Microsoft Practice Questions, Discussions & Exam Topics by our Authors

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to...

In this scenario, the goal is to ensure that visitors are consistently serviced by the same web server for each request. To achieve this, we need to configure session persistence. Session persistence ensures that a client is consistently routed to the same virtual machine during their session. Let’s go through each option: A) Floating IP (direct server return) to Disabled - Explanation: Floating IP is used in scenarios where traffic is returned directly from the backend server without passing through the load balancer. It does not directly influence session persistence. - Reason for rejection: This setting impacts how responses are sent back to the client but does not ensure consistent routing to the same server for all requests. It is unrelated to session persistence. B) Session persistence to None - Explanation: Session persistence set to "None" means there is no session affinity. The load balancer will randomly route requests to any of the backend servers, which can result in visitors being sent to different servers on different requests. - Reason for rejection: This option does not meet the requirement of ensuring that visitors are consistently serviced by the sam...

Author: Andrew · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: * A virtual network that has a subnet named Subnet1 * Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 * A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: * Priority: 100 * Source: Any * Source port range: * * Destination: * * Destination port range: 3389 * Protocol: UDP * Action: Allow VM1 has a public IP a...

Let’s analyze the scenario and solution step by step to understand whether it meets the goal of allowing Remote Desktop connections (RDP) to VM1 from the internet. Current Setup: - VM1 is connected to Subnet1, and has NSG-VM1 associated with its network interface. - NSG-VM1 contains a custom inbound rule allowing UDP traffic on port 3389 (RDP). - NSG-Subnet1 contains only the default inbound security rules, meaning it does not explicitly allow or deny RDP traffic. - VM1 has a public IP address, which is necessary for inbound internet traffic. Requirements: You need to enable Remote Desktop connections to VM1 from the internet. RDP typically uses TCP on port 3389, not UDP. Solution: 1. Add an inbound security rule to NSG-Subnet1 that: - Allows connections from Any source. - Allows traffic to any destination. - Specifically allows TCP traffic on port 3389 (RDP). 2. Remove NSG-VM1 from the network interface of VM1. Analysis: - NSG-VM1: When NSG-VM1 is associated with VM1’s network interface, it can control inbound traffic directly to the VM. It currently allows UDP traffic on port 3389 but does not allow TCP traffic, which is nec...

Author: Maya2022 · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: * A virtual network that has a subnet named Subnet1 * Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 * A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: * Priority: 100 * Source: Any * Source port range: * * Destination: * * Destination port range: 3389 Protocol: UDP - * Action: All...

Let’s break down the scenario and solution to determine whether it allows you to establish Remote Desktop (RDP) connections from the internet to VM1. Current Setup: - VM1 is located in Subnet1 and has NSG-VM1 applied to its network interface. - NSG-VM1 has an inbound rule that allows UDP traffic on port 3389 (RDP). However, RDP typically uses TCP for connection establishment. - NSG-Subnet1 has only default inbound security rules, which do not explicitly allow or deny traffic for RDP. - VM1 has a public IP address, which is essential for internet access. Requirement: You need to enable RDP connections from the internet to VM1. This requires allowing TCP traffic on port 3389. Solution: The solution proposes adding an inbound security rule to NSG-Subnet1 that: - Allows connections from the internet (Any source) to the VirtualNetwork ...

Author: Ethan · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: * A virtual network that has a subnet named Subnet1 * Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 * A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: * Priority: 100 * Source: Any * Source port range: * * Destination: * * Destination port range: 3389 * Protocol: UDP * Action: Allow VM1 h...

Let's analyze the scenario and solution to determine if it meets the goal of allowing Remote Desktop (RDP) connections from the internet to VM1. Current Setup: - VM1 is located in Subnet1 and has NSG-VM1 applied to its network interface. - NSG-VM1 has an inbound security rule allowing UDP traffic on port 3389 (RDP). - NSG-Subnet1 has the default inbound security rules, meaning it does not explicitly allow or deny traffic for RDP. - VM1 has a public IP address, which is necessary for internet access. Requirement: You need to enable RDP connections to VM1 from the internet, which requires allowing TCP traffic on port 3389. Solution: The solution proposes adding an inbound security rule to both NSG-Subnet1 and NSG-VM1 that: - Allows connections from the internet source (Any) to the VirtualNetwork destination. - Uses TCP protocol on port 3389. Analysis: 1. NSG-VM1: - Currently, NSG-VM1 has an inbound rule allowing UDP traffic on port 3389. However, RDP requires TCP traffic, so this rule is not sufficient. - The solution adds an inbound rule to NSG-VM1 for TCP traffic on port 3389, which is the correct protocol for RDP. 2. NSG-Subnet...

Author: Matthew · Last updated Jul 27, 2026

SNAPSHOT - You have a virtual network named VNet1 that has the configuration shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the inform...

Author: Olivia · Last updated Jul 27, 2026

You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table. Each virtual machine uses a static IP address. You need to create network security groups (NSGs) to meet following requirements: * Allow web requests from the internet to VM3, VM4, VM5, and VM6. * Allow all connections between VM...

