Microsoft AZ-104 Azure Network Security Practice Test

 

Topic 15 focuses on NSGs, ASGs, Bastion, Service Endpoints, and Private Endpoints for the Microsoft Certified: Azure Administrator Associate certification and the AZ-104 exam, using Microsoft Azure administration scenarios. For broader exam preparation, review the Microsoft Azure Administrator AZ-104 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

To allow or deny network flows to supported Azure resources at subnet or network-interface scope, which Azure configuration should be selected?

1. Network security group (NSG)
2. AzureBastionSubnet
3. Network access isolation with Private Link
4. Effective security rules

Correct Answer: A

 

Correct Answer

Answer A is correct because Network security group (NSG) is a stateful packet-filtering resource containing ordered inbound and outbound security rules. It directly supports the requirement to allow or deny network flows to supported Azure resources at subnet or network-interface scope.

Incorrect Answers

Answer B is incorrect because AzureBastionSubnet is used to provide the network placement required by an Azure Bastion host; it does not provide the capability described in the scenario.

Answer C is incorrect because Network access isolation with Private Link is used to keep service traffic on private addressing and reduce exposure to the public network; it does not provide the capability described in the scenario.

Answer D is incorrect because Effective security rules are used to troubleshoot the actual NSG filtering applied to a virtual machine interface; it does not provide the capability described in the scenario.

 

Question 2

For Network security group (NSG), which administrative outcome is expected?

1. Allow or deny network flows to supported Azure resources at subnet or network-interface scope
2. Apply security filtering specifically to traffic for that NIC
3. Control which allow or deny rule wins when multiple NSG rules could match a flow
4. Simplify NSG rules that must allow or deny traffic to an Azure service

Correct Answer: A

 

Correct Answer

Answer A is correct because Network security group (NSG) is a stateful packet-filtering resource containing ordered inbound and outbound security rules. Its intended administrative use is to allow or deny network flows to supported Azure resources at subnet or network-interface scope.

Incorrect Answers

Answer B is incorrect because that outcome belongs to NIC-level NSG, which is used to apply security filtering specifically to traffic for that NIC; it is not the primary purpose of Network security group (NSG).

Answer C is incorrect because that outcome belongs to NSG rule priority, which is used to control which allow or deny rule wins when multiple NSG rules could match a flow; it is not the primary purpose of Network security group (NSG).

Answer D is incorrect because that outcome belongs to Service tag, which is used to simplify NSG rules that must allow or deny traffic to an Azure service; it is not the primary purpose of Network security group (NSG).

 

Question 3

To control which allow or deny rule wins when multiple NSG rules could match a flow, which Azure configuration should be selected?

1. NSG rule priority
2. Application security group (ASG)
3. Service tag
4. Private endpoint

Correct Answer: A

 

Correct Answer

Answer A is correct because NSG rule priority is the number used to determine rule evaluation order, where lower numbers are evaluated before higher numbers. It directly supports the requirement to control which allow or deny rule wins when multiple NSG rules could match a flow.

Incorrect Answers

Answer B is incorrect because Application security group (ASG) is used to write security rules around application roles instead of hard-coding individual IP addresses; it does not provide the capability described in the scenario.

Answer C is incorrect because Service tag is used to simplify NSG rules that must allow or deny traffic to an Azure service; it does not provide the capability described in the scenario.

Answer D is incorrect because Private endpoint is used to access a supported PaaS resource through a private VNet address; it does not provide the capability described in the scenario.

 

Question 4

For NSG rule priority, which administrative outcome is expected?

1. Ensure clients resolve a service name to the private endpoint rather than its public address
2. Allow or deny network flows to supported Azure resources at subnet or network-interface scope
3. Control which allow or deny rule wins when multiple NSG rules could match a flow
4. Simplify NSG rules that must allow or deny traffic to an Azure service

Correct Answer: C

 

Correct Answer

Answer C is correct because NSG rule priority is the number used to determine rule evaluation order, where lower numbers are evaluated before higher numbers. Its intended administrative use is to control which allow or deny rule wins when multiple NSG rules could match a flow.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Private DNS integration, which is used to ensure clients resolve a service name to the private endpoint rather than its public address; it is not the primary purpose of NSG rule priority.

