Microsoft AZ-305 Practice Test 85
Question 840
Acceptance testing must establish the following operational result: Tunnel state and routes verify the site connection. Which verification action most directly establishes that outcome?
- Disable a region's origin and test global service reachability.
- Establish the tunnel and test protected private IP reachability.
- Drop a test ISP link and observe VPN tunnel rerouting.
- Test a client authentication and a permitted private address route.
Explanation
Correct Answer
B:Tunnel state and routes verify the site connection.
Incorrect Answers
A:This is a test for A multi-region HTTP service needs one global entry point with edge WAF and origin failover. The requirement here is instead demonstrated by establish the tunnel and test protected private IP reachability.
C:That verification addresses the different requirement: A critical branch cannot lose Azure connectivity when one ISP circuit fails. It does not directly establish tunnel state and routes verify the site connection.
D:That verification addresses the different requirement: Remote employees need individually authenticated access to private Azure networks. It does not directly establish tunnel state and routes verify the site connection.
Question 841
Remote employees need individually authenticated access to private Azure networks. Which Azure architecture choice best meets this requirement?
- Deploy one tunnel over one power and ISP failure domain and call it resilient.
- Configure ExpressRoute without any carrier circuit and call it an internet VPN.
- Build a site-to-site tunnel from every individual laptop as a branch router.
- Use a supported Azure VPN Gateway point-to-site VPN configuration.
Explanation
Correct Answer
D:P2S allows client-initiated private connectivity with eligible identity methods.
Incorrect Answers
A:A single transport path remains a critical dependency. In the present requirement, remote employees need individually authenticated access to private Azure networks. The needed design instead works because p2S allows client-initiated private connectivity with eligible identity methods.
B:ExpressRoute requires a supported private circuit and separate provisioning. In the present requirement, remote employees need individually authenticated access to private Azure networks. The needed design instead works because p2S allows client-initiated private connectivity with eligible identity methods.
C:S2S is not the normal per-user remote access model. This proposal contradicts the stated architecture constraint.
Question 842
An architecture proposal for site-to-site and point-to-site vpn relies on the following approach: Build a site-to-site tunnel from every individual laptop as a branch router. Which specific failure or mismatch should the design reviewer identify?
- S2S is not the normal per-user remote access model.
- Service endpoints secure Azure service routing but do not create Private Link interfaces.
- A single transport path remains a critical dependency.
- ExpressRoute requires a supported private circuit and separate provisioning.
Explanation
Correct Answer
A:Build a site-to-site tunnel from every individual laptop as a branch router. S2S is not the normal per-user remote access model.
Incorrect Answers
B:This concern applies to Assume enabling a service endpoint creates a private NIC for the service inside the VNet. in another design network solutions design. The current proposal specifically fails because s2S is not the normal per-user remote access model.
C:That assessment refers to the separate proposal 'Deploy one tunnel over one power and ISP failure domain and call it resilient.' not to the recommendation under review. Here, S2S is not the normal per-user remote access model.
D:That assessment refers to the separate proposal 'Configure ExpressRoute without any carrier circuit and call it an internet VPN.' not to the recommendation under review. Here, S2S is not the normal per-user remote access model.
Question 843
Acceptance testing must establish the following operational result: The session demonstrates P2S functionality. Which verification action most directly establishes that outcome?
- Drop a test ISP link and observe VPN tunnel rerouting.
- Establish the tunnel and test protected private IP reachability.
- Test a client authentication and a permitted private address route.
- Check effective endpoint routes and permitted storage resource access.
Explanation
Correct Answer
C:The session demonstrates P2S functionality.
Incorrect Answers
A:That verification addresses the different requirement: A critical branch cannot lose Azure connectivity when one ISP circuit fails. It does not directly establish the session demonstrates P2S functionality.
B:That verification addresses the different requirement: A branch must connect to one Azure VNet over the public internet with encryption. It does not directly establish the session demonstrates P2S functionality.
D:This is a test for An app subnet wants to restrict which Azure Storage accounts can be accessed through a service endpoint design. The requirement here is instead demonstrated by test a client authentication and a permitted private address route.
Question 844
A critical branch cannot lose Azure connectivity when one ISP circuit fails. Which Azure architecture choice best meets this requirement?
- Build a site-to-site tunnel from every individual laptop as a branch router.
- Deploy one tunnel over one power and ISP failure domain and call it resilient.
- Configure ExpressRoute without any carrier circuit and call it an internet VPN.
- Configure resilient VPN gateway and redundant branch tunnels where supported.
Explanation
Correct Answer
D:Multiple independent connections reduce a single-link failure risk.
Incorrect Answers
A:S2S is not the normal per-user remote access model. In the present requirement, a critical branch cannot lose Azure connectivity when one ISP circuit fails. The needed design instead works because multiple independent connections reduce a single-link failure risk.
B:A single transport path remains a critical dependency. This proposal contradicts the stated architecture constraint.
C:ExpressRoute requires a supported private circuit and separate provisioning. In the present requirement, a critical branch cannot lose Azure connectivity when one ISP circuit fails. The needed design instead works because multiple independent connections reduce a single-link failure risk.
Question 845
An architecture proposal for site-to-site and point-to-site vpn relies on the following approach: Deploy one tunnel over one power and ISP failure domain and call it resilient. Which specific failure or mismatch should the design reviewer identify?
- An NSG does not replace centrally routed network firewall inspection.
- A single transport path remains a critical dependency.
- S2S is not the normal per-user remote access model.
- ExpressRoute requires a supported private circuit and separate provisioning.
Explanation
Correct Answer
B:Deploy one tunnel over one power and ISP failure domain and call it resilient. A single transport path remains a critical dependency.
