Q1.An organization is working on the IP address design for the subnets of an Azure virtual network.
Which type of resource actually consumes a private IP address inside these subnets?
Show answer
In an Azure virtual network, whether a resource consumes an IP address within a subnet depends on the resource type.
An internal load balancer allocates a private IP address in the subnet as its frontend IP, so it always consumes an IP.
Storage accounts and service endpoints, on the other hand, are features for connecting to PaaS resources and do not require an IP within the subnet.
A service endpoint policy is also an access-control mechanism and does not consume an IP.
Therefore, the only resource that requires an IP address within the subnet is the internal load balancer.
Azure Load Balancer overview
Q2.You operate an Azure subscription that has an Azure VPN gateway named GW1.
GW1 provides point-to-site (P2S) VPN connectivity, and users connect to GW1 from Windows 11 devices using SSTP connections.
You need to configure this P2S VPN connection to support Microsoft Entra authentication.
Which three actions should you perform in sequence?
Drag (or tap) the required number of items from the “Options” on the left to the “Answer area” on the right. You can reorder items by dragging within the answer area.
- Register the Microsoft.HybridNetwork resource provider
- In the point-to-site configuration of GW1, set the authentication type to Microsoft Entra and the tunnel type to OpenVPN (SSL)
- Grant Microsoft Entra tenant admin consent to the Azure VPN application
- In the point-to-site configuration of GW1, set the authentication type to Microsoft Entra and the tunnel type to IKEv2 and SSTP (SSL)
- Download the Azure VPN client profile configuration package and distribute it to users
- Drag here
Show answer
This question asks for the correct procedure to configure a P2S VPN that supports Microsoft Entra authentication.
First, grant admin consent to the Azure VPN application and enable authentication through Microsoft Entra.
Next, in the point-to-site configuration of GW1, set the authentication type to Microsoft Entra and configure the IKEv2 and SSTP tunnels.
The OpenVPN setting is not required for this requirement.
Finally, distribute the VPN client configuration package so that users can connect.
Registering a resource provider is also not required for this requirement.
About point-to-site VPN
Q3.You have two Azure virtual networks named Vnet1 and Vnet2.
A Windows 10 device named Client1 connects to Vnet1 using a point-to-site (P2S) IKEv2 VPN.
You configure virtual network peering between Vnet1 and Vnet2, allow gateway transit on the Vnet1 side, and enable use of remote gateways on the Vnet2 side.
However, you find that Client1 cannot communicate with Vnet2.
You need to enable Client1 to communicate with Vnet2.
Solution: You enable BGP on the Vnet1 gateway.
Does this achieve the goal?
Show answer
This solution does not achieve the goal, so the answer is “No”.
For a client using a P2S IKEv2 connection, when peering or the network configuration is changed, it is necessary to re-download and re-apply the VPN client configuration package.
Enabling BGP on the Vnet1 gateway does not automatically let Client1 learn the new route to Vnet2.
To reflect the changed topology on the client, the updated configuration must be redistributed.
Therefore, enabling BGP is not a direct solution to the communication failure.
About point-to-site VPN routing – Azure
Q4.You have Azure virtual networks with the following configuration.
Vnet1 has the subnet Subnet1-1 (10.1.1.0/24) and is peered with Vnet3.
Vnet2 has the subnet Subnet2-1 (10.2.1.0/24) and is peered with Vnet3.
Vnet3 has AzureFirewallSubnet (10.3.1.0/24) and is peered with both Vnet1 and Vnet2.
You deploy Azure Firewall to Vnet3.
You need to ensure that traffic from Subnet1-1 to Subnet2-1 passes through the firewall.
What configuration is required?
| Name | Subnet | Subnet address space | Peered with |
|---|---|---|---|
| Vnet1 | Subnet1-1 | 10.1.1.0/24 | Vnet3 |
| Vnet2 | Subnet2-1 | 10.2.1.0/24 | Vnet3 |
| Vnet3 | AzureFirewallSubnet | 10.3.1.0/24 | Vnet1, Vnet2 |
Show answer
To route traffic through Azure Firewall, you must explicitly control the communication path.
To do this, use user-defined routes (UDRs), associate route tables with Subnet1-1 and Subnet2-1, and point the next hop to Azure Firewall.
Setting a route on the AzureFirewallSubnet side does not control the path from the source subnets.
Peering and Azure private DNS zones are not involved in routing control.
Therefore, associating route tables with the source subnets is essential.
Tutorial: Deploy and configure Azure Firewall using the Azure portal
Q5.You operate an on-premises network and an Azure virtual network named Vnet1.
You need to implement Azure Extended Network.
The solution must minimize cost.
Which type of virtual machine should you deploy to Vnet1, and which tool should you use to configure the Azure Extended Network?
Show answer
To implement Azure Extended Network, use Windows Server 2022 Datacenter: Azure Edition, which supports the extended networking feature.
