az-104 dumps topic 5, 1-150 Flashcards

Question

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first? A. Move VM1 to Subscription2. B. Move VNet1 to Subscription2. C. Modify the IP address space of VNet2. D. Provision virtual network gateways (next 30)

Answer 1

D. Provision virtual network gateways There is no overlap between the VNets: VNet1: 10.0.0.0/16 - CIDR IP Range 10.0.0.0 - 10.0.255.255 VNet2: 10.10.0.0/24 - CIDR IP Range 10.10.0.0 - 10.0.0.255 Note: If a virtual network has address ranges that overlap with another virtual network or on-premises network, the two networks can't be connected. You can connect virtual networks (VNets) by using the VNet-to-VNet connection type. Virtual networks can be in different regions and from different subscriptions. When you connect VNets from different subscriptions, the subscriptions don't need to be associated with the same Active Directory tenant. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

Answer 2

B. No Solution: You export the client certificate from Computer1 and install the certificate on Computer2. Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

Answer 3

B. No Solution: You export the client certificate from Computer1 and install the certificate on Computer2. Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

Answer 4

B. Create a deny rule in a network security group (NSG) that is linked to Subnet1 You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the internet. Reference: https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices

Answer 5

A. Associate NIC1 to ASG1 Application Security Group can be associated with NICs. References: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups

Answer 6

A. Create a connection B. Create a local site VPN gateway C. Create a VPN gateway that uses the VpnGw1 SKU For a site to site VPN, you need: - a local gateway - a gateway subnet - a VPN gateway - a connection to connect the local gateway and the VPN gateway However, the question states that VNet1 connects to your on-premises network by using Azure ExpressRoute. For an ExpressRoute connection, VNET1 must already be configured with a gateway subnet so we don't need another one. Note: BasicSKU cannot coexist with ExpressRoute. You must use a non-Basic SKU gateway for both the ExpressRoute gateway and the VPN gateway.

Answer 7

A. Create a connection B. Create a local site VPN gateway C. Create a VPN gateway that uses the VpnGw1 SKU For a site to site VPN, you need: - a local gateway - a gateway subnet - a VPN gateway - a connection to connect the local gateway and the VPN gateway However, the question states that VNet1 connects to your on-premises network by using Azure ExpressRoute. For an ExpressRoute connection, VNET1 must already be configured with a gateway subnet so we don't need another one. Note: BasicSKU cannot coexist with ExpressRoute. You must use a non-Basic SKU gateway for both the ExpressRoute gateway and the VPN gateway. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal https://azure.microsoft.com/es-es/pricing/details/vpn-gateway

Answer 8

Hosts on vNET6 can communicate with hosts on [answer choice]: vNET6 only Peering status to both VNet1 and Vnet2 are disconnected. So, only communication inside vNET6. To change the status of the peering connection to vNET1 to Connected, you must first [answer choice]: delete peering1 Peering to vNET1 is enabled but disconnected. We need to delete the peering from both virtual networks, and then re-create them. You can't add address ranges to or delete address ranges from a virtual network's address space once a virtual network is peered with another virtual network. To add or remove address ranges, delete the peering, add or remove the address ranges, then re-create the peering. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-troubleshoot-peering-issues#the-peering-status-is-disconnected

Answer 9

VM1 is in the same availability set as VM2. - Yes If Probe1.htm is present on VM1 and VM2, LB1 will balance TCP port 80 between VM1 and VM2. - Yes If you delete Rule 1, LB1 will balance all the requests between VM1 and VM2 for all the ports. - No 1. A Basic Load Balancer supports virtual machines in a single availability set or virtual machine scale set. 2. When using load-balancing rules with Azure Load Balancer, you need to specify health probes to allow Load Balancer to detect the backend endpoint status. The configuration of the health probe and probe responses determine which backend pool instances will receive new flows. You can use health probes to detect the failure of an application on a backend endpoint. You can also generate a custom response to a health probe and use the health probe for flow control to manage load or planned downtime. When a health probe fails, Load Balancer will stop sending new flows to the respective unhealthy instance. Outbound connectivity is not impacted, only inbound connectivity is impacted. 3. There will be no loadbalancing between the VMs. Basic Load Balancer: Virtual machines in a single availability set or virtual machine scale set. Standard Load Balancer: Any virtual machines or virtual machine scale sets in a single virtual network. Reference: https://docs.microsoft.com/en-us/azure/load-balancer/skus https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview

