Microsoft AZ-305 Azure Network Connectivity Practice Test

 

Topic 23 focuses on Azure Network Connectivity to the Internet and On-Premises Networks for the Microsoft Certified: Azure Solutions Architect Expert certification and the AZ-305 exam, using Microsoft Azure solution-architecture scenarios. For broader exam preparation, review the Microsoft Azure Solutions Architect Expert AZ-305 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which Azure capability centralizes shared services and connectivity in a hub while isolating workload networks in spokes?

1. Hub-and-spoke topology
2. ExpressRoute Global Reach
3. Azure public IP address
4. Azure VPN Gateway

Correct Answer: A

 

Correct Answer

Answer A is correct because Hub-and-spoke topology matches the described capability and is intended to scale network governance and shared connectivity across many application networks.

Incorrect Answers

Answer B is incorrect because ExpressRoute Global Reach is intended to use ExpressRoute connectivity to provide private site-to-site WAN transit, which is a different architectural function.

Answer C is incorrect because Azure public IP address is intended to make a supported Azure service directly reachable from the internet when required, which is a different architectural function.

Answer D is incorrect because Azure VPN Gateway is intended to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate, which is a different architectural function.

 

Question 2

To make a supported Azure service directly reachable from the internet when required, which Azure design option should be selected?

1. Virtual network peering
2. Azure ExpressRoute
3. Azure public IP address
4. Azure NAT Gateway

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure public IP address is designed to make a supported Azure service directly reachable from the internet when required. Azure public IP address provides a public IPv4 or IPv6 endpoint that can be associated with supported Azure resources.

Incorrect Answers

Answer A is incorrect because Virtual network peering can be useful in Azure architectures, but its primary role is to connect Azure VNets without deploying a gateway between them; it is not the best match for the stated priority.

Answer B is incorrect because Azure ExpressRoute can be useful in Azure architectures, but its primary role is to connect enterprise networks to Azure without traversing the public internet; it is not the best match for the stated priority.

Answer D is incorrect because Azure NAT Gateway can be useful in Azure architectures, but its primary role is to give private resources reliable outbound internet access without individual public IPs; it is not the best match for the stated priority.

 

Question 3

For Azure Virtual WAN, which statement is accurate?

1. Exposes supported Azure services through private endpoints with private IP addresses in a virtual network.
2. Provides a managed global transit network for branch, VPN, ExpressRoute, and VNet connectivity.
3. Centralizes shared services and connectivity in a hub while isolating workload networks in spokes.
4. Hosts private DNS zones that resolve names within linked virtual networks and hybrid environments with appropriate DNS integration.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Virtual WAN provides a managed global transit network for branch, VPN, ExpressRoute, and VNet connectivity.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure Private Link, whose purpose is to access platform services privately without using their public endpoints.

Answer C is incorrect because that description belongs to Hub-and-spoke topology, whose purpose is to scale network governance and shared connectivity across many application networks.

Answer D is incorrect because that description belongs to Azure Private DNS, whose purpose is to provide internal name resolution for private endpoints and private Azure services.

 

Question 4

To provide internal name resolution for private endpoints and private Azure services, which Azure design option should be selected?

1. Azure DNS Private Resolver
2. Azure Private DNS
3. Azure VPN Gateway
4. Azure public IP address

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Private DNS hosts private DNS zones that resolve names within linked virtual networks and hybrid environments with appropriate DNS integration. It directly meets the requirement to provide internal name resolution for private endpoints and private Azure services.

Incorrect Answers

Answer A is incorrect because Azure DNS Private Resolver is used to integrate hybrid DNS without deploying custom DNS forwarder virtual machines; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Azure VPN Gateway is used to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure public IP address is used to make a supported Azure service directly reachable from the internet when required; that does not directly satisfy the requirement in this scenario.

 

Question 5

For Azure DNS Private Resolver, which statement is accurate?

