Topic 11 Practice Test 2 covers Azure Virtual Networks for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure and manage virtual networks in Azure. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
At Proseware, the organization has a subnet proposal that overlaps an existing subnet and must redesign the range before deployment. What should be configured? Choose ONE.
- Create or modify the virtual network and its subnets
- Create virtual network peering between the two virtual networks
- Associate an Azure public IP address with the internet-facing resource
- Add a user-defined route with Virtual appliance as the next hop
Correct Answer: A
Correct Answer
Answer A is correct because A virtual network provides the private Azure IP address space, and subnets divide that space into nonoverlapping ranges to organize workloads and apply network controls. Proseware must define a nonoverlapping subnet address range inside the virtual network for the new workload. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Proseware must define a nonoverlapping subnet address range inside the virtual network for the new workload. This is not the requested capability.
Answer C is incorrect because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Proseware must define a nonoverlapping subnet address range inside the virtual network for the new workload. Its purpose differs from that need.
Answer D is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Proseware must define a nonoverlapping subnet address range inside the virtual network for the new workload. That behavior does not fit here.
Question 2
An Azure administrator at Wingtip Toys learns that the organization is expanding a virtual network and must allocate an additional nonoverlapping subnet prefix. What should the administrator do? Choose ONE.
- Create virtual network peering between the two virtual networks
- Create or modify the virtual network and its subnets
- Associate an Azure public IP address with the internet-facing resource
- Add a user-defined route with Virtual appliance as the next hop
Correct Answer: B
Correct Answer
Answer B is correct because A virtual network provides the private Azure IP address space, and subnets divide that space into nonoverlapping ranges to organize workloads and apply network controls. Wingtip Toys must define a nonoverlapping subnet address range inside the virtual network for the new workload. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Wingtip Toys must define a nonoverlapping subnet address range inside the virtual network for the new workload. It would leave the requirement unmet.
Answer C is incorrect because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Wingtip Toys must define a nonoverlapping subnet address range inside the virtual network for the new workload. Its function is different in this case.
Answer D is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Wingtip Toys must define a nonoverlapping subnet address range inside the virtual network for the new workload. The feature solves a different problem.
Question 3
Lucerne Publishing has nonoverlapping same-region VNets and wants private address communication with peering system routes. Which option is appropriate? Choose ONE.
- Create global virtual network peering
- Create the additional required peering connection
- Create virtual network peering between the two virtual networks
- Add a user-defined route with Virtual appliance as the next hop
Correct Answer: C
Correct Answer
Answer C is correct because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Lucerne Publishing must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because Global virtual network peering connects supported virtual networks in different Azure regions while preserving private IP connectivity over the Microsoft backbone. Lucerne Publishing must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. That behavior does not fit here.
Answer B is incorrect because Virtual network peering is not transitive; two spokes that only peer with the same hub do not automatically gain direct connectivity through those peerings. Lucerne Publishing must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. The option targets another design goal.
Answer D is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Lucerne Publishing must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. This does not satisfy that condition.
Question 4
- Datum is replacing a gateway-based connection between two Azure virtual networks located in the same region. Choose the best change. Choose ONE.
- Create global virtual network peering
- Create the additional required peering connection
- Add a user-defined route with Virtual appliance as the next hop
- Create virtual network peering between the two virtual networks
Correct Answer: D
Correct Answer
Answer D is correct because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. A. Datum must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because Global virtual network peering connects supported virtual networks in different Azure regions while preserving private IP connectivity over the Microsoft backbone. A. Datum must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. The feature solves a different problem.
Answer B is incorrect because Virtual network peering is not transitive; two spokes that only peer with the same hub do not automatically gain direct connectivity through those peerings. A. Datum must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. This is not the requested capability.
Answer C is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. A. Datum must connect two virtual networks in the same Azure region using private IP addresses over the Microsoft backbone. Its purpose differs from that need.
Question 5
An Azure administrator at Contoso learns that the organization is designing a cross-region Azure network and does not want to route VNet-to-VNet traffic through the public internet. What should the administrator do? Choose ONE.