Answer B is incorrect because that outcome belongs to Network security group (NSG), which is used to allow or deny network flows to supported Azure resources at subnet or network-interface scope; it is not the primary purpose of NSG rule priority.

Answer D is incorrect because that outcome belongs to Service tag, which is used to simplify NSG rules that must allow or deny traffic to an Azure service; it is not the primary purpose of NSG rule priority.

 

Question 5

To simplify bidirectional communication for established allowed flows, which Azure configuration should be selected?

1. Private endpoint
2. Network access isolation with Private Link
3. Application security group (ASG)
4. Stateful NSG behavior

Correct Answer: D

 

Correct Answer

Answer D is correct because Stateful NSG behavior is the behavior in which return traffic for an allowed connection is automatically permitted without requiring a separate opposite-direction rule. It directly supports the requirement to simplify bidirectional communication for established allowed flows.

Incorrect Answers

Answer A is incorrect because Private endpoint is used to access a supported PaaS resource through a private VNet address; it does not provide the capability described in the scenario.

Answer B is incorrect because Network access isolation with Private Link is used to keep service traffic on private addressing and reduce exposure to the public network; it does not provide the capability described in the scenario.

Answer C is incorrect because Application security group (ASG) is used to write security rules around application roles instead of hard-coding individual IP addresses; it does not provide the capability described in the scenario.

 

Question 6

For Stateful NSG behavior, which administrative outcome is expected?

1. Allow or deny network flows to supported Azure resources at subnet or network-interface scope
2. Simplify bidirectional communication for established allowed flows
3. Keep service traffic on private addressing and reduce exposure to the public network
4. Supply default connectivity behavior while allowing higher-priority custom rules to override it

Correct Answer: B

 

Correct Answer

Answer B is correct because Stateful NSG behavior is the behavior in which return traffic for an allowed connection is automatically permitted without requiring a separate opposite-direction rule. Its intended administrative use is to simplify bidirectional communication for established allowed flows.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Network security group (NSG), which is used to allow or deny network flows to supported Azure resources at subnet or network-interface scope; it is not the primary purpose of Stateful NSG behavior.

Answer C is incorrect because that outcome belongs to Network access isolation with Private Link, which is used to keep service traffic on private addressing and reduce exposure to the public network; it is not the primary purpose of Stateful NSG behavior.

Answer D is incorrect because that outcome belongs to Default NSG rules, which is used to supply default connectivity behavior while allowing higher-priority custom rules to override it; it is not the primary purpose of Stateful NSG behavior.

 

Question 7

To supply default connectivity behavior while allowing higher-priority custom rules to override it, which Azure configuration should be selected?

1. Effective security rules
2. Stateful NSG behavior
3. Private endpoint
4. Default NSG rules

Correct Answer: D

 

Correct Answer

Answer D is correct because Default NSG rules are built-in rules that provide baseline virtual-network, load-balancer, and internet behavior at lower precedence than custom rules. It directly supports the requirement to supply default connectivity behavior while allowing higher-priority custom rules to override it.

Incorrect Answers

Answer A is incorrect because Effective security rules are used to troubleshoot the actual NSG filtering applied to a virtual machine interface; it does not provide the capability described in the scenario.

Answer B is incorrect because Stateful NSG behavior is used to simplify bidirectional communication for established allowed flows; it does not provide the capability described in the scenario.

Answer C is incorrect because Private endpoint is used to access a supported PaaS resource through a private VNet address; it does not provide the capability described in the scenario.

 

Question 8

For Default NSG rules, which administrative outcome is expected?

