You save $69.98
The Storage service endpoint policy now restricts subnet egress to account A. Which boundary remains true?
A Storage service endpoint policy filters supported account destinations, but it does not create Private Link IPs or replace Storage data-plane authorization. That remains a practical service boundary even after the recommended change (create a Storage service endpoint policy listing only approved account A and associate it with the workload subnet) is implemented; retest it when identities, policies, service capacity or network paths change.
Service endpoints continue to reach the Azure Storage public service endpoint, not a private IP allocated inside a subnet. Use Private Link for that requirement.
The endpoint policy controls reachable Storage resource destinations. Authentication and data-plane authorization are still separately evaluated by the account.
Policies are associated with specific subnets. Other subnets require their own applicable configuration, not an assumption of subscription-wide enforcement.
A cloud administrator receives this request: Administrators need interactive RDP/SSH to private VMs but do not want those VMs assigned public IP addresses. The requirement is: provide browser-based privileged connectivity through an Azure-managed jump service. Which configuration should be chosen first?
Bastion supports secured administration of private VMs without direct per-VM public IP exposure. This achieves provide browser-based privileged connectivity through an Azure-managed jump service through deploy Azure Bastion in its dedicated AzureBastionSubnet and connect to private VM addresses instead of relying on merely similar resource settings.
SAS authenticates supported storage access, not RDP; that would not meet provide browser-based privileged connectivity through an Azure-managed jump service, for which the relevant Azure action is deploy Azure Bastion in its dedicated AzureBastionSubnet and connect to private VM addresses.
Public DNS does not make an RFC1918 private address directly internet reachable; that would not meet provide browser-based privileged connectivity through an Azure-managed jump service, for which the relevant Azure action is deploy Azure Bastion in its dedicated AzureBastionSubnet and connect to private VM addresses.
That increases the attack surface contrary to the private-only requirement; that would not meet provide browser-based privileged connectivity through an Azure-managed jump service, for which the relevant Azure action is deploy Azure Bastion in its dedicated AzureBastionSubnet and connect to private VM addresses.
A pilot in Azure exposes this failure: Remote administration fails because the private VM has no routable public endpoint. The service was intended to meet: provide browser-based privileged connectivity through an Azure-managed jump service. What is the most likely cause?
The trace reports: Remote administration fails because the private VM has no routable public endpoint. The causal misconfiguration is: The team lacks a properly configured Bastion or other private administrative connectivity path. The targeted action is to deploy Bastion with supported subnet sizing and permissions, then connect through the portal/client.
The proposed mechanism concerns the private VM already has a functioning Azure Bastion session without any public IP and the intended administrator can sign in, which is not established by the observed remote administration fails because the private VM has no routable public endpoint. Test the more directly supported condition: The team lacks a properly configured Bastion or other private administrative connectivity path.
The effective NSG rule set allows a broader source prefix or has a higher-priority broad allow; that mechanism would be more consistent with an observation such as an unapproved public client can still connect to TCP 443 on the VM, rather than this case's remote administration fails because the private VM has no routable public endpoint.
An applicable subnet NSG has a higher-impact deny or another effective rule blocks the flow; that mechanism would be more consistent with an observation such as an inbound HTTPS connection is denied even though the NIC NSG contains an allow rule, rather than this case's remote administration fails because the private VM has no routable public endpoint.
The team confirms the following Azure defect: Remote administration fails because the private VM has no routable public endpoint. Which targeted remediation addresses the root cause?
Deploy Bastion with supported subnet sizing and permissions, then connect through the portal/client. This addresses the documented failure condition: the team lacks a properly configured Bastion or other private administrative connectivity path. Retest the affected operation and retain the original least-privilege boundaries.
That increases the attack surface contrary to the private-only requirement. In the reported incident (remote administration fails because the private VM has no routable public endpoint), that change would not correct the cause: the team lacks a properly configured Bastion or other private administrative connectivity path.
SAS authenticates supported storage access, not RDP. In the reported incident (remote administration fails because the private VM has no routable public endpoint), that change would not correct the cause: the team lacks a properly configured Bastion or other private administrative connectivity path.