- Create global virtual network peering
- Create virtual network peering between the two virtual networks
- Create the additional required peering connection
- Associate an Azure public IP address with the internet-facing resource
Correct Answer: A
Correct Answer
Answer A is correct because Global virtual network peering connects supported virtual networks in different Azure regions while preserving private IP connectivity over the Microsoft backbone. Contoso must connect virtual networks in different Azure regions using supported Azure virtual network peering. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Contoso must connect virtual networks in different Azure regions using supported Azure virtual network peering. This does not satisfy that condition.
Answer C is incorrect because Virtual network peering is not transitive; two spokes that only peer with the same hub do not automatically gain direct connectivity through those peerings. Contoso must connect virtual networks in different Azure regions using supported Azure virtual network peering. It would leave the requirement unmet.
Answer D is incorrect because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Contoso must connect virtual networks in different Azure regions using supported Azure virtual network peering. Its function is different in this case.
Question 6
A cloud engineer at Northwind Traders is working with an environment that is extending a multi-region application network using the peering feature intended for different regions. Select the correct configuration. Choose ONE.
- Create virtual network peering between the two virtual networks
- Create global virtual network peering
- Create the additional required peering connection
- Associate an Azure public IP address with the internet-facing resource
Correct Answer: B
Correct Answer
Answer B is correct because Global virtual network peering connects supported virtual networks in different Azure regions while preserving private IP connectivity over the Microsoft backbone. Northwind Traders must connect virtual networks in different Azure regions using supported Azure virtual network peering. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Northwind Traders must connect virtual networks in different Azure regions using supported Azure virtual network peering. Its purpose differs from that need.
Answer C is incorrect because Virtual network peering is not transitive; two spokes that only peer with the same hub do not automatically gain direct connectivity through those peerings. Northwind Traders must connect virtual networks in different Azure regions using supported Azure virtual network peering. That behavior does not fit here.
Answer D is incorrect because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Northwind Traders must connect virtual networks in different Azure regions using supported Azure virtual network peering. The option targets another design goal.
Question 7
In Woodgrove Bank’s Azure environment, the organization is troubleshooting why spoke A cannot reach spoke B even though both peerings to the hub show Connected. What is required? Choose ONE.
- Create virtual network peering between the two virtual networks
- Synchronize the peering after the address-space change
- Create the additional required peering connection
- Add a user-defined route with Virtual appliance as the next hop
Correct Answer: C
Correct Answer
Answer C is correct because Virtual network peering is not transitive; two spokes that only peer with the same hub do not automatically gain direct connectivity through those peerings. Woodgrove Bank must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. It aligns with the required Azure outcome.
Incorrect Answers
Answer A is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Woodgrove Bank must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. Its function is different in this case.
Answer B is incorrect because After a peered virtual network address space changes, the peering must be synchronized so the remote peer learns the updated prefixes and system routes. Woodgrove Bank must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. The feature solves a different problem.
Answer D is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Woodgrove Bank must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. This is not the requested capability.
Question 8
Adventure Works assumed a hub-and-spoke topology would automatically transit traffic between spokes and now needs direct spoke connectivity. Which option is appropriate? Choose ONE.
- Create virtual network peering between the two virtual networks
- Synchronize the peering after the address-space change
- Add a user-defined route with Virtual appliance as the next hop
- Create the additional required peering connection
Correct Answer: D
Correct Answer
Answer D is correct because Virtual network peering is not transitive; two spokes that only peer with the same hub do not automatically gain direct connectivity through those peerings. Adventure Works must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. The option supplies the needed behavior.
Incorrect Answers
Answer A is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Adventure Works must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. The option targets another design goal.
Answer B is incorrect because After a peered virtual network address space changes, the peering must be synchronized so the remote peer learns the updated prefixes and system routes. Adventure Works must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. This does not satisfy that condition.
Answer C is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Adventure Works must provide direct private connectivity between two spoke virtual networks because hub peering does not make peering transitive. It would leave the requirement unmet.
Question 9
A cloud engineer at Proseware is working with an environment that has a Connected peering where newly added remote subnet routes do not appear on the other side. Select the correct configuration. Choose ONE.