To determine the minimum number of Network Security Groups (NSGs) required for the given scenario, let's break down the requirements and the options provided. Requirements: 1. Allow web requests from the internet to VM3, VM4, VM5, and VM6: This indicates that NSGs need to allow inbound HTTP/HTTPS traffic to these VMs from the internet. 2. Allow all connections between VM1 and VM2: This means VM1 and VM2 must be able to communicate freely without restrictions, implying an NSG rule that allows all traffic between them. 3. Allow Remote Desktop connections to VM1: This means an NSG must allow inbound RDP traffic (TCP port 3389) to VM1 from the internet. 4. Prevent all other network traffic to VNET1: This requires that any traffic not explicitly allowed by the previous rules be denied. Analysis: - VM3, VM4, VM5, and VM6 need to accept web requests (HTTP/HTTPS) from the internet. This means that you will need to configure NSG rules for inbound traffic on port 80 (HTTP) or 443 (HTTPS) for these VMs. - VM1 and VM2 need unrestricted communication between each other. You can create NSG rules to allow all traffic between these two VMs, ensuring there are no restrictions. - Remote Desktop (RDP) for VM1: You would need to create a specific inbound rule for RDP (port 3389) to allow traffic from the internet to VM1. - Preventing all other traffic: You can use a default deny rule to block any other traffic that does not match the allowed rules. NSG Assignments: - Option 1 (NSG for VM1 and VM2): You need an NSG for VM1 and VM2 to allow unrestricted communication between them. This NSG can be applied at the subnet level or at the NIC level. - Option 2 (NSG for VMs with web traffic): To allow web traffic from the internet to VM3, VM4, VM5, and VM6, you need to configure inbound rules for HTTP/HTTPS on an NSG attached to the subnet or NICs of those VMs. - Option 3 (NSG for RDP access to VM1): An NSG with an inbound rule for...

Author: GlowingTiger · Last updated Jul 27, 2026

You have an Azure subscription that contains the resources shown in the following table. The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters: Microsoft.Network/virtualNetworks Microsoft.Compute/virtualMa...

Problem Breakdown: - Azure Subscription & Resources: The Azure policy "Not allowed resource types" is assigned to RG1, which restricts the creation of specific resource types: - Microsoft.Network/virtualNetworks - Microsoft.Compute/virtualMachines - The task is to create a new virtual machine (VM2) and connect it to VNET1 within RG1. Key Points: - The Not allowed resource types policy restricts the creation of virtual networks (VNETs) and virtual machines (VMs) in RG1. Therefore, this policy is preventing both the creation of VM2 and the ability to connect it to VNET1. - The issue here is not that the virtual network (VNET1) does not exist, but that RG1 cannot create Microsoft.Compute/virtualMachines and Microsoft.Network/virtualNetworks resources due to the existing policy. Evaluation of Options: Option A: Remove Microsoft.Compute/virtualMachines from the policy - Reasoning: The Microsoft.Compute/virtualMachines resource type is restricted by the policy, which means you cannot create virtual machines in RG1. Removing Microsoft.Compute/virtualMachines from the policy would allow the creation of virtual machines. - Why selected: This ...

Author: Lina Zhang · Last updated Jul 27, 2026

Your company has an Azure subscription named Subscription1. The company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named adatum.com. Adatum.com contains 1,000 DNS records. You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed: * The DNS Manager console * Azur...

To determine the best option for moving the adatum.com DNS zone from an on-premises DNS server (Server1) to an Azure DNS zone in Subscription1, let’s evaluate the options and understand the requirements. Key Considerations: 1. The task: You need to move the adatum.com zone from the on-premises DNS server (Server1) to an Azure DNS zone in Subscription1. 2. Minimizing administrative effort: The goal is to move the DNS zone with as little manual configuration or intervention as possible. 3. Existing tools: The tools available on Server2 include Azure PowerShell, Azure CLI 2.0, and the DNS Manager console. Evaluation of Options: Option A: Azure CLI - Reasoning: Azure CLI is a powerful command-line tool that allows you to manage Azure resources, including DNS zones. It can automate the process of creating and managing DNS zones and records in Azure. - Minimizing effort: While Azure CLI can efficiently handle the creation of an Azure DNS zone, moving existing DNS records from the on-premises server to Azure requires exporting the DNS zone from the DNS Manager console on Server1 and then importing it into Azure using CLI commands. This adds some manual steps (e.g., exporting records and formatting them) and can be a bit more complex compared to other options. Option B: Azure PowerShell - Reasoning: Azure PowerShell provides similar functionality to Azure CLI, and it’s also a robust tool for managing Azure resources. It can be used to automate the creation of DNS zones and manage DNS records. - Minimizing effort: Like Azure CLI, using Azure PowerShell requires exporting the DNS zone from Server1 and importing it into Azure, which involves a bit more effort and manual work compared to a more integrated approach. PowerShell can automate certai...

Author: Liam123 · Last updated Jul 27, 2026

You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2, and VM3. You need to direct all the Remote Deskto...

To direct all Remote Desktop Protocol (RDP) connections to VM3 only, let's evaluate the options and determine the best approach. Key Considerations: - RDP typically uses TCP port 3389, which is the port used to remotely connect to Windows servers. - The requirement is to ensure that RDP traffic is directed specifically to VM3 while keeping the existing load balancer functionality for ports 80 and 443 (HTTP/HTTPS). Evaluation of Options: Option A: Inbound NAT rule - Reasoning: Inbound NAT (Network Address Translation) rules allow you to forward specific traffic from a public IP address and port to a private IP address and port on a specific VM in the backend pool. - Minimizing effort: By configuring an Inbound NAT rule for RDP (port 3389), you can explicitly forward RDP traffic to VM3. This allows you to control which VM receives the RDP traffic, while the load balancer continues to handle ports 80 and 443 as usual. - Why selected: Inbound NAT rules are the right choice for directing RDP traffic to a specific VM in a pool. You can configure a rule to ensure that all RDP traffic (port 3389) reaches VM3 while other VMs (VM1 and VM2) are not affected. Option B: A new public load balancer for VM3 - Reasoning: Creating a new load balancer for VM3 is unnecessary. The existing load balancer already balances traffic for ports 80 and 443, and creating a new one just for VM3 would be inefficient and unnecessary. RDP traffic can be managed with an Inbound NAT rule ...