Public DNS does not make an RFC1918 private address directly internet reachable. In the reported incident (remote administration fails because the private VM has no routable public endpoint), that change would not correct the cause: the team lacks a properly configured Bastion or other private administrative connectivity path.
A team has configured Azure for this workload: Administrators need interactive RDP/SSH to private VMs but do not want those VMs assigned public IP addresses. The requirement is: provide browser-based privileged connectivity through an Azure-managed jump service. Which TWO verification steps would establish the relevant behavior? Select TWO answers.
Verify direct internet RDP/SSH to that VM remains unavailable. This provides direct evidence on intended NIC, private source and target port rather than relying on a resource name or a presumed configuration. Its coverage is distinct from the separate check to initiate a session to a private test VM without any public VM IP: both are necessary to support provide browser-based privileged connectivity through an Azure-managed jump service.
Initiate a session to a private test VM without any public VM IP. This provides direct evidence on intended NIC, private source and target port rather than relying on a resource name or a presumed configuration. Its coverage is distinct from the separate check to verify direct internet RDP/SSH to that VM remains unavailable: both are necessary to support provide browser-based privileged connectivity through an Azure-managed jump service.
Bastion provisioning does not guarantee a usable session to the private VM; guest login and allowed network path must still be tested.
A direct public-IP RDP test bypasses Bastion and violates the private-only design. It cannot establish Bastion’s managed jump path.
A successful managed session proves usability, but not the independent absence of direct public administration. Both conditions must be tested.
A risk reviewer is considering an Azure design that aims to: provide browser-based privileged connectivity through an Azure-managed jump service. Which limitation should still be documented?
Bastion still requires correct Azure permissions, network rules, supported clients and guest OS credentials. That remains a practical service boundary even after the recommended change (deploy Azure Bastion in its dedicated AzureBastionSubnet and connect to private VM addresses) is implemented; retest it when identities, policies, service capacity or network paths change.
The two checks cover separate behavior: 'Verify direct internet RDP/SSH to that VM remains unavailable' and 'Initiate a session to a private test VM without any public VM IP'. Neither check removes the remaining operational limitation: Bastion still requires correct Azure permissions, network rules, supported clients and guest OS credentials.
The incident (remote administration fails because the private VM has no routable public endpoint) could recur if a related Azure dependency changes. The design still faces the limitation: Bastion still requires correct Azure permissions, network rules, supported clients and guest OS credentials.
The successful check 'Verify direct internet RDP/SSH to that VM remains unavailable' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Bastion still requires correct Azure permissions, network rules, supported clients and guest OS credentials.
A cloud administrator receives this request: A company owns corp-example.net and needs external clients to resolve app.corp-example.net to its Azure public frontend. The requirement is: host authoritative public DNS records for the corporate domain. Which configuration should be chosen first?
Public Azure DNS publishes records to internet resolvers after proper delegation to the zone's nameservers. This achieves host authoritative public DNS records for the corporate domain through create an Azure DNS public zone, delegate it from the registrar and add the appropriate A or alias record instead of relying on merely similar resource settings.
Tags are not authoritative DNS resource records; that would not meet host authoritative public DNS records for the corporate domain, for which the relevant Azure action is create an Azure DNS public zone, delegate it from the registrar and add the appropriate A or alias record.
A VNet resolver setting is not DNS delegation for a public domain; that would not meet host authoritative public DNS records for the corporate domain, for which the relevant Azure action is create an Azure DNS public zone, delegate it from the registrar and add the appropriate A or alias record.
Private DNS links do not serve authoritative public internet resolution; that would not meet host authoritative public DNS records for the corporate domain, for which the relevant Azure action is create an Azure DNS public zone, delegate it from the registrar and add the appropriate A or alias record.
A pilot in Azure exposes this failure: External resolvers report NXDOMAIN even though the team added an A record in an Azure zone. The service was intended to meet: host authoritative public DNS records for the corporate domain. What is the most likely cause?
The trace reports: External resolvers report NXDOMAIN even though the team added an A record in an Azure zone. The causal misconfiguration is: The domain delegation or published record set does not match the authoritative public Azure DNS zone. The targeted action is to correct registrar NS delegation and publish the record set in the authoritative public zone.
