WGU E031 TASK 1 CAPSTONE
PROJECT PROPOSAL | SECURE
AZURE HYBRID-CLOUD
LATEST MOCK PRACTICE SET
140 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E031 TASK 1 CAPSTONE PROJECT PROPOSAL | SECURE AZURE HYBRID-CLOUD NETWORK,
VYOS, VLANS, IPSEC VPN & NSGS | PASSED 2026. It contains 140 carefully selected questions that reflect the
most current exam content and testing strategies. Each question is accompanied by a correct answer and a
detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 140 Questions
Foundations - Application - WGU E031 TASK 1 Capstone Project Proposal Secure Azure Hybrid-cloud
Network VYOS Vlans Ipsec VPN & NSGS Passed 2026 Cloud Networking AND Security Architecture
Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Cloud Architecture AND 1-24 Azure, Ipsec, Tunnel, On-premises, Network
Azure Networking
Fundamentals
Hybrid Network Design AND 25-48 Azure, Traffic, On-premises, Network, Router
Connectivity VPN
Expressroute
Network Segmentation AND 49-72 Azure, Traffic, Network, On-premises, Ensure
VLAN Configuration
Routing AND VYOS 73-96 Azure, Traffic, On-premises, Network, Ipsec
Configuration
Security Group 97-120 Azure, Network, Traffic, Configuration, On-premises
Implementation AND NSG
Rules
Ipsec VPN Configuration 121-140 Azure, Network, On-premises, Ipsec, Ensure
AND Troubleshooting
TOTAL 140 All questions include answers and detailed rationales
,Section A - Cloud Architecture AND Azure Networking
Fundamentals
Q1.
In an Azure hybrid-cloud network, a VyOS instance is deployed to connect on-premises
and Azure VNets. Which routing approach ensures that traffic between the on-premises
network and Azure VNets uses the IPsec tunnel while allowing VNet-to-VNet traffic to stay
within Azure?
A. Configure VyOS with BGP to advertise B. Create user-defined routes (UDRs) on
on-premises prefixes to Azure and rely on Azure subnets that force all traffic to the
Azure Route Server for dynamic routing. VyOS NVA, with VyOS performing IPsec
encapsulation for on-premises destinations
and direct forwarding for VNet destinations.
C. Implement Azure Route Server and D. Set up VNet peering between all VNets
attach it to the gateway subnet, delegating and the on-premises network via
all routing decisions to the Route Server. ExpressRoute, bypassing VyOS for
VNet-to-VNet traffic.
Correct: B - Create user-defined routes (UDRs) on Azure subnets that force all traffic to
the VyOS NVA, with VyOS performing IPsec encapsulation for on-premises destinations
and direct forwarding for VNet destinations.
Rationale:UDRs on Azure subnets direct traffic to the VyOS NVA, which then applies IPsec
for on-premises destinations and routes VNet-to-VNet traffic natively. Option A is incorrect
because BGP alone does not control Azure internal routing. Option C misplaces Route
Server, which is not a replacement for NVA routing. Option D eliminates the IPsec tunnel
requirement.
Q2.
When designing VLANs for an Azure hybrid network using VyOS, which consideration is
critical for ensuring that broadcast domains are correctly mapped to Azure virtual
networks?
A. Assign each VLAN a unique subnet and B. Use the same VLAN ID across all Azure
ensure that VyOS has a virtual interface VNets to simplify configuration and reduce
(VIF) for each VLAN, with Azure VNet overhead.
address spaces matching those subnets.
C. Configure Azure VNet peering to D. Enable VLAN trunking on Azure virtual
propagate VLAN tags across VNets. switches to allow multiple VLANs per
subnet.
Correct: A - Assign each VLAN a unique subnet and ensure that VyOS has a virtual
interface (VIF) for each VLAN, with Azure VNet address spaces matching those subnets.
Page 3
, Section A - Cloud Architecture AND Azure Networking Fundamentals
Rationale: Each VLAN must correspond to a distinct subnet and VIF on VyOS, and Azure
VNet address spaces must align to avoid overlapping broadcast domains. Option B is wrong
because VLAN IDs must be unique per segment. Option C is incorrect because VNet peering
does not carry VLAN tags. Option D is invalid because Azure does not support VLAN trunking
on virtual switches.
Q3.
In a VyOS-based IPsec VPN, which parameter ensures that the tunnel can negotiate a
shared key without exposing the pre-shared key in transit?
A. Using IKEv2 with certificate-based B. Enabling Perfect Forward Secrecy (PFS)
authentication instead of pre-shared keys. on the IKE phase.
C. Configuring the VPN to use Aggressive D. Setting the lifetime to a high value to
Mode with pre-shared keys. reduce rekey frequency.
Correct: A - Using IKEv2 with certificate-based authentication instead of pre-shared keys.
Rationale:Certificate-based authentication (IKEv2) eliminates the need to transmit a
pre-shared key, as authentication is based on digital certificates. PFS (option B) protects
session keys but does not address key exchange security. Aggressive Mode (option C) is less
secure and can expose the PSK. Lifetime (option D) does not affect key transmission.
Q4.
Given the following Azure NSG rule priorities, which traffic flow will be permitted or
denied? Priority 100: Allow inbound from VirtualNetwork to VirtualNetwork. Priority 200:
Deny inbound from Internet to 10.0.1.0/24. Priority 300: Allow inbound from 203.0.113.0/24
to 10.0.1.0/24. A packet arrives from the internet