1. Provides scalable managed outbound internet connectivity with predictable public IP addresses for subnets.
2. Centralizes shared services and connectivity in a hub while isolating workload networks in spokes.
3. Provides managed inbound and outbound DNS endpoints for recursive name resolution between Azure and on-premises environments.
4. Provides private connectivity between on-premises networks and Microsoft cloud services through a connectivity provider.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure DNS Private Resolver provides managed inbound and outbound DNS endpoints for recursive name resolution between Azure and on-premises environments.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure NAT Gateway, whose purpose is to give private resources reliable outbound internet access without individual public IPs.

Answer B is incorrect because that description belongs to Hub-and-spoke topology, whose purpose is to scale network governance and shared connectivity across many application networks.

Answer D is incorrect because that description belongs to Azure ExpressRoute, whose purpose is to connect enterprise networks to Azure without traversing the public internet.

 

Question 6

For Hub-and-spoke topology, which statement is accurate?

1. Centralizes shared services and connectivity in a hub while isolating workload networks in spokes.
2. Provides a public IPv4 or IPv6 endpoint that can be associated with supported Azure resources.
3. Connects on-premises sites through Microsoft global network by linking ExpressRoute circuits.
4. Provides encrypted site-to-site, point-to-site, or VNet-to-VNet connectivity over the public internet.

Correct Answer: A

 

Correct Answer

Answer A is correct because Hub-and-spoke topology centralizes shared services and connectivity in a hub while isolating workload networks in spokes.

Incorrect Answers

Answer B is incorrect because that description belongs to Azure public IP address, whose purpose is to make a supported Azure service directly reachable from the internet when required.

Answer C is incorrect because that description belongs to ExpressRoute Global Reach, whose purpose is to use ExpressRoute connectivity to provide private site-to-site WAN transit.

Answer D is incorrect because that description belongs to Azure VPN Gateway, whose purpose is to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate.

 

Question 7

When considering Azure Private Link, which requirement supports that choice?

1. To integrate hybrid DNS without deploying custom DNS forwarder virtual machines.
2. To provide private IP connectivity to a specific platform service instance.
3. To make a supported Azure service directly reachable from the internet when required.
4. To access platform services privately without using their public endpoints.

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Private Link exposes supported Azure services through private endpoints with private IP addresses in a virtual network.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure DNS Private Resolver, not Azure Private Link.

Answer B is incorrect because that outcome is more directly associated with Private endpoint, not Azure Private Link.

Answer C is incorrect because that outcome is more directly associated with Azure public IP address, not Azure Private Link.

 

Question 8

An organization wants to make a supported Azure service directly reachable from the internet when required. Which design choice most directly meets the requirement?

1. Azure ExpressRoute
2. Virtual network peering
3. Azure public IP address
4. Azure NAT Gateway

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure public IP address provides a public IPv4 or IPv6 endpoint that can be associated with supported Azure resources. It directly meets the requirement to make a supported Azure service directly reachable from the internet when required.

Incorrect Answers

Answer A is incorrect because Azure ExpressRoute is used to connect enterprise networks to Azure without traversing the public internet; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Virtual network peering is used to connect Azure VNets without deploying a gateway between them; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure NAT Gateway is used to give private resources reliable outbound internet access without individual public IPs; that does not directly satisfy the requirement in this scenario.

 

Question 9

Which Azure capability connects on-premises sites through Microsoft global network by linking ExpressRoute circuits?

1. Azure Private Link
2. Virtual network peering
3. Azure Private DNS
4. ExpressRoute Global Reach

Correct Answer: D

 

Correct Answer

Answer D is correct because ExpressRoute Global Reach matches the described capability and is intended to use ExpressRoute connectivity to provide private site-to-site WAN transit.

Incorrect Answers

Answer A is incorrect because Azure Private Link is intended to access platform services privately without using their public endpoints, which is a different architectural function.