1. Simplify NSG rules that must allow or deny traffic to an Azure service
2. Supply default connectivity behavior while allowing higher-priority custom rules to override it
3. Access a supported PaaS resource through a private VNet address
4. Write security rules around application roles instead of hard-coding individual IP addresses

Correct Answer: B

 

Correct Answer

Answer B is correct because Default NSG rules are built-in rules that provide baseline virtual-network, load-balancer, and internet behavior at lower precedence than custom rules. Its intended administrative use is to supply default connectivity behavior while allowing higher-priority custom rules to override it.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Service tag, which is used to simplify NSG rules that must allow or deny traffic to an Azure service; it is not the primary purpose of Default NSG rules.

Answer C is incorrect because that outcome belongs to Private endpoint, which is used to access a supported PaaS resource through a private VNet address; it is not the primary purpose of Default NSG rules.

Answer D is incorrect because that outcome belongs to Application security group (ASG), which is used to write security rules around application roles instead of hard-coding individual IP addresses; it is not the primary purpose of Default NSG rules.

 

Question 9

To apply security filtering to supported resources that use the protected subnet, which Azure configuration should be selected?

1. NSG rule priority
2. Subnet-level NSG
3. Azure Bastion
4. Service tag

Correct Answer: B

 

Correct Answer

Answer B is correct because Subnet-level NSG is an NSG associated with a subnet. It directly supports the requirement to apply security filtering to supported resources that use the protected subnet.

Incorrect Answers

Answer A is incorrect because NSG rule priority is used to control which allow or deny rule wins when multiple NSG rules could match a flow; it does not provide the capability described in the scenario.

Answer C is incorrect because Azure Bastion is used to administer VMs securely while reducing direct internet exposure of management ports; it does not provide the capability described in the scenario.

Answer D is incorrect because Service tag is used to simplify NSG rules that must allow or deny traffic to an Azure service; it does not provide the capability described in the scenario.

 

Question 10

For Subnet-level NSG, which administrative outcome is expected?

1. Simplify bidirectional communication for established allowed flows
2. Keep service traffic on private addressing and reduce exposure to the public network
3. Simplify NSG rules that must allow or deny traffic to an Azure service
4. Apply security filtering to supported resources that use the protected subnet

Correct Answer: D

 

Correct Answer

Answer D is correct because Subnet-level NSG is an NSG associated with a subnet. Its intended administrative use is to apply security filtering to supported resources that use the protected subnet.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Stateful NSG behavior, which is used to simplify bidirectional communication for established allowed flows; it is not the primary purpose of Subnet-level NSG.

Answer B is incorrect because that outcome belongs to Network access isolation with Private Link, which is used to keep service traffic on private addressing and reduce exposure to the public network; it is not the primary purpose of Subnet-level NSG.

Answer C is incorrect because that outcome belongs to Service tag, which is used to simplify NSG rules that must allow or deny traffic to an Azure service; it is not the primary purpose of Subnet-level NSG.

 

Question 11

To apply security filtering specifically to traffic for that NIC, which Azure configuration should be selected?

1. Application security group (ASG)
2. NIC-level NSG
3. Azure Bastion
4. Effective security rules

Correct Answer: B

 

Correct Answer

Answer B is correct because NIC-level NSG is an NSG associated directly with a virtual machine network interface. It directly supports the requirement to apply security filtering specifically to traffic for that NIC.

Incorrect Answers

Answer A is incorrect because Application security group (ASG) is used to write security rules around application roles instead of hard-coding individual IP addresses; it does not provide the capability described in the scenario.

Answer C is incorrect because Azure Bastion is used to administer VMs securely while reducing direct internet exposure of management ports; it does not provide the capability described in the scenario.

Answer D is incorrect because Effective security rules are used to troubleshoot the actual NSG filtering applied to a virtual machine interface; it does not provide the capability described in the scenario.

 

Question 12

For NIC-level NSG, which administrative outcome is expected?