Author: Lucas Carter · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription named Subscription1 that contains the virtual networks in the following table. Subscription1 contains the virtual machines in the following table. In Subscription1, you create a load balancer that has the following configurations: * Name: LB1 * SKU: Basic * Type: Internal * Subnet: Subnet12 * Virtual network: VN...

Author: Victoria · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure virtual machine that runs Windows Server 2019 and has the following configurations: * Name: VM1 * Location: West US * Connected to: VNET1 * Private IP address: 10.1.0.4 * Public IP addresses: 52.186.85.63 * DNS suffix in Windows Server: Adatum.com You create the Azure DNS zones shown in the following table. You need to identify which DNS zones you can link to VNET1 and the DNS zones to whi...

Author: Henry · Last updated Jul 27, 2026

DRAG DROP - You have an on-premises network that you plan to connect to Azure by using a site-so-site VPN. In Azure, you have an Azure virtual network named VNet1 that uses an address space of 10.0.0.0/16 VNet1 contains a subnet named Subnet1 that uses an address space of 10.0.0.0/24. You need to create a site-to-site VPN to Azure. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to...

Author: Kai99 · Last updated Jul 27, 2026

You have an Azure subscription that contains the resources in the following table. VM1 and VM2 are deployed from the same template and host line-of-business applications. You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.) Y...

To prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80, let's analyze the options and determine the best solution. Key Considerations: - Port 80 is typically used for HTTP traffic (web traffic). - Network Security Groups (NSGs) can have inbound and outbound rules. - Inbound rules control traffic coming into the VM. - Outbound rules control traffic going from the VM to the Internet or other destinations. Evaluation of Options: Option A: Disassociate the NSG from a network interface - Reasoning: Disassociating the NSG from a network interface would effectively stop enforcing any network security rules on the interface, which means the NSG would no longer control traffic to or from the VM. - Why rejected: Disassociating the NSG would remove all controls (including restrictions on port 80), allowing traffic in both directions. This option does not solve the specific problem of blocking HTTP access to websites over port 80. It would actually make the system less secure. Option B: Change the Port_80 inbound security rule - Reasoning: Inbound rules control traffic coming into the VM. However, the issue is with outbound traffic, which is traffic from the VM to external websites, not inbound traffic to the VM. - Why rejected: Changing the Port_80 inbound security rule would not affect outbound traffic to websites. This is not the right solution since we need to prevent outgoing traffic on port 80,...

Author: Kunal · Last updated Jul 27, 2026

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 cont...

To connect VNet1 in Subscription1 to VNet2 in Subscription2, the first step is to establish a secure and reliable communication link between the two virtual networks. Here's a breakdown of the options: Key Considerations: - VNet1 (10.0.0.0/16) and VNet2 (10.10.0.0/24) are in different subscriptions, and these subscriptions are associated with different Azure Active Directory (Azure AD) tenants. - Connecting virtual networks across subscriptions requires the appropriate configuration, and there are several ways to do this (e.g., Virtual Network Peering, Virtual Network Gateways). Evaluation of Options: Option A: Move VM1 to Subscription2 - Reasoning: Moving VM1 to Subscription2 would not directly help in connecting the two virtual networks (VNet1 and VNet2). The virtual machine’s location within a subscription does not impact how virtual networks are connected. - Why rejected: Moving VM1 does not resolve the issue of connecting the two virtual networks. The problem is with the network connectivity between VNet1 and VNet2, not with the placement of the virtual machine. Option B: Move VNet1 to Subscription2 - Reasoning: Moving VNet1 to Subscription2 would not help in establishing connectivity between the two VNets either. Changing the subscription of a virtual network does not inherently affect its ability to connect with another virtual network. - Why rejected: The problem is about connecting VNet1 and VNet2, regardless of their subscription association. Moving VNet1 to Subscription2 is unnecessary and would still require additional configura...

Author: Isabella1 · Last updated Jul 27, 2026

You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit. The planned disk configurations for VM1 are shown in the following exhibit. You need to ensure that VM1 can be created in an Availability Zone. Which two setting...

To ensure that VM1 can be created in an Availability Zone, we need to examine the key settings related to Azure's Availability Zones and what is required for a virtual machine to be deployed in one. Key Considerations: 1. Availability Zones are used to ensure high availability by spreading virtual machines across different physical locations within an Azure region. Not all settings are compatible with Availability Zones. 2. For a VM to be deployed in an Availability Zone, it must meet specific requirements such as the type of disk used and the availability settings. Evaluation of Options: Option A: Use managed disks - Reasoning: Managed disks are required for VMs in Availability Zones. Azure uses managed disks for VM OS and data disks, which are stored in Azure Storage and managed by Azure itself. - Why selected: If you want to create a VM in an Availability Zone, the VM must use managed disks. Unmanaged disks are not supported for Availability Zone deployment. - Why rejected: If the VM uses unmanaged disks, it will not be eligible for deployment in an Availability Zone, so switching to managed disks is necessary. Option B: OS disk type - Reasoning: The OS disk type can either be Standard HDD, Standard SSD, or Premium SSD. Availability Zones are supported for all of these disk types, but the disk type needs to be compatible with Availability Zones and should be managed. - Why rejected: The OS disk type itself does not need to be modified specifically for an Availability Zone. The key is ensuring that the VM uses managed disks and is properly configured for Availabi...

Author: Manish · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription that contains the resources shown in the following table. VMSS1 is set to VM (virtual machines) orchestration mode. You need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1. Which resource group and location should you use to dep...