Answer B is incorrect because Virtual network peering is intended to connect Azure VNets without deploying a gateway between them, which is a different architectural function.

Answer C is incorrect because Azure Private DNS is intended to provide internal name resolution for private endpoints and private Azure services, which is a different architectural function.

 

Question 10

A branch office and remote administrators need encrypted connectivity to Azure over the public internet. Which requirement best explains why an architect would choose Azure VPN Gateway?

1. To access platform services privately without using their public endpoints.
2. To connect enterprise networks to Azure without traversing the public internet.
3. To connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate.
4. To connect Azure VNets without deploying a gateway between them.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure VPN Gateway provides encrypted site-to-site, point-to-site, or VNet-to-VNet connectivity over the public internet.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure Private Link, not Azure VPN Gateway.

Answer B is incorrect because that outcome is more directly associated with Azure ExpressRoute, not Azure VPN Gateway.

Answer D is incorrect because that outcome is more directly associated with Virtual network peering, not Azure VPN Gateway.

 

Question 11

Which Azure capability provides encrypted site-to-site, point-to-site, or VNet-to-VNet connectivity over the public internet?

1. Azure Private Link
2. Azure ExpressRoute
3. Azure VPN Gateway
4. Virtual network peering

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure VPN Gateway matches the described capability and is intended to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate.

Incorrect Answers

Answer A is incorrect because Azure Private Link is intended to access platform services privately without using their public endpoints, which is a different architectural function.

Answer B is incorrect because Azure ExpressRoute is intended to connect enterprise networks to Azure without traversing the public internet, which is a different architectural function.

Answer D is incorrect because Virtual network peering is intended to connect Azure VNets without deploying a gateway between them, which is a different architectural function.

 

Question 12

For Azure NAT Gateway, which statement is accurate?

1. Provides encrypted site-to-site, point-to-site, or VNet-to-VNet connectivity over the public internet.
2. Provides a managed global transit network for branch, VPN, ExpressRoute, and VNet connectivity.
3. Provides scalable managed outbound internet connectivity with predictable public IP addresses for subnets.
4. Connects on-premises sites through Microsoft global network by linking ExpressRoute circuits.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure NAT Gateway provides scalable managed outbound internet connectivity with predictable public IP addresses for subnets.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure VPN Gateway, whose purpose is to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate.

Answer B is incorrect because that description belongs to Azure Virtual WAN, whose purpose is to simplify large-scale hub-and-spoke and branch connectivity across regions.

Answer D is incorrect because that description belongs to ExpressRoute Global Reach, whose purpose is to use ExpressRoute connectivity to provide private site-to-site WAN transit.

 

Question 13

When considering Virtual network peering, which requirement supports that choice?

1. To provide private IP connectivity to a specific platform service instance.
2. To connect Azure VNets without deploying a gateway between them.
3. To simplify large-scale hub-and-spoke and branch connectivity across regions.
4. To integrate hybrid DNS without deploying custom DNS forwarder virtual machines.

Correct Answer: B

 

Correct Answer

Answer B is correct because Virtual network peering connects Azure virtual networks privately over the Microsoft backbone with low-latency routing.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Private endpoint, not Virtual network peering.

Answer C is incorrect because that outcome is more directly associated with Azure Virtual WAN, not Virtual network peering.

Answer D is incorrect because that outcome is more directly associated with Azure DNS Private Resolver, not Virtual network peering.

 

Question 14

When considering Hub-and-spoke topology, which requirement supports that choice?

1. To use ExpressRoute connectivity to provide private site-to-site WAN transit.
2. To scale network governance and shared connectivity across many application networks.
3. To connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate.
4. To make a supported Azure service directly reachable from the internet when required.

Correct Answer: B

 

Correct Answer

Answer B is correct because Hub-and-spoke topology centralizes shared services and connectivity in a hub while isolating workload networks in spokes.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with ExpressRoute Global Reach, not Hub-and-spoke topology.