1. Simplify bidirectional communication for established allowed flows
2. Apply security filtering to supported resources that use the protected subnet
3. Apply security filtering specifically to traffic for that NIC
4. Access a supported PaaS resource through a private VNet address

Correct Answer: C

 

Correct Answer

Answer C is correct because NIC-level NSG is an NSG associated directly with a virtual machine network interface. Its intended administrative use is to apply security filtering specifically to traffic for that NIC.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Stateful NSG behavior, which is used to simplify bidirectional communication for established allowed flows; it is not the primary purpose of NIC-level NSG.

Answer B is incorrect because that outcome belongs to Subnet-level NSG, which is used to apply security filtering to supported resources that use the protected subnet; it is not the primary purpose of NIC-level NSG.

Answer D is incorrect because that outcome belongs to Private endpoint, which is used to access a supported PaaS resource through a private VNet address; it is not the primary purpose of NIC-level NSG.

 

Question 13

To troubleshoot the actual NSG filtering applied to a virtual machine interface, which Azure configuration should be selected?

1. Effective security rules
2. NIC-level NSG
3. Service tag
4. Default NSG rules

Correct Answer: A

 

Correct Answer

Answer A is correct because Effective security rules are the resulting security rules affecting a NIC after relevant subnet and NIC NSG rules are combined. It directly supports the requirement to troubleshoot the actual NSG filtering applied to a virtual machine interface.

Incorrect Answers

Answer B is incorrect because NIC-level NSG is used to apply security filtering specifically to traffic for that NIC; it does not provide the capability described in the scenario.

Answer C is incorrect because Service tag is used to simplify NSG rules that must allow or deny traffic to an Azure service; it does not provide the capability described in the scenario.

Answer D is incorrect because Default NSG rules are used to supply default connectivity behavior while allowing higher-priority custom rules to override it; it does not provide the capability described in the scenario.

 

Question 14

For Effective security rules, which administrative outcome is expected?

1. Troubleshoot the actual NSG filtering applied to a virtual machine interface
2. Ensure clients resolve a service name to the private endpoint rather than its public address
3. Apply security filtering specifically to traffic for that NIC
4. Apply security filtering to supported resources that use the protected subnet

Correct Answer: A

 

Correct Answer

Answer A is correct because Effective security rules are the resulting security rules affecting a NIC after relevant subnet and NIC NSG rules are combined. Its intended administrative use is to troubleshoot the actual NSG filtering applied to a virtual machine interface.

Incorrect Answers

Answer B is incorrect because that outcome belongs to Private DNS integration, which is used to ensure clients resolve a service name to the private endpoint rather than its public address; it is not the primary purpose of Effective security rules.

Answer C is incorrect because that outcome belongs to NIC-level NSG, which is used to apply security filtering specifically to traffic for that NIC; it is not the primary purpose of Effective security rules.

Answer D is incorrect because that outcome belongs to Subnet-level NSG, which is used to apply security filtering to supported resources that use the protected subnet; it is not the primary purpose of Effective security rules.

 

Question 15

To write security rules around application roles instead of hard-coding individual IP addresses, which Azure configuration should be selected?

1. Application security group (ASG)
2. Service tag
3. Network access isolation with Private Link
4. Private DNS integration

Correct Answer: A

 

Correct Answer

Answer A is correct because Application security group (ASG) is a logical group of VM network interfaces that can be referenced in NSG rules. It directly supports the requirement to write security rules around application roles instead of hard-coding individual IP addresses.

Incorrect Answers

Answer B is incorrect because Service tag is used to simplify NSG rules that must allow or deny traffic to an Azure service; it does not provide the capability described in the scenario.

Answer C is incorrect because Network access isolation with Private Link is used to keep service traffic on private addressing and reduce exposure to the public network; it does not provide the capability described in the scenario.