Author: Liam · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3. Peering for VNET1 is configured as shown in the following exhibit. Peering for VNET2 is configured as shown in the following exhibit. Peering for VNET3 is configured as shown in the following exhibit. How can packets be routed be...

Author: Ryan · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and instal...

Key Considerations: - Point-to-site (P2S) VPN: This type of VPN allows individual clients (like Computer2) to connect to an Azure virtual network (VNet1) without the need for a site-to-site VPN. The connection uses certificates or Azure Active Directory (Azure AD) authentication for verification. - The scenario specifies that the connection from Computer1 to VNet1 uses a self-signed certificate. This means that Computer2 must also use a matching or valid certificate to establish the VPN connection, unless a different form of authentication (such as Azure AD) is used. Evaluation of the Solution: Solution: Modify the Azure Active Directory (Azure AD) authentication policies - Reasoning: Azure AD authentication is another option for P2S VPN connections, and it can be used instead of certificates. However, modifying Azure AD authentication policies would not automatically enable Computer2 to establish a point-to-site VPN connection using the existing self-signed certificate. For Computer2 to use a self-signed certificate...

Author: Amelia · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you downloa...

Key Considerations: - The point-to-site VPN connection from Computer1 to VNet1 uses a self-signed certificate. In a point-to-site VPN configuration, the client computer must have the proper certificate to authenticate and establish the connection. - The goal is to ensure that Computer2 can establish a point-to-site VPN connection to VNet1. The issue revolves around whether joining Computer2 to Azure Active Directory (Azure AD) will resolve the certificate-based authentication requirement. Evaluation of the Solution: Solution: Join Computer2 to Azure Active Directory (Azure AD) - Reasoning: Joining Computer2 to Azure AD might help with identity management and provide access to Azure resources. However, Azure AD join does not automatically provide the necessary self-signed certificate for ...

Author: Suresh · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network securit...

Key Considerations: - Network Security Groups (NSGs) are used to control network traffic to and from Azure resources based on security rules, such as blocking specific ports. - The goal is to automatically block TCP port 8080 between the virtual networks when an NSG is created. - The proposed solution involves creating a resource lock and assigning it to the subscription. To determine if this is effective, we need to understand how resource locks work and whether they can help enforce specific network security settings. Evaluation of the Solution: Solution: Create a resource lock, and assign the lock to the subscription - Reasoning: A resource lock in Azure prevents resources from being deleted or modified. It ensures that certain resources cannot be accidentally deleted or altered. However, resource locks do not enforce specific configuration settings, such as network security rules. - Why rejected: A reso...

Author: Aarav · Last updated Jul 27, 2026

You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1. You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet. You add a network interface named vm1173 to VM1 as shown in the exhibit. (Click the Exhibit tab.) From Computer1, you attempt to conn...

To troubleshoot and establish a Remote Desktop connection to VM1 from Computer1, we need to consider various network and VM-related factors, especially focusing on network security rules, VM status, and the proper interface configurations. Breakdown of the options: A) Change the priority of the RDP rule - Explanation: In Azure, Network Security Groups (NSGs) control inbound and outbound traffic for virtual machines and network interfaces. If there’s a rule that blocks RDP (port 3389) traffic, it can be identified in the NSG settings. Changing the priority of the rule might help allow RDP traffic, but only if there’s a conflict in rules. - Why this might be rejected: There’s no indication in the problem that the issue is due to NSG priorities; the focus is more on the configuration of the network interface or the VM itself. We also don't know the current NSG configuration, so it's better to check whether any blocking rule exists first. B) Attach a network interface - Explanation: The exhibit shows that VM1 has a network interface named `vm1173` added to it. If this new interface is misconfigured or not properly attached to the correct network, it might prevent a successful RDP connection. - Why this is a likely candidate: If `vm1173` is newly added, it may not be properly associated or configured to handle RDP connections, making the VM inaccessible for Remote Desktop. Ensuring the network interface is...

Author: Emily · Last updated Jul 27, 2026

You have the Azure virtual machines shown in the following table. A DNS service is installed on VM1. You configure the DNS servers settings for each virtual network as shown in the following exhibit. You need to ensure that ...

To ensure that all virtual machines can resolve DNS names using the DNS service on VM1, we need to enable network communication between the virtual networks (VNETs) and configure the DNS service in such a way that all the VMs in these networks can use it. Breakdown of the options: A) Configure a conditional forwarder on VM1 - Explanation: A conditional forwarder is used to forward DNS queries for specific domains to other DNS servers. However, this option is typically used to resolve DNS queries for specific domains in a multi-domain setup or in scenarios where DNS resolution needs to be forwarded to different DNS servers based on the domain being queried. - Why this might be rejected: Since the goal is to allow all VMs in all VNETs to use the DNS service on VM1, this option may not be sufficient. The issue appears to be about inter-VNET DNS resolution, which would require network connectivity and proper DNS forwarding across VNETs, not just a conditional forwarder on VM1. B) Add service endpoints on VNET1 - Explanation: Service endpoints enable private access to Azure services over a direct connection from a virtual network, ensuring secure and optimized traffic between the virtual network and the Azure service. - Why this might be rejected: While service endpoints are useful for services like Azure Storage, SQL Database, or Key Vault, they do not apply to enabling DNS resolution across VNETs. Adding service endpoints on VNET1 alone will not solve the issue of DNS resolution across multiple VNETs. C) Add service endpoints on VNET2 and ...

Author: ShadowWolf101 · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription that contains the Azure virtual machines shown in the following table. You add inbound security rules to a network security group (NSG) named NSG1 as shown in the following table. You run Azure Network Watcher as shown in the following exhibit. You run Network Watcher again as shown in the following exhibit. ...