Answer C is incorrect because that outcome is more directly associated with Azure VPN Gateway, not Hub-and-spoke topology.

Answer D is incorrect because that outcome is more directly associated with Azure public IP address, not Hub-and-spoke topology.

 

Question 15

To give private resources reliable outbound internet access without individual public IPs, which Azure design option should be selected?

1. Azure NAT Gateway
2. Azure VPN Gateway
3. ExpressRoute Global Reach
4. Azure Virtual WAN

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure NAT Gateway provides scalable managed outbound internet connectivity with predictable public IP addresses for subnets. It directly meets the requirement to give private resources reliable outbound internet access without individual public IPs.

Incorrect Answers

Answer B is incorrect because Azure VPN Gateway is used to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because ExpressRoute Global Reach is used to use ExpressRoute connectivity to provide private site-to-site WAN transit; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Virtual WAN is used to simplify large-scale hub-and-spoke and branch connectivity across regions; that does not directly satisfy the requirement in this scenario.

 

Question 16

For Private endpoint, which statement is accurate?

1. Provides scalable managed outbound internet connectivity with predictable public IP addresses for subnets.
2. Is a network interface with a private IP in a VNet that maps to a supported Private Link service.
3. Hosts private DNS zones that resolve names within linked virtual networks and hybrid environments with appropriate DNS integration.
4. Centralizes shared services and connectivity in a hub while isolating workload networks in spokes.

Correct Answer: B

 

Correct Answer

Answer B is correct because Private endpoint is a network interface with a private IP in a VNet that maps to a supported Private Link service.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure NAT Gateway, whose purpose is to give private resources reliable outbound internet access without individual public IPs.

Answer C is incorrect because that description belongs to Azure Private DNS, whose purpose is to provide internal name resolution for private endpoints and private Azure services.

Answer D is incorrect because that description belongs to Hub-and-spoke topology, whose purpose is to scale network governance and shared connectivity across many application networks.

 

Question 17

To scale network governance and shared connectivity across many application networks, which Azure design option should be selected?

1. ExpressRoute Global Reach
2. Azure public IP address
3. Hub-and-spoke topology
4. Azure VPN Gateway

Correct Answer: C

 

Correct Answer

Answer C is correct because Hub-and-spoke topology centralizes shared services and connectivity in a hub while isolating workload networks in spokes. It directly meets the requirement to scale network governance and shared connectivity across many application networks.

Incorrect Answers

Answer A is incorrect because ExpressRoute Global Reach is used to use ExpressRoute connectivity to provide private site-to-site WAN transit; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Azure public IP address is used to make a supported Azure service directly reachable from the internet when required; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure VPN Gateway is used to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate; that does not directly satisfy the requirement in this scenario.

 

Question 18

To use ExpressRoute connectivity to provide private site-to-site WAN transit, which Azure design option should be selected?

1. Virtual network peering
2. Azure Private Link
3. Azure Private DNS
4. ExpressRoute Global Reach

Correct Answer: D

 

Correct Answer

Answer D is correct because ExpressRoute Global Reach is designed to use ExpressRoute connectivity to provide private site-to-site WAN transit. ExpressRoute Global Reach connects on-premises sites through Microsoft global network by linking ExpressRoute circuits.

Incorrect Answers

Answer A is incorrect because Virtual network peering can be useful in Azure architectures, but its primary role is to connect Azure VNets without deploying a gateway between them; it is not the best match for the stated priority.

Answer B is incorrect because Azure Private Link can be useful in Azure architectures, but its primary role is to access platform services privately without using their public endpoints; it is not the best match for the stated priority.

Answer C is incorrect because Azure Private DNS can be useful in Azure architectures, but its primary role is to provide internal name resolution for private endpoints and private Azure services; it is not the best match for the stated priority.

 

Question 19

To access platform services privately without using their public endpoints, which Azure design option should be selected?

