Microsoft AZ-305 Network Security and Routing Design Practice Test

 

Topic 24 focuses on Network Performance, Security, Load Balancing, and Routing Design for the Microsoft Certified: Azure Solutions Architect Expert certification and the AZ-305 exam, using Microsoft Azure solution-architecture scenarios. For broader exam preparation, review the Microsoft Azure Solutions Architect Expert AZ-305 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

An organization wants to route clients among public endpoints at DNS resolution time. Which design choice most directly meets the requirement?

1. Azure Route Server
2. Azure DDoS Protection
3. Azure Traffic Manager
4. Azure Firewall

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Traffic Manager provides DNS-based global traffic distribution using performance, priority, weighted, geographic, and other routing methods. It directly meets the requirement to route clients among public endpoints at DNS resolution time.

Incorrect Answers

Answer A is incorrect because Azure Route Server is used to avoid manual route-table maintenance in dynamic NVA routing scenarios; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Azure DDoS Protection is used to reduce availability risk from volumetric network attacks; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Firewall is used to control and inspect network traffic across Azure networks with a managed firewall; that does not directly satisfy the requirement in this scenario.

 

Question 2

To improve VM network performance for latency-sensitive workloads, which Azure design option should be selected?

1. Accelerated Networking
2. Azure Front Door
3. Azure Application Gateway
4. Proximity placement group

Correct Answer: A

 

Correct Answer

Answer A is correct because Accelerated Networking is designed to improve VM network performance for latency-sensitive workloads. Accelerated Networking uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems.

Incorrect Answers

Answer B is incorrect because Azure Front Door can be useful in Azure architectures, but its primary role is to optimize and protect globally distributed web applications at the edge; it is not the best match for the stated priority.

Answer C is incorrect because Azure Application Gateway can be useful in Azure architectures, but its primary role is to route web traffic based on HTTP characteristics within or across application tiers; it is not the best match for the stated priority.

Answer D is incorrect because Proximity placement group can be useful in Azure architectures, but its primary role is to reduce network latency among tightly coupled compute resources; it is not the best match for the stated priority.

 

Question 3

When considering Azure Firewall, which requirement supports that choice?

1. To control and inspect network traffic across Azure networks with a managed firewall.
2. To apply distributed network access controls close to Azure workloads.
3. To improve VM network performance for latency-sensitive workloads.
4. To steer subnet traffic through firewalls, virtual appliances, or custom paths.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Firewall is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Network security group (NSG), not Azure Firewall.

Answer C is incorrect because that outcome is more directly associated with Accelerated Networking, not Azure Firewall.

Answer D is incorrect because that outcome is more directly associated with User-defined route (UDR), not Azure Firewall.

 

Question 4

When considering Azure DDoS Protection, which requirement supports that choice?

1. To reduce availability risk from volumetric network attacks.
2. To steer subnet traffic through firewalls, virtual appliances, or custom paths.
3. To improve VM network performance for latency-sensitive workloads.
4. To distribute network-layer traffic across healthy backend instances in a region.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure DDoS Protection provides enhanced distributed denial-of-service detection and mitigation for protected virtual networks and public IP resources.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with User-defined route (UDR), not Azure DDoS Protection.

Answer C is incorrect because that outcome is more directly associated with Accelerated Networking, not Azure DDoS Protection.

Answer D is incorrect because that outcome is more directly associated with Azure Load Balancer, not Azure DDoS Protection.

 

Question 5

To reduce availability risk from volumetric network attacks, which Azure design option should be selected?

1. Accelerated Networking
2. User-defined route (UDR)
3. Azure DDoS Protection
4. Azure Load Balancer

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure DDoS Protection is designed to reduce availability risk from volumetric network attacks. Azure DDoS Protection provides enhanced distributed denial-of-service detection and mitigation for protected virtual networks and public IP resources.

Incorrect Answers

Answer A is incorrect because Accelerated Networking can be useful in Azure architectures, but its primary role is to improve VM network performance for latency-sensitive workloads; it is not the best match for the stated priority.

Answer B is incorrect because User-defined route (UDR) can be useful in Azure architectures, but its primary role is to steer subnet traffic through firewalls, virtual appliances, or custom paths; it is not the best match for the stated priority.

