You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You plan to deploy Azure virtual machines and Azure Bastion to VNet1. You need to recommend an IP subnetting configuration for VNet1. The solution must maximize the number of IP addresses that can be assigned to the virtual machines What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Question 77
You have an Azure subscription that contains the resources is shown in the following table. You need to ensure that the apps hosted on VM1 can resolve the IP address of the What should you create first?
Correct Answer: B
Question 78
Your company, named Contoso, Ltd, has an Azure subscription that contains the resources show in the following table. You plan to deploy Azure Front Door. The solution must meet the following requirement: * Requests to a URL of https://contoso.azurefd.net/uk must be routed to App1uk. * Requests to a URL of https://contoso.azurefd.net/us must be routed to App1us. * Requests to a URL of https://contoso.azurefd.net/images must be routed to the storage account closest to the user. What is the minimum number of backend pools and routing rules you should create? To answer, the appropriate number to the correct component. Each number may be used once, more than once, or not at all. You may need to drag the spilt bar between panes scroll to view content: Note: Each correct selection is worth one point.
Correct Answer:
Question 79
You have an Azure subscription that contains the resources shown in the following table. You create a virtual network named Vnet2 in the West US region. You plan to enable peering between Vnet1 and Vnet2. You need to ensure that the virtual machines connected to Vnet2 can connect to VM1 and VM2 via LB1. What should you do?
Correct Answer: A
Question 80
Task 7 You need to ensure that hosts on VNET2 can access hosts on both VNET1 and VNET3. The solution must prevent hosts on VNET1 and VNET3 from communicating through VNET2.
Correct Answer:
See the Explanation below for step by step instructions. Explanation Here are the steps and explanations for ensuring that hosts on VNET2 can access hosts on both VNET1 and VNET3, but hosts on VNET1 and VNET3 cannot communicate through VNET2: * To connect different virtual networks in Azure, you need to use virtual network peering. Virtual network peering allows you to create low-latency, high-bandwidth connections between virtual networks without using gateways or the internet1. * To create a virtual network peering, you need to go to the Azure portal and select your virtual network. Then select Peerings under Settings and select + Add2. * On the Add peering page, enter or select the following information: * Name: Type a unique name for the peering from the source virtual network to the destination virtual network. * Virtual network deployment model: Select Resource manager. * Subscription: Select the subscription that contains the destination virtual network. * Virtual network: Select the destination virtual network from the list or enter its resource ID. * Name of the peering from [destination virtual network] to [source virtual network]: Type a unique name for the peering from the destination virtual network to the source virtual network. * Configure virtual network access settings: Select Enabled to allow resources in both virtual networks to communicate with each other. * Allow forwarded traffic: Select Disabled to prevent traffic that originates from outside either of the peered virtual networks from being forwarded through either of them. * Allow gateway transit: Select Disabled to prevent either of the peered virtual networks from using a gateway in the other virtual network. * Use remote gateways: Select Disabled to prevent either of the peered virtual networks from using a gateway in the other virtual network as a transit point to another network. * Select Add to create the peering2. * Repeat the previous steps to create peerings between VNET2 and VNET1, and between VNET2 and VNET3. This will allow hosts on VNET2 to access hosts on both VNET1 and VNET3. * To prevent hosts on VNET1 and VNET3 from communicating through VNET2, you need to use network security groups (NSGs) to filter traffic between subnets. NSGs are rules that allow or deny inbound or outbound traffic based on source or destination IP address, port, or protocol3. * To create an NSG, you need to go to the Azure portal and select Create a resource. Search for network security group and select Network security group. Then select Create4. * On the Create a network security group page, enter or select the following information: * Subscription: Select your subscription name. * Resource group: Select your resource group name. * Name: Type a unique name for your NSG. * Region: Select the same region as your virtual networks. * Select Review + create and then select Create to create your NSG4. * To add rules to your NSG, you need to go to the Network security groups service in the Azure portal and select your NSG. Then select Inbound security rules or Outbound security rules under Settings and select + Add4. * On the Add inbound security rule page or Add outbound security rule page, enter or select the following information: * Source or Destination: Select CIDR block. * Source CIDR blocks or Destination CIDR blocks: Enter the IP address range of the source or destination subnet that you want to filter. For example, 10.0.1.0/24 for VNET1 subnet 1, 10.0.2.0/24 for VNET2 subnet 1, and 10.0.3.0/24 for VNET3 subnet 1. * Protocol: Select Any to apply the rule to any protocol. * Action: Select Deny to block traffic from or to the source or destination subnet. * Priority: Enter a number between 100 and 4096 that indicates the order of evaluation for this rule. Lower numbers have higher priority than higher numbers. * Name: Type a unique name for your rule. * Select Add to create your rule4. * Repeat the previous steps to create inbound and outbound rules for your NSG that deny traffic between VNET1 and VNET3 subnets. For example, you can create an inbound rule that denies traffic from 10.0.1.0/24 (VNET1 subnet 1) to 10.0.3.0/24 (VNET3 subnet 1), and an outbound rule that denies traffic * from 10.0.3.0/24 (VNET3 subnet 1) to 10.0.1.0/24 (VNET1 subnet 1). * To associate your NSG with a subnet, you need to go to the Virtual networks service in the Azure portal and select your virtual network. Then select Subnets under Settings and select the subnet that you want to associate with your NSG5. * On the Edit subnet page, under Network security group, select your NSG from the drop-down list. Then select Save5. * Repeat the previous steps to associate your NSG with the subnets in VNET1 and VNET3 that you want to isolate from each other.