Author: RadiantPhoenixX · Last updated Jul 27, 2026

You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address. The virtual machines host several applications that are accessible over port 443 to users on the Internet. Your on-premises network has a site-to-site VPN connection to VNet1. You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network. You need to prevent RDP access...

To meet the requirement of preventing RDP access to virtual machines from the Internet while still allowing access to applications over port 443, the key issue is controlling the access to port 3389 (used for RDP) while ensuring the availability of applications over port 443. Let's analyze each option: A) Modify the address space of the local network gateway - Explanation: The local network gateway in a site-to-site VPN represents the on-premises side of the connection. Changing the address space here would only affect the routing between the on-premises network and VNet1. It wouldn’t help with controlling RDP access from the Internet, as the issue at hand is to restrict RDP traffic from the Internet, not from the on-premises network. - Why this is rejected: This option is unrelated to the requirement of limiting RDP access from the Internet. Modifying the address space wouldn't control RDP traffic for the virtual machines. B) Create a deny rule in a network security group (NSG) that is linked to Subnet1 - Explanation: A Network Security Group (NSG) controls inbound and outbound traffic to network interfaces (NICs), subnets, or virtual machines. By creating a deny rule for port 3389 (RDP) for public IP addresses, you can block RDP traffic from the Internet while still allowing other traffic (like port 443 for application access). You can also specify that the deny rule applies only to traffic coming from the Internet, allowing RDP only from the on-premises network. - Why this is selected: This is the best solution because it directly addresses the problem of blocking RDP access from the Internet while maintaining the accessibility of other applications (like those using port 443). You can control the traffic using NSGs, applying the deny rule for port 3389 from the I...

Author: Rahul · Last updated Jul 27, 2026

You have an Azure subscription that contains the resources in the following table. Subnet1 is associated to VNet1. NIC1 attaches VM1 to S...

To apply ASG1 (Application Security Group 1) to VM1, we need to ensure that the virtual machine is correctly linked to ASG1 through its network interface (NIC). Let's break down the options: A) Associate NIC1 to ASG1 - Explanation: An Application Security Group (ASG) is designed to group virtual machine network interfaces and apply security rules (such as access control lists) based on the ASG. To associate VM1 with ASG1, you need to attach NIC1 (the network interface of VM1) to ASG1. - Why this is selected: This is the correct option because NIC1 represents the network interface of VM1. Associating NIC1 with ASG1 will ensure that VM1 can be grouped in ASG1 for applying relevant network security rules that target the ASG. You would typically use this to apply network security rules to VM1 based on the ASG group membership. B) Modify the properties of ASG1 - Explanation: ASG1 is the security group itself, and modifying its properties would usually involve changing its name or other attributes, but this doesn't directly address associating NIC1 (the network interface of...

Author: CrystalWolfX · Last updated Jul 27, 2026

You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute. You plan to prepare the environment for automatic failover in case of ExpressRoute failure. You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution mus...

To prepare for automatic failover between an ExpressRoute connection and a site-to-site VPN in Azure, you need to establish a failover mechanism where the VPN is used when ExpressRoute fails. The solution should be cost-effective while meeting the necessary technical requirements. Option Analysis: 1. A) Create a connection This option is needed to establish the actual link between your Azure virtual network and the on-premises network over the site-to-site VPN. Without a connection, there will be no data flow between Azure and the on-premises network. It is necessary, but on its own, it is not enough to fulfill the entire requirement. 2. B) Create a local site VPN gateway This option is not needed in this scenario. The local site VPN gateway refers to the on-premises VPN gateway configuration. In Azure, you generally set up the VPN gateway on Azure, and the on-premises side will have its own VPN gateway. Therefore, creating a local site VPN gateway is not an action you need to take in Azure. 3. C) Create a VPN gateway that uses the VpnGw1 SKU The VpnGw1 SKU would provide the necessary capacity for a standard site-to-site VPN. However, the VpnGw1 SKU is typically used for high-throughput or advanced features that might be unnecessary for failover configuration, especially when cost minimization is a priority. This option adds more complexity and hi...

Author: Maya2022 · Last updated Jul 27, 2026

SNAPSHOT - You have peering configured as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information pres...

Author: Emma · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription that contains the resources in the following table. You install the Web Server server role (IIS) on VM1 and VM2, and then add VM1 and VM2 to LB1. LB1 is configured as shown in the LB1 exhibit. (Click the LB1 tab.) Rule1 is configured as shown in the Rule1 exhibit. (Click the Rule1 tab.) For eac...

Author: Aarav · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1. VM1 has the following configurations: * Subnet: 10.0.0.0/24 * Availability set: AVSet * Network security group (NSG): None * Private IP address: 10.0.0.4 (dynamic) * Public IP address: 40.90.219.6 (dynamic) You deploy a standard, Internet-facing load balancer named slb1. You need to configure slb1 to allow connectivity t...

Author: Isabella · Last updated Jul 27, 2026

You have an Azure subscription that contains the resources shown in the following table. You need to create a network interf...

To determine where you can create the network interface (NIC1), we need to understand the relationship between resources and locations in Azure. Scenario Setup: In Azure, when creating resources such as a Network Interface (NIC), the NIC must be placed in the same region (location) as the Virtual Network (VNet) that it will connect to. Based on the information given in the table, the NIC must be created in a location where the associated VNet exists. Key Factors: - Location of resources: The location of the VNet determines where the NIC can be created. A NIC cannot exist in a different region from the VNet it is associated with. Therefore, if your VNet is in a specific region, the NIC must also be in the same region. - Regions available: If the table indicates that the VNet is located in specific regions (e.g., East US, West Europe, etc.), then the NIC must be created in those same regions. Analysis of Each Option: 1. A) East US and North Europe only: This would only be valid if the resources, particularly the VNet, are located specifically in East US or North Europe. If the VNet is in a different region, t...