Answer D is incorrect because Azure Load Balancer can be useful in Azure architectures, but its primary role is to distribute network-layer traffic across healthy backend instances in a region; it is not the best match for the stated priority.

 

Question 6

An architect compares priority, weighted, and geographic routing for a public application. Which statement describes the Traffic Manager capability relevant to this choice?

1. Provides enhanced distributed denial-of-service detection and mitigation for protected virtual networks and public IP resources.
2. Provides DNS-based global traffic distribution using performance, priority, weighted, geographic, and other routing methods.
3. Is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options.
4. Uses BGP to exchange routes dynamically between Azure virtual networks and supported network virtual appliances.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Traffic Manager provides DNS-based global traffic distribution using performance, priority, weighted, geographic, and other routing methods.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure DDoS Protection, whose purpose is to reduce availability risk from volumetric network attacks.

Answer C is incorrect because that description belongs to Azure Firewall, whose purpose is to control and inspect network traffic across Azure networks with a managed firewall.

Answer D is incorrect because that description belongs to Azure Route Server, whose purpose is to avoid manual route-table maintenance in dynamic NVA routing scenarios.

 

Question 7

When considering Accelerated Networking, which requirement supports that choice?

1. To route web traffic based on HTTP characteristics within or across application tiers.
2. To improve VM network performance for latency-sensitive workloads.
3. To optimize and protect globally distributed web applications at the edge.
4. To reduce network latency among tightly coupled compute resources.

Correct Answer: B

 

Correct Answer

Answer B is correct because Accelerated Networking uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure Application Gateway, not Accelerated Networking.

Answer C is incorrect because that outcome is more directly associated with Azure Front Door, not Accelerated Networking.

Answer D is incorrect because that outcome is more directly associated with Proximity placement group, not Accelerated Networking.

 

Question 8

A supported VM workload needs lower network latency and reduced networking overhead. Which interface capability should the architect evaluate?

1. Accelerated Networking
2. Proximity placement group
3. Azure Front Door
4. Azure Application Gateway

Correct Answer: A

 

Correct Answer

Answer A is correct because Accelerated Networking uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems. It directly meets the requirement to improve VM network performance for latency-sensitive workloads.

Incorrect Answers

Answer B is incorrect because Proximity placement group is used to reduce network latency among tightly coupled compute resources; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Azure Front Door is used to optimize and protect globally distributed web applications at the edge; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Application Gateway is used to route web traffic based on HTTP characteristics within or across application tiers; that does not directly satisfy the requirement in this scenario.

 

Question 9

Which Azure capability filters HTTP and HTTPS traffic using managed and custom rules to help block common web attacks?

1. Azure Front Door
2. Azure Firewall
3. Web Application Firewall (WAF)
4. Azure DDoS Protection

Correct Answer: C

 

Correct Answer

Answer C is correct because Web Application Firewall (WAF) matches the described capability and is intended to protect internet-facing web applications from application-layer attacks.

Incorrect Answers

Answer A is incorrect because Azure Front Door is intended to optimize and protect globally distributed web applications at the edge, which is a different architectural function.

Answer B is incorrect because Azure Firewall is intended to control and inspect network traffic across Azure networks with a managed firewall, which is a different architectural function.

Answer D is incorrect because Azure DDoS Protection is intended to reduce availability risk from volumetric network attacks, which is a different architectural function.

 

Question 10

When considering Azure Load Balancer, which requirement supports that choice?

1. To control and inspect network traffic across Azure networks with a managed firewall.
2. To optimize and protect globally distributed web applications at the edge.
3. To route web traffic based on HTTP characteristics within or across application tiers.
4. To distribute network-layer traffic across healthy backend instances in a region.

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Load Balancer provides regional Layer 4 TCP and UDP load balancing for supported public or internal workloads.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure Firewall, not Azure Load Balancer.

Answer B is incorrect because that outcome is more directly associated with Azure Front Door, not Azure Load Balancer.

Answer C is incorrect because that outcome is more directly associated with Azure Application Gateway, not Azure Load Balancer.

 

Question 11

Which Azure capability provides regional Layer 7 HTTP and HTTPS load balancing with path-based routing, TLS termination, and optional WAF?

