Question 250
An application routes by hostname but uses a generic probe that targets the wrong virtual host and marks every endpoint down. Which action best addresses this finding?
- Update backend pool membership and probe configuration and verify traffic distribution from client requests.
- Configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
Explanation
Correct Answer
B:HTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
Incorrect Answers
A:For this question, hTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
C:For this finding, hTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
D:Here, hTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
Question 251
An on-premises route learned over BGP overlaps a narrow spoke UDR, and the team cannot explain the chosen next hop. A hub VPN gateway provides on-premises routes, but a spoke has its own gateway and is configured to use both its own and a remote gateway simultaneously. An NVA is advertised as a transit point for interspoke traffic, but the spoke UDR only covers internet prefixes. Which course of action addresses the stated issues?
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination; review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; and review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions.
- Review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions; review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; and add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination; review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; and add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination; review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions; and add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
Explanation
Correct Answer
C:Route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR. Spoke gateway ownership and remote-gateway consumption have documented compatibility rules. Forcing only 0.0.0.0/0 does not guarantee every more-specific private route traverses the intended inspection path. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: forcing only 0.0.0.0/0 does not guarantee every more-specific private route traverses the intended inspection path.
B:Two actions meet their requirements, but action 1 misses this need: route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR.
D:Two actions meet their requirements, but action 2 misses this need: spoke gateway ownership and remote-gateway consumption have documented compatibility rules.
Question 252
A VM scale set needs predictable outbound source addresses without accepting internet-initiated inbound connections. An application sees outbound socket exhaustion during burst traffic and engineers increase only inbound load-balancer probes. Which response best addresses these needs?
- Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior; inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload.
- Inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload; do not Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior.
- Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior; review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments.
- Use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity; inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload.
Explanation
Correct Answer
A:NAT Gateway supplies scalable subnet outbound connectivity without serving as an inbound application listener. Outbound source translation ports limit concurrency independently of inbound application health probes. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior. The remaining action alone does not satisfy the situation.
C:Outbound source translation ports limit concurrency independently of inbound application health probes.
D:NAT Gateway supplies scalable subnet outbound connectivity without serving as an inbound application listener.
Question 253
An e-commerce site faces SQL injection in HTTP form fields but the security team relies solely on an L4 NSG port restriction. A web application needs global edge enforcement for geographically distributed users, but the team builds a WAF policy only on one regional internal Application Gateway. An application uses Application Gateway WAF but the policy is never associated with the intended listener, so suspected attacks still reach the app. What is the most appropriate plan for this situation?
- Deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling; Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention; and Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
- Deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling; apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic; and Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention.
- Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention; apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic; and Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
- Deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling; apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic; and Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
Explanation
Correct Answer
D:Web application attacks require application-layer inspection of HTTP payloads beyond port-level packet rules. Front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service. An unattached policy cannot protect the traffic path regardless of how many managed rules it defines. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service.
B:Two actions meet their requirements, but action 3 misses this need: an unattached policy cannot protect the traffic path regardless of how many managed rules it defines.
C:Two actions meet their requirements, but action 1 misses this need: web application attacks require application-layer inspection of HTTP payloads beyond port-level packet rules.
Question 254
A hub-and-spoke environment requires centralized stateful inspection of outbound traffic from many spokes and their on-premises extensions. Which response most directly resolves the issue?
- Configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
- Configure Azure Firewall application rules for supported web protocols and destination domains.
- Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address.
- Use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities.
Explanation
Correct Answer
C:Azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing.
Incorrect Answers
A:For this question, azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing.
B:For this finding, azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing.
D:Here, azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing.
Question 255
A support engineer uses Azure Network Adapter as an assumed universally supported feature on every legacy Windows Server build. Which response most directly resolves the issue?
- Check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path.
- Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles.
- Provide supported custom DNS server or private resolution configuration through the client and gateway architecture.
- Inspect certificate trust chains and authentication logs on both client and gateway before altering network routes.
Explanation
Correct Answer
A:Convenience management features have specific host and Azure prerequisites rather than universal availability.
Incorrect Answers
B:For this question, convenience management features have specific host and Azure prerequisites rather than universal availability.
C:Here, convenience management features have specific host and Azure prerequisites rather than universal availability.
