You save $69.98
A risk reviewer is considering an Azure design that aims to: allow inspected traffic between spokes through a central firewall rather than assuming peering automatically forwards it. Which limitation should still be documented?
Hub-and-spoke transit requires compatible routes and firewall policy; simply enabling peering is insufficient. That remains a practical service boundary even after the recommended change (enable permitted forwarded traffic, place an NVA/firewall in the hub and configure appropriate user-defined routes for spoke-to-spoke paths) is implemented; retest it when identities, policies, service capacity or network paths change.
The two checks cover separate behavior: 'Inspect effective routes for test spoke VMs and confirm the firewall next hop' and 'Send authorized traffic between spokes and verify it passes through inspection'. Neither check removes the remaining operational limitation: Hub-and-spoke transit requires compatible routes and firewall policy; simply enabling peering is insufficient.
The incident (spoke A can reach the hub but cannot reach spoke B through the intended firewall) could recur if a related Azure dependency changes. The design still faces the limitation: Hub-and-spoke transit requires compatible routes and firewall policy; simply enabling peering is insufficient.
The successful check 'Inspect effective routes for test spoke VMs and confirm the firewall next hop' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Hub-and-spoke transit requires compatible routes and firewall policy; simply enabling peering is insufficient.
A cloud administrator receives this request: Two VNets in different Azure regions must communicate privately while the application stays within Azure's network backbone. The requirement is: implement global VNet peering with distinct address spaces and appropriate regional permissions. Which configuration should be chosen first?
Global VNet peering provides private IP connectivity between supported VNets in different regions over Azure's backbone. This achieves implement global VNet peering with distinct address spaces and appropriate regional permissions through configure supported global VNet peering and review NSG and route rules on both networks instead of relying on merely similar resource settings.
Overlapping address ranges prevent the intended direct peering; that would not meet implement global VNet peering with distinct address spaces and appropriate regional permissions, for which the relevant Azure action is configure supported global VNet peering and review NSG and route rules on both networks.
DNS answers cannot traverse isolated network boundaries by themselves; that would not meet implement global VNet peering with distinct address spaces and appropriate regional permissions, for which the relevant Azure action is configure supported global VNet peering and review NSG and route rules on both networks.
A resource group location does not provide packet transport; that would not meet implement global VNet peering with distinct address spaces and appropriate regional permissions, for which the relevant Azure action is configure supported global VNet peering and review NSG and route rules on both networks.
A pilot in Azure exposes this failure: Remote-region VMs cannot reach each other using private addresses despite successful DNS resolution. The service was intended to meet: implement global VNet peering with distinct address spaces and appropriate regional permissions. What is the most likely cause?
The trace reports: Remote-region VMs cannot reach each other using private addresses despite successful DNS resolution. The causal misconfiguration is: The VNets have no valid global peering connection or their address spaces overlap. The targeted action is to add valid peering links for both directions with nonoverlapping prefixes and correct security rules.
The proposed mechanism concerns the DNS A record uses an outdated hostname, while both clients correctly resolve the current private destination and connectivity remains denied, which is not established by the observed remote-region VMs cannot reach each other using private addresses despite successful DNS resolution. Test the more directly supported condition: The VNets have no valid global peering connection or their address spaces overlap.
The proposed mechanism concerns the peered VNets have verified distinct CIDR ranges; the only discrepancy is an old friendly description of one peering connection, which is not established by the observed remote-region VMs cannot reach each other using private addresses despite successful DNS resolution. Test the more directly supported condition: The VNets have no valid global peering connection or their address spaces overlap.
The environment assumes hub peering is transitive and has no effective forwarding/UDR path; that mechanism would be more consistent with an observation such as spoke A can reach the hub but cannot reach spoke B through the intended firewall, rather than this case's remote-region VMs cannot reach each other using private addresses despite successful DNS resolution.
The team confirms the following Azure defect: Remote-region VMs cannot reach each other using private addresses despite successful DNS resolution. Which targeted remediation addresses the root cause?