1. Network security group (NSG)
2. Azure Application Gateway
3. Azure Traffic Manager
4. Web Application Firewall (WAF)

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Application Gateway matches the described capability and is intended to route web traffic based on HTTP characteristics within or across application tiers.

Incorrect Answers

Answer A is incorrect because Network security group (NSG) is intended to apply distributed network access controls close to Azure workloads, which is a different architectural function.

Answer C is incorrect because Azure Traffic Manager is intended to route clients among public endpoints at DNS resolution time, which is a different architectural function.

Answer D is incorrect because Web Application Firewall (WAF) is intended to protect internet-facing web applications from application-layer attacks, which is a different architectural function.

 

Question 12

Which Azure capability uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems?

1. Proximity placement group
2. Azure Front Door
3. Azure Application Gateway
4. Accelerated Networking

Correct Answer: D

 

Correct Answer

Answer D is correct because Accelerated Networking matches the described capability and is intended to improve VM network performance for latency-sensitive workloads.

Incorrect Answers

Answer A is incorrect because Proximity placement group is intended to reduce network latency among tightly coupled compute resources, which is a different architectural function.

Answer B is incorrect because Azure Front Door is intended to optimize and protect globally distributed web applications at the edge, which is a different architectural function.

Answer C is incorrect because Azure Application Gateway is intended to route web traffic based on HTTP characteristics within or across application tiers, which is a different architectural function.

 

Question 13

An Azure architect needs to route web traffic based on HTTP characteristics within or across application tiers. Which Azure service or capability is the best fit?

1. Web Application Firewall (WAF)
2. Network security group (NSG)
3. Azure Application Gateway
4. Azure Traffic Manager

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Application Gateway provides regional Layer 7 HTTP and HTTPS load balancing with path-based routing, TLS termination, and optional WAF. It directly meets the requirement to route web traffic based on HTTP characteristics within or across application tiers.

Incorrect Answers

Answer A is incorrect because Web Application Firewall (WAF) is used to protect internet-facing web applications from application-layer attacks; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Network security group (NSG) is used to apply distributed network access controls close to Azure workloads; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Traffic Manager is used to route clients among public endpoints at DNS resolution time; that does not directly satisfy the requirement in this scenario.

 

Question 14

To distribute network-layer traffic across healthy backend instances in a region, which Azure design option should be selected?

1. Azure Front Door
2. Azure Application Gateway
3. Azure Firewall
4. Azure Load Balancer

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Load Balancer is designed to distribute network-layer traffic across healthy backend instances in a region. Azure Load Balancer provides regional Layer 4 TCP and UDP load balancing for supported public or internal workloads.

Incorrect Answers

Answer A is incorrect because Azure Front Door can be useful in Azure architectures, but its primary role is to optimize and protect globally distributed web applications at the edge; it is not the best match for the stated priority.

Answer B is incorrect because Azure Application Gateway can be useful in Azure architectures, but its primary role is to route web traffic based on HTTP characteristics within or across application tiers; it is not the best match for the stated priority.

Answer C is incorrect because Azure Firewall can be useful in Azure architectures, but its primary role is to control and inspect network traffic across Azure networks with a managed firewall; it is not the best match for the stated priority.

 

Question 15

Which Azure capability provides regional Layer 4 TCP and UDP load balancing for supported public or internal workloads?

1. Azure Firewall
2. Azure Application Gateway
3. Azure Front Door
4. Azure Load Balancer

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Load Balancer matches the described capability and is intended to distribute network-layer traffic across healthy backend instances in a region.

Incorrect Answers

Answer A is incorrect because Azure Firewall is intended to control and inspect network traffic across Azure networks with a managed firewall, which is a different architectural function.

Answer B is incorrect because Azure Application Gateway is intended to route web traffic based on HTTP characteristics within or across application tiers, which is a different architectural function.

Answer C is incorrect because Azure Front Door is intended to optimize and protect globally distributed web applications at the edge, which is a different architectural function.

 

Question 16

For Azure Firewall, which statement is accurate?

1. Is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options.
2. Uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems.
3. Overrides selected Azure system routes by specifying custom next hops in a route table.
4. Filters inbound and outbound traffic at subnet or network-interface scope using stateful Layer 3 and Layer 4 rules.

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Firewall is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options.