Answer 10

Before you create a backend pool on slb1, you must: Remove the public IP address from VM1 -> Reason being when you create a LB and add VM to backend pool make sure VM doesn't have a Public IP assigned to it. Before you can connect to VM1 from slb1, you must: Create and configure an NSG - > key thing to notice in question is "STANDAR LB " . Backend pool VM in standard LB should compulsorily have NSG associated to it and configured with required port to be allowed. 1. Note: A public load balancer can provide outbound connections for virtual machines (VMs) inside your virtual network. These connections are accomplished by translating their private IP addresses to public IP addresses. Public Load Balancers are used to load balance internet traffic to your VMs. Load balancer and the public IP address SKU must match when you use them with public IP addresses. Only Basic SKU IPs work with the Basic SKU load balancer and only Standard SKU IPs work with Standard SKU load balancers. 2. NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource. Note: You can only attach virtual machines that are in the same location and on the same virtual network as the LB. Also, when adding them to a backend pool, it doesn’t matter in which status are the VMs. Reference: https://docs.microsoft.com/en-us/azure/aks/load-balancer-standard https://docs.microsoft.com/en-us/azure/virtual-network/public-ip-addresses https://stackoverflow.com/questions/52882024/cannot-add-vm-to-standard-azure-load-balancer https://docs.microsoft.com/en-us/azure/load-balancer/skus https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

Answer 11

B. East US only Before creating a network interface, you must have an existing virtual network in the same location and subscription you create a network interface in. If you try to create a NIC on a location that does not have any Vnets you will get the following error: "The currently selected subscription and location lack any existing virtual networks. Create a virtual network first." Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

Answer 12

B. Configure the name servers for adatum.com at the domain registrar Adatum.com is a public DNS zone. The Internet top level domain DNS servers need to know which DNS servers to direct DNS queries for adatum.com to. You configure this by configuring the name servers for adatum.com at the domain registrar.

Answer 13

Task1: IP flow verify At some point, a VM may become unable to communicate with other resources, because of a security rule. The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which. Task2: Connection troubleshoot Diagnose outbound connections from a VM: The connection troubleshoot capability enables you to test a connection between a VM and another VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned when using the connection monitor capability, but tests the connection at a point in time, rather than monitoring it over time, as connection monitor does. Learn more about how to troubleshoot connections using connection-troubleshoot. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

Answer 14

VM1 connects to 193.77.134.10 for DNS queries. - Yes VM1 uses the VNET configured DNS 193.77.134.10. You can specify DNS server IP addresses in the VNet settings. The setting is applied as the default DNS server(s) for all VMs in the VNet. The DNS is set on the VNET level. VM2 connects to 193.77.134.10 for DNS queries. - No VM2 uses the NIC configured DNS 192.168.10.15. You can set DNS servers per VM or cloud service to override the default network settings. This VM has 192.168.10.5 set as DNS server, so it overrides the default DNS set on VNET1. VM3 connects to 192.168.10.15 for DNS queries. - Yes VM3 uses the NIC configured DNS 192.168.10.15 You can set DNS servers per VM or cloud service to override the default network settings. This VM has 192.168.10.5 set as DNS server, so it overrides the default DNS set on VNET1. NIC configured DNS servers takes precedence over VNET configured DNS servers. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#name-resolution-dns

Answer 15

Resources that you can move from RG1 to RG2: IP1, VNET2, and storage1 Resources that you can move from RG2 to RG1: IP2, VNET2, and storage2 Locks are designed for any update or removal. In this case we want to move only, we are not deleting, and we are not changing anything in the resource. A read-only lock on a resource group prevents you from moving existing resources in or out of the resource group. But note that a resource with read-only lock can be moved to another resource group. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#considerations-before-applying-your-locks

Answer 16

B. No It's not valid, because: LB1: Standard SKU VM1: Basic SKU public IP VM2: Basic SKU public IP You can only attach virtual machines that are in the same location and on the same virtual network as the LB. Virtual machines must have a standard SKU public IP or no public IP. The LB needs to be a standard SKU to accept individual VMs outside an availability set or vmss. VMs do not need to have public IPs but if they do have them they have to be standard SKU. Vms can only be from a single network. When they don’t have a public IP they are assigned an ephemeral IP. Also, when adding them to a backend pool, it doesn’t matter in which status are the VMs. Note: Load balancer and the public IP address SKU must match when you use them with public IP addresses. Reference: https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

Answer 17

B. No It's not valid, because: LB1: Standard SKU VM1: Standard SKU public IP VM2: Basic SKU public IP You can only attach virtual machines that are in the same location and on the same virtual network as the LB. Virtual machines must have a standard SKU public IP or no public IP. The LB needs to be a standard SKU to accept individual VMs outside an availability set or vmss. VMs do not need to have public IPs but if they do have them they have to be standard SKU. Vms can only be from a single network. When they don’t have a public IP they are assigned an ephemeral IP. Also, when adding them to a backend pool, it doesn’t matter in which status are the VMs. Note: Load balancer and the public IP address SKU must match when you use them with public IP addresses. Reference: https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

Answer 18

A. Yes It's valid, because: LB1: Standard SKU VM1: Standard SKU public IP VM2: Standard SKU public IP

Answer 19

A. Yes Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

Answer 20

C. For Rule5, change the Action to Allow and change the priority to 401 HTTPS uses port 443. Rule2, with priority 500, denies HTTPS traffic. Rule5, with priority changed from 2000 to 401, would allow HTTPS traffic. Note: There are several versions of this question in the exam. The question has two possible correct answers: 1. Change the priority of Rule3 to 450. 2. For Rule5, change the Action to Allow and change the priority to 401. Other incorrect answer options you may see on the exam include the following: ✑ Modify the action of Rule1. ✑ Change the priority of Rule6 to 100. ✑ For Rule4, change the protocol from UDP to Any. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Note: Priority is a number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.