1. Azure Private Link
2. Azure public IP address
3. Private endpoint
4. Azure DNS Private Resolver

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Private Link is designed to access platform services privately without using their public endpoints. Azure Private Link exposes supported Azure services through private endpoints with private IP addresses in a virtual network.

Incorrect Answers

Answer B is incorrect because Azure public IP address can be useful in Azure architectures, but its primary role is to make a supported Azure service directly reachable from the internet when required; it is not the best match for the stated priority.

Answer C is incorrect because Private endpoint can be useful in Azure architectures, but its primary role is to provide private IP connectivity to a specific platform service instance; it is not the best match for the stated priority.

Answer D is incorrect because Azure DNS Private Resolver can be useful in Azure architectures, but its primary role is to integrate hybrid DNS without deploying custom DNS forwarder virtual machines; it is not the best match for the stated priority.

 

Question 20

Which Azure capability provides managed inbound and outbound DNS endpoints for recursive name resolution between Azure and on-premises environments?

1. Azure DNS Private Resolver
2. Azure NAT Gateway
3. Hub-and-spoke topology
4. Azure ExpressRoute

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure DNS Private Resolver matches the described capability and is intended to integrate hybrid DNS without deploying custom DNS forwarder virtual machines.

Incorrect Answers

Answer B is incorrect because Azure NAT Gateway is intended to give private resources reliable outbound internet access without individual public IPs, which is a different architectural function.

Answer C is incorrect because Hub-and-spoke topology is intended to scale network governance and shared connectivity across many application networks, which is a different architectural function.

Answer D is incorrect because Azure ExpressRoute is intended to connect enterprise networks to Azure without traversing the public internet, which is a different architectural function.

 

Question 21

To simplify large-scale hub-and-spoke and branch connectivity across regions, which Azure design option should be selected?

1. Hub-and-spoke topology
2. Azure Private Link
3. Azure Private DNS
4. Azure Virtual WAN

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Virtual WAN is designed to simplify large-scale hub-and-spoke and branch connectivity across regions. Azure Virtual WAN provides a managed global transit network for branch, VPN, ExpressRoute, and VNet connectivity.

Incorrect Answers

Answer A is incorrect because Hub-and-spoke topology can be useful in Azure architectures, but its primary role is to scale network governance and shared connectivity across many application networks; it is not the best match for the stated priority.

Answer B is incorrect because Azure Private Link can be useful in Azure architectures, but its primary role is to access platform services privately without using their public endpoints; it is not the best match for the stated priority.

Answer C is incorrect because Azure Private DNS can be useful in Azure architectures, but its primary role is to provide internal name resolution for private endpoints and private Azure services; it is not the best match for the stated priority.

 

Question 22

Many application networks need shared connectivity and common network governance through a central network. Which topology should the architect choose?

1. Azure public IP address
2. Hub-and-spoke topology
3. ExpressRoute Global Reach
4. Azure VPN Gateway

Correct Answer: B

 

Correct Answer

Answer B is correct because Hub-and-spoke topology is designed to scale network governance and shared connectivity across many application networks. Hub-and-spoke topology centralizes shared services and connectivity in a hub while isolating workload networks in spokes.

Incorrect Answers

Answer A is incorrect because Azure public IP address can be useful in Azure architectures, but its primary role is to make a supported Azure service directly reachable from the internet when required; it is not the best match for the stated priority.

Answer C is incorrect because ExpressRoute Global Reach can be useful in Azure architectures, but its primary role is to use ExpressRoute connectivity to provide private site-to-site WAN transit; it is not the best match for the stated priority.

Answer D is incorrect because Azure VPN Gateway can be useful in Azure architectures, but its primary role is to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate; it is not the best match for the stated priority.

 

Question 23

To connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate, which Azure design option should be selected?