Incorrect Answers

Answer B is incorrect because that description belongs to Accelerated Networking, whose purpose is to improve VM network performance for latency-sensitive workloads.

Answer C is incorrect because that description belongs to User-defined route (UDR), whose purpose is to steer subnet traffic through firewalls, virtual appliances, or custom paths.

Answer D is incorrect because that description belongs to Network security group (NSG), whose purpose is to apply distributed network access controls close to Azure workloads.

 

Question 17

A solution architect needs to apply distributed network access controls close to Azure workloads. Which Azure service or capability is the best fit?

1. Proximity placement group
2. Azure Route Server
3. Network security group (NSG)
4. Azure DDoS Protection

Correct Answer: C

 

Correct Answer

Answer C is correct because Network security group (NSG) filters inbound and outbound traffic at subnet or network-interface scope using stateful Layer 3 and Layer 4 rules. It directly meets the requirement to apply distributed network access controls close to Azure workloads.

Incorrect Answers

Answer A is incorrect because Proximity placement group is used to reduce network latency among tightly coupled compute resources; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Azure Route Server is used to avoid manual route-table maintenance in dynamic NVA routing scenarios; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure DDoS Protection is used to reduce availability risk from volumetric network attacks; that does not directly satisfy the requirement in this scenario.

 

Question 18

When considering Network security group (NSG), which requirement supports that choice?

1. To reduce network latency among tightly coupled compute resources.
2. To reduce availability risk from volumetric network attacks.
3. To apply distributed network access controls close to Azure workloads.
4. To avoid manual route-table maintenance in dynamic NVA routing scenarios.

Correct Answer: C

 

Correct Answer

Answer C is correct because Network security group (NSG) filters inbound and outbound traffic at subnet or network-interface scope using stateful Layer 3 and Layer 4 rules.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Proximity placement group, not Network security group (NSG).

Answer B is incorrect because that outcome is more directly associated with Azure DDoS Protection, not Network security group (NSG).

Answer D is incorrect because that outcome is more directly associated with Azure Route Server, not Network security group (NSG).

 

Question 19

To control and inspect network traffic across Azure networks with a managed firewall, which Azure design option should be selected?

1. Azure Firewall
2. User-defined route (UDR)
3. Accelerated Networking
4. Network security group (NSG)

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Firewall is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options. It directly meets the requirement to control and inspect network traffic across Azure networks with a managed firewall.

Incorrect Answers

Answer B is incorrect because User-defined route (UDR) is used to steer subnet traffic through firewalls, virtual appliances, or custom paths; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Accelerated Networking is used to improve VM network performance for latency-sensitive workloads; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Network security group (NSG) is used to apply distributed network access controls close to Azure workloads; that does not directly satisfy the requirement in this scenario.

 

Question 20

To avoid manual route-table maintenance in dynamic NVA routing scenarios, which Azure design option should be selected?

1. Azure Load Balancer
2. Accelerated Networking
3. Web Application Firewall (WAF)
4. Azure Route Server

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Route Server is designed to avoid manual route-table maintenance in dynamic NVA routing scenarios. Azure Route Server uses BGP to exchange routes dynamically between Azure virtual networks and supported network virtual appliances.

Incorrect Answers

Answer A is incorrect because Azure Load Balancer can be useful in Azure architectures, but its primary role is to distribute network-layer traffic across healthy backend instances in a region; it is not the best match for the stated priority.

Answer B is incorrect because Accelerated Networking can be useful in Azure architectures, but its primary role is to improve VM network performance for latency-sensitive workloads; it is not the best match for the stated priority.

Answer C is incorrect because Web Application Firewall (WAF) can be useful in Azure architectures, but its primary role is to protect internet-facing web applications from application-layer attacks; it is not the best match for the stated priority.

 

Question 21

To optimize and protect globally distributed web applications at the edge, which Azure design option should be selected?

1. Network security group (NSG)
2. Azure Traffic Manager
3. User-defined route (UDR)
4. Azure Front Door

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Front Door is designed to optimize and protect globally distributed web applications at the edge. Azure Front Door provides global anycast Layer 7 routing, acceleration, health-based failover, CDN capabilities, and optional WAF.

Incorrect Answers

Answer A is incorrect because Network security group (NSG) can be useful in Azure architectures, but its primary role is to apply distributed network access controls close to Azure workloads; it is not the best match for the stated priority.