Answer 21

B. No You should use a policy definition. Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources. Same questions with 4 different answers: 1) Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider. - No 2) Solution: You assign a built-in policy definition to the subscription. - No 3) Solution: You create a resource lock, and then you assign the lock to the subscription. - No 4) Solution: You configure a custom policy definition, and then you assign the policy to the subscription. - Yes Reference: https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition

Answer 22

A Site-to-Site connection can be established between VNET1 and VNET2. - No VNET1 and VNET2 can be peered. - Yes VNET1 and VNETA can be peered.- Yes VNET1: 10.10.10.0 - 10.10.10.255 VNET2: 172.16.0.0 - 172.16.255.255 VNETA: 10.10.128.0 - 10.10.255.255 Box 1: No To create a VNet to VNet VPN you need to have a special Gateway Subnet. Here, the VNet has no sufficient address space to create a Gateway Subnet and thus to establish a VNet to VNet VPN connection. Box 2: Yes For VNet peering the only consideration is that the VNets do not overlap. VNET1 and VNET2 do not overlap. Box 3: Yes For VNet peering the only consideration is that the VNets do not overlap. VNET1 and VNETA do not overlap.

Answer 23

B. No (correct sln: : You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150) You want to establish a successful connection from 131.107.100.50 over TCP port 43, and the solution suggests to create a deny inbound rule with low priority. It doesn’t make any sense. Virtual machines in load-balanced pools: The source port and address range applied are from the originating computer, not the load balancer. The destination port and address range are for the destination computer, not the load balancer. AllowAzureLoadBalancerInBound: The AzureLoadBalancer service tag translates to the virtual IP address of the host, 168.63.129.16 where the Azure health probe originates. Actual traffic does not travel through here, and if you don’t use Azure Load Balancing, this rule can be overridden. The Load Balancer backend pool VMs may not be responding to the probes due to any of the following reasons: - Load Balancer backend pool VM is unhealthy. - Load Balancer backend pool VM is not listening on the probe port. - Firewall, or a network security group is blocking the port on the Load Balancer backend pool VMs. - Other misconfigurations in Load Balancer. Note: Check if a Deny All network security groups rule on the NIC of the VM or the subnet that has a higher priority than the default rule that allows LB probes & traffic (network security groups must allow Load Balancer IP of 168.63.129.16). "Attach network interface" Button is enabeld! That means, VM is Stopped and deallocated! Reference: https://fastreroute.com/azure-network-security-groups-explained/ https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-troubleshoot-health-probe-status https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#azure-platform-considerations https://msazure.club/addendum-of-azure-load-balancer-and-nsg-rules http://gowie.eu/index.php/azure/best-practice/23-nsg-best-practice

Answer 24

B. No (correct sln: : You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150) Allow_131.107.100.50 rule has a higher priority (100) than BlockAllOther441 (200) and it allows inbound traffic over TCP 443 from source 131.107.100.50. App1 (VM1 and VM2) is in a VNet, so this rule applies. Unfortunately, we still cannot access App1, so the issue is somewhere else, maybe the VMs are off, or the firewall is blocking it. Virtual machines in load-balanced pools: The source port and address range applied are from the originating computer, not the load balancer. The destination port and address range are for the destination computer, not the load balancer. AllowAzureLoadBalancerInBound: The AzureLoadBalancer service tag translates to the virtual IP address of the host, 168.63.129.16 where the Azure health probe originates. Actual traffic does not travel through here, and if you don’t use Azure Load Balancing, this rule can be overridden. The Load Balancer backend pool VMs may not be responding to the probes due to any of the following reasons: - Load Balancer backend pool VM is unhealthy. - Load Balancer backend pool VM is not listening on the probe port. - Firewall, or a network security group is blocking the port on the Load Balancer backend pool VMs. - Other misconfigurations in Load Balancer. Note: Check if a Deny All network security groups rule on the NIC of the VM or the subnet that has a higher priority than the default rule that allows LB probes & traffic (network security groups must allow Load Balancer IP of 168.63.129.16). "Attach network interface" Button is enabeld! That means, VM is Stopped and deallocated! Reference: https://fastreroute.com/azure-network-security-groups-explained/ https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-troubleshoot-health-probe-status https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#azure-platform-considerations https://msazure.club/addendum-of-azure-load-balancer-and-nsg-rules http://gowie.eu/index.php/azure/best-practice/23-nsg-best-practice