- Synchronize the peering after the address-space change
- Create virtual network peering between the two virtual networks
- Create global virtual network peering
- Inspect the effective routes on the affected network interface
Correct Answer: A
Correct Answer
Answer A is correct because After a peered virtual network address space changes, the peering must be synchronized so the remote peer learns the updated prefixes and system routes. Proseware must update peering route information after changing the address space of a peered virtual network. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Proseware must update peering route information after changing the address space of a peered virtual network. This is not the requested capability.
Answer C is incorrect because Global virtual network peering connects supported virtual networks in different Azure regions while preserving private IP connectivity over the Microsoft backbone. Proseware must update peering route information after changing the address space of a peered virtual network. Its purpose differs from that need.
Answer D is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Proseware must update peering route information after changing the address space of a peered virtual network. That behavior does not fit here.
Question 10
Wingtip Toys is troubleshooting stale peering route information immediately after an address-space modification. Which Azure feature fits? Choose ONE.
- Create virtual network peering between the two virtual networks
- Synchronize the peering after the address-space change
- Create global virtual network peering
- Inspect the effective routes on the affected network interface
Correct Answer: B
Correct Answer
Answer B is correct because After a peered virtual network address space changes, the peering must be synchronized so the remote peer learns the updated prefixes and system routes. Wingtip Toys must update peering route information after changing the address space of a peered virtual network. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Wingtip Toys must update peering route information after changing the address space of a peered virtual network. It would leave the requirement unmet.
Answer C is incorrect because Global virtual network peering connects supported virtual networks in different Azure regions while preserving private IP connectivity over the Microsoft backbone. Wingtip Toys must update peering route information after changing the address space of a peered virtual network. Its function is different in this case.
Answer D is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Wingtip Toys must update peering route information after changing the address space of a peered virtual network. The feature solves a different problem.
Question 11
Lucerne Publishing needs a user-defined route that identifies the security appliance as the next hop. Which action fits? Choose ONE.
- Add a user-defined route with None as the next hop
- Inspect the effective routes on the affected network interface
- Add a user-defined route with Virtual appliance as the next hop
- Create virtual network peering between the two virtual networks
Correct Answer: C
Correct Answer
Answer C is correct because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Lucerne Publishing must send traffic for a specified prefix through a network virtual appliance by using a route table. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because A user-defined route whose next hop is None drops traffic for the matching prefix and is used when the design intentionally blackholes that destination range. Lucerne Publishing must send traffic for a specified prefix through a network virtual appliance by using a route table. That behavior does not fit here.
Answer B is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Lucerne Publishing must send traffic for a specified prefix through a network virtual appliance by using a route table. The option targets another design goal.
Answer D is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Lucerne Publishing must send traffic for a specified prefix through a network virtual appliance by using a route table. This does not satisfy that condition.
Question 12
In A. Datum’s Azure environment, the organization has a route table but the matching traffic still follows a system route instead of the required inspection appliance. What is required? Choose ONE.
- Add a user-defined route with None as the next hop
- Inspect the effective routes on the affected network interface
- Create virtual network peering between the two virtual networks
- Add a user-defined route with Virtual appliance as the next hop
Correct Answer: D
Correct Answer
Answer D is correct because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. A. Datum must send traffic for a specified prefix through a network virtual appliance by using a route table. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because A user-defined route whose next hop is None drops traffic for the matching prefix and is used when the design intentionally blackholes that destination range. A. Datum must send traffic for a specified prefix through a network virtual appliance by using a route table. The feature solves a different problem.
Answer B is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. A. Datum must send traffic for a specified prefix through a network virtual appliance by using a route table. This is not the requested capability.
Answer C is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. A. Datum must send traffic for a specified prefix through a network virtual appliance by using a route table. Its purpose differs from that need.
Question 13
Contoso needs an Azure-assigned public address for an internet-facing endpoint rather than private-only VNet connectivity. Which Azure feature fits? Choose ONE.
- Associate an Azure public IP address with the internet-facing resource
- Create virtual network peering between the two virtual networks
- Add a user-defined route with Virtual appliance as the next hop
- Create or modify the virtual network and its subnets
Correct Answer: A
Correct Answer
Answer A is correct because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Contoso must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Contoso must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. This does not satisfy that condition.
Answer C is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Contoso must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. It would leave the requirement unmet.
Answer D is incorrect because A virtual network provides the private Azure IP address space, and subnets divide that space into nonoverlapping ranges to organize workloads and apply network controls. Contoso must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. Its function is different in this case.