Answer B is incorrect because Azure Traffic Manager can be useful in Azure architectures, but its primary role is to route clients among public endpoints at DNS resolution time; it is not the best match for the stated priority.

Answer C is incorrect because User-defined route (UDR) can be useful in Azure architectures, but its primary role is to steer subnet traffic through firewalls, virtual appliances, or custom paths; it is not the best match for the stated priority.

 

Question 22

Which Azure capability provides enhanced distributed denial-of-service detection and mitigation for protected virtual networks and public IP resources?

1. Azure DDoS Protection
2. Azure Load Balancer
3. Accelerated Networking
4. User-defined route (UDR)

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure DDoS Protection matches the described capability and is intended to reduce availability risk from volumetric network attacks.

Incorrect Answers

Answer B is incorrect because Azure Load Balancer is intended to distribute network-layer traffic across healthy backend instances in a region, which is a different architectural function.

Answer C is incorrect because Accelerated Networking is intended to improve VM network performance for latency-sensitive workloads, which is a different architectural function.

Answer D is incorrect because User-defined route (UDR) is intended to steer subnet traffic through firewalls, virtual appliances, or custom paths, which is a different architectural function.

 

Question 23

Which Azure capability overrides selected Azure system routes by specifying custom next hops in a route table?

1. Proximity placement group
2. Azure Route Server
3. Azure Application Gateway
4. User-defined route (UDR)

Correct Answer: D

 

Correct Answer

Answer D is correct because User-defined route (UDR) matches the described capability and is intended to steer subnet traffic through firewalls, virtual appliances, or custom paths.

Incorrect Answers

Answer A is incorrect because Proximity placement group is intended to reduce network latency among tightly coupled compute resources, which is a different architectural function.

Answer B is incorrect because Azure Route Server is intended to avoid manual route-table maintenance in dynamic NVA routing scenarios, which is a different architectural function.

Answer C is incorrect because Azure Application Gateway is intended to route web traffic based on HTTP characteristics within or across application tiers, which is a different architectural function.

 

Question 24

For Accelerated Networking, which statement is accurate?

1. Provides regional Layer 7 HTTP and HTTPS load balancing with path-based routing, TLS termination, and optional WAF.
2. Uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems.
3. Places supported compute resources near one another in an Azure datacenter.
4. Provides global anycast Layer 7 routing, acceleration, health-based failover, CDN capabilities, and optional WAF.

Correct Answer: B

 

Correct Answer

Answer B is correct because Accelerated Networking uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure Application Gateway, whose purpose is to route web traffic based on HTTP characteristics within or across application tiers.

Answer C is incorrect because that description belongs to Proximity placement group, whose purpose is to reduce network latency among tightly coupled compute resources.

Answer D is incorrect because that description belongs to Azure Front Door, whose purpose is to optimize and protect globally distributed web applications at the edge.

 

Question 25

When considering Azure Application Gateway, which requirement supports that choice?

1. To protect internet-facing web applications from application-layer attacks.
2. To route clients among public endpoints at DNS resolution time.
3. To route web traffic based on HTTP characteristics within or across application tiers.
4. To apply distributed network access controls close to Azure workloads.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Application Gateway provides regional Layer 7 HTTP and HTTPS load balancing with path-based routing, TLS termination, and optional WAF.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Web Application Firewall (WAF), not Azure Application Gateway.

Answer B is incorrect because that outcome is more directly associated with Azure Traffic Manager, not Azure Application Gateway.

Answer D is incorrect because that outcome is more directly associated with Network security group (NSG), not Azure Application Gateway.

 

Question 26

A public web application needs global Layer 7 routing with health-based failover and optional edge web-application protection. Which statement describes Azure Front Door’s role in this design?

1. Overrides selected Azure system routes by specifying custom next hops in a route table.
2. Provides global anycast Layer 7 routing, acceleration, health-based failover, CDN capabilities, and optional WAF.
3. Provides DNS-based global traffic distribution using performance, priority, weighted, geographic, and other routing methods.
4. Filters inbound and outbound traffic at subnet or network-interface scope using stateful Layer 3 and Layer 4 rules.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Front Door provides global anycast Layer 7 routing, acceleration, health-based failover, CDN capabilities, and optional WAF.