Answer 25

B. No (correct sln: : You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150) Allow_131.107.100.50 rule has a higher priority (100). The issue is not related with the priority of the rule. Virtual machines in load-balanced pools: The source port and address range applied are from the originating computer, not the load balancer. The destination port and address range are for the destination computer, not the load balancer. AllowAzureLoadBalancerInBound: The AzureLoadBalancer service tag translates to the virtual IP address of the host, 168.63.129.16 where the Azure health probe originates. Actual traffic does not travel through here, and if you don’t use Azure Load Balancing, this rule can be overridden. The Load Balancer backend pool VMs may not be responding to the probes due to any of the following reasons: - Load Balancer backend pool VM is unhealthy. - Load Balancer backend pool VM is not listening on the probe port. - Firewall, or a network security group is blocking the port on the Load Balancer backend pool VMs. - Other misconfigurations in Load Balancer. Note: Check if a Deny All network security groups rule on the NIC of the VM or the subnet that has a higher priority than the default rule that allows LB probes & traffic (network security groups must allow Load Balancer IP of 168.63.129.16). "Attach network interface" Button is enabeld! That means, VM is Stopped and deallocated! Reference: https://fastreroute.com/azure-network-security-groups-explained/ https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-troubleshoot-health-probe-status https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#azure-platform-considerations https://msazure.club/addendum-of-azure-load-balancer-and-nsg-rules http://gowie.eu/index.php/azure/best-practice/23-nsg-best-practice

Answer 26

B. No Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources. You should use a custom policy definition. Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources. Same questions with 4 different answers: 1) Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider. - No 2) Solution: You assign a built-in policy definition to the subscription. - No 3) Solution: You create a resource lock, and then you assign the lock to the subscription. - No 4) Solution: You configure a custom policy definition, and then you assign the policy to the subscription. - Yes Reference: https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition

Answer 27

B. Azure Container Networking Interface (CNI) With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space. Incorrect Answers: A: The kubenet networking option is the default configuration for AKS cluster creation. With kubenet, nodes get an IP address from the Azure virtual network subnet. Pods receive an IP address from a logically different address space to the Azure virtual network subnet of the nodes. Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network. C, D: AKS only supports Kubenet networking and Azure Container Networking Interface (CNI) networking Reference: https://docs.microsoft.com/en-us/azure/aks/concepts-network

Answer 28

B. No It's not valid, because: LB1: Standard SKU VM1: Basic SKU public IP You can only attach virtual machines that are in the same location and on the same virtual network as the LB. Virtual machines must have a standard SKU public IP or no public IP. The LB needs to be a standard SKU to accept individual VMs outside an availability set or vmss. VMs do not need to have public IPs but if they do have them they have to be standard SKU. Vms can only be from a single network. When they don’t have a public IP they are assigned an ephemeral IP. Also, when adding them to a backend pool, it doesn’t matter in which status are the VMs. Note: Load balancer and the public IP address SKU must match when you use them with public IP addresses. Reference: https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

Answer 29

B. Yes You should use a custom policy definition. Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources. Same questions with 4 different answers: 1) Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider. - No 2) Solution: You assign a built-in policy definition to the subscription. - No 3) Solution: You create a resource lock, and then you assign the lock to the subscription. - No 4) Solution: You configure a custom policy definition, and then you assign the policy to the subscription. - Yes Reference: https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition

Answer 30

C. Connection monitor Connection monitor lets you know the round-trip time to make the connection, in milliseconds. Connection monitor probes the connection every 60 seconds, so you can monitor latency over time. The connection monitor capability monitors communication at a regular interval and informs you of reachability, latency, and network topology changes between the VM and the endpoint. Incorrect Answers: A: The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which security rule allowed or denied the communication, so that you can resolve the problem. B: The connection troubleshoot capability enables you to test a connection between a VM and another VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned when using the connection monitor capability, but tests the connection at a point in time, rather than monitoring it over time, as connection monitor does. D: The NSG flow log capability allows you to log the source and destination IP address, port, protocol, and whether traffic was allowed or denied by an NSG. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/connection-monitor https://docs.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview

Answer 31

The virtual machines that will be load balanced by using LB1: - be created in the same availability set or virtual machine scale set LB2: - be connected to the same virtual network 1: The Basic tier is quite restrictive. A load balancer is restricted to a single availability set, virtual machine scale set, or a single machine. 2: The Standard tier can span any virtual machine in a single virtual network, including blends of scale sets, availability sets, and machines. Reference: https://www.petri.com/comparing-basic-standard-azure-load-balancers

Answer 32

public IP addresses: 4 virtual network gateways: 2 local network gateways: 2 1: Two public IP addresses in the on-premises data center, and two public IP addresses in the VNET. The most reliable option is to combine the active-active gateways on both your network and Azure. 2: Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption that happens to the active instance, the standby instance would take over (failover) automatically, and resume the S2S VPN or VNet-to-VNet connections. Box 3: Dual-redundancy: active-active VPN gateways for both Azure and on-premises networks Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

Answer 33

D. vm1.internal.cloudapp.net When performing a reverse DNS lookup in Azure for a private IP address assigned to a virtual machine, the Fully Qualified Domain Name (FQDN) follows the format *.internal.cloudapp.net. This naming convention is used for private IP addresses within a virtual network in Azure. Thus, the FQDN returned for VM1 with the IP address 10.0.0.4 would be vm1.internal.cloudapp.net.