Answer D is incorrect because Private DNS integration is used to ensure clients resolve a service name to the private endpoint rather than its public address; it does not provide the capability described in the scenario.

 

Question 16

For Application security group (ASG), which administrative outcome is expected?

1. Supply default connectivity behavior while allowing higher-priority custom rules to override it
2. Allow or deny network flows to supported Azure resources at subnet or network-interface scope
3. Provide the network placement required by an Azure Bastion host
4. Write security rules around application roles instead of hard-coding individual IP addresses

Correct Answer: D

 

Correct Answer

Answer D is correct because Application security group (ASG) is a logical group of VM network interfaces that can be referenced in NSG rules. Its intended administrative use is to write security rules around application roles instead of hard-coding individual IP addresses.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Default NSG rules, which is used to supply default connectivity behavior while allowing higher-priority custom rules to override it; it is not the primary purpose of Application security group (ASG).

Answer B is incorrect because that outcome belongs to Network security group (NSG), which is used to allow or deny network flows to supported Azure resources at subnet or network-interface scope; it is not the primary purpose of Application security group (ASG).

Answer C is incorrect because that outcome belongs to AzureBastionSubnet, which is used to provide the network placement required by an Azure Bastion host; it is not the primary purpose of Application security group (ASG).

 

Question 17

To simplify NSG rules that must allow or deny traffic to an Azure service, which Azure configuration should be selected?

1. AzureBastionSubnet
2. Network access isolation with Private Link
3. Service tag
4. Application security group (ASG)

Correct Answer: C

 

Correct Answer

Answer C is correct because Service tag is a Microsoft-maintained label representing groups of Azure service IP prefixes for use in security rules. It directly supports the requirement to simplify NSG rules that must allow or deny traffic to an Azure service.

Incorrect Answers

Answer A is incorrect because AzureBastionSubnet is used to provide the network placement required by an Azure Bastion host; it does not provide the capability described in the scenario.

Answer B is incorrect because Network access isolation with Private Link is used to keep service traffic on private addressing and reduce exposure to the public network; it does not provide the capability described in the scenario.

Answer D is incorrect because Application security group (ASG) is used to write security rules around application roles instead of hard-coding individual IP addresses; it does not provide the capability described in the scenario.

 

Question 18

For Service tag, which administrative outcome is expected?

1. Apply security filtering to supported resources that use the protected subnet
2. Simplify NSG rules that must allow or deny traffic to an Azure service
3. Administer VMs securely while reducing direct internet exposure of management ports
4. Provide the network placement required by an Azure Bastion host

Correct Answer: B

 

Correct Answer

Answer B is correct because Service tag is a Microsoft-maintained label representing groups of Azure service IP prefixes for use in security rules. Its intended administrative use is to simplify NSG rules that must allow or deny traffic to an Azure service.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Subnet-level NSG, which is used to apply security filtering to supported resources that use the protected subnet; it is not the primary purpose of Service tag.

Answer C is incorrect because that outcome belongs to Azure Bastion, which is used to administer VMs securely while reducing direct internet exposure of management ports; it is not the primary purpose of Service tag.

Answer D is incorrect because that outcome belongs to AzureBastionSubnet, which is used to provide the network placement required by an Azure Bastion host; it is not the primary purpose of Service tag.

 

Question 19

To administer VMs securely while reducing direct internet exposure of management ports, which Azure configuration should be selected?

1. Private DNS integration
2. Effective security rules
3. Azure Bastion
4. NIC-level NSG

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Bastion is a managed service that provides RDP and SSH connectivity to virtual machines through the Azure portal or supported clients without requiring public IP addresses on the VMs. It directly supports the requirement to administer VMs securely while reducing direct internet exposure of management ports.

Incorrect Answers

Answer A is incorrect because Private DNS integration is used to ensure clients resolve a service name to the private endpoint rather than its public address; it does not provide the capability described in the scenario.

Answer B is incorrect because Effective security rules are used to troubleshoot the actual NSG filtering applied to a virtual machine interface; it does not provide the capability described in the scenario.

