Topic 12 Practice Test 2 covers Secure Virtual Network Access for Microsoft Azure Administrator AZ-104 and maps to the objective: Configure secure access to virtual networks. For broader exam preparation, review the Microsoft AZ-104 Exam Dumps. Every option includes focused technical reasoning explaining both the Azure concept and its fit to the scenario.
Question 1
At Fabrikam, the organization is resolving a rule conflict and must ensure the new security rule is processed before the current entry. What should be configured? Choose ONE.
- Use a lower numeric priority for the rule that must be evaluated first
- Create or modify a network security group rule
- Ensure both the subnet NSG and the NIC NSG allow the required flow
- Use an application security group as the NSG source or destination
Correct Answer: A
Correct Answer
Answer A is correct because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. Fabrikam must make a new NSG rule take precedence over an existing conflicting rule. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Fabrikam must make a new NSG rule take precedence over an existing conflicting rule. This is not the requested capability.
Answer C is incorrect because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Fabrikam must make a new NSG rule take precedence over an existing conflicting rule. Its purpose differs from that need.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Fabrikam must make a new NSG rule take precedence over an existing conflicting rule. That behavior does not fit here.
Question 2
An Azure administrator at Adventure Works learns that the organization is reviewing two matching NSG rules and must make the intended rule the first one evaluated. What should the administrator do? Choose ONE.
- Create or modify a network security group rule
- Use a lower numeric priority for the rule that must be evaluated first
- Ensure both the subnet NSG and the NIC NSG allow the required flow
- Use an application security group as the NSG source or destination
Correct Answer: B
Correct Answer
Answer B is correct because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. Adventure Works must make a new NSG rule take precedence over an existing conflicting rule. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Adventure Works must make a new NSG rule take precedence over an existing conflicting rule. It would leave the requirement unmet.
Answer C is incorrect because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Adventure Works must make a new NSG rule take precedence over an existing conflicting rule. Its function is different in this case.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Adventure Works must make a new NSG rule take precedence over an existing conflicting rule. The feature solves a different problem.
Question 3
Proseware has two NSG associations and needs the packet accepted by the effective policy at each applicable layer. Which option is appropriate? Choose ONE.
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
- Ensure both the subnet NSG and the NIC NSG allow the required flow
- Use an application security group as the NSG source or destination
Correct Answer: C
Correct Answer
Answer C is correct because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Proseware must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Proseware must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. That behavior does not fit here.
Answer B is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Proseware must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. The option targets another design goal.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Proseware must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. This does not satisfy that condition.
Question 4
Tailspin Toys is troubleshooting traffic that passes one associated NSG but is denied by the other. Choose the best change. Choose ONE.
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
- Use an application security group as the NSG source or destination
- Ensure both the subnet NSG and the NIC NSG allow the required flow
Correct Answer: D
Correct Answer
Answer D is correct because When NSGs are associated to both a subnet and a network interface, the traffic must be allowed by the effective rules at each applicable layer to succeed. Tailspin Toys must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Tailspin Toys must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. The feature solves a different problem.
Answer B is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Tailspin Toys must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. This is not the requested capability.
Answer C is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Tailspin Toys must allow the required traffic through both applicable NSG layers when a subnet NSG and a NIC NSG are present. Its purpose differs from that need.
Question 5
An Azure administrator at Litware learns that the organization wants NSG rules to refer to application roles such as web and database rather than individual addresses. What should the administrator do? Choose ONE.
- Use an application security group as the NSG source or destination
- Use an Azure service tag in the network security rule
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
Correct Answer: A
Correct Answer
Answer A is correct because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Litware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. Litware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. This does not satisfy that condition.
Answer C is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Litware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. It would leave the requirement unmet.
Answer D is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Litware must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. Its function is different in this case.
Question 6
A cloud engineer at A. Datum is working with an environment that needs an Azure-native grouping object for VM NICs that can be used as an NSG source or destination. Select the correct configuration. Choose ONE.
