Design and implement core networking infrastructure

Your company deploys Azure Bastion in a hub VNet to provide secure RDP/SSH access to VMs across peered spoke VNets. Administrators complain that they cannot connect to VMs from their local machines using the native Windows RDP client (mstsc), and they also cannot upload or download files during Bastion sessions. Your current deployment uses the Bastion Basic SKU. What must you do to enable both native client connectivity and file transfer?

Contoso runs an on-premises data center connected to an Azure hub VNet via ExpressRoute. On-premises servers must resolve records hosted in an Azure private DNS zone (contoso-internal.com) that is linked to the hub VNet. Contoso does not want to deploy and manage DNS server VMs in Azure. Which Azure DNS Private Resolver component must you deploy and reference so that on-premises DNS servers can forward queries into Azure and receive answers from the linked private DNS zone?

Contoso runs several VNets in Azure that must resolve names hosted on an on-premises Active Directory DNS server (contoso.local) reachable over an ExpressRoute circuit. You deploy an Azure DNS Private Resolver. You need Azure workloads to forward only queries for contoso.local to the on-premises DNS servers while all other queries continue to use Azure-provided DNS. What should you configure?

You are deploying an Azure Firewall into a hub virtual network that uses the address space 10.10.0.0/16. The firewall must be deployed successfully with a dedicated subnet, and you plan to later add a management subnet for forced tunneling. Which subnet configuration meets the requirements for the primary firewall subnet?

Your company runs a site-to-site VPN connection between an on-premises datacenter and an Azure VNet through a VpnGw2 gateway. The operations team reports intermittent slowdowns and wants proactive alerting when the tunnel approaches its throughput ceiling. You need to configure alerting on the actual data traffic passing through the VPN gateway with the least administrative effort. Which approach should you use?

Your organization runs several hub-and-spoke VNets across two Azure regions. The networking team wants a single dashboard that visualizes the health and metrics of network components (application gateways, load balancers, ExpressRoute circuits) and shows dependency topology without deploying agents to every VM. Which Azure capability should you use to meet this requirement with the least operational effort?

Your company is deploying an Azure Route Server in a hub VNet to enable dynamic route exchange between an SD-WAN network virtual appliance (NVA) and the Azure fabric. During configuration, the peering with the NVA fails to establish a BGP session. You confirm the NVA is running and reachable. Which configuration requirement must be satisfied for the BGP peering between Azure Route Server and the NVA to succeed?

Your company deploys Azure Route Server in a hub VNet to exchange routes with a third-party SD-WAN NVA. Several spoke VNets are peered to the hub. Workloads in the spokes must automatically learn the on-premises branch routes that the NVA advertises to Route Server, without configuring user-defined routes in each spoke. When you configure the VNet peering between the hub and each spoke, which setting must you enable on the peering so the spokes receive the branch routes learned by Route Server?

Your company has 40 spoke VNets that must all connect to a single hub VNet where a shared Azure Firewall resides. You need spokes to reach the hub, and you also need spokes to communicate directly with each other without routing through the hub. You want to manage this at scale as new spokes are onboarded automatically based on tags. Using Azure Virtual Network Manager, which connectivity configuration topology and option should you deploy?

Contoso manages 60 VNets across multiple subscriptions using Azure Virtual Network Manager. The security team requires that inbound traffic on TCP port 3389 (RDP) from the internet be blocked on all VNets, and this block must take precedence over any network security group rules that individual application teams might create. The teams must still be free to manage their own NSGs for all other traffic. What should you implement in Azure Virtual Network Manager?

Your company runs a hub-and-spoke topology in Azure. VMs in the spoke VNets must resolve names for internal Azure resources, public internet names, and records hosted on an on-premises Active Directory DNS server (10.50.0.10) reachable over an ExpressRoute connection. You deploy a pair of DNS forwarder VMs in the hub VNet and want all spoke VMs to use them. Which configuration on the spoke VNets ensures VMs send DNS queries to the hub forwarders?

Your company owns a public IPv4 range (203.0.113.0/24) registered with your Regional Internet Registry. You are migrating on-premises services to Azure and must retain these exact public IP addresses so external partners' firewall allowlists do not need updating. You need to bring this range into Azure so it can be used to allocate public IP addresses to Azure resources. Which approach should you use?

Your company runs several production workloads across multiple Azure subscriptions in a single tenant. Public-facing virtual machines and load balancers are exposed via standard public IPs. Management wants coordinated, tuned DDoS mitigation with attack analytics and cost protection for the resources in these VNets, while minimizing the number of plans purchased. What is the recommended approach to enable Azure DDoS Network Protection?

Your company runs several Azure VNets and an on-premises data center connected via ExpressRoute. Azure-hosted VMs must resolve records in a private DNS zone (azure.contoso.com) linked to the hub VNet, and on-premises servers must resolve those same Azure private DNS records. Additionally, Azure VMs must resolve on-premises Active Directory names (corp.contoso.com) hosted on on-premises DNS servers. You want a fully managed solution that avoids deploying and maintaining DNS forwarder VMs. What should you implement?

Your company runs several workloads in an Azure VNet subnet named AppSubnet. For regulatory compliance, all internet-bound traffic from these VMs must be inspected by an on-premises firewall before it can leave the corporate network. You have already deployed a site-to-site VPN gateway connecting the VNet to the on-premises datacenter. Which configuration correctly implements forced tunneling for AppSubnet?

You are designing a hub VNet that will host a VPN gateway, an ExpressRoute gateway, and a future Azure Route Server. The network team wants to reserve a single dedicated subnet for the VPN and ExpressRoute gateways that allows for coexistence and future expansion without renumbering. Which subnet configuration should you implement for the gateway subnet?

You are designing outbound internet connectivity for workloads spread across three subnets in a zone-redundant Azure region. The security team requires all outbound SNAT to use a predictable set of static public IPs, and the architecture must survive the failure of a single availability zone. You plan to use Azure NAT Gateway. Which deployment approach correctly meets both the static-IP and zone-resilience requirements?

A company runs a fleet of virtual machines in a subnet named 'app-subnet' within a VNet. The VMs make a very high volume of outbound connections to a third-party SaaS API over the internet. Operations reports intermittent connection failures with SNAT port exhaustion errors originating from the default outbound access and the Standard Load Balancer outbound rules. You must provide scalable, reliable outbound connectivity with predictable public source IPs while minimizing SNAT port exhaustion. What should you implement?

You manage a subnet containing 40 virtual machines that make frequent outbound HTTPS calls to a third-party payment API. Your team currently relies on the default outbound access provided by Azure and is experiencing intermittent SNAT port exhaustion. You need a solution that provides scalable, predictable outbound connectivity with the least administrative overhead and without deploying additional compute. What should you implement?

A VM in the subnet 'AppSubnet' can no longer reach an external HTTPS endpoint (port 443), and the application team reports intermittent failures. You need to identify whether the traffic is being blocked and, if so, precisely which network security rule or user-defined route is responsible for dropping the packets between the VM and the destination. Which Azure Network Watcher capability should you use?