Answer D is incorrect because NIC-level NSG is used to apply security filtering specifically to traffic for that NIC; it does not provide the capability described in the scenario.

 

Question 20

For Azure Bastion, which administrative outcome is expected?

1. Administer VMs securely while reducing direct internet exposure of management ports
2. Provide the network placement required by an Azure Bastion host
3. Supply default connectivity behavior while allowing higher-priority custom rules to override it
4. Apply security filtering specifically to traffic for that NIC

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Bastion is a managed service that provides RDP and SSH connectivity to virtual machines through the Azure portal or supported clients without requiring public IP addresses on the VMs. Its intended administrative use is to administer VMs securely while reducing direct internet exposure of management ports.

Incorrect Answers

Answer B is incorrect because that outcome belongs to AzureBastionSubnet, which is used to provide the network placement required by an Azure Bastion host; it is not the primary purpose of Azure Bastion.

Answer C is incorrect because that outcome belongs to Default NSG rules, which is used to supply default connectivity behavior while allowing higher-priority custom rules to override it; it is not the primary purpose of Azure Bastion.

Answer D is incorrect because that outcome belongs to NIC-level NSG, which is used to apply security filtering specifically to traffic for that NIC; it is not the primary purpose of Azure Bastion.

 

Question 21

To provide the network placement required by an Azure Bastion host, which Azure configuration should be selected?

1. Private DNS integration
2. Service endpoint
3. Default NSG rules
4. AzureBastionSubnet

Correct Answer: D

 

Correct Answer

Answer D is correct because AzureBastionSubnet is the dedicated subnet name and subnet used to deploy Azure Bastion in a virtual network. It directly supports the requirement to provide the network placement required by an Azure Bastion host.

Incorrect Answers

Answer A is incorrect because Private DNS integration is used to ensure clients resolve a service name to the private endpoint rather than its public address; it does not provide the capability described in the scenario.

Answer B is incorrect because Service endpoint is used to restrict a PaaS service to selected VNets without creating a private IP for the service; it does not provide the capability described in the scenario.

Answer C is incorrect because Default NSG rules are used to supply default connectivity behavior while allowing higher-priority custom rules to override it; it does not provide the capability described in the scenario.

 

Question 22

For AzureBastionSubnet, which administrative outcome is expected?

1. Write security rules around application roles instead of hard-coding individual IP addresses
2. Simplify bidirectional communication for established allowed flows
3. Provide the network placement required by an Azure Bastion host
4. Keep service traffic on private addressing and reduce exposure to the public network

Correct Answer: C

 

Correct Answer

Answer C is correct because AzureBastionSubnet is the dedicated subnet name and subnet used to deploy Azure Bastion in a virtual network. Its intended administrative use is to provide the network placement required by an Azure Bastion host.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Application security group (ASG), which is used to write security rules around application roles instead of hard-coding individual IP addresses; it is not the primary purpose of AzureBastionSubnet.

Answer B is incorrect because that outcome belongs to Stateful NSG behavior, which is used to simplify bidirectional communication for established allowed flows; it is not the primary purpose of AzureBastionSubnet.

Answer D is incorrect because that outcome belongs to Network access isolation with Private Link, which is used to keep service traffic on private addressing and reduce exposure to the public network; it is not the primary purpose of AzureBastionSubnet.

 

Question 23

To restrict a PaaS service to selected VNets without creating a private IP for the service, which Azure configuration should be selected?

1. Service endpoint
2. Effective security rules
3. Azure Bastion
4. NIC-level NSG

Correct Answer: A

 

Correct Answer

Answer A is correct because Service endpoint is a VNet feature that extends subnet identity to supported Azure PaaS services while traffic still targets the service public endpoint. It directly supports the requirement to restrict a PaaS service to selected VNets without creating a private IP for the service.