Incorrect Answers

Answer A is incorrect because that description belongs to User-defined route (UDR), whose purpose is to steer subnet traffic through firewalls, virtual appliances, or custom paths.

Answer C is incorrect because that description belongs to Azure Traffic Manager, whose purpose is to route clients among public endpoints at DNS resolution time.

Answer D is incorrect because that description belongs to Network security group (NSG), whose purpose is to apply distributed network access controls close to Azure workloads.

 

Question 27

For Azure DDoS Protection, which statement is accurate?

1. Provides regional Layer 4 TCP and UDP load balancing for supported public or internal workloads.
2. Uses SR-IOV to reduce latency, jitter, and CPU overhead for supported VM sizes and operating systems.
3. Provides enhanced distributed denial-of-service detection and mitigation for protected virtual networks and public IP resources.
4. Overrides selected Azure system routes by specifying custom next hops in a route table.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure DDoS Protection provides enhanced distributed denial-of-service detection and mitigation for protected virtual networks and public IP resources.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure Load Balancer, whose purpose is to distribute network-layer traffic across healthy backend instances in a region.

Answer B is incorrect because that description belongs to Accelerated Networking, whose purpose is to improve VM network performance for latency-sensitive workloads.

Answer D is incorrect because that description belongs to User-defined route (UDR), whose purpose is to steer subnet traffic through firewalls, virtual appliances, or custom paths.

 

Question 28

A network design selects a public application endpoint while resolving its DNS name. Which requirement fits Azure Traffic Manager at this stage?

1. To avoid manual route-table maintenance in dynamic NVA routing scenarios.
2. To reduce availability risk from volumetric network attacks.
3. To route clients among public endpoints at DNS resolution time.
4. To control and inspect network traffic across Azure networks with a managed firewall.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Traffic Manager provides DNS-based global traffic distribution using performance, priority, weighted, geographic, and other routing methods.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure Route Server, not Azure Traffic Manager.

Answer B is incorrect because that outcome is more directly associated with Azure DDoS Protection, not Azure Traffic Manager.

Answer D is incorrect because that outcome is more directly associated with Azure Firewall, not Azure Traffic Manager.

 

Question 29

An Azure architect needs to reduce network latency among tightly coupled compute resources. Which Azure service or capability is the best fit?

1. Proximity placement group
2. Web Application Firewall (WAF)
3. Azure Traffic Manager
4. Azure Load Balancer

Correct Answer: A

 

Correct Answer

Answer A is correct because Proximity placement group places supported compute resources near one another in an Azure datacenter. It directly meets the requirement to reduce network latency among tightly coupled compute resources.

Incorrect Answers

Answer B is incorrect because Web Application Firewall (WAF) is used to protect internet-facing web applications from application-layer attacks; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Azure Traffic Manager is used to route clients among public endpoints at DNS resolution time; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Load Balancer is used to distribute network-layer traffic across healthy backend instances in a region; that does not directly satisfy the requirement in this scenario.

 

Question 30

Which Azure capability is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options?

1. Azure Firewall
2. Network security group (NSG)
3. User-defined route (UDR)
4. Accelerated Networking

Correct Answer: A

 

Correct Answer

Answer A is correct because Azure Firewall matches the described capability and is intended to control and inspect network traffic across Azure networks with a managed firewall.

Incorrect Answers

Answer B is incorrect because Network security group (NSG) is intended to apply distributed network access controls close to Azure workloads, which is a different architectural function.

Answer C is incorrect because User-defined route (UDR) is intended to steer subnet traffic through firewalls, virtual appliances, or custom paths, which is a different architectural function.

Answer D is incorrect because Accelerated Networking is intended to improve VM network performance for latency-sensitive workloads, which is a different architectural function.

 

Question 31

For Network security group (NSG), which statement is accurate?

1. Filters inbound and outbound traffic at subnet or network-interface scope using stateful Layer 3 and Layer 4 rules.
2. Places supported compute resources near one another in an Azure datacenter.
3. Provides enhanced distributed denial-of-service detection and mitigation for protected virtual networks and public IP resources.
4. Uses BGP to exchange routes dynamically between Azure virtual networks and supported network virtual appliances.