This edition is optimized for Azure and lets you realize an extended network while keeping additional costs low.
For the configuration tool, use Windows Admin Center, which makes it easy to set up subnet extension between on-premises and Azure.
Other editions and tools such as Server Manager either do not support this feature or lead to complex configuration and higher cost.
Therefore, this choice also meets the minimum-cost requirement.
Extend an on-premises subnet into Azure using Azure Extended Network | Microsoft Learn
Q6.You need to configure VNET1 so that all events and metrics are recorded as logs.
The solution must allow you to query the events and metrics directly from the Azure portal using KQL.
Which configuration should you choose?
Show answer
The requirement is to be able to query events and metrics directly from the Azure portal using KQL.
To meet this, enable logs and all metrics (AllMetrics) in the diagnostic setting and specify a Log Analytics workspace as the destination.
Data accumulated in Log Analytics can be analyzed directly with KQL.
Azure Storage is intended for retention and Event Hub for forwarding, and neither can be queried directly with KQL.
Configuring a metric alert is a monitoring-notification mechanism and does not apply to this requirement.
Diagnostic settings in Azure Monitor – Azure Monitor | Microsoft Learn
Q7.You have an Azure Web Application Firewall (WAF) v2 tier named AG1 on an Azure Application Gateway.
A policy named Policy1 is configured on AG1.
You need to add a custom rule to Policy1.
The rule must block all requests from IP addresses that belong to a specific IP address range.
Which four PowerShell cmdlets should you run in sequence?
Drag (or tap) the required number of items from the “Options” on the left to the “Answer area” on the right. You can reorder items by dragging within the answer area.
- New-AzApplicationGatewayFirewallPolicyExclusion
- New-AzApplicationGatewayFirewallMatchVariable
- New-AzApplicationGatewayFirewallCondition
- New-AzApplicationGatewayFirewallCustomRule
- Set-AzApplicationGatewayFirewallPolicy
- Drag here
Show answer
In the procedure to create a WAF custom rule, first define the match variable to evaluate (such as the IP address) with New-AzApplicationGatewayFirewallMatchVariable.
Next, create a condition that matches the specific IP range with New-AzApplicationGatewayFirewallCondition.
Based on that condition, create the custom rule with New-AzApplicationGatewayFirewallCustomRule.
Finally, apply it to the policy with Set-AzApplicationGatewayFirewallPolicy.
Exclusion is for exception settings, so it is not used for the blocking requirement.
Create custom rules for Web Application Firewall on Application Gateway
Q8.You have two Azure subscriptions.
In the East US Azure region of each subscription, you need to perform the following actions.
Deploy 50 virtual machines to availability zone 1.
Deploy 50 virtual machines to availability zone 2.
Deploy 50 virtual machines to availability zone 3.
What is the minimum number of virtual networks and /25 subnets that you need to create, respectively?
Show answer
A virtual network is created within a single subscription, so you need at least one in each of the two subscriptions, for a total of two virtual networks.
You do not need to separate virtual networks or subnets per availability zone.
A /25 subnet has 128 addresses, but Azure reserves 5 in each subnet, so the number usable is 123.
Because each subscription needs 150 VMs, two /25 subnets are needed per subscription, for a total of four across the two subscriptions.
Azure virtual network overview
Q9.You have an on-premises network named Site1.
You have an Azure subscription that contains a virtual network named VNet1 and a storage account named storage1.
Site1 and VNet1 are connected by a site-to-site (S2S) VPN.
You need to enable servers in Site1 to connect to storage1 over this S2S VPN.
The solution must minimize administrative effort.
What should you create in VNet1?
Show answer
To securely connect from on-premises to Azure Storage over an S2S VPN, create a private endpoint.
This assigns the storage account a private IP within the VNet, so it can be accessed through the VNet.
Servers on-premises connected via the S2S VPN can also reach this private IP without going over the internet.
A service endpoint is limited to access from within the VNet and is not suitable for connections from on-premises.
Therefore, a private endpoint is the optimal solution that achieves this with minimal administrative effort.
What is an Azure private endpoint?
Q10.You have an on-premises VPN appliance named GW1.
You have an Azure subscription that contains an Azure VPN gateway named VPNGW1, and VPNGW1 connects to GW1.
You need to change the IKEv2 encryption algorithm used between VPNGW1 and GW1.
Which PowerShell cmdlets should you run?
Show answer
To change the IKEv2 encryption algorithm, first define an IPsec/IKE policy with New-AzIpsecPolicy, specifying the encryption and integrity algorithms.
Next, use Set-AzVirtualNetworkGatewayConnection to apply the policy to that connection.
It is important that the setting is applied per connection rather than on the gateway itself.
New-AzIpsecTrafficSelectorPolicy and Set-AzFirewallPolicy serve different purposes and do not apply to this requirement.
Configure IPsec/IKE policy for VPN gateways using PowerShell