Incorrect Answers

Answer B is incorrect because Effective security rules are used to troubleshoot the actual NSG filtering applied to a virtual machine interface; it does not provide the capability described in the scenario.

Answer C is incorrect because Azure Bastion is used to administer VMs securely while reducing direct internet exposure of management ports; it does not provide the capability described in the scenario.

Answer D is incorrect because NIC-level NSG is used to apply security filtering specifically to traffic for that NIC; it does not provide the capability described in the scenario.

 

Question 24

For Service endpoint, which administrative outcome is expected?

1. Ensure clients resolve a service name to the private endpoint rather than its public address
2. Restrict a PaaS service to selected VNets without creating a private IP for the service
3. Apply security filtering specifically to traffic for that NIC
4. Administer VMs securely while reducing direct internet exposure of management ports

Correct Answer: B

 

Correct Answer

Answer B is correct because Service endpoint is a VNet feature that extends subnet identity to supported Azure PaaS services while traffic still targets the service public endpoint. Its intended administrative use is to restrict a PaaS service to selected VNets without creating a private IP for the service.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Private DNS integration, which is used to ensure clients resolve a service name to the private endpoint rather than its public address; it is not the primary purpose of Service endpoint.

Answer C is incorrect because that outcome belongs to NIC-level NSG, which is used to apply security filtering specifically to traffic for that NIC; it is not the primary purpose of Service endpoint.

Answer D is incorrect because that outcome belongs to Azure Bastion, which is used to administer VMs securely while reducing direct internet exposure of management ports; it is not the primary purpose of Service endpoint.

 

Question 25

To access a supported PaaS resource through a private VNet address, which Azure configuration should be selected?

1. NSG rule priority
2. AzureBastionSubnet
3. Private endpoint
4. Stateful NSG behavior

Correct Answer: C

 

Correct Answer

Answer C is correct because Private endpoint is a network interface with a private IP in a VNet that connects privately to a specific Private Link resource. It directly supports the requirement to access a supported PaaS resource through a private VNet address.

Incorrect Answers

Answer A is incorrect because NSG rule priority is used to control which allow or deny rule wins when multiple NSG rules could match a flow; it does not provide the capability described in the scenario.

Answer B is incorrect because AzureBastionSubnet is used to provide the network placement required by an Azure Bastion host; it does not provide the capability described in the scenario.

Answer D is incorrect because Stateful NSG behavior is used to simplify bidirectional communication for established allowed flows; it does not provide the capability described in the scenario.

 

Question 26

For Private endpoint, which administrative outcome is expected?

1. Write security rules around application roles instead of hard-coding individual IP addresses
2. Access a supported PaaS resource through a private VNet address
3. Control which allow or deny rule wins when multiple NSG rules could match a flow
4. Apply security filtering to supported resources that use the protected subnet

Correct Answer: B

 

Correct Answer

Answer B is correct because Private endpoint is a network interface with a private IP in a VNet that connects privately to a specific Private Link resource. Its intended administrative use is to access a supported PaaS resource through a private VNet address.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Application security group (ASG), which is used to write security rules around application roles instead of hard-coding individual IP addresses; it is not the primary purpose of Private endpoint.

Answer C is incorrect because that outcome belongs to NSG rule priority, which is used to control which allow or deny rule wins when multiple NSG rules could match a flow; it is not the primary purpose of Private endpoint.

Answer D is incorrect because that outcome belongs to Subnet-level NSG, which is used to apply security filtering to supported resources that use the protected subnet; it is not the primary purpose of Private endpoint.

 

Question 27

To ensure clients resolve a service name to the private endpoint rather than its public address, which Azure configuration should be selected?

1. Service tag
2. Private DNS integration
3. NIC-level NSG
4. Effective security rules

Correct Answer: B

 

Correct Answer

Answer B is correct because Private DNS integration is DNS configuration that maps a Private Link service hostname to its private endpoint address for clients using the private path. It directly supports the requirement to ensure clients resolve a service name to the private endpoint rather than its public address.

