Topic 12 Practice Test 1 covers Secure Virtual Network Access for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure secure access to virtual networks. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
Contoso has an allow rule at priority 300 and needs a more specific deny rule to be evaluated first. Which action fits? Choose ONE.
- Use a lower numeric priority for the rule that must be evaluated first
- Create or modify a network security group rule
- Ensure both the subnet NSG and the NIC NSG allow the required flow
- Use an application security group as the NSG source or destination
Correct Answer: A
Correct Answer
Answer A is correct because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. Contoso must make a new NSG rule take precedence over an existing conflicting rule. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Contoso must make a new NSG rule take precedence over an existing conflicting rule. This does not satisfy that condition.
Answer C is incorrect because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Contoso must make a new NSG rule take precedence over an existing conflicting rule. It would leave the requirement unmet.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Contoso must make a new NSG rule take precedence over an existing conflicting rule. Its function is different in this case.
Question 2
Northwind Traders needs an exception rule to win during NSG evaluation without deleting the broader rule. Choose the best change. Choose ONE.
- Create or modify a network security group rule
- Use a lower numeric priority for the rule that must be evaluated first
- Ensure both the subnet NSG and the NIC NSG allow the required flow
- Use an application security group as the NSG source or destination
Correct Answer: B
Correct Answer
Answer B is correct because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. Northwind Traders must make a new NSG rule take precedence over an existing conflicting rule. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Northwind Traders must make a new NSG rule take precedence over an existing conflicting rule. Its purpose differs from that need.
Answer C is incorrect because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Northwind Traders must make a new NSG rule take precedence over an existing conflicting rule. That behavior does not fit here.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Northwind Traders must make a new NSG rule take precedence over an existing conflicting rule. The option targets another design goal.
Question 3
An Azure administrator at Woodgrove Bank learns that the organization must design a flow that remains permitted when security groups are attached at both subnet and NIC scope. What should the administrator do? Choose ONE.
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
- Ensure both the subnet NSG and the NIC NSG allow the required flow
- Use an application security group as the NSG source or destination
Correct Answer: C
Correct Answer
Answer C is correct because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Woodgrove Bank must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. It aligns with the required Azure outcome.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Woodgrove Bank must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. Its function is different in this case.
Answer B is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Woodgrove Bank must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. The feature solves a different problem.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Woodgrove Bank must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. This is not the requested capability.
Question 4
At Adventure Works, the organization has an inbound allow on the subnet but the VM NIC NSG still blocks the same flow. What should be configured? Choose ONE.
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
- Use an application security group as the NSG source or destination
- Ensure both the subnet NSG and the NIC NSG allow the required flow
Correct Answer: D
Correct Answer
Answer D is correct because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Adventure Works must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. The option supplies the needed behavior.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Adventure Works must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. The option targets another design goal.
Answer B is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Adventure Works must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. This does not satisfy that condition.
Answer C is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Adventure Works must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. It would leave the requirement unmet.
Question 5
Proseware has a web tier whose VM addresses change during lifecycle operations but should share the same security policy. Choose the best change. Choose ONE.
- Use an application security group as the NSG source or destination
- Use an Azure service tag in the network security rule
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
Correct Answer: A
Correct Answer
Answer A is correct because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Proseware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. Proseware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. This is not the requested capability.
Answer C is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Proseware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. Its purpose differs from that need.
Answer D is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Proseware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. That behavior does not fit here.
Question 6
Wingtip Toys is simplifying security rules for many NICs that perform the same application function. Which option is appropriate? Choose ONE.
- Use an Azure service tag in the network security rule
- Use an application security group as the NSG source or destination
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
Correct Answer: B
Correct Answer
Answer B is correct because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Wingtip Toys must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. Wingtip Toys must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. It would leave the requirement unmet.
Answer C is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Wingtip Toys must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. Its function is different in this case.
Answer D is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Wingtip Toys must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. The feature solves a different problem.
Question 7
A cloud engineer at Lucerne Publishing is working with an environment that has multiple NSG associations and wants to inspect the security rules effective on a particular NIC. Select the correct configuration. Choose ONE.