- Use an Azure service tag in the network security rule
- Use an application security group as the NSG source or destination
- Create or modify a network security group rule
- Inspect the effective security rules on the affected network interface
Correct Answer: B
Correct Answer
Answer B is correct because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. A. Datum must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. A. Datum must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. Its purpose differs from that need.
Answer C is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. A. Datum must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. That behavior does not fit here.
Answer D is incorrect because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. A. Datum must group VM network interfaces by application role and reference that group in NSG rules instead of maintaining IP lists. The option targets another design goal.
Question 7
In Contoso’s Azure environment, the organization is validating an access change and needs to see the resulting effective security rule set for the VM. What is required? Choose ONE.
- Create or modify a network security group rule
- Use a lower numeric priority for the rule that must be evaluated first
- Inspect the effective security rules on the affected network interface
- Use an application security group as the NSG source or destination
Correct Answer: C
Correct Answer
Answer C is correct because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Contoso must view the combined subnet and NIC network security rules that actually apply to a VM network interface. It aligns with the required Azure outcome.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Contoso must view the combined subnet and NIC network security rules that actually apply to a VM network interface. Its function is different in this case.
Answer B is incorrect because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. Contoso must view the combined subnet and NIC network security rules that actually apply to a VM network interface. The feature solves a different problem.
Answer D is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Contoso must view the combined subnet and NIC network security rules that actually apply to a VM network interface. This is not the requested capability.
Question 8
Fourth Coffee needs the final security policy after Azure combines rules from the subnet and network interface. Which option is appropriate? Choose ONE.
- Create or modify a network security group rule
- Use a lower numeric priority for the rule that must be evaluated first
- Use an application security group as the NSG source or destination
- Inspect the effective security rules on the affected network interface
Correct Answer: D
Correct Answer
Answer D is correct because Effective security rules combine the applicable subnet and network-interface NSG rules so an administrator can see which security policy is actually applied to a VM NIC. Fourth Coffee must view the combined subnet and NIC network security rules that actually apply to a VM network interface. The option supplies the needed behavior.
Incorrect Answers
Answer A is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Fourth Coffee must view the combined subnet and NIC network security rules that actually apply to a VM network interface. The option targets another design goal.
Answer B is incorrect because Network security group rules are processed in ascending numeric priority, so a rule with a lower priority number is evaluated before a rule with a higher number. Fourth Coffee must view the combined subnet and NIC network security rules that actually apply to a VM network interface. This does not satisfy that condition.
Answer C is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Fourth Coffee must view the combined subnet and NIC network security rules that actually apply to a VM network interface. It would leave the requirement unmet.
Question 9
A cloud engineer at Fabrikam is working with an environment that has operators who need RDP and SSH access to private-address VMs from the Azure portal. Select the correct configuration. Choose ONE.
- Use Azure Bastion for administrative RDP or SSH access
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Create or modify a network security group rule
Correct Answer: A
Correct Answer
Answer A is correct because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Fabrikam must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Fabrikam must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. This is not the requested capability.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Fabrikam must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. Its purpose differs from that need.
Answer D is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Fabrikam must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. That behavior does not fit here.
Question 10
Adventure Works needs a managed jump service deployed with the virtual network instead of per-VM public IP addresses. Which Azure feature fits? Choose ONE.
- Create a private endpoint for the Azure service
- Use Azure Bastion for administrative RDP or SSH access
- Enable a virtual network service endpoint for the Azure service
- Create or modify a network security group rule
Correct Answer: B
Correct Answer
Answer B is correct because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Adventure Works must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Adventure Works must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. It would leave the requirement unmet.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Adventure Works must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. Its function is different in this case.
Answer D is incorrect because Network security groups filter inbound and outbound traffic with stateful allow or deny rules based on priority, direction, protocol, ports, and source or destination criteria. Adventure Works must provide managed RDP or SSH administration to VMs through their private IP addresses without assigning public IPs to the VMs. The feature solves a different problem.