Incorrect Answers

Answer A is incorrect because Service tag is used to simplify NSG rules that must allow or deny traffic to an Azure service; it does not provide the capability described in the scenario.

Answer C is incorrect because NIC-level NSG is used to apply security filtering specifically to traffic for that NIC; it does not provide the capability described in the scenario.

Answer D is incorrect because Effective security rules are used to troubleshoot the actual NSG filtering applied to a virtual machine interface; it does not provide the capability described in the scenario.

 

Question 28

For Private DNS integration, which administrative outcome is expected?

1. Supply default connectivity behavior while allowing higher-priority custom rules to override it
2. Apply security filtering to supported resources that use the protected subnet
3. Administer VMs securely while reducing direct internet exposure of management ports
4. Ensure clients resolve a service name to the private endpoint rather than its public address

Correct Answer: D

 

Correct Answer

Answer D is correct because Private DNS integration is DNS configuration that maps a Private Link service hostname to its private endpoint address for clients using the private path. Its intended administrative use is to ensure clients resolve a service name to the private endpoint rather than its public address.

Incorrect Answers

Answer A is incorrect because that outcome belongs to Default NSG rules, which is used to supply default connectivity behavior while allowing higher-priority custom rules to override it; it is not the primary purpose of Private DNS integration.

Answer B is incorrect because that outcome belongs to Subnet-level NSG, which is used to apply security filtering to supported resources that use the protected subnet; it is not the primary purpose of Private DNS integration.

Answer C is incorrect because that outcome belongs to Azure Bastion, which is used to administer VMs securely while reducing direct internet exposure of management ports; it is not the primary purpose of Private DNS integration.

 

Question 29

To keep service traffic on private addressing and reduce exposure to the public network, which Azure configuration should be selected?

1. Application security group (ASG)
2. Service endpoint
3. Network access isolation with Private Link
4. Effective security rules

Correct Answer: C

 

Correct Answer

Answer C is correct because Network access isolation with Private Link is the design choice of using private endpoints and disabling or restricting public access on a PaaS resource. It directly supports the requirement to keep service traffic on private addressing and reduce exposure to the public network.

Incorrect Answers

Answer A is incorrect because Application security group (ASG) is used to write security rules around application roles instead of hard-coding individual IP addresses; it does not provide the capability described in the scenario.

Answer B is incorrect because Service endpoint is used to restrict a PaaS service to selected VNets without creating a private IP for the service; it does not provide the capability described in the scenario.

Answer D is incorrect because Effective security rules are used to troubleshoot the actual NSG filtering applied to a virtual machine interface; it does not provide the capability described in the scenario.

 

Question 30

For Network access isolation with Private Link, which administrative outcome is expected?

1. Apply security filtering specifically to traffic for that NIC
2. Write security rules around application roles instead of hard-coding individual IP addresses
3. Restrict a PaaS service to selected VNets without creating a private IP for the service
4. Keep service traffic on private addressing and reduce exposure to the public network

Correct Answer: D

 

Correct Answer

Answer D is correct because Network access isolation with Private Link is the design choice of using private endpoints and disabling or restricting public access on a PaaS resource. Its intended administrative use is to keep service traffic on private addressing and reduce exposure to the public network.

Incorrect Answers

Answer A is incorrect because that outcome belongs to NIC-level NSG, which is used to apply security filtering specifically to traffic for that NIC; it is not the primary purpose of Network access isolation with Private Link.

Answer B is incorrect because that outcome belongs to Application security group (ASG), which is used to write security rules around application roles instead of hard-coding individual IP addresses; it is not the primary purpose of Network access isolation with Private Link.

Answer C is incorrect because that outcome belongs to Service endpoint, which is used to restrict a PaaS service to selected VNets without creating a private IP for the service; it is not the primary purpose of Network access isolation with Private Link.