meet the following requirements:
✑ Support up to 10 Gbps of traffic.
✑ Support availability zones.
✑ Support FastPath.
✑ Minimize costs.
Which SKU should you deploy?

A. ERGw1AZ

B. ERGw2

C. ErGw3

D. ErGw3AZ

HOTSPOT -
You have a virtual network named VNET1 that contains the subnets shown in the following table:
 
You have Azure virtual machines that have the network configurations shown in the following table:
 
For NSG1, you create the inbound security rule shown in the following table:
 
For NSG2, you create the inbound security rule shown in the following table:
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have an Azure subscription named Subscription1.
Subscription1 contains the virtual machines in the following table:
 
Subscription1 contains a virtual network named VNet1 that has the subnets in the following table:
 
VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled on VM3.
You create a route table named RT1 that contains the routes in the following table:
 
You apply RT1 to Subnet1 and Subnet2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

Your on-premises network contains an SMB share named Share1.
You have an Azure subscription that contains the following resources:
✑ A web app named webapp1
✑ A virtual network named VNET1
You need to ensure that webapp1 can connect to Share1.
What should you deploy?

A. an Azure Application Gateway

B. an Azure Active Directory (Azure AD) Application Proxy

C. an Azure Virtual Network Gateway

You have an Azure subscription that contains the resources shown in the following table.
 
You create a public IP address named IP1.
Which two resources can you associate to IP1? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. VM1

B. LB1

C. NIC1

D. VPN1

E. VNet1

You have an Azure subscription that contains a storage account named storage1.
You need to allow access to storage1 from selected networks and your home office. The solution must minimize administrative effort.
What should you do first for storage1?

A. Add a private endpoint.

B. Modify the Public network access settings.

C. Select Internet routing.

D. Modify the Access Control (IAM) settings.

You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure virtual network.
Which tunneling protocol should you use?

A. IKEv1

B. PPTP

C. IKEv2

D. L2TP

You have an Azure subscription that contains the resources shown in the following table.
 
You configure Azure Site Recovery to replicate VM1 between the US East and West US regions.
You perform a test failover of VM1 and specify VNET2 as the target virtual network.
When the test version of VM1 is created, to which subnet will the virtual machine be connected?

A. TestSubnet1

B. DemoSubnet1

C. RecoverySubnetA

D. RecoverySubnetB

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Protocol to UDP

B. Session persistence to None

C. Floating IP (direct server return) to Disabled

D. Session persistence to Client IP

HOTSPOT -
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 10.0.0.0/16 and contains the VPN Gateway and subnets in the following table:
 
Subnet1 contains a virtual appliance named VM1 that operates as a router.
You create a routing table named RT1.
You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.
How should you configure RT1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
 
You have the peering options shown in the following exhibit.
 
You need to design a communication strategy for the resources on the virtual networks.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Enabled

B. Floating IP (direct server return) to Disabled

C. a health probe

D. Session persistence to Client IP and Protocol

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Disabled

B. Session persistence to Client IP

C. Protocol to UDP

D. Idle Time-out (minutes) to 20

HOTSPOT -
You have an Azure subscription that contains the virtual machines shown in the following table:
 
VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound Remote Desktop connections.
Subnet1 and Subnet2 are in a virtual network named VNET1.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the default rules.
NSG2 uses the default rules and the following custom incoming rule:
✑ Priority: 100
✑ Name: Rule1
✑ Port: 3389
✑ Protocol: TCP
✑ Source: Any
✑ Destination: Any
✑ Action: Allow
NSG1 is associated to Subnet1. NSG2 is associated to the network interface of VM2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered.
You plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1.
You need to configure NSG1 to allow inbound access to the virtual machines via Bastion1.
Which port should you configure for the inbound security rule?

A. 22

B. 443

C. 389

D. 8080

You have an Azure subscription that contains two virtual machines named VM1 and VM2.
You create an Azure load balancer.
You plan to create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2.
Which two additional load balancer resources should you create before you can create the load balancing rule? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. a frontend IP address

B. an inbound NAT rule

C. a virtual network

D. a backend pool

E. a health probe

HOTSPOT
-
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the servers shown in the following table.
 
You plan to migrate contoso.com to Azure.
You create an Azure virtual network named VNET1 that has the following settings:
• Address space: 10.0.0.0/16
• Subnet:
o   Name: Subnet1
o   IPv4: 10.0.1.0/24
You need to move DC1 to VNET1. The solution must ensure that the member servers in contoso.com can resolve AD DS DNS names.
How should you configure DC1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

You have an on-premises network that contains a database server named dbserver1.
You have an Azure subscription.
You plan to deploy three Azure virtual machines. Each virtual machine will be deployed to a separate availability zone.
You need to configure an Azure VPN gateway for a site-to-site VPN. The solution must ensure that the virtual machines can connect to dbserver1.
Which type of public IP address SKU and assignment should you use for the gateway?

A. a basic SKU and a static IP address assignment

B. a standard SKU and a static IP address assignment

C. a basic SKU and a dynamic IP address assignment

HOTSPOT -
You have an Azure subscription that contains the virtual machines shown in the following table.
 
The subscription contains a storage account named contoso2024 as shown in the following exhibit.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
 

HOTSPOT -
You have two Azure virtual machines as shown in the following table.
 
You create the Azure DNS zones shown in the following table.
 
You perform the following actions:
✑ ׀¢׀¾ fabrikam.com, you add a virtual network link to vnet1 and enable auto registration.
✑ For contoso.com, you assign vm1 and vm2 the Owner role.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

DRAG DROP -
You have an Azure subscription that contains two on-premises locations named site1 and site2.
You need to connect site1 and site2 by using an Azure Virtual WAN.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
 

HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
 
You have the virtual machines shown in the following table.
 
You have the virtual network interfaces shown in the following table.
 
Server1 is a DNS server that contains the resources shown in the following table.
 
You have an Azure private DNS zone named contoso.com that has a virtual network link to VNET2 and the records shown in the following table.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have a virtual network named VNet1 as shown in the exhibit. (Click the Exhibit tab.)
 
No devices are connected to VNet1.
You plan to peer VNet1 to another virtual network named VNet2. VNet2 has an address space of 10.2.0.0/16.
You need to create the peering.
What should you do first?

A. Modify the address space of VNet1.

B. Add a gateway subnet to VNet1.

C. Create a subnet on VNet1 and VNet2.

D. Configure a service endpoint on VNet2.

You have the Azure virtual machines shown in the following table.
 
VNET1 is linked to a private DNS zone named contoso.com that contains the records shown in the following table.
 
You need to ping VM2 from VM1.
Which DNS names can you use to ping VM2?

A. comp2.contoso.com and comp4.contoso.com only

B. comp1.contoso.com, comp2.contoso.com, comp3.contoso.com, and comp4.contoso.com

C. comp2.contoso.com only

D. comp1.contoso.com and comp2.contoso.com only

E. comp1.contoso.com, comp2.contoso.com, and comp4.contoso.com only