Implement and manage virtual networking

Your company runs a three-tier application in a single virtual network. The web tier has 8 VMs and the app tier has 6 VMs, and their IP addresses change frequently due to autoscaling. You must configure an NSG so that only the web-tier VMs can initiate connections to the app-tier VMs on port 8080, without hardcoding IP addresses and without creating a separate NSG rule per VM. What should you do?

Your company hosts several Windows VMs in a virtual network. Security policy prohibits assigning public IP addresses to any VM and forbids opening inbound RDP (port 3389) from the internet on NSGs. Administrators still need secure RDP access to these VMs directly from the Azure portal. Which solution meets these requirements with the least administrative effort?

Your company has an on-premises DNS server and an Azure VNet named VNet1. You deploy several Azure VMs into VNet1 that must resolve records hosted in an Azure Private DNS zone named corp.contoso.internal. On-premises servers must also be able to resolve names in this private zone. The Private DNS zone is already linked to VNet1. Which solution enables on-premises servers to resolve records in the Azure Private DNS zone?

Your company runs several virtual machines in a VNet named VNet-Prod. You create an Azure private DNS zone named contoso.internal to allow the VMs to resolve each other by hostname. After creating the zone, you notice that no DNS records for the existing VMs appear in the zone, and the VMs cannot resolve each other's names. What must you do to enable automatic creation of DNS records for VMs in VNet-Prod?

Your company owns the domain contoso.com registered with a third-party domain registrar. You create a public DNS zone named contoso.com in Azure DNS and add several A and CNAME records. However, when external clients query these records, they do not resolve to the values you configured in Azure DNS. What must you do to make Azure DNS authoritative for the domain?

You deploy Azure Bastion into a VNet named VNet1 in the East US region. You need to use this Bastion host to connect to a virtual machine named VM2 that resides in a separate VNet named VNet2 in the same region. VM2 has no public IP address. What must you configure to allow the Bastion host in VNet1 to connect to VM2?

Your company runs a three-tier application in the East US region. The middle tier consists of five VMs spread across three availability zones. You need to distribute internal traffic from the web tier to the middle-tier VMs so that the load balancer itself remains available even if an entire availability zone fails. Which load balancer configuration should you deploy?

You manage a public Standard Azure Load Balancer that distributes HTTP traffic across three VMs in a backend pool. The application stores user session state in memory on each VM rather than in a shared cache. Users report that they are frequently logged out and must re-authenticate during a single browsing session. You need to ensure that requests from the same client are consistently routed to the same backend VM while making the minimal configuration change. What should you configure on the load balancing rule?

A web server VM named VM1 resides in subnet Web-Subnet. An NSG named NSG-Subnet is associated with the subnet, and a separate NSG named NSG-NIC is associated with VM1's network interface. Users report that inbound HTTPS (TCP 443) connections to VM1 are failing. NSG-NIC contains a custom inbound rule (priority 100) that allows TCP 443 from any source. NSG-Subnet contains a custom inbound rule (priority 200) that denies TCP 443 from any source, plus a rule (priority 300) allowing TCP 443. Which action will restore inbound HTTPS connectivity to VM1 with the least administrative effort?

Your company hosts a set of application VMs in a subnet named Subnet-App within a virtual network. Security policy requires that these VMs be able to communicate with other resources inside the same virtual network but must be completely blocked from initiating any outbound connections to the public internet. You want to enforce this using an NSG applied to Subnet-App with the minimum number of custom rules. Which approach should you use?

A network security group named NSG-Web is attached to the subnet hosting several web servers. You add two inbound security rules: Rule 'Allow-HTTP' with priority 200 that permits TCP port 80 from any source, and Rule 'Deny-Internet' with priority 300 that denies all traffic from the Internet service tag. Internet clients report they can still reach the web servers over HTTP. What is the reason for this behavior?

Your company deploys an Azure Storage account and creates a private endpoint for its blob service inside a virtual network named VNet1. On-premises and Azure VMs connected to VNet1 must connect to the storage account using its private IP address instead of its public endpoint. After creating the private endpoint, VMs in VNet1 still resolve the storage account FQDN to its public IP address. What should you configure to ensure the FQDN resolves to the private IP?

Your company runs an Azure SQL Database that must be accessed by application servers in an on-premises datacenter connected to Azure via ExpressRoute. Security requires that traffic to the database never traverse the public internet and that the database be reachable using a private IP address from the on-premises network. Which solution should you implement?

You manage a subnet containing 30 virtual machines that have no public IP addresses. The VMs must initiate outbound connections to a third-party SaaS API on the internet, and the provider requires that all requests originate from a single, predictable public IP address. You need a solution that provides reliable, scalable outbound connectivity without exposing the VMs to inbound internet traffic. What should you configure?

Your company runs a VM in Azure that uses a Basic SKU public IP address for inbound access. You need to place this VM behind a Standard SKU public Azure Load Balancer for zone-redundant, highly available access. During configuration, the Standard Load Balancer rejects the association of the existing public IP. What must you do to resolve this issue?

You are deploying a public-facing web application in the East US region. You provision a Standard SKU public Azure Load Balancer that must survive a single datacenter failure by being zone-redundant. You need to create a public IP address to associate with the load balancer's frontend. Which public IP address configuration meets the requirement?

You deploy a virtual machine with a Basic SKU public IP address configured with dynamic allocation. Users access the VM's web application through the IP address. After the VM is stopped (deallocated) for maintenance and restarted, users report they can no longer reach the application at the previous IP address. You must ensure the public IP address does not change across deallocation and restart cycles, with minimal administrative effort. What should you do?

You manage an Azure public Standard Load Balancer that distributes traffic to two VMs hosting a SQL Server Always On availability group listener. The application must connect to the availability group listener IP, and the backend VMs need to receive traffic addressed to the frontend IP without the load balancer rewriting the destination address. Which load balancing rule setting must you enable to support this configuration?

You manage a public Standard SKU Azure Load Balancer that distributes HTTP traffic across three virtual machines in a backend pool. Users report intermittent errors. On investigation, you find that the load balancer is only sending traffic to one of the three VMs, even though all three VMs are running. The health probe is configured to check TCP port 80. What is the MOST likely cause of the other two VMs not receiving traffic?

You manage a Standard SKU public Azure Load Balancer that distributes HTTP traffic across three VMs in a backend pool. The support team needs to RDP directly to one specific VM (VM2) in the pool using the load balancer's public IP address on port 50002, forwarding to port 3389 on that VM. Each VM has no public IP of its own. What should you configure on the load balancer?