Answer 34

B. No Because of "cost", correct "priority"

Answer 35

C. Create a route-based virtual network gateway E. Delete GW1 Azure do not support Point-to-Site connections with Policy-Based Gateways, supports point-to-site connections ONLY with a Route-Based Virtual Network Gateway. Since GW1 is Policy-Based, first we need to Delete the GW1 first and then create route-based virtual network gateway. C: A VPN gateway is used when creating a VPN connection to your on-premises network. Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct traffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled as a network interface or VTI (virtual tunnel interface). E: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that perform packet filtering. IPsec tunnel encryption and decryption are added to the packet filtering and processing engine. Incorrect Answers: F: Point-to-Site connections do not require a VPN device or a public-facing IP address. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-portal https://docs.microsoft.com/en-us/azure/vpngateway/vpn-gateway-connect-multiple-policybased-rm-ps

Answer 36

The A record for VM5 will be registered automatically in the adatum.com zone. - No VM5 can resolve VM9.adatum.com. - No VM6 can resolve VM9.adatum.com. - Yes VNet1 (NOT A Registration Netvork) : VM5 VNet2 (IS A Registration Netvork) : VM1, VM6 and VM9 1. VM5 is in VNet1 - answer is NO. 2. VM5 is in VNet1 - answer is NO. 3. VM6 is in VNet2 - answer is YES. 1: Azure DNS provides automatic registration of virtual machines from a single virtual network that's linked to a private zone as a registration virtual network. VM5 does not belong to the registration virtual network though. 2: Forward DNS resolution is supported across virtual networks that are linked to the private zone as resolution virtual networks. VM5 does belong to a resolution virtual network. 3: VM6 belongs to registration virtual network, and an A (Host) record exists for VM9 in the DNS zone. By default, registration virtual networks also act as resolution virtual networks, in the sense that DNS resolution against the zone works from any of the virtual machines within the registration virtual network. Reference: https://docs.microsoft.com/en-us/azure/dns/private-dns-overview

Answer 37

You can enable auto registration for Link2. - Yes You can add a virtual network link for VNET1 to Zone3.com. - Yes You can add a virtual network link for VNET2 to Zone1.com and enable auto registration. - Yes 1. You can click the checkbox to Enable Auto-Reg. Note: You can do this to any VNET as long as that VNET is not linked to another Zone with Auto-reg ON. So if VNET is in another zone but Auto-reg is OFF, then you can enable Auto-Reg in Only One Zone 2. You can add Vnet1 to Zone3 but make sure Auto Reg is OFF. You cannot add Vnet1 to Zone3 with Auto Reg is ON. 3. You can add Vnet2 to Zone1 and set to Auto Reg ON because VNET2 has no link yet to any zone with Auto Reg ON. to summarize: Zones can have multiple VNETs. Each VNET can be set to Auto Reg ON VNETs can be linked to multiple Zones but they can only Auto Reg to one Zone

Answer 38

"name": - AzureBastionSubnet "properties": { "addressPrefix": - 10.10.10.0/27 To associate a virtual network with a Bastion, it must contain a subnet with name AzureBastionSubnet and a prefix of at least /26. (Question is outdated)Also see documentation here: https://docs.microsoft.com/en-gb/azure/bastion/quickstart-host-portal For Azure Bastion resources deployed on or after November 2, 2021, the minimum AzureBastionSubnet size is /26 or larger (/25, /24, etc.).

Answer 39

A. Yes. Using Azure Network Watcher to create a packet capture allows for monitoring network traffic between VM1 and VM2 for three hours, effectively meeting the requirement. There are several versions of this question. The following are the possible Correct and Incorrect solutions. Correct solution: Meets the goal. -Solution: From Azure Network Watcher, you create a packet capture. Incorrect solution: Does not meet the goal. -Solution: From Azure Monitor, you create a metric on Network In and Network Out. -Solution: From Azure Network Watcher, you create a connection monitor. -Solution: From Performance Monitor, you create a Data Collector Set (DCS).

Answer 40

B. No. Using Azure Network Watcher to create a packet capture allows for monitoring network traffic between VM1 and VM2 for three hours, effectively meeting the requirement. There are several versions of this question. The following are the possible Correct and Incorrect solutions. Correct solution: Meets the goal. -Solution: From Azure Network Watcher, you create a packet capture. Incorrect solution: Does not meet the goal. -Solution: From Azure Monitor, you create a metric on Network In and Network Out. -Solution: From Azure Network Watcher, you create a connection monitor. -Solution: From Performance Monitor, you create a Data Collector Set (DCS).

Answer 41

B. No. Using Azure Network Watcher to create a packet capture allows for monitoring network traffic between VM1 and VM2 for three hours, effectively meeting the requirement. There are several versions of this question. The following are the possible Correct and Incorrect solutions. Correct solution: Meets the goal. -Solution: From Azure Network Watcher, you create a packet capture. Incorrect solution: Does not meet the goal. -Solution: From Azure Monitor, you create a metric on Network In and Network Out. -Solution: From Azure Network Watcher, you create a connection monitor. -Solution: From Performance Monitor, you create a Data Collector Set (DCS).