Question 11
Proseware has a policy requirement for service-endpoint-based subnet authorization rather than Private Link. Which action fits? Choose ONE.
- Create a private endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Enable a virtual network service endpoint for the Azure service
- Disable public network access on the service after private endpoint validation
Correct Answer: C
Correct Answer
Answer C is correct because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Proseware must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Proseware must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. That behavior does not fit here.
Answer B is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Proseware must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. The option targets another design goal.
Answer D is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Proseware must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. This does not satisfy that condition.
Question 12
In Tailspin Toys’s Azure environment, the organization needs subnet-scoped service access but does not require the Azure service to receive a private IP in the VNet. What is required? Choose ONE.
- Create a private endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Disable public network access on the service after private endpoint validation
- Enable a virtual network service endpoint for the Azure service
Correct Answer: D
Correct Answer
Answer D is correct because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Tailspin Toys must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Tailspin Toys must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. The feature solves a different problem.
Answer B is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Tailspin Toys must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. This is not the requested capability.
Answer C is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Tailspin Toys must extend the subnet identity to a supported Azure service while continuing to use the service public endpoint model over the Azure backbone. Its purpose differs from that need.
Question 13
Litware needs a private network interface mapping to a specific Azure service subresource. Which Azure feature fits? Choose ONE.
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Use Azure Bastion for administrative RDP or SSH access
Correct Answer: A
Correct Answer
Answer A is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Litware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. The service behavior matches the constraint.
Incorrect Answers
Answer B is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Litware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. This does not satisfy that condition.
Answer C is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Litware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. It would leave the requirement unmet.
Answer D is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Litware must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. Its function is different in this case.
Question 14
At A. Datum, the organization must expose a PaaS service privately to connected networks using an IP from a VNet subnet. What should be configured? Choose ONE.
- Enable a virtual network service endpoint for the Azure service
- Create a private endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
- Use Azure Bastion for administrative RDP or SSH access
Correct Answer: B
Correct Answer
Answer B is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. A. Datum must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. This meets the stated administration goal.
Incorrect Answers
Answer A is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. A. Datum must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. Its purpose differs from that need.
Answer C is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. A. Datum must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. That behavior does not fit here.
Answer D is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. A. Datum must give a supported Azure service a private IP presence in the virtual network through Azure Private Link. The option targets another design goal.
Question 15
Contoso is designing a private service connection where both the network interface and DNS mapping must be created. Choose the best change. Choose TWO.
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Use Azure Bastion for administrative RDP or SSH access
- Configure the recommended private DNS zone for the private endpoint
- Disable public network access on the service after private endpoint validation
Correct Answers: A, D
Correct Answers
Answer A is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Contoso must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. It aligns with the required Azure outcome.
Answer D is correct because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Contoso must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. It is the strongest fit here.
Incorrect Answers
Answer B is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Contoso must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. The feature solves a different problem.
Answer C is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Contoso must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. This is not the requested capability.
Answer E is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Contoso must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. Its purpose differs from that need.
Question 16
Fourth Coffee has no existing private endpoint or DNS zone and needs the two core components for private FQDN connectivity. Which action fits? Choose TWO.
- Enable a virtual network service endpoint for the Azure service
- Create a private endpoint for the Azure service
- Use Azure Bastion for administrative RDP or SSH access
- Disable public network access on the service after private endpoint validation
- Configure the recommended private DNS zone for the private endpoint
Correct Answers: B, E
Correct Answers
Answer B is correct because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Fourth Coffee must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. The option supplies the needed behavior.
Answer E is correct because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Fourth Coffee must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. The service behavior matches the constraint.
Incorrect Answers
Answer A is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Fourth Coffee must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. This does not satisfy that condition.