Incorrect Answers
A:This concern applies to Assume a regular VNet NSG is a stateful central transit firewall for all hubs. in another design network solutions design. The current proposal specifically fails because a single transport path remains a critical dependency.
C:That assessment refers to the separate proposal 'Build a site-to-site tunnel from every individual laptop as a branch router.' not to the recommendation under review. Here, A single transport path remains a critical dependency.
D:That assessment refers to the separate proposal 'Configure ExpressRoute without any carrier circuit and call it an internet VPN.' not to the recommendation under review. Here, A single transport path remains a critical dependency.
Question 846
Acceptance testing must establish the following operational result: Failover proof demonstrates redundancy. Which verification action most directly establishes that outcome?
- Drop a test ISP link and observe VPN tunnel rerouting.
- Test a client authentication and a permitted private address route.
- Trace a protected flow and confirm firewall log entries.
- Establish the tunnel and test protected private IP reachability.
Explanation
Correct Answer
A:Failover proof demonstrates redundancy.
Incorrect Answers
B:That verification addresses the different requirement: Remote employees need individually authenticated access to private Azure networks. It does not directly establish failover proof demonstrates redundancy.
C:This is a test for A deployment needs centrally inserted inspection for cross-branch traffic in a managed network fabric. The requirement here is instead demonstrated by drop a test ISP link and observe VPN tunnel rerouting.
D:That verification addresses the different requirement: A branch must connect to one Azure VNet over the public internet with encryption. It does not directly establish failover proof demonstrates redundancy.
Question 847
A financial company needs predictable private connectivity from on-premises to Azure through a carrier. Which Azure architecture choice best meets this requirement?
- Use one ExpressRoute circuit as the only recovery route for every business region.
- Treat a public HTTPS connection as a carrier private circuit.
- Treat private carrier routing as proof all application traffic is encrypted.
- Deploy ExpressRoute with supported circuit and gateway design.
Explanation
Correct Answer
D:ExpressRoute provides private connectivity instead of an ordinary Internet VPN path.
Incorrect Answers
A:One circuit still represents a shared failure point. In the present requirement, a financial company needs predictable private connectivity from on-premises to Azure through a carrier. The needed design instead works because expressRoute provides private connectivity instead of an ordinary Internet VPN path.
B:Public Internet transport lacks the same connectivity isolation characteristics. This proposal contradicts the stated architecture constraint.
C:Confidentiality requires explicit encryption controls where needed. In the present requirement, a financial company needs predictable private connectivity from on-premises to Azure through a carrier. The needed design instead works because expressRoute provides private connectivity instead of an ordinary Internet VPN path.
Question 848
An architecture proposal for expressroute and private hybrid connectivity relies on the following approach: Treat a public HTTPS connection as a carrier private circuit. Which specific failure or mismatch should the design reviewer identify?
- Confidentiality requires explicit encryption controls where needed.
- Broad propagation defeats separation requirements.
- Public Internet transport lacks the same connectivity isolation characteristics.
- One circuit still represents a shared failure point.
Explanation
Correct Answer
C:Treat a public HTTPS connection as a carrier private circuit. Public Internet transport lacks the same connectivity isolation characteristics.
Incorrect Answers
A:That assessment refers to the separate proposal 'Treat private carrier routing as proof all application traffic is encrypted.' not to the recommendation under review. Here, Public Internet transport lacks the same connectivity isolation characteristics.
B:This concern applies to Propagate all sensitive prefixes to every connection by default. in another design network solutions design. The current proposal specifically fails because public Internet transport lacks the same connectivity isolation characteristics.
D:That assessment refers to the separate proposal 'Use one ExpressRoute circuit as the only recovery route for every business region.' not to the recommendation under review. Here, Public Internet transport lacks the same connectivity isolation characteristics.
Question 849
Acceptance testing must establish the following operational result: Route evidence verifies the private network path. Which verification action most directly establishes that outcome?
- Test reachability from restricted and permitted connections.
- Inspect BGP peering and route reachability across the provisioned circuit.
- Simulate circuit failure and verify alternate path behavior.
- Capture a compliant encrypted application flow over the private path.
Explanation
Correct Answer
B:Route evidence verifies the private network path.
Incorrect Answers
A:This is a test for Two Virtual WAN route tables must isolate sensitive workloads while retaining shared services. The requirement here is instead demonstrated by inspect BGP peering and route reachability across the provisioned circuit.
C:That verification addresses the different requirement: A company needs cross-region hybrid connectivity and wants to avoid one circuit being a sole dependency. It does not directly establish route evidence verifies the private network path.
D:That verification addresses the different requirement: An engineer assumes ExpressRoute automatically encrypts every frame end to end. It does not directly establish route evidence verifies the private network path.
Question 850
A company needs cross-region hybrid connectivity and wants to avoid one circuit being a sole dependency. Which Azure architecture choice best meets this requirement?
- Treat private carrier routing as proof all application traffic is encrypted.
- Plan ExpressRoute resiliency with diverse circuits or supported gateway architecture.
- Treat a public HTTPS connection as a carrier private circuit.
- Use one ExpressRoute circuit as the only recovery route for every business region.
Explanation
Correct Answer
B:Independent paths mitigate provider or circuit outages.
Incorrect Answers
A:Confidentiality requires explicit encryption controls where needed. In the present requirement, a company needs cross-region hybrid connectivity and wants to avoid one circuit being a sole dependency. The needed design instead works because independent paths mitigate provider or circuit outages.
C:Public Internet transport lacks the same connectivity isolation characteristics. In the present requirement, a company needs cross-region hybrid connectivity and wants to avoid one circuit being a sole dependency. The needed design instead works because independent paths mitigate provider or circuit outages.
D:One circuit still represents a shared failure point. This proposal contradicts the stated architecture constraint.