Answer 42

- Remove the public IP addresses from vm1 and vm2. - Create a health probe and backend pool on Ib1. - Create a load balancing rule on lb1. Reference: https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-standard-public-zone-redundant-portal

Answer 43

B. No. Using Azure Network Watcher to create a packet capture allows for monitoring network traffic between VM1 and VM2 for three hours, effectively meeting the requirement. There are several versions of this question. The following are the possible Correct and Incorrect solutions. Correct solution: Meets the goal. -Solution: From Azure Network Watcher, you create a packet capture. Incorrect solution: Does not meet the goal. -Solution: From Azure Monitor, you create a metric on Network In and Network Out. -Solution: From Azure Network Watcher, you create a connection monitor. -Solution: From Performance Monitor, you create a Data Collector Set (DCS).

Answer 44

B. No (correct sln: : You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150) You want to establish a successful connection from 131.107.100.50 over TCP port 43, and the solution suggests to create a deny inbound rule with low priority. It doesn’t make any sense. Virtual machines in load-balanced pools: The source port and address range applied are from the originating computer, not the load balancer. The destination port and address range are for the destination computer, not the load balancer. AllowAzureLoadBalancerInBound: The AzureLoadBalancer service tag translates to the virtual IP address of the host, 168.63.129.16 where the Azure health probe originates. Actual traffic does not travel through here, and if you don’t use Azure Load Balancing, this rule can be overridden.

Answer 45

Create a Virtual WAN resource. Create a virtual hub. Create VPN sites. Connect the VPN sites to the hub. Reference: https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal

Answer 46

Server2 resolves host2.contoso.com to 131.107.50.50. - No Server2 resolves host1.contoso.com to 131.107.10.15. - Yes Server3 resolves host2.contoso.com to 131.107.50.50. - No No: Server2 uses Server1 for DNS. Server1 has no host2.contoso.com record for 131.107.50.50. It would work if VNET1 hat a virtual network link to the private zone contoso.com. Yes: Server2 uses Server1 for DNS. Server1 has a host1.contoso.com record for 131.107.10.15 No: Server3 uses 10.10.0.4 as DNS (inherited from VNET2). 10.10.0.4 (Server1) has no record for host2.contoso.com. The virtual network link for the private zone contoso.com on VNET2 won't be used since the DNS from VNET1 is set on VNET2. VNET1 DNS is not aware of the private zone contoso.com. It would work if VNET1 had a virtual network link to the private zone contoso.com.

Answer 47

A. Modify the address space of VNet1. The virtual networks you peer must have non-overlapping IP address spaces. The exhibit indicates that VNet1 has an address space of 10.2.0.0/16, which is the same as VNet2, and thus overlaps. We need to change the address space for VNet1. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-constraints https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq

Answer 48

C. comp2.contoso.com only A record: Is used to map a DNS/domain name to an IP Ref:https://www.cloudflare.com/learning/dns/dns-records/dns-a-record/ TXT records in a lot of cases get used to prove ownership of a domain, it has other purposes too. Reference: https://support.google.com/a/answer/2716800?hl=en#:~:text=TXT%20records%20are%20a%20type,and%20to%20ensure%20email%20security. PTR: A Reverse DNS lookup is used by remote hosts to determine who 'owns' an IP address. Reference: https://www.mailenable.com/kb/content/article.asp?ID=ME020206 CNAME records get used to redirect a DNS name or subdomain name to another DNS name or domain name or subdomain name. reference: https://support.dnsimple.com/articles/cname-record/ Basic understanding of DNS record types and what they are used for. https://ns1.com/resources/dns-types-records-servers-and-queries

Answer 49

Direction: Outbound Source 10.1.0.10 (VM1) Destination: 10.1.0.11 (VM2) Priority: 110 Both the VMs are from the same Vnet. So inbound is allow by default within the n/w. "Rules in inbound direction affect traffic that is being initiated from external sources, such as the Internet or another VM, to a virtual machine. Outbound security rules affect traffic sent from a VM." The ICMP traffic is being sent from VM1, so outbound.

Answer 50

B. No Solution: You export the client certificate from Computer1 and install the certificate on Computer2. Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

Answer 51

C. IP3 only Matching SKUs are required for load balancer and public IP resources. You can't have a mixture of Basic SKU resources and standard SKU resources. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses

Answer 52

B. the Calico network policy Reference: https://docs.microsoft.com/en-us/azure/aks/use-network-policies

Answer 53

Address prefix: 10.0.0.0/16 Next hop type: Virtual appliance Assigned to: GatewaySubnet 1. destination-> Vnet 1 (Address space of Vnet1) 2. VM1 ->Virtual Appliance. You can specify IP address of VM 1 when configuring next hop as Virtual appliance. 3. This route is to be followed by Gateway Subnet for the incoming traffic. You can associate routing table to the Subnet from Rout Table -> subnet ->Associate.