The public frontend, load-balancing rule or healthy backend pool is incomplete; that mechanism would be more consistent with an observation such as external clients reach one VM directly but the intended public load balancer IP does not accept requests, rather than this case's external resolvers report NXDOMAIN even though the team added an A record in an Azure zone.
The frontend was configured as a public load balancer or backend public IP exposure remains open; that mechanism would be more consistent with an observation such as external clients can connect to the proxy, contrary to the private-only requirement, rather than this case's external resolvers report NXDOMAIN even though the team added an A record in an Azure zone.
The private DNS VNet link or required A record was never created or is incorrect; that mechanism would be more consistent with an observation such as a VM in the intended VNet cannot resolve inventory.internal.example despite the private zone existing, rather than this case's external resolvers report NXDOMAIN even though the team added an A record in an Azure zone.
The team confirms the following Azure defect: External resolvers report NXDOMAIN even though the team added an A record in an Azure zone. Which targeted remediation addresses the root cause?
Correct registrar NS delegation and publish the record set in the authoritative public zone. This addresses the documented failure condition: the domain delegation or published record set does not match the authoritative public Azure DNS zone. Retest the affected operation and retain the original least-privilege boundaries.
Private DNS links do not serve authoritative public internet resolution. In the reported incident (external resolvers report NXDOMAIN even though the team added an A record in an Azure zone), that change would not correct the cause: the domain delegation or published record set does not match the authoritative public Azure DNS zone.
Tags are not authoritative DNS resource records. In the reported incident (external resolvers report NXDOMAIN even though the team added an A record in an Azure zone), that change would not correct the cause: the domain delegation or published record set does not match the authoritative public Azure DNS zone.
A VNet resolver setting is not DNS delegation for a public domain. In the reported incident (external resolvers report NXDOMAIN even though the team added an A record in an Azure zone), that change would not correct the cause: the domain delegation or published record set does not match the authoritative public Azure DNS zone.
A team has configured Azure for this workload: A company owns corp-example.net and needs external clients to resolve app.corp-example.net to its Azure public frontend. The requirement is: host authoritative public DNS records for the corporate domain. Which TWO verification steps would establish the relevant behavior? Select TWO answers.
Resolve the hostname from an unrelated external network after cache expiration. This supplies observed evidence for host authoritative public DNS records for the corporate domain. It is not interchangeable with the second required check, query authoritative nameservers directly for the app hostname, because that checks a separate success or failure boundary.
Query authoritative nameservers directly for the app hostname. This supplies observed evidence for host authoritative public DNS records for the corporate domain. It is not interchangeable with the second required check, resolve the hostname from an unrelated external network after cache expiration, because that checks a separate success or failure boundary.
A release checklist recording 'Query authoritative nameservers directly for the app hostname' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must query authoritative nameservers directly for the app hostname on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The required check must exercise resolve the hostname from an unrelated external network after cache expiration on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Resolve the hostname from an unrelated external network after cache expiration' even though the intended caller fails. This does not prove the required behavior for resolve the hostname from an unrelated external network after cache expiration.
A risk reviewer is considering an Azure design that aims to: host authoritative public DNS records for the corporate domain. Which limitation should still be documented?
Public DNS publication does not configure an application listener or secure it with a valid TLS certificate. That remains a practical service boundary even after the recommended change (create an Azure DNS public zone, delegate it from the registrar and add the appropriate A or alias record) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (external resolvers report NXDOMAIN even though the team added an A record in an Azure zone) could recur if a related Azure dependency changes. The design still faces the limitation: Public DNS publication does not configure an application listener or secure it with a valid TLS certificate.
The successful check 'Resolve the hostname from an unrelated external network after cache expiration' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Public DNS publication does not configure an application listener or secure it with a valid TLS certificate.
The two checks cover separate behavior: 'Resolve the hostname from an unrelated external network after cache expiration' and 'Query authoritative nameservers directly for the app hostname'. Neither check removes the remaining operational limitation: Public DNS publication does not configure an application listener or secure it with a valid TLS certificate.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