D:For this finding, convenience management features have specific host and Azure prerequisites rather than universal availability.
Question 256
A subscription owner assumes every Front Door tier includes Private Link origins and WAF features at identical price and functionality. Which response most directly resolves the issue?
- Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door.
- Inspect origin group routing, priority, weight, and health settings and test representative client regions.
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing.
- Select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
Explanation
Correct Answer
D:Front Door feature availability and origin security options vary by tier and must be checked explicitly.
Incorrect Answers
A:Here, front Door feature availability and origin security options vary by tier and must be checked explicitly.
B:For this finding, front Door feature availability and origin security options vary by tier and must be checked explicitly.
C:For this question, front Door feature availability and origin security options vary by tier and must be checked explicitly.
Question 257
A business needs a public website record resolvable worldwide and mistakenly stores its authoritative A record only in Azure Private DNS. Which action best addresses this finding?
- Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings.
- Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Enable supported auto-registration on the designated VNet link and verify which resource types produce records.
Explanation
Correct Answer
C:Private DNS zones are not internet authoritative and cannot substitute for public DNS delegation.
Incorrect Answers
A:For this finding, private DNS zones are not internet authoritative and cannot substitute for public DNS delegation.
B:For this question, private DNS zones are not internet authoritative and cannot substitute for public DNS delegation.
D:Here, private DNS zones are not internet authoritative and cannot substitute for public DNS delegation.
Question 258
A storage account should accept requests from two authorized Azure subnets while continuing to use its normal public service name. An app on-premises must reach a storage account exclusively over a private IP but the architect suggests using only a VNet service endpoint. Which response best addresses these needs?
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules; use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules; choose a private endpoint when the requirement is a private IP on the consumer VNet.
- Use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP; do not enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules.
- Add the intended subnet to the service's supported network access rules and confirm the service endpoint state; use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP.
Explanation
Correct Answer
A:Service endpoints secure supported service access by source subnet while the service retains its public endpoint model. Service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints. Both actions are needed.
Incorrect Answers
B:Service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
C:This plan leaves out a required action: Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules. The remaining action alone does not satisfy the situation.
D:Service endpoints secure supported service access by source subnet while the service retains its public endpoint model.
Question 259
An architect tries to expose a self-hosted application through Azure Private Endpoint without creating any supported Private Link target service. A private-link provider changes its backend pool, then assumes all client endpoint connections must be recreated. What is the most appropriate plan for this situation?
- Maintain the supported Private Link service frontend while updating backend health and routing as needed; do not publish the service through an eligible Private Link service or supported Azure service target first.
- Configure Private Link service visibility and connection approval permissions before accepting consumer requests; Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Publish the service through an eligible Private Link service or supported Azure service target first; create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals.
- Publish the service through an eligible Private Link service or supported Azure service target first; Maintain the supported Private Link service frontend while updating backend health and routing as needed.
Explanation
Correct Answer
D:Private endpoints consume a published private connection; they do not automatically publish arbitrary VM ports. Consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Publish the service through an eligible Private Link service or supported Azure service target first. The remaining action alone does not satisfy the situation.
B:Private endpoints consume a published private connection; they do not automatically publish arbitrary VM ports.
C:Consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract.
Question 260
A regulated enterprise owns a registered public IPv4 block and wants to advertise it from Azure rather than use Azure-owned public space. A web application must maintain one stable inbound IP through a VM restart, but it currently receives a dynamic public address. A team allocates an unused public IP prefix and expects an individual virtual machine to respond to the entire prefix automatically. Which course of action addresses the stated issues?
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; create a suitable static Standard public IP and associate it with the supported load balancer or network interface; and create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; create a suitable static Standard public IP and associate it with the supported load balancer or network interface; and create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; and create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; create a suitable static Standard public IP and associate it with the supported load balancer or network interface; and Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix.
Explanation
Correct Answer
A:Custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges. A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address. Reserving a prefix does not itself configure listeners or give one VM every address in that prefix. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges.
C:Two actions meet their requirements, but action 2 misses this need: a static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address.
D:Two actions meet their requirements, but action 3 misses this need: reserving a prefix does not itself configure listeners or give one VM every address in that prefix.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests