You fail to establish a Site-to-Site VPN connection between your company’s main office and an Azure virtual network.

You need to troubleshoot what prevents you from establishing the IPsec tunnel.

Which diagnostic log should you review?

Reveal Solution Hide Solution

Your company has an on-premises network and three Azure subscriptions named Subscription1, Subscription2, and Subscription3.

The departments at the company use the Azure subscriptions as shown in the following table.

All the resources in the subscriptions are in either the West US Azure region or the West US 2 Azure region.

You plan to connect all the subscriptions to the on-premises network by using ExpressRoute.

What is the minimum number of ExpressRoute circuits required?

Reveal Solution Hide Solution

You have an Azure virtual network and an on-premises datacenter.

You need to implement a Site-to-Site VPN connection between the datacenter and the virtual network.

Which two resources should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

You have the Azure resources shown in the following table.

You configure storage1 to provide access to the subnet in Vnet1 by using a service endpoint.

You need to ensure that you can use the service endpoint to connect to the read-only endpoint of

storage1 in the paired Azure region.

What should you do first?

Reveal Solution Hide Solution

DRAG DROP

You have two Azure subscriptions named Subscnption1 and Subscription2. Subscription1 contains a virtual network named Vnet1. Vnet1 contains an application server. Subscription2 contains a virtual network named Vnet2.

You need to provide the virtual machines in Vnet2 with access to the application server in Vnet1 by using a private endpoint.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

You have an Azure virtual network named Vnet1.

You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be prevented from accessing any Azure Storage

resources.

Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

DRAG DROP

You have an Azure subscription that contains the resources shown in the following table.

The IP Addresses settings for Vnet1 are configured as shown in the exhibit.

You need to ensure that you can integrate WebApp1 and Vnet1.

Which three actions should you perform in sequence before you can integrate WebApp1 and Vnet1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

To integrate WebApp1 with Vnet1, the following actions need to be performed in sequence:

Modify the address space of Vnet1:

The address space for Vnet1 currently is 10.3.0.0/16, and the subnet also has the same address range which leaves no room for further subnetting. You would need to create a smaller subnet within this address space for the integration with WebApp1.

Create a service endpoint:

Service endpoints are needed to secure your critical Azure service resources to only your virtual networks. By enabling a service endpoint, traffic from your VNet to the Azure service always remains on the Microsoft Azure backbone network.

Add a private endpoint:

A private endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. The private endpoint uses an IP address from your VNet, effectively bringing the service into your VNet.

These actions would enable private connectivity between WebApp1 and Vnet1, ensuring that the traffic between your web app and the virtual network is kept on the Azure backbone network, secure from the public internet.

You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.

The subscription contains the following resources:

* An Azure App Service app named App1

* An Azure DNS zone named contoso.com

* An Azure private DNS zone named private.contoso.com

* A virtual network named Vnet1

You create a private endpoint for App1. The record for the endpoint is registered automatically in Azure DNS.

You need to provide a developer with the name that is registered in Azure DNS for the private endpoint.

What should you provide?

Reveal Solution Hide Solution

HOTSPOT

You have the Azure App Service app shown in the App Service exhibit.

The VNet Integration settings for as12 are configured as shown in the Vnet Integration exhibit.

The Private Endpoint connections settings for as12 are configured as shown in the Private Endpoint connections exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Based on the information provided in the screenshots regarding Azure App Service and its VNet Integration and Private Endpoint connections, let’s address the statements provided:

Subnet2 can contain only App Service apps in the ASP1 App Service plan.

No, this statement is not necessarily true. A subnet can contain multiple app services from different App Service plans, not just a single one like ASP1. The App Service plan determines the location, features, cost, and compute resources associated with an app, but multiple plans can use the same subnet for integration.

As12 will use an IP address from Subnet2 for network communications.

Yes, if the Azure App Service ‘as12’ is integrated with a VNet that includes Subnet2, it will use an IP address from Subnet2’s range for network communications within that VNet.

Computers in Vnet1 will connect to a private IP address when they connect to as12.

No, the screenshots do not show any configured private endpoint connections for the ‘as12’ app service, which would be required for ‘as12’ to have a private IP address within the VNet. Without a private endpoint, computers in Vnet1 would connect to the public IP address of ‘as12’, unless further configuration is done outside of what is shown in the screenshots.

You have an Azure subscription that contains the public IP addresses shown in the following table.

You plan to deploy a NAT gateway named NAT1.

Which public IP addresses can be used as the public IP address for NAT1?

Reveal Solution Hide Solution