Answer 54

From the Internet, you can connect to VM1 by using Remote Desktop. - No From the Internet, you can connect to VM2 by using Remote Desktop. - Yes From VM1, you can connect to VM2 by using Remote Desktop. - Yes No: VM1 has default rules which denies any port open for inbound rules Yes: VM2 has custom rule allowing RDP port Yes: VM1 and VM2 are in the same Vnet. by default, communication are allowed

Answer 55

D. a backend pool E. a health probe If you want to add a rule to your LB later you have to create a backend pool and health probe first.

Answer 56

B. a standard SKU and a static IP address assignment

Answer 57

The DNS A record for vm1 is added to contoso.com and has the IP address of 131.107.50.20. - No The DNS A record for vm1 is added to fabrikam.com and has the IP address of 10.0.1.4. - Yes The DNS A record for vm2 is added to fabrikam.com and has the IP address of 10.0.1.5. - Yes 1. none of the actions in question added the VM1 record to contoso.com dns. 2, 3. vnet1 is linked and auto-rego is enabled, records get added automatically. Fabrikam.com is a Private DNS zone. The private IP address is used. Note: The Azure DNS private zones auto registration feature manages DNS records for virtual machines deployed in a virtual network. When you link a virtual network with a private DNS zone with this setting enabled, a DNS record gets created for each virtual machine deployed in the virtual network. For each virtual machine, an A record and a PTR record are created. DNS records for newly deployed virtual machines are also automatically created in the linked private DNS zone. Note: If you use Azure Provided DNS then appropriate DNS suffix will be automatically applied to your virtual machines. For all other options you must either use Fully Qualified Domain Names (FQDN) or manually apply appropriate DNS suffix to your virtual machines. Reference: https://docs.microsoft.com/en-us/azure/dns/dns-zones-records https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

Answer 58

D. ErGw3AZ

Answer 59

VM2 can connect to the TCP port 1433 services on VM1. - No VM1 can connect to the TCP port 1433 services on VM2. - Yes VM2 can connect to the TCP port 1433 services on VM3. - Yes 2. No rule explicitly blocks communication from VM1. The default rules, which allow communication, are thus applied. 3. No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The default rules, which allow communication, are thus applied. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Answer 60

VM3 can establish a network connection to VM1. - Yes If VM3 is turned off, VM2 can establish a network connection to VM1. - No VM1 can establish a network connection to VM2. - Yes Y = RT is not applied to VM3. VM3 will have the default route between subnets in a vnet. N = VM2 > Subnet2 has RT applied to it. VM3 is the next hop which is turned off. Y = VM3 has has IP forwarding enabled which can fwd traffic from VM1 to VM2. 1. The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3, VM3 can connect to VM1. 2. VM3, which has IP forwarding, must be turned on, in order for VM2 to connect to VM1. 3. The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect to VM2 via VM3. IP forwarding enables the virtual machine a network interface is attached to: ✑ Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface. Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations. The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple network interfaces or a single network interface attached to it. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview https://www.quora.com/What-is-IP-forwarding

Answer 61

C. an Azure Virtual Network Gateway A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally facing public IP address assigned to it. A: Application Gateway is for http, https and Websocket - Not SMB B: Application Proxy is also for accessing web applications on-prem - Not SMB. Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

Answer 62

B. service endpoints "Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. " https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

Answer 63

C. IKEv2 keyword is "Route-Based" coz "Policy-based" only supports IKEv1. A Site-to-Site (S2S) VPN gateway connection is used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. IKEv2 supports 10 S2S connections, while IKEv1 only supports 1. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-classic-portal https://docs.microsoft.com/enus/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps

Answer 64

B. DemoSubnet1 https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-network-mapping The subnet of the target VM is selected based on the name of the subnet of the source VM. - If a subnet with the same name as the source VM subnet is available in the target network, that subnet is set for the target VM. - If a subnet with the same name doesn't exist in the target network, the first subnet in the alphabetical order is set as the target subnet.

Answer 65

B. 443 Using Bastion your RDP/SSH session is over TLS on port 443. https://learn.microsoft.com/en-us/azure/bastion/bastion-overview If you say port 22 then what about windows VM as it is not mentioned that the VM is windows or Linux? You will have to allow port 443 in NSG.

Answer 66

IP address: Obtain an IP address automatically Name resolution: Configure VNET1 to use a custom DNS server 1. The first 4 IP addresses within a subnet space are getting reserved for Azure automatically. Thus, 10.0.1.3 can't be the right answer. 10.0.2.1 is in the VNET space but falls out of the subnet space. 192.168.2.1 is just out of the VNET. 2. This VNET1 should use our pre-created DNS server as its DNS server so tahat the member servers in contoso.com can resolve AD DS DNS names.

