NEW QUESTION 1
A company configures an Azure site-to-site VPN between an on-premises network and an Azure virtual network.
The company reports that after completing the configuration, the VPN connection cannot be established. You need to troubleshoot the connection issue.
What should you do first?

• A. Identify the shared key by running this PowerShell cmdlet: Get-AzVirtualNetworkGatewayConnectionSharedKey.
• B. Identify the shared key by running this PowerShell cmdlet:Get-AzVirtualNetworkGatewayConnectionVpnDeviceConfigScript.
• C. Verify the AzureRoot.cer file exists.
• D. Verify the AzureClient.pfx file exists.

Answer: B

NEW QUESTION 2
A company deploys ExpressRoute.
The company reports that there is an autonomous system (AS) number mismatch. You need to identify the AS number of the circuit.
Which PowerShell cmdlet should you run?

• A. Get-AzExpressRouteCircuitPeeringConfig
• B. Get-AzExpressRouteCircuitStats
• C. Get-AzExpressRouteCircuitRouteTable
• D. Get-AzExpressRouteCircuit

Answer: B

NEW QUESTION 3
A company has users in Azure Active Directory (Azure AD). The company enables the users to use Azure AD multi-factor authentication (MFA).
A user named User1 reports they receive the following error while setting up additional security verification settings for MFA:
Sorry! We can't process your request. Your session is invalid or expired. There was an error processing your request because your session is invalid or expired. Please try again.
You need to help the user complete the MFA setup. What should you do?

• A. From the Microsoft 365 Admin portal, clear the Block this user from signing in option for the user.
• B. Instruct the user to complete the setup process within 10 minutes.
• C. Instruct the user to enter the correct verification code.
• D. Instruct the user to clear their web browser cache.
• E. From the Azure AD portal, reset the user's password.

Answer: E

NEW QUESTION 4
A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).
A new subnet should be unreachable from the on-premises network. You need to implement a solution.
Solution: Configure subnet delegation. Does the solution meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 5
A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.
The company reports that the Azure VM backup job is failing. You need to troubleshoot the issue.
Solution: Configure the retention range for the current VM backup policy. Does the solution meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 6
A company deploys an Azure Firewall. The company reports the following log entry:

For each of the following questions, select Yes or No.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 7
A company develops an Azure Cosmos DB solution. The solution has the following components:
A virtual network named VNet1 in a resource group named RG1.
A subnet named Subnet1 in VNet1.
A Private Link service.
The company is unable to configure a source IP address for the Private Link service from Subnet1. You need to resolve the issue for Subnet1.
How should you complete the PowerShell commands?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 8
A company enables just-in-time (JIT) virtual machine (VM) access in Azure.
An administrator observes a list of VMs on the Unsupported tab of the JIT VM access page in the Microsoft Defender for Cloud portal.
You need to determine why some VMs are not supported for JIT VM access. What should you conclude?

• A. The administrator is using the Microsoft Defender for Cloud free tier.
• B. The VMs were provisioned by using a classic deployment.
• C. The administrator does not have the SecurityReader role.
• D. The administrator does not have permissions to request JIT access to the VMs.

Answer: B

NEW QUESTION 9
A company plans to use an Azure PaaS service by using Azure Private Link service. The azure Private Link service and an endpoint have been configured.
The company reports that the endpoint is unable to connect to the service. You need to resolve the connectivity issue.
What should you do?

• A. Disable the endpoint network policies.
• B. Validate the VPN device.
• C. Approve the connection state.
• D. Disable the service network policies.

Answer: D

NEW QUESTION 10
A company uses public Azure DNS zones.
The company reports DNS record creation and name resolution issues. You need to troubleshoot the issues.
What are the causes of the issues?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 11
A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a network security group (NSG) with all of the subnets.
Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named VNet2. Virtual network peering is enabled between VNet1 and VNet2.
You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet. You discover that FlowLog1 is not reporting outbound flow traffic.
You need to resolve the issue with FlowLog1. What should you do?

• A. Configure FlowLog1 for version 2.
• B. Create the storage account for FlowLog1 as a premium block blob.
• C. Configure the FlowTimeoutInMinutes property on VNet2 to a non-null value.
• D. Enable FlowLog1 in a network security group associated with the network interface of VM1.

Answer: A

NEW QUESTION 12
A company uses an Azure VPN gateway with an IP address of 203.0.113.20. Users report that the VPN connection frequently drops.
You need to determine when each connection failure occurred. How should you complete the Azure Monitor query?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 13
A company deploys Azure Bastion to connect to their virtual machine (VM) infrastructure.
An engineer attempts to connect to a Windows VM by using Remote Desktop Protocol (RDP). The connection fails.
You need to troubleshoot the issue. Which two actions should you perform?

• A. Monitor traffic with the following PowerShell cmdlet Test-AzNetworkWatcherConnectivity.
• B. Configure Azure Bastion with static assignment.
• C. Apply a network security group on the same subnet as Azure Bastion.
• D. Run the Network Watcher Connection troubleshoot service.
• E. Monitor traffic with the following PowerShell cmdlet New-AzNetworkWatcherFlowLog.

Answer: BE

NEW QUESTION 14
A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR). An administrator receives an error that password writeback cloud not be enabled during the Azure AD Connect configuration. The administrator observes the following event log error:
Error getting auth token
You need to resolve the issue.
Solution: Use a global administrator account that is not federated to configure Azure AD Connect. Does the solution meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 15
A company uses Azure Backup Agent to back up specific files and folders from an on-premises virtual machine (VM).
An administrator reports that the backup job is transferring files slowly. You determine that the backup job is verifying changes in directories by scanning the entire volume.
You need to determine the state of the backup job. In which state will the backups occur?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 16
A company implements self-service password reset (SSPR).
After a firewall upgrade at the company's datacenter, SSPR stops working. You need to resolve the issue.
Which two URLs must be present on the firewalls to allow SSPR to connect?

• A. *.update.microsoft.com
• B. *.servicebus.windows.net
• C. *.passwordreset.onmicrosoft.com
• D. *.svc.ms
• E. *.adl.windows.com

Answer: AE

NEW QUESTION 17
......