Question 14
At Northwind Traders, the organization has a resource with private addressing only and the design now requires a directly associated internet-routable Azure IP. What should be configured? Choose ONE.
- Create virtual network peering between the two virtual networks
- Associate an Azure public IP address with the internet-facing resource
- Add a user-defined route with Virtual appliance as the next hop
- Create or modify the virtual network and its subnets
Correct Answer: B
Correct Answer
Answer B is correct because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Northwind Traders must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because Virtual network peering connects Azure virtual networks over the Microsoft backbone so resources can communicate using private IP addresses without a gateway in the traffic path. Northwind Traders must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. Its purpose differs from that need.
Answer C is incorrect because A user-defined route can send matching traffic to a network virtual appliance by selecting Virtual appliance as the next-hop type and specifying the appliance private IP. Northwind Traders must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. That behavior does not fit here.
Answer D is incorrect because A virtual network provides the private Azure IP address space, and subnets divide that space into nonoverlapping ranges to organize workloads and apply network controls. Northwind Traders must provide an internet-routable Azure address to a supported resource that must be reachable directly from the internet. The option targets another design goal.
Question 15
Woodgrove Bank is gathering evidence for a routing incident and needs the NIC route table plus an active path test. Choose the best change. Choose TWO.
- Inspect the effective routes on the affected network interface
- Run Network Watcher IP flow verify
- Associate an Azure public IP address with the internet-facing resource
- Run Network Watcher Connection troubleshoot
- Synchronize the peering after the address-space change
Correct Answers: A, D
Correct Answers
Answer A is correct because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Woodgrove Bank must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. It aligns with the required Azure outcome.
Answer D is correct because Connection troubleshoot actively tests connectivity between a source and destination and reports reachability, latency, and relevant routing or security findings. Woodgrove Bank must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. It is the strongest fit here.
Incorrect Answers
Answer B is incorrect because IP flow verify evaluates whether a specific inbound or outbound packet would be allowed or denied by the effective network security rules on a virtual machine network interface. Woodgrove Bank must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. The feature solves a different problem.
Answer C is incorrect because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Woodgrove Bank must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. This is not the requested capability.
Answer E is incorrect because After a peered virtual network address space changes, the peering must be synchronized so the remote peer learns the updated prefixes and system routes. Woodgrove Bank must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. Its purpose differs from that need.
Question 16
Adventure Works is diagnosing a peered-VNet path and wants both the applied routes and an end-to-end connectivity result. Which action fits? Choose TWO.
- Run Network Watcher IP flow verify
- Inspect the effective routes on the affected network interface
- Associate an Azure public IP address with the internet-facing resource
- Synchronize the peering after the address-space change
- Run Network Watcher Connection troubleshoot
Correct Answers: B, E
Correct Answers
Answer B is correct because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Adventure Works must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. The option supplies the needed behavior.
Answer E is correct because Connection troubleshoot actively tests connectivity between a source and destination and reports reachability, latency, and relevant routing or security findings. Adventure Works must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. The service behavior matches the constraint.
Incorrect Answers
Answer A is incorrect because IP flow verify evaluates whether a specific inbound or outbound packet would be allowed or denied by the effective network security rules on a virtual machine network interface. Adventure Works must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. This does not satisfy that condition.
Answer C is incorrect because A public IP address provides an Azure resource with an internet-routable address when the resource type supports public IP association. Adventure Works must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. It would leave the requirement unmet.
Answer D is incorrect because After a peered virtual network address space changes, the peering must be synchronized so the remote peer learns the updated prefixes and system routes. Adventure Works must collect both the effective routing view and an active source-to-destination connectivity test for a routing investigation. Its function is different in this case.
Question 17
At Proseware, the organization has intermittent connectivity and wants Network Watcher to test a specific source-to-destination flow. What should be configured? Choose ONE.
- Run Network Watcher Connection troubleshoot
- Inspect the effective routes on the affected network interface
- Run Network Watcher IP flow verify
- Verify that the effective route uses the Virtual network peering next hop
Correct Answer: A
Correct Answer
Answer A is correct because Connection troubleshoot actively tests connectivity between a source and destination and reports reachability, latency, and relevant routing or security findings. Proseware must actively test reachability between a source and destination and obtain routing or security diagnostics. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Proseware must actively test reachability between a source and destination and obtain routing or security diagnostics. This is not the requested capability.