Add valid peering links for both directions with nonoverlapping prefixes and correct security rules. This addresses the documented failure condition: the VNets have no valid global peering connection or their address spaces overlap. Retest the affected operation and retain the original least-privilege boundaries.
A resource group location does not provide packet transport. In the reported incident (remote-region VMs cannot reach each other using private addresses despite successful DNS resolution), that change would not correct the cause: the VNets have no valid global peering connection or their address spaces overlap.
Overlapping address ranges prevent the intended direct peering. In the reported incident (remote-region VMs cannot reach each other using private addresses despite successful DNS resolution), that change would not correct the cause: the VNets have no valid global peering connection or their address spaces overlap.
DNS answers cannot traverse isolated network boundaries by themselves. In the reported incident (remote-region VMs cannot reach each other using private addresses despite successful DNS resolution), that change would not correct the cause: the VNets have no valid global peering connection or their address spaces overlap.
A team has configured Azure for this workload: Two VNets in different Azure regions must communicate privately while the application stays within Azure's network backbone. The requirement is: implement global VNet peering with distinct address spaces and appropriate regional permissions. Which TWO verification steps would establish the relevant behavior? Select TWO answers.
Test an authorized private TCP flow between regional VMs. This supplies observed evidence for implement global VNet peering with distinct address spaces and appropriate regional permissions. It is not interchangeable with the second required check, inspect peerings on each VNet and confirm connected states, because that checks a separate success or failure boundary.
Inspect peerings on each VNet and confirm connected states. This supplies observed evidence for implement global VNet peering with distinct address spaces and appropriate regional permissions. It is not interchangeable with the second required check, test an authorized private TCP flow between regional VMs, because that checks a separate success or failure boundary.
A release checklist recording 'Inspect peerings on each VNet and confirm connected states' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must inspect peerings on each VNet and confirm connected states on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The required check must exercise test an authorized private TCP flow between regional VMs on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Test an authorized private TCP flow between regional VMs' even though the intended caller fails. This does not prove the required behavior for test an authorized private tcp flow between regional vms.
A risk reviewer is considering an Azure design that aims to: implement global VNet peering with distinct address spaces and appropriate regional permissions. Which limitation should still be documented?
Global peering has cost, region and policy considerations and is not a multi-region application failover mechanism by itself. That remains a practical service boundary even after the recommended change (configure supported global VNet peering and review NSG and route rules on both networks) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (remote-region VMs cannot reach each other using private addresses despite successful DNS resolution) could recur if a related Azure dependency changes. The design still faces the limitation: Global peering has cost, region and policy considerations and is not a multi-region application failover mechanism by itself.
The successful check 'Test an authorized private TCP flow between regional VMs' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Global peering has cost, region and policy considerations and is not a multi-region application failover mechanism by itself.
The two checks cover separate behavior: 'Test an authorized private TCP flow between regional VMs' and 'Inspect peerings on each VNet and confirm connected states'. Neither check removes the remaining operational limitation: Global peering has cost, region and policy considerations and is not a multi-region application failover mechanism by itself.
An Azure administrator must resolve a specific request: A VM is protected by both subnet-level and NIC-level NSGs and an engineer wants to know why one TCP connection is denied. The expected outcome is: evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation. Which option is appropriate?
The connection must be allowed by applicable NSG rules; a deny at either level can block the flow. This achieves evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation through use Network Watcher effective security rules or IP flow verify to identify the denying rule and scope instead of relying on merely similar resource settings.
Host key changes are unrelated to effective inbound TCP 443 filtering; that would not meet evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation, for which the relevant Azure action is use Network Watcher effective security rules or IP flow verify to identify the denying rule and scope.
Removing all protection is not an appropriately scoped diagnosis; that would not meet evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation, for which the relevant Azure action is use Network Watcher effective security rules or IP flow verify to identify the denying rule and scope.
Both applicable layers can influence the final result; that would not meet evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation, for which the relevant Azure action is use Network Watcher effective security rules or IP flow verify to identify the denying rule and scope.
Operations sees an unexpected outcome: An inbound HTTPS connection is denied even though the NIC NSG contains an allow rule. The original demand was: evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation. Which cause is most consistent with the evidence?