- Create or modify a network security group rule
- Use a lower numeric priority for the rule that must be evaluated first
- Inspect the effective security rules on the affected network interface
- Use an application security group as the NSG source or destination
Correct Answer: C
Correct Answer
Answer C is correct because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Lucerne Publishing must view the combined subnet and NIC network security rules that actually apply to a VM network interface. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Lucerne Publishing must view the combined subnet and NIC network security rules that actually apply to a VM network interface. That behavior does not fit here.
Answer B is incorrect because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. Lucerne Publishing must view the combined subnet and NIC network security rules that actually apply to a VM network interface. The option targets another design goal.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Lucerne Publishing must view the combined subnet and NIC network security rules that actually apply to a VM network interface. This does not satisfy that condition.
Question 8
An Azure administrator at A. Datum learns that the organization is troubleshooting a denied connection and cannot tell which associated NSG contributes the blocking rule. What should the administrator do? Choose ONE.
- Create or modify a network security group rule
- Use a lower numeric priority for the rule that must be evaluated first
- Use an application security group as the NSG source or destination
- Inspect the effective security rules on the affected network interface
Correct Answer: D
Correct Answer
Answer D is correct because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. A. Datum must view the combined subnet and NIC network security rules that actually apply to a VM network interface. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. A. Datum must view the combined subnet and NIC network security rules that actually apply to a VM network interface. The feature solves a different problem.
Answer B is incorrect because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. A. Datum must view the combined subnet and NIC network security rules that actually apply to a VM network interface. This is not the requested capability.
Answer C is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. A. Datum must view the combined subnet and NIC network security rules that actually apply to a VM network interface. Its purpose differs from that need.
Question 9
Contoso must remove public IP addresses from administrative VMs while retaining browser-based secure management. Which option is appropriate? Choose ONE.
- Use Azure Bastion for administrative RDP or SSH access
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Create or modify a network security group rule
Correct Answer: A
Correct Answer
Answer A is correct because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Contoso must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Contoso must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. This does not satisfy that condition.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Contoso must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. It would leave the requirement unmet.
Answer D is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Contoso must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. Its function is different in this case.
Question 10
In Northwind Traders’s Azure environment, the organization is hardening management access so target VMs no longer expose public management endpoints. What is required? Choose ONE.
- Create a private endpoint for the Azure service
- Use Azure Bastion for administrative RDP or SSH access
- Enable a virtual network service endpoint for the Azure service
- Create or modify a network security group rule
Correct Answer: B
Correct Answer
Answer B is correct because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Northwind Traders must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Northwind Traders must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. Its purpose differs from that need.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Northwind Traders must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. That behavior does not fit here.
Answer D is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Northwind Traders must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. The option targets another design goal.
Question 11
Woodgrove Bank is choosing a networking feature that optimizes the route to a supported service and exposes the virtual network identity to that service. Which Azure feature fits? Choose ONE.
- Create a private endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Enable a virtual network service endpoint for the Azure service
- Disable public network access on the service after private endpoint validation
Correct Answer: C
Correct Answer
Answer C is correct because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Woodgrove Bank must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. It aligns with the required Azure outcome.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Woodgrove Bank must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. Its function is different in this case.
Answer B is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Woodgrove Bank must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. The feature solves a different problem.
Answer D is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Woodgrove Bank must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. This is not the requested capability.
Question 12
A cloud engineer at Adventure Works is working with an environment that wants a storage service firewall to recognize requests as coming from an approved subnet without creating a private endpoint. Select the correct configuration. Choose ONE.
- Create a private endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Disable public network access on the service after private endpoint validation
- Enable a virtual network service endpoint for the Azure service
Correct Answer: D
Correct Answer
Answer D is correct because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Adventure Works must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. The option supplies the needed behavior.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Adventure Works must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. The option targets another design goal.
Answer B is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Adventure Works must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. This does not satisfy that condition.
Answer C is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Adventure Works must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. It would leave the requirement unmet.
Question 13
In Proseware’s Azure environment, the organization has clients that must reach a storage subresource by a private address from the VNet. What is required? Choose ONE.
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Use Azure Bastion for administrative RDP or SSH access
Correct Answer: A
Correct Answer
Answer A is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Proseware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Proseware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. This is not the requested capability.
Answer C is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Proseware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. Its purpose differs from that need.
Answer D is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Proseware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. That behavior does not fit here.
Question 14
Wingtip Toys is replacing access through the service public endpoint with Private Link connectivity. Which action fits? Choose ONE.