1. Azure Private Link
2. Azure ExpressRoute
3. Azure VPN Gateway
4. Virtual network peering

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure VPN Gateway is designed to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate. Azure VPN Gateway provides encrypted site-to-site, point-to-site, or VNet-to-VNet connectivity over the public internet.

Incorrect Answers

Answer A is incorrect because Azure Private Link can be useful in Azure architectures, but its primary role is to access platform services privately without using their public endpoints; it is not the best match for the stated priority.

Answer B is incorrect because Azure ExpressRoute can be useful in Azure architectures, but its primary role is to connect enterprise networks to Azure without traversing the public internet; it is not the best match for the stated priority.

Answer D is incorrect because Virtual network peering can be useful in Azure architectures, but its primary role is to connect Azure VNets without deploying a gateway between them; it is not the best match for the stated priority.

 

Question 24

When considering ExpressRoute Global Reach, which requirement supports that choice?

1. To connect Azure VNets without deploying a gateway between them.
2. To access platform services privately without using their public endpoints.
3. To provide internal name resolution for private endpoints and private Azure services.
4. To use ExpressRoute connectivity to provide private site-to-site WAN transit.

Correct Answer: D

 

Correct Answer

Answer D is correct because ExpressRoute Global Reach connects on-premises sites through Microsoft global network by linking ExpressRoute circuits.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Virtual network peering, not ExpressRoute Global Reach.

Answer B is incorrect because that outcome is more directly associated with Azure Private Link, not ExpressRoute Global Reach.

Answer C is incorrect because that outcome is more directly associated with Azure Private DNS, not ExpressRoute Global Reach.

 

Question 25

An organization wants to integrate hybrid DNS without deploying custom DNS forwarder virtual machines. Which design choice most directly meets the requirement?

1. Azure DNS Private Resolver
2. Azure NAT Gateway
3. Hub-and-spoke topology
4. Azure ExpressRoute

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure DNS Private Resolver provides managed inbound and outbound DNS endpoints for recursive name resolution between Azure and on-premises environments. It directly meets the requirement to integrate hybrid DNS without deploying custom DNS forwarder virtual machines.

Incorrect Answers

Answer B is incorrect because Azure NAT Gateway is used to give private resources reliable outbound internet access without individual public IPs; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Hub-and-spoke topology is used to scale network governance and shared connectivity across many application networks; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure ExpressRoute is used to connect enterprise networks to Azure without traversing the public internet; that does not directly satisfy the requirement in this scenario.

 

Question 26

Two on-premises sites already use ExpressRoute and need private site-to-site connectivity through supported ExpressRoute connections. Which capability addresses this requirement?

1. Azure Private DNS
2. Virtual network peering
3. Azure Private Link
4. ExpressRoute Global Reach

Correct Answer: D

 

Correct Answer

Answer D is correct because ExpressRoute Global Reach connects on-premises sites through Microsoft global network by linking ExpressRoute circuits. It directly meets the requirement to use ExpressRoute connectivity to provide private site-to-site WAN transit.

Incorrect Answers

Answer A is incorrect because Azure Private DNS is used to provide internal name resolution for private endpoints and private Azure services; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Virtual network peering is used to connect Azure VNets without deploying a gateway between them; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Azure Private Link is used to access platform services privately without using their public endpoints; that does not directly satisfy the requirement in this scenario.

 

Question 27

For Virtual network peering, which statement is accurate?

1. Provides managed inbound and outbound DNS endpoints for recursive name resolution between Azure and on-premises environments.
2. Is a network interface with a private IP in a VNet that maps to a supported Private Link service.
3. Connects Azure virtual networks privately over the Microsoft backbone with low-latency routing.
4. Provides a managed global transit network for branch, VPN, ExpressRoute, and VNet connectivity.

Correct Answer: C

 

Correct Answer

Answer C is correct because Virtual network peering connects Azure virtual networks privately over the Microsoft backbone with low-latency routing.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure DNS Private Resolver, whose purpose is to integrate hybrid DNS without deploying custom DNS forwarder virtual machines.