Correct Answer: A

 

Correct Answer

Answer A is correct because Network security group (NSG) filters inbound and outbound traffic at subnet or network-interface scope using stateful Layer 3 and Layer 4 rules.

Incorrect Answers

Answer B is incorrect because that description belongs to Proximity placement group, whose purpose is to reduce network latency among tightly coupled compute resources.

Answer C is incorrect because that description belongs to Azure DDoS Protection, whose purpose is to reduce availability risk from volumetric network attacks.

Answer D is incorrect because that description belongs to Azure Route Server, whose purpose is to avoid manual route-table maintenance in dynamic NVA routing scenarios.

 

Question 32

Which Azure capability places supported compute resources near one another in an Azure datacenter?

1. Azure Traffic Manager
2. Web Application Firewall (WAF)
3. Azure Load Balancer
4. Proximity placement group

Correct Answer: D

 

Correct Answer

Answer D is correct because Proximity placement group matches the described capability and is intended to reduce network latency among tightly coupled compute resources.

Incorrect Answers

Answer A is incorrect because Azure Traffic Manager is intended to route clients among public endpoints at DNS resolution time, which is a different architectural function.

Answer B is incorrect because Web Application Firewall (WAF) is intended to protect internet-facing web applications from application-layer attacks, which is a different architectural function.

Answer C is incorrect because Azure Load Balancer is intended to distribute network-layer traffic across healthy backend instances in a region, which is a different architectural function.

 

Question 33

Which Azure capability filters inbound and outbound traffic at subnet or network-interface scope using stateful Layer 3 and Layer 4 rules?

1. Proximity placement group
2. Network security group (NSG)
3. Azure Route Server
4. Azure DDoS Protection

Correct Answer: B

 

Correct Answer

Answer B is correct because Network security group (NSG) matches the described capability and is intended to apply distributed network access controls close to Azure workloads.

Incorrect Answers

Answer A is incorrect because Proximity placement group is intended to reduce network latency among tightly coupled compute resources, which is a different architectural function.

Answer C is incorrect because Azure Route Server is intended to avoid manual route-table maintenance in dynamic NVA routing scenarios, which is a different architectural function.

Answer D is incorrect because Azure DDoS Protection is intended to reduce availability risk from volumetric network attacks, which is a different architectural function.

 

Question 34

For Azure Load Balancer, which statement is accurate?

1. Provides global anycast Layer 7 routing, acceleration, health-based failover, CDN capabilities, and optional WAF.
2. Provides regional Layer 4 TCP and UDP load balancing for supported public or internal workloads.
3. Is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options.
4. Provides regional Layer 7 HTTP and HTTPS load balancing with path-based routing, TLS termination, and optional WAF.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Load Balancer provides regional Layer 4 TCP and UDP load balancing for supported public or internal workloads.

Incorrect Answers

Answer A is incorrect because that description belongs to Azure Front Door, whose purpose is to optimize and protect globally distributed web applications at the edge.

Answer C is incorrect because that description belongs to Azure Firewall, whose purpose is to control and inspect network traffic across Azure networks with a managed firewall.

Answer D is incorrect because that description belongs to Azure Application Gateway, whose purpose is to route web traffic based on HTTP characteristics within or across application tiers.

 

Question 35

An organization needs a managed network firewall to inspect and control traffic between Azure networks. Which Azure security service fits this role?

1. Accelerated Networking
2. Azure Firewall
3. User-defined route (UDR)
4. Network security group (NSG)

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Firewall is designed to control and inspect network traffic across Azure networks with a managed firewall. Azure Firewall is a managed stateful network security service with application and network rules, threat intelligence, and centralized policy options.

Incorrect Answers

Answer A is incorrect because Accelerated Networking can be useful in Azure architectures, but its primary role is to improve VM network performance for latency-sensitive workloads; it is not the best match for the stated priority.

Answer C is incorrect because User-defined route (UDR) can be useful in Azure architectures, but its primary role is to steer subnet traffic through firewalls, virtual appliances, or custom paths; it is not the best match for the stated priority.

Answer D is incorrect because Network security group (NSG) can be useful in Azure architectures, but its primary role is to apply distributed network access controls close to Azure workloads; it is not the best match for the stated priority.

