Centralizing Shared Network Services GCAD Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is a security consideration when centralizing DNS services?

   • ADNS queries should be sent in plaintext to simplify troubleshooting.
   • BDNS delegation should be avoided to maintain central control.
   • CDNS traffic should be allowed to traverse any network path without restriction.
   • DDNS servers should be protected from unauthorized access and tampering.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company is using Azure VMs in a hub-and-spoke topology. They want to centralize DHCP management but are aware that Azure VMs use platform DHCP. They need to ensure that VMs receive consistent DNS settings and that IP assignments are tracked centrally. What is the best way to achieve this?

   • AUse static IP addresses for all VMs and manage them in an external IPAM tool.
   • BDeploy a DHCP server VM in the hub and configure it as the DHCP server for all subnets.
   • CUse Azure Firewall as a DHCP server.
   • DConfigure custom DNS servers on each VNet and use Azure's built-in DHCP to assign IPs.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is centralizing DNS services for a large multi-region cloud deployment. They want to ensure high availability and low latency for DNS resolution. They are considering using cloud provider native DNS services. What is the best approach?

   • AConfigure each VNet to use its own DNS server and rely on the cloud provider's default DNS for redundancy.
   • BUse a third-party DNS service that supports anycast and configure it with the same records.
   • CUse the cloud provider's managed DNS service (e.g., Azure DNS, AWS Route 53) and configure it with multiple records and health checks.
   • DDeploy a pair of DNS server VMs in each region and use a global load balancer to distribute queries.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A multinational company is centralizing identity for network access. They have offices in the EU and US, and must comply with GDPR data residency for EU user data. They want to use a single identity provider for both VPN and cloud access. What is the best approach?

   • AUse a single Azure AD tenant with data residency in the EU region, and synchronize users from both regions.
   • BDeploy separate Azure AD tenants for EU and US users, with no synchronization.
   • CDeploy a single Azure AD tenant with users synchronized from both regions, storing all data in the US region.
   • DUse on-premises AD for EU users and Azure AD for US users.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security operations center (SOC) needs to collect network flow logs, firewall logs, and DNS logs from multiple cloud accounts and on-premises systems into a single SIEM. The company has a compliance requirement to retain logs for one year. What is the most appropriate architecture?

   • AConfigure each cloud account to send logs directly to the SIEM vendor's cloud, and store on-premises logs locally.
   • BUse a central log aggregation account with a log analytics workspace, and configure diagnostic settings to send all relevant logs there.
   • CEnable Azure Monitor for all VMs and rely on its default settings for log retention.
   • DStore logs in each account's own storage account and have the SIEM query them individually.
   Reveal Solution Discussion Select an answer first