Answer B is incorrect because that description belongs to Private endpoint, whose purpose is to provide private IP connectivity to a specific platform service instance.

Answer D is incorrect because that description belongs to Azure Virtual WAN, whose purpose is to simplify large-scale hub-and-spoke and branch connectivity across regions.

 

Question 28

To connect enterprise networks to Azure without traversing the public internet, which Azure design option should be selected?

1. Azure Virtual WAN
2. Private endpoint
3. ExpressRoute Global Reach
4. Azure ExpressRoute

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure ExpressRoute provides private connectivity between on-premises networks and Microsoft cloud services through a connectivity provider. It directly meets the requirement to connect enterprise networks to Azure without traversing the public internet.

Incorrect Answers

Answer A is incorrect because Azure Virtual WAN is used to simplify large-scale hub-and-spoke and branch connectivity across regions; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Private endpoint is used to provide private IP connectivity to a specific platform service instance; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because ExpressRoute Global Reach is used to use ExpressRoute connectivity to provide private site-to-site WAN transit; that does not directly satisfy the requirement in this scenario.

 

Question 29

A Private Link design needs a private IP address in a VNet for one particular platform service instance. Which requirement is met by creating the private endpoint?

1. To provide internal name resolution for private endpoints and private Azure services.
2. To provide private IP connectivity to a specific platform service instance.
3. To scale network governance and shared connectivity across many application networks.
4. To give private resources reliable outbound internet access without individual public IPs.

Correct Answer: B

 

Correct Answer

Answer B is correct because Private endpoint is a network interface with a private IP in a VNet that maps to a supported Private Link service.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure Private DNS, not Private endpoint.

Answer C is incorrect because that outcome is more directly associated with Hub-and-spoke topology, not Private endpoint.

Answer D is incorrect because that outcome is more directly associated with Azure NAT Gateway, not Private endpoint.

 

Question 30

Applications must resolve private endpoint names to internal addresses through private DNS zones. Which Azure DNS service supports this namespace?

1. Azure Private DNS
2. Azure public IP address
3. Azure DNS Private Resolver
4. Azure VPN Gateway

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Private DNS is designed to provide internal name resolution for private endpoints and private Azure services. Azure Private DNS hosts private DNS zones that resolve names within linked virtual networks and hybrid environments with appropriate DNS integration.

Incorrect Answers

Answer B is incorrect because Azure public IP address can be useful in Azure architectures, but its primary role is to make a supported Azure service directly reachable from the internet when required; it is not the best match for the stated priority.

Answer C is incorrect because Azure DNS Private Resolver can be useful in Azure architectures, but its primary role is to integrate hybrid DNS without deploying custom DNS forwarder virtual machines; it is not the best match for the stated priority.

Answer D is incorrect because Azure VPN Gateway can be useful in Azure architectures, but its primary role is to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate; it is not the best match for the stated priority.

 

Question 31

An organization wants to connect Azure VNets without deploying a gateway between them. Which design choice most directly meets the requirement?

1. Azure Virtual WAN
2. Virtual network peering
3. Private endpoint
4. Azure DNS Private Resolver

Correct Answer: B

 

Correct Answer

Answer B is correct because Virtual network peering connects Azure virtual networks privately over the Microsoft backbone with low-latency routing. It directly meets the requirement to connect Azure VNets without deploying a gateway between them.

Incorrect Answers

Answer A is incorrect because Azure Virtual WAN is used to simplify large-scale hub-and-spoke and branch connectivity across regions; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Private endpoint is used to provide private IP connectivity to a specific platform service instance; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure DNS Private Resolver is used to integrate hybrid DNS without deploying custom DNS forwarder virtual machines; that does not directly satisfy the requirement in this scenario.

 

Question 32

To provide private IP connectivity to a specific platform service instance, which Azure design option should be selected?