Answer C is incorrect because Azure Bastion provides managed RDP and SSH connectivity to virtual machines through their private IP addresses, so the VMs do not need public IP addresses for administration. Fourth Coffee must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. It would leave the requirement unmet.
Answer D is incorrect because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Fourth Coffee must configure both the private endpoint connection and private DNS resolution so clients reach the Azure service by its normal FQDN over a private IP. Its function is different in this case.
Question 17
At Fabrikam, the organization assumed a private endpoint automatically disabled the public endpoint and must now close public access explicitly. What should be configured? Choose ONE.
- Disable public network access on the service after private endpoint validation
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
Correct Answer: A
Correct Answer
Answer A is correct because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Fabrikam must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. This is the precise operational fit.
Incorrect Answers
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Fabrikam must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. This is not the requested capability.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Fabrikam must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. Its purpose differs from that need.
Answer D is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Fabrikam must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. That behavior does not fit here.
Question 18
An Azure administrator at Adventure Works learns that the organization must remove the public access path while preserving the already tested private endpoint connection. What should the administrator do? Choose ONE.
- Create a private endpoint for the Azure service
- Disable public network access on the service after private endpoint validation
- Enable a virtual network service endpoint for the Azure service
- Configure the recommended private DNS zone for the private endpoint
Correct Answer: B
Correct Answer
Answer B is correct because Creating a private endpoint does not automatically disable a service public endpoint in many Azure services; public access must be disabled separately when private-only access is required. Adventure Works must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. That capability fits the scenario directly.
Incorrect Answers
Answer A is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Adventure Works must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. It would leave the requirement unmet.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Adventure Works must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. Its function is different in this case.
Answer D is incorrect because Private endpoint clients normally need DNS that resolves the service FQDN to the private endpoint IP, commonly through the Microsoft-recommended privatelink private DNS zone. Adventure Works must enforce private-only service access after the private endpoint is working because public connectivity must no longer be accepted. The feature solves a different problem.
Question 19
Proseware must simplify an NSG rule that targets a known Azure platform service rather than an application tier. Which option is appropriate? Choose ONE.
- Use an application security group as the NSG source or destination
- Create a private endpoint for the Azure service
- Use an Azure service tag in the network security rule
- Enable a virtual network service endpoint for the Azure service
Correct Answer: C
Correct Answer
Answer C is correct because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. Proseware must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. It therefore matches the requested outcome.
Incorrect Answers
Answer A is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Proseware must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. That behavior does not fit here.
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Proseware must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. The option targets another design goal.
Answer D is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Proseware must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. This does not satisfy that condition.
Question 20
Tailspin Toys wants Microsoft to maintain the service address set referenced by the security policy. Choose the best change. Choose ONE.
- Use an application security group as the NSG source or destination
- Create a private endpoint for the Azure service
- Enable a virtual network service endpoint for the Azure service
- Use an Azure service tag in the network security rule
Correct Answer: D
Correct Answer
Answer D is correct because Service tags represent groups of Azure service IP prefixes maintained by Microsoft and can simplify NSG rules when policy targets a supported Azure service rather than specific addresses. Tailspin Toys must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. It is the strongest fit here.
Incorrect Answers
Answer A is incorrect because Application security groups let administrators group network interfaces by application role and reference those groups in NSG rules instead of maintaining individual IP addresses. Tailspin Toys must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. The feature solves a different problem.
Answer B is incorrect because A private endpoint creates a network interface with a private IP address in the virtual network and privately connects that address to a specific Azure Private Link resource or subresource. Tailspin Toys must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. This is not the requested capability.
Answer C is incorrect because A service endpoint extends the virtual network identity to a supported Azure service and keeps service traffic on the Azure backbone while the service continues to use its public endpoint model. Tailspin Toys must reference a Microsoft-maintained set of Azure service IP prefixes in an NSG rule instead of hard-coding those service addresses. Its purpose differs from that need.