The trace reports: An inbound HTTPS connection is denied even though the NIC NSG contains an allow rule. The causal misconfiguration is: An applicable subnet NSG has a higher-impact deny or another effective rule blocks the flow. The targeted action is to locate the denying effective rule and revise only the authorized source/port scope.
The effective NSG rule set allows a broader source prefix or has a higher-priority broad allow; that mechanism would be more consistent with an observation such as an unapproved public client can still connect to TCP 443 on the VM, rather than this case's an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule.
The team lacks a properly configured Bastion or other private administrative connectivity path; that mechanism would be more consistent with an observation such as remote administration fails because the private VM has no routable public endpoint, rather than this case's an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule.
NSG rules were written to specific obsolete IPs rather than the intended application-role group; that mechanism would be more consistent with an observation such as new app VMs fail to communicate after their private addresses change, rather than this case's an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule.
A service owner needs a practical fix after this failure: An inbound HTTPS connection is denied even though the NIC NSG contains an allow rule. What is the best remediation?
Locate the denying effective rule and revise only the authorized source/port scope. This addresses the documented failure condition: an applicable subnet NSG has a higher-impact deny or another effective rule blocks the flow. Retest the affected operation and retain the original least-privilege boundaries.
Removing all protection is not an appropriately scoped diagnosis. In the reported incident (an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule), that change would not correct the cause: an applicable subnet NSG has a higher-impact deny or another effective rule blocks the flow.
Both applicable layers can influence the final result. In the reported incident (an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule), that change would not correct the cause: an applicable subnet NSG has a higher-impact deny or another effective rule blocks the flow.
Host key changes are unrelated to effective inbound TCP 443 filtering. In the reported incident (an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule), that change would not correct the cause: an applicable subnet NSG has a higher-impact deny or another effective rule blocks the flow.
A deployment claims to meet: evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation. The environment is: A VM is protected by both subnet-level and NIC-level NSGs and an engineer wants to know why one TCP connection is denied. Which TWO test results would substantiate that claim? Select TWO answers.
Run IP flow verify for the exact 5-tuple and confirm the rule decision. This provides direct evidence on intended NIC, private source and target port rather than relying on a resource name or a presumed configuration. Its coverage is distinct from the separate check to inspect effective security rules on the NIC after the change: both are necessary to support evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation.
Inspect effective security rules on the NIC after the change. This provides direct evidence on intended NIC, private source and target port rather than relying on a resource name or a presumed configuration. Its coverage is distinct from the separate check to run IP flow verify for the exact 5-tuple and confirm the rule decision: both are necessary to support evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation.
Effective NSG evaluation includes both subnet and NIC rule sets. A subnet allow alone does not establish the five-tuple decision for the actual NIC.
The result depends on the actual source, destination, protocol and port plus the applicable NSGs. A different VM can have different effective rules.
ICMP reachability is not the named TCP five-tuple. The specific denied flow and effective security rules need inspection.
An infrastructure design was selected to meet: evaluate the combined effective NSG rules for the VM rather than looking at one NSG in isolation. What caveat remains relevant during operation?
NSG evaluation cannot explain every connection failure; guest firewalls, routes and service listeners may also block traffic. That remains a practical service boundary even after the recommended change (use Network Watcher effective security rules or IP flow verify to identify the denying rule and scope) is implemented; retest it when identities, policies, service capacity or network paths change.
The successful check 'Run IP flow verify for the exact 5-tuple and confirm the rule decision' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: NSG evaluation cannot explain every connection failure; guest firewalls, routes and service listeners may also block traffic.
The two checks cover separate behavior: 'Run IP flow verify for the exact 5-tuple and confirm the rule decision' and 'Inspect effective security rules on the NIC after the change'. Neither check removes the remaining operational limitation: NSG evaluation cannot explain every connection failure; guest firewalls, routes and service listeners may also block traffic.
The incident (an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule) could recur if a related Azure dependency changes. The design still faces the limitation: NSG evaluation cannot explain every connection failure; guest firewalls, routes and service listeners may also block traffic.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