1. Azure NAT Gateway
2. Azure Private DNS
3. Hub-and-spoke topology
4. Private endpoint

Correct Answer: D

 

Correct Answer

Answer D is correct because Private endpoint is designed to provide private IP connectivity to a specific platform service instance. Private endpoint is a network interface with a private IP in a VNet that maps to a supported Private Link service.

Incorrect Answers

Answer A is incorrect because Azure NAT Gateway can be useful in Azure architectures, but its primary role is to give private resources reliable outbound internet access without individual public IPs; it is not the best match for the stated priority.

Answer B is incorrect because Azure Private DNS can be useful in Azure architectures, but its primary role is to provide internal name resolution for private endpoints and private Azure services; it is not the best match for the stated priority.

Answer C is incorrect because Hub-and-spoke topology can be useful in Azure architectures, but its primary role is to scale network governance and shared connectivity across many application networks; it is not the best match for the stated priority.

 

Question 33

Which Azure capability hosts private DNS zones that resolve names within linked virtual networks and hybrid environments with appropriate DNS integration?

1. Azure DNS Private Resolver
2. Azure Private DNS
3. Azure VPN Gateway
4. Azure public IP address

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Private DNS matches the described capability and is intended to provide internal name resolution for private endpoints and private Azure services.

Incorrect Answers

Answer A is incorrect because Azure DNS Private Resolver is intended to integrate hybrid DNS without deploying custom DNS forwarder virtual machines, which is a different architectural function.

Answer C is incorrect because Azure VPN Gateway is intended to connect Azure networks to remote users or sites when encrypted internet-based connectivity is appropriate, which is a different architectural function.

Answer D is incorrect because Azure public IP address is intended to make a supported Azure service directly reachable from the internet when required, which is a different architectural function.

 

Question 34

For Azure ExpressRoute, which statement is accurate?

1. Provides private connectivity between on-premises networks and Microsoft cloud services through a connectivity provider.
2. Provides a managed global transit network for branch, VPN, ExpressRoute, and VNet connectivity.
3. Is a network interface with a private IP in a VNet that maps to a supported Private Link service.
4. Connects on-premises sites through Microsoft global network by linking ExpressRoute circuits.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure ExpressRoute provides private connectivity between on-premises networks and Microsoft cloud services through a connectivity provider.

Incorrect Answers

Answer B is incorrect because that description belongs to Azure Virtual WAN, whose purpose is to simplify large-scale hub-and-spoke and branch connectivity across regions.

Answer C is incorrect because that description belongs to Private endpoint, whose purpose is to provide private IP connectivity to a specific platform service instance.

Answer D is incorrect because that description belongs to ExpressRoute Global Reach, whose purpose is to use ExpressRoute connectivity to provide private site-to-site WAN transit.

 

Question 35

To integrate hybrid DNS without deploying custom DNS forwarder virtual machines, which Azure design option should be selected?

1. Azure DNS Private Resolver
2. Azure NAT Gateway
3. Azure ExpressRoute
4. Hub-and-spoke topology

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure DNS Private Resolver is designed to integrate hybrid DNS without deploying custom DNS forwarder virtual machines. Azure DNS Private Resolver provides managed inbound and outbound DNS endpoints for recursive name resolution between Azure and on-premises environments.

Incorrect Answers

Answer B is incorrect because Azure NAT Gateway can be useful in Azure architectures, but its primary role is to give private resources reliable outbound internet access without individual public IPs; it is not the best match for the stated priority.

Answer C is incorrect because Azure ExpressRoute can be useful in Azure architectures, but its primary role is to connect enterprise networks to Azure without traversing the public internet; it is not the best match for the stated priority.

Answer D is incorrect because Hub-and-spoke topology can be useful in Azure architectures, but its primary role is to scale network governance and shared connectivity across many application networks; it is not the best match for the stated priority.