Author: Charlotte · Last updated Jul 27, 2026

You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table. You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com. For controso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the Exhibit tab.) You discover that VM1 can resolve names in contoso.com but...

To solve the problem where VM1 can resolve names in the contoso.com DNS zone but not in adatum.com, let's evaluate the provided options and see which one addresses the issue effectively: Key Factors: - VM1 can resolve names in contoso.com but cannot resolve names in adatum.com. - VM1 can resolve other hosts on the Internet, meaning it has Internet connectivity and is likely configured with a public DNS resolver. - The DNS setup includes both a public Azure DNS zone (adatum.com) and a private Azure DNS zone (contoso.com). Option Analysis: A) Update the DNS suffix on VM1 to be adatum.com - This option would set the DNS suffix search list to prioritize adatum.com. However, changing the DNS suffix doesn't affect the ability to resolve names in a public DNS zone, which adatum.com is. DNS suffixes help with name resolution for internal or domain-based resources. Since VM1 already has Internet access and can resolve other external names, this option isn't the root cause of the issue. - Rejection Reason: This will not help VM1 resolve names in a public DNS zone like adatum.com if VM1's DNS resolution isn't correctly configured for public zones. B) Configure the name servers for adatum.com at the domain registrar - The issue could be that the adatum.com DNS zone is not configured with the correct name servers at the domain registrar. For adatum.com to be resolvable on the public Internet, the name servers for this domain must be set at the domain registrar to point to Azure DNS servers. - Rejection Reason: This action might b...

Author: NightmareDragon2025 · Last updated Jul 27, 2026

SNAPSHOT - You plan to use Azure Network Watcher to perform the following tasks: * Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine. * Task2: Validate outbound connectivity from an Azure virtual machine to an external host. Which feature should you use f...

Author: Jack · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription that contains the Azure virtual machines shown in the following table. You configure the network interfaces of the virtual machines to use the settings shown in the following table. From the settings of VNET1 you configure the DNS servers shown in the following exhibit. The virtual machines can successfully connect to the DNS server that has an IP address of 192.168.10.15 and the DNS server that h...

Author: Ethan · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription that contains the resource groups shown in the following table. RG1 contains the resources shown in the following table. You need to identify which resources you can move from RG1 to RG2, and which resources you can move from RG2 to RG1. Which resources should y...

Author: Maya2022 · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: * Name: LB1 * Type: Internal *...

Key Information: - Virtual Machines: VM1 and VM2 are part of the same virtual network (VNET1). - Load Balancer Configuration: The load balancer (LB1) is Internal, and its SKU is Standard. - Goal: Add VM1 and VM2 to the backend pool of LB1. Option Analysis: A) Yes - The scenario specifies that you are creating a Basic SKU public IP address and associating it with the network interface of VM1. - Key Issue: The load balancer (LB1) is of type Internal and is intended for traffic within a virtual network. An Internal Load Balancer (ILB) is designed to distribute traffic within a VNet, and it does not require a public IP for backend pool members like VM1 and VM2. - The Basic SKU public IP is typically used with Public Load Balancers, not Internal Load Balancers. An Internal Load Balancer would use private IP addresses within the VNet, not public IP addresses. By creating a Basic SKU public IP, you're mixing config...

Author: Carlos Garcia · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: * Name: LB1 * Type: Internal * ...

To determine if this solution meets the goal of adding VM1 and VM2 to the backend pool of the internal load balancer (LB1), let's break down the key factors: Key Factors: 1. Internal Load Balancer: You are deploying an internal load balancer (LB1), meaning it is designed for use within a virtual network (VNET1) and cannot use a public IP address. The internal load balancer only uses private IP addresses for its backend pool. 2. Standard SKU Public IP: The Standard SKU public IP is a public IP address. However, internal load balancers cannot use public IPs, as they are designed to handle traffic within a virtual network using private IPs. Therefore, associating a public IP address with the network interface of VM1 would not meet the requirements of the internal load balancer. 3. Stopping VM2: Stopping VM2 does ...

Author: Henry · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: * Name: LB1 * Type: Internal * SKU: Standard *...

To determine if the solution meets the goal of adding VM1 and VM2 to the backend pool of the internal load balancer (LB1), let's analyze the key factors: Key Factors: 1. Internal Load Balancer (LB1): An internal load balancer is configured for use within a private virtual network (VNET1), meaning it can only accept traffic from within the VNET and distribute it using private IP addresses. 2. Public IP Addresses: The solution involves creating Standard SKU public IP addresses and associating them with the network interfaces of VM1 and VM2. Public IP addresses are used to provide external access to services and are typically associated with public-facing load balancers (such as external load balancers) rather than internal load balancers. 3. Compatibility Issue: Internal load balancers ...

Author: Madison · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN cl...

To determine whether the solution meets the goal of establishing a point-to-site VPN connection from Computer2 to VNet1, let's break down the key factors: Key Factors: 1. Point-to-Site VPN: In a point-to-site VPN setup, a client computer (in this case, Computer2) must authenticate with the Azure VPN gateway using a certificate-based authentication method (in this scenario, a self-signed certificate). 2. Self-Signed Certificate: The VPN connection on Computer1 is already configured with a self-signed certificate. When setting up a point-to-site VPN connection, Azure requires that the client computer (Computer2) has the same certificate installed for authentication. 3. Exporting the Client Certificate: To establish a successful VPN connection, Computer2 must have the client certificate that was used for authentication by Computer1. This certificate must be exported from Computer1 and installed on Computer2. ...