Answer C is incorrect because IP flow verify evaluates whether a specific inbound or outbound packet would be allowed or denied by the effective network security rules on a virtual machine network interface. Proseware must actively test reachability between a source and destination and obtain routing or security diagnostics. Its purpose differs from that need.
Answer D is incorrect because When peering routes are functioning, the remote virtual network address prefixes appear in effective routes with Virtual network peering as the next-hop type. Proseware must actively test reachability between a source and destination and obtain routing or security diagnostics. That behavior does not fit here.
Question 18
An Azure administrator at Wingtip Toys learns that the organization is troubleshooting a failed TCP connection and wants an active Network Watcher connectivity test. What should the administrator do? Choose ONE.
- Inspect the effective routes on the affected network interface
- Run Network Watcher Connection troubleshoot
- Run Network Watcher IP flow verify
- Verify that the effective route uses the Virtual network peering next hop
Correct Answer: B
Correct Answer
Answer B is correct because Connection troubleshoot actively tests connectivity between a source and destination and reports reachability, latency, and relevant routing or security findings. Wingtip Toys must actively test reachability between a source and destination and obtain routing or security diagnostics. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Wingtip Toys must actively test reachability between a source and destination and obtain routing or security diagnostics. It would leave the requirement unmet.
Answer C is incorrect because IP flow verify evaluates whether a specific inbound or outbound packet would be allowed or denied by the effective network security rules on a virtual machine network interface. Wingtip Toys must actively test reachability between a source and destination and obtain routing or security diagnostics. Its function is different in this case.
Answer D is incorrect because When peering routes are functioning, the remote virtual network address prefixes appear in effective routes with Virtual network peering as the next-hop type. Wingtip Toys must actively test reachability between a source and destination and obtain routing or security diagnostics. The feature solves a different problem.
Question 19
Lucerne Publishing wants Network Watcher to identify the allowing or denying security rule for a particular flow. Which option is appropriate? Choose ONE.
- Run Network Watcher Connection troubleshoot
- Inspect the effective routes on the affected network interface
- Run Network Watcher IP flow verify
- Verify that the effective route uses the Virtual network peering next hop
Correct Answer: C
Correct Answer
Answer C is correct because IP flow verify evaluates whether a specific inbound or outbound packet would be allowed or denied by the effective network security rules on a virtual machine network interface. Lucerne Publishing must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because Connection troubleshoot actively tests connectivity between a source and destination and reports reachability, latency, and relevant routing or security findings. Lucerne Publishing must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. That behavior does not fit here.
Answer B is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. Lucerne Publishing must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. The option targets another design goal.
Answer D is incorrect because When peering routes are functioning, the remote virtual network address prefixes appear in effective routes with Virtual network peering as the next-hop type. Lucerne Publishing must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. This does not satisfy that condition.
Question 20
- Datum is troubleshooting a VM connection and needs a focused allow-or-deny result from the effective security policy. Choose the best change. Choose ONE.
- Run Network Watcher Connection troubleshoot
- Inspect the effective routes on the affected network interface
- Verify that the effective route uses the Virtual network peering next hop
- Run Network Watcher IP flow verify
Correct Answer: D
Correct Answer
Answer D is correct because IP flow verify evaluates whether a specific inbound or outbound packet would be allowed or denied by the effective network security rules on a virtual machine network interface. A. Datum must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because Connection troubleshoot actively tests connectivity between a source and destination and reports reachability, latency, and relevant routing or security findings. A. Datum must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. The feature solves a different problem.
Answer B is incorrect because Effective routes show the combined routes that apply to a network interface, including system, peering, BGP, and user-defined routes, which is useful for routing diagnosis. A. Datum must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. This is not the requested capability.
Answer C is incorrect because When peering routes are functioning, the remote virtual network address prefixes appear in effective routes with Virtual network peering as the next-hop type. A. Datum must determine whether effective network security rules allow or deny a specific packet flow for a VM network interface. Its purpose differs from that need.