 

Question 36

To route clients among public endpoints at DNS resolution time, which Azure design option should be selected?

1. Azure Route Server
2. Azure Firewall
3. Azure Traffic Manager
4. Azure DDoS Protection

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Traffic Manager is designed to route clients among public endpoints at DNS resolution time. Azure Traffic Manager provides DNS-based global traffic distribution using performance, priority, weighted, geographic, and other routing methods.

Incorrect Answers

Answer A is incorrect because Azure Route Server can be useful in Azure architectures, but its primary role is to avoid manual route-table maintenance in dynamic NVA routing scenarios; it is not the best match for the stated priority.

Answer B is incorrect because Azure Firewall can be useful in Azure architectures, but its primary role is to control and inspect network traffic across Azure networks with a managed firewall; it is not the best match for the stated priority.

Answer D is incorrect because Azure DDoS Protection can be useful in Azure architectures, but its primary role is to reduce availability risk from volumetric network attacks; it is not the best match for the stated priority.

 

Question 37

When considering User-defined route (UDR), which requirement supports that choice?

1. To avoid manual route-table maintenance in dynamic NVA routing scenarios.
2. To route web traffic based on HTTP characteristics within or across application tiers.
3. To reduce network latency among tightly coupled compute resources.
4. To steer subnet traffic through firewalls, virtual appliances, or custom paths.

Correct Answer: D

 

Correct Answer

Answer D is correct because User-defined route (UDR) overrides selected Azure system routes by specifying custom next hops in a route table.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Azure Route Server, not User-defined route (UDR).

Answer B is incorrect because that outcome is more directly associated with Azure Application Gateway, not User-defined route (UDR).

Answer C is incorrect because that outcome is more directly associated with Proximity placement group, not User-defined route (UDR).

 

Question 38

When considering Azure Route Server, which requirement supports that choice?

1. To protect internet-facing web applications from application-layer attacks.
2. To distribute network-layer traffic across healthy backend instances in a region.
3. To improve VM network performance for latency-sensitive workloads.
4. To avoid manual route-table maintenance in dynamic NVA routing scenarios.

Correct Answer: D

 

Correct Answer

Answer D is correct because Azure Route Server uses BGP to exchange routes dynamically between Azure virtual networks and supported network virtual appliances.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Web Application Firewall (WAF), not Azure Route Server.

Answer B is incorrect because that outcome is more directly associated with Azure Load Balancer, not Azure Route Server.

Answer C is incorrect because that outcome is more directly associated with Accelerated Networking, not Azure Route Server.

 

Question 39

When considering Azure Front Door, which requirement supports that choice?

1. To apply distributed network access controls close to Azure workloads.
2. To optimize and protect globally distributed web applications at the edge.
3. To route clients among public endpoints at DNS resolution time.
4. To steer subnet traffic through firewalls, virtual appliances, or custom paths.

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Front Door provides global anycast Layer 7 routing, acceleration, health-based failover, CDN capabilities, and optional WAF.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Network security group (NSG), not Azure Front Door.

Answer C is incorrect because that outcome is more directly associated with Azure Traffic Manager, not Azure Front Door.

Answer D is incorrect because that outcome is more directly associated with User-defined route (UDR), not Azure Front Door.

 

Question 40

To protect internet-facing web applications from application-layer attacks, which Azure design option should be selected?

1. Azure Front Door
2. Web Application Firewall (WAF)
3. Azure Firewall
4. Azure DDoS Protection

Correct Answer: B

 

Correct Answer

Answer B is correct because Web Application Firewall (WAF) is designed to protect internet-facing web applications from application-layer attacks. Web Application Firewall (WAF) filters HTTP and HTTPS traffic using managed and custom rules to help block common web attacks.

Incorrect Answers

Answer A is incorrect because Azure Front Door can be useful in Azure architectures, but its primary role is to optimize and protect globally distributed web applications at the edge; it is not the best match for the stated priority.

Answer C is incorrect because Azure Firewall can be useful in Azure architectures, but its primary role is to control and inspect network traffic across Azure networks with a managed firewall; it is not the best match for the stated priority.

Answer D is incorrect because Azure DDoS Protection can be useful in Azure architectures, but its primary role is to reduce availability risk from volumetric network attacks; it is not the best match for the stated priority.