Author: StarryEagle42 · Last updated Jul 27, 2026

You have an Azure virtual machine named VM1. The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.) You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as...

To determine the correct action to ensure users can connect to the website hosted on VM1 via the HTTPS protocol, we need to review the key factors, such as the network interface configuration and the specific security rules that are likely present in the exhibit (though it's not visible here). The goal is to ensure that TCP port 443, which is used for HTTPS, is open for inbound traffic from the internet. Key Factors: 1. HTTPS Port: HTTPS typically operates on TCP port 443. To allow external users to access the website, this port must be open on the virtual machine's network interface. 2. Network Security Rules: Network security rules are typically configured in Azure Network Security Groups (NSGs) or on the virtual machine's own firewall. These rules control the flow of traffic to and from the VM. 3. Examine Possible Actions: - A) Modify the protocol of Rule4: This option would modify an existing rule (Rule4), but we do not have enough details on whether Rule4 pertains to HTTPS (TCP 443) or another protocol. Changing the protocol of an existing rule might not be the best solution because it might interfere with other configurations. - B) Delete Rule1: Deleting Rule1 would typically remove some existing network security rule. However, we don't have enough information to det...

Author: Nia · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security group...

Key Factors: 1. Network Security Groups (NSGs): An NSG allows you to control inbound and outbound traffic to network interfaces (NIC), virtual machines (VMs), and subnets in an Azure virtual network. You can define security rules that allow or deny specific traffic, including specific ports such as TCP port 8080. 2. Microsoft.ClassicNetwork Provider: The Microsoft.ClassicNetwork provider is part of the older Azure networking stack. It is used for managing legacy network configurations, including classic virtual networks and network security groups from the older Azure portal. The newer Azure networking stack utilizes Resource Manager (RM) and is not dependent on ClassicNetwork. 3. Unregistering the Microsoft.ClassicNetwork Provider: Unregistering the Microsoft.ClassicNetwork provider would stop the ability to manage classic network resources and NSGs associated with those classic networks. However, this does not affect the management or creation of modern NSGs for resource groups, virtual networks, or modern network interfaces created under the Azure Resource Manager (ARM) model. 4. ...

Author: Ishaan · Last updated Jul 27, 2026

SNAPSHOT - You manage two Azure subscriptions named Subscription1 and Subscription2. Subscription1 has following virtual networks: The virtual networks contain the following subnets: Subscription2 contains the following virtual network: * Name: VNETA * Address space: 10.10.128.0/17 * Location: Canada Central VNETA contains the following subnets: ...

Author: MysticJaguar44 · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. Y...

Key Factors: 1. App1 and Azure Load Balancer: App1 is deployed on two Azure virtual machines, VM1 and VM2, with an Azure Load Balancer handling connections. TCP port 443 is used for HTTPS traffic. 2. Effective Network Security Configurations: The Network Security Groups (NSGs) for the virtual machines (like VM2) play a crucial role in controlling inbound and outbound traffic to the VM. The configurations shown in the exhibit for VM2 are critical in determining whether traffic from 131.107.100.50 can reach App1. 3. Troubleshooting Connections: The issue is that connections from 131.107.100.50 to App1 (on TCP port 443) are failing. This could be due to misconfigured inbound security rules or blocking of the relevant traffic in the NSG. 4. Security Rule Configuration: The solution proposes creating an inbound security rule that denies all traffic from 131.107.100.50 with a priority (or cost) of 64999. ...

Author: Aarav · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from...

Key Factors: 1. App1 and Azure Load Balancer: App1 is installed on VM1 and VM2, with an Azure Load Balancer managing traffic to both virtual machines. TCP port 443 is used for HTTPS traffic. 2. Network Security Configurations: The effective network security rules for VM2 are important in determining whether traffic from 131.107.100.50 is allowed to reach the virtual machine. We know that connections to App1 are currently failing, and Load Balancer rules are verified to be correct. 3. BlockAllOther443 Rule: The BlockAllOther443 inbound security rule is likely blocking all traffic on port 443 from sources other than the specified allowed addresses or ranges. This would include blocking the connection from 131.107.100.50, which is the source where the connection is failing. 4. Goal: The goal is to ensure that 131.107.100.50 can successfu...

Author: Liam · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.5...

Key Factors: 1. App1 and Azure Load Balancer: App1 is installed on VM1 and VM2, and connections are managed by an Azure Load Balancer. The connection issue pertains to traffic from the IP address 131.107.100.50 over TCP port 443 (HTTPS). 2. Network Security Configurations: The security rules for VM2 are important in controlling traffic to and from the virtual machine. The question suggests that the issue is related to the network security rule settings, specifically for inbound traffic from 131.107.100.50 on TCP port 443. 3. Allow_131.107.100.50 Rule: The Allow_131.107.100.50 inbound security rule is likely configured to allow traffic from 131.107.100.50. However, if its priority is too low (i.e., a higher numerical value), it may be overridden by other rules with higher priority, leading to the blocking of the connection. 4. Priority of Security Rules: In Azure NSGs, security rules are evaluated based on priority. Rules with lower priority numbers (e.g., 100) are evaluated first. If a "deny" rule matches b...

Author: MysticJaguar44 · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several net...