Answer 67

C. VNET1 only

Answer 68

B. 2 Connection monitor resource: A region-specific Azure resource. https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-create-using-portal#before-you-begin

Answer 69

C. Routing preference Routing preference in Azure Traffic Manager allows you to specify how to route traffic to your Azure service endpoints based on various criteria, such as the geographic location of the client or the endpoint, the performance of the endpoint, or the priority of the endpoint. By configuring routing preference, you can direct incoming user traffic to the Microsoft point-of-presence (POP) closest to the user's location, ensuring the best possible user experience. This can be achieved by selecting the "Performance" routing method in Azure Traffic Manager, which uses DNS-based traffic routing to direct users to the endpoint that offers the best performance from the user's location. https://learn.microsoft.com/en-us/azure/storage/common/network-routing-preference#microsoft-global-network-versus-internet-routing

Answer 70

A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.

Answer 71

C. Create a route table.

Answer 72

A. VM1 only https://learn.microsoft.com/en-us/azure/bastion/bastion-overview Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal, or via the native SSH or RDP client already installed on your local computer.

Answer 73

D. Upgrade Bastion1 to the Standard SKU https://learn.microsoft.com/en-us/azure/bastion/configuration-settings#instance When you configure Azure Bastion using the Basic SKU, two instances are created. If you use the Standard SKU, you can specify the number of instances. This is called host scaling. Each instance can support 20 concurrent RDP connections and 40 concurrent SSH connections for medium workloads. Once the concurrent sessions are exceeded, an additional scale unit (instance) is required.

Answer 74

A. IP1 only - IPv4 Standard Regional Static Tested in sandbox - IPv4 - Static - Standard - Global: Error during the selection in the interface - A Global Tier PublicIPAddress cannot be attached to Bastions. - IPv4 - Static - Standard - Regional: OK - IPv4 - Static - Basic - Regional Error during the selection in the interface - Static public IP addresses cannot be associated. - IPv4 - Dynamic - Basic - Regional Error during the selection in the interface - The SKU type for the public IP address does not match the SKU type of the load balancer (?? I don't know why this message). - IPv6 - Static - Standard - Regional: Error during deployment (The selected IPv6 public IP address is not supported for Azure Bastion. To fix this, please recreate your Azure Bastion with an IPv4 public IP address. (Code: PublicIpAddressVersionNotSupported))

Answer 75

D. VM1, Disk1, NetInt1, and VNet1 When you move a virtual machine from one subscription to another, you need to ensure that all the dependent resources are also moved along with it. In the given scenario, VM1 is associated with the resources Disk1 (OS Disk), NetInt1 (Network Interface), and VNet1 (Virtual Network), and the storage account named storage1 is not associated with VM1. Therefore, to move VM1 to Sub2, you need to move the following resources: VM1: This is the virtual machine that you want to move to Sub2. Disk1: This is the OS disk for VM1, and it contains the operating system and boot files. NetInt1: This is the network interface that is attached to VM1 and provides connectivity to the virtual network. VNet1: This is the virtual network that is associated with VM1, and it provides the network connectivity to the virtual machine.

Answer 76

C. a resource guard Resource Guard is an Azure feature that helps protect critical resources, such as Recovery Services Vaults and Backup Vaults, from unauthorized modifications. It does this by adding an extra layer of authorization to critical operations. How Resource Guard works Resource Guard works by associating a vault with a Resource Guard. When you try to perform a critical operation on the vault, Azure first checks to see if you have the appropriate permissions on the Resource Guard. If you do not have the appropriate permissions, the operation will fail. How to create a Resource Guard Creating a Resource Guard is a simple process that can be done in the Azure portal. You can create a Resource Guard in the same subscription or a different subscription as the vault you want to protect. https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization?tabs=azure-portal&pivots=vaults-recovery-services-vault Before you start Testing scenarios Create a Resource Guard Enable MUA on a Recovery Services vault Protected operations on a vault using MUA Authorize critical operations on a vault Disable MUA on a Recovery Services vault

Answer 77

A. 1 Azure Bastion supports reaching virtual machines in globally peered virtual networks, but if the region that hosts your Azure Bastion resource is unavailable, you won't be able to use your Azure Bastion resource. https://learn.microsoft.com/en-us/azure/reliability/reliability-bastion#multi-region-support Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don't have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it can be used to connect to VMs deployed in a peered VNet without deploying an additional bastion host. For more information about VNet peering, see About virtual network peering. Azure Bastion works with the following types of peering: Virtual network peering: Connect virtual networks within the same Azure region. Global virtual network peering: Connecting virtual networks across Azure regions.

Answer 78

B. the public networking type

Answer 79

virtual network network interface virtual machine Azure Monitor extension

Answer 80

B. VM1 and VM2 only

Answer 81

D. Configure a virtual network. In order to migrate 50 VMs to Azure using Azure Site Recovery, one needs: - Recovery Service Vault (which is created) - Configure virtual network - configure extended network (next step after)

Answer 82

Subnet size: /26 Public IP: Standard SKU with a static allocation

Answer 83

B. peering

Answer 84

D. OS type VS B. Networking type ???

Answer 85

B. a route table that has custom routes