- Enable a virtual network service endpoint for the Azure service
- Create a private endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Use Azure Bastion for administrative RDP or SSH access
Correct Answer: B
Correct Answer
Answer B is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Wingtip Toys must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Wingtip Toys must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. It would leave the requirement unmet.
Answer C is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Wingtip Toys must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. Its function is different in this case.
Answer D is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Wingtip Toys must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. The feature solves a different problem.
Question 15
At Lucerne Publishing, the organization is replacing public PaaS access with Private Link and requires normal-name resolution from connected virtual networks. What should be configured? Choose TWO.
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Use Azure Bastion for administrative RDP or SSH access
- Configure the recommended private DNS zone for the private endpoint
- Disable public network access on the service after private endpoint validation
Correct Answers: A, D
Correct Answers
Answer A is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Lucerne Publishing must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. It therefore matches the requested outcome.
Answer D is correct because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Lucerne Publishing must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. The option supplies the needed behavior.
Incorrect Answers
Answer B is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Lucerne Publishing must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. The option targets another design goal.
Answer C is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Lucerne Publishing must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. This does not satisfy that condition.
Answer E is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Lucerne Publishing must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. It would leave the requirement unmet.
Question 16
- Datum is building a new Private Link path and wants applications to keep using the service hostname while resolving it privately. Which Azure feature fits? Choose TWO.
- Enable a virtual network service endpoint for the Azure service
- Create a private endpoint for the Azure service
- Use Azure Bastion for administrative RDP or SSH access
- Disable public network access on the service after private endpoint validation
- Configure the recommended private DNS zone for the private endpoint
Correct Answers: B, E
Correct Answers
Answer B is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. A. Datum must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. It is the strongest fit here.
Answer E is correct because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. A. Datum must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. This is the precise operational fit.
Incorrect Answers
Answer A is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. A. Datum must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. This is not the requested capability.
Answer C is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. A. Datum must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. Its purpose differs from that need.
Answer D is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. A. Datum must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. That behavior does not fit here.
Question 17
Contoso has validated Private Link access but security policy prohibits any remaining public network path to the service. Which action fits? Choose ONE.
- Disable public network access on the service after private endpoint validation
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
Correct Answer: A
Correct Answer
Answer A is correct because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Contoso must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Contoso must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. This does not satisfy that condition.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Contoso must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. It would leave the requirement unmet.
Answer D is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Contoso must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. Its function is different in this case.
Question 18
Northwind Traders is completing a private-only design after confirming private DNS and endpoint connectivity. Choose the best change. Choose ONE.
- Create a private endpoint for the Azure service
- Disable public network access on the service after private endpoint validation
- Enable a virtual network service endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
Correct Answer: B
Correct Answer
Answer B is correct because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Northwind Traders must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Northwind Traders must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. Its purpose differs from that need.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Northwind Traders must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. That behavior does not fit here.
Answer D is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Northwind Traders must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. The option targets another design goal.
Question 19
An Azure administrator at Woodgrove Bank learns that the organization is replacing a long list of Azure service CIDR prefixes with the appropriate abstract rule source or destination. What should the administrator do? Choose ONE.
- Use an application security group as the NSG source or destination
- Create a private endpoint for the Azure service
- Use an Azure service tag in the network security rule
- Enable a virtual network service endpoint for the Azure service
Correct Answer: C
Correct Answer
Answer C is correct because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. Woodgrove Bank must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. It aligns with the required Azure outcome.
Incorrect Answers
Answer A is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Woodgrove Bank must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. Its function is different in this case.
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Woodgrove Bank must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. The feature solves a different problem.
Answer D is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Woodgrove Bank must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. This is not the requested capability.
Question 20
At Adventure Works, the organization needs an NSG rule for a supported Azure service whose published IP ranges change over time. What should be configured? Choose ONE.
- Use an application security group as the NSG source or destination
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Use an Azure service tag in the network security rule
Correct Answer: D
Correct Answer
Answer D is correct because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. Adventure Works must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. The option supplies the needed behavior.
Incorrect Answers
Answer A is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Adventure Works must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. The option targets another design goal.
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Adventure Works must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. This does not satisfy that condition.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Adventure Works must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. It would leave the requirement unmet.