Key Factors: 1. Azure Virtual Networks: The scenario involves 10 virtual networks that are hosted in separate resource groups. The goal is to ensure that when a Network Security Group (NSG) is created, it automatically blocks TCP port 8080 between these virtual networks. 2. Network Security Groups (NSGs): NSGs are used to control traffic by defining rules for inbound and outbound network traffic. These rules can block or allow specific ports or traffic between networks, such as blocking TCP port 8080. 3. Policy Definition: Azure Policy is a service that allows you to enforce organizational standards and assess compliance at scale. Policies can be used to control the creation and configuration of resources in Azure. The idea is to apply a built-in policy that ensures TCP port 8080 is automatically blocked when an NSG is created. 4. Built-in Policy Definitions: Azure provides several built-in policy definitions to help enforce security, compliance, and best practices. However, these built-in policies typically do not automatically create or modify NSG rules like blocking TCP port 8080. 5. Customization: To automatically block TCP port 8080 between virtual networks when...

Author: Andrew · Last updated Jul 27, 2026

You have an Azure subscription. You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients connect to App1 by using the IP address of the pod. For the AKS c...

To determine the best networking option for your AKS cluster to support App1, we need to consider the requirements and scenarios provided in your question: 1. App1 is accessed by on-premises clients using the IP address of the pod: This means that the IP address of the pod should be publicly reachable or at least available for clients outside the AKS cluster. This implies the need for a networking solution that allows the pods to have IP addresses that are accessible from on-premises environments. Let's examine each option: A) kubenet: - Description: `kubenet` is a basic network configuration where each pod gets an IP address from an internal Azure virtual network (VNet), but it uses NAT (Network Address Translation) for outbound traffic. Pods cannot be directly accessed from outside the VNet, and the cluster is isolated. - Rejection Reason: Since on-premises clients need to connect to the pods directly using their IP address, `kubenet` is not suitable because it does not expose individual pod IP addresses externally. In addition, it uses a private IP range for the pods, which restricts access from external sources. B) Azure Container Networking Interface (CNI): - Description: The Azure CNI plugin assigns an IP address from the virtual network directly to each pod. This allows the pods to have IP addresses that are part of the Azure VNet, making them directly accessible from external clients (e.g., on-premises clients). - Benefits: Since the pods have their own VNet IPs, they can be accessed directly via their IP addresses, which matches your requirement. The CNI configuration allows for seamless integration with the Azure networking model, supporting direct connectivity t...

Author: StarryEagle42 · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: * Nam...

To determine whether the solution meets the goal of adding VM1 and VM2 to the backend pool of the internal load balancer (LB1), we need to consider the key configuration of the load balancer and the network setup for the virtual machines. Breakdown of Key Elements: 1. Internal Load Balancer (LB1): - The load balancer is internal, which means it will only route traffic within the VNET1 (no public IP address is involved for routing). - It is configured to only forward traffic to internal resources (VMs within the same virtual network or peered networks). 2. Public IP address on VM2: - The key aspect of the question revolves around VM2 having a public IP address. For the load balancer to work properly with an internal configuration, VM2 should not be using a public IP address. Instead, VM2 should be using a private IP address that is part of the VNET1. 3. Disassociating the public IP from VM2: - If VM2 ...

Author: Liam · Last updated Jul 27, 2026

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (N...

Let's break down the scenario and solution: Scenario Recap: - 10 virtual networks are hosted in separate resource groups. - An administrator plans to create several network security groups (NSGs) in the subscription. - The goal is to automatically block TCP port 8080 between the virtual networks when an NSG is created. Solution Details: The solution proposes creating a custom policy definition and then assigning the policy to the subscription. The question is whether this meets the goal of automatically blocking TCP port 8080 when an NSG is created. Key Factors to Consider: 1. Network Security Groups (NSGs): - NSGs control inbound and outbound traffic for resources (like virtual machines, network interfaces, etc.) within a virtual network. - However, NSGs are not typically used for inter-virtual network communication. To block traffic between virtual networks, Network Security Rules must be configured within each NSG, and you would need to create a rule that blocks TCP port 8080. 2. Azure Policy: - Azure Policy allows you to enforce rules and guidelines in your environment, ensuring that resources comply with organizational standards. - Custom policies can be defined to control resource creation or configuration. - A pol...

Author: ElectricLionX · Last updated Jul 27, 2026

You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2. VM1 hosts a frontend application that connects to VM2 to retrieve data. Users report that the frontend application is slower than usual. You ...

To determine the average round-trip time (RTT) of packets from VM1 to VM2 and address the reported performance issue, we need to use the correct Azure Network Watcher feature that can measure network latency between virtual machines. Let's break down the options: A) IP Flow Verify: - Description: IP Flow Verify is used to check if traffic is allowed or denied based on Network Security Group (NSG) rules between a source and a destination. - Reason for Rejection: This tool helps to diagnose connectivity issues related to NSG rules but does not measure network performance or round-trip time (RTT). It focuses more on checking if traffic is being blocked or allowed at the network level, not on latency or RTT. B) Connection Troubleshoot: - Description: Connection Troubleshoot is designed to identify connectivity issues between two endpoints, checking if the traffic can flow between them and troubleshooting network-related problems. - Reason for Rejection: While this tool helps identify whether traffic between the two virtual machines is successfully passing through, it does not provide detailed insights into performance metrics like RTT. It focuses more on testing basic connectivity. C) Connection Monitor: - Description: Connection Monitor allows you to m...

Author: Chloe · Last updated Jul 27, 2026

SNAPSHOT - You have an Azure subscription that contains the public load balancers shown in the following table. You plan to create six virtual machines and to load balance requests to the virtual machines. Each load balancer will load balance three virtual machines. You need to create the virtual machines for the planned solution. How should you...

Author: CrystalWolfX · Last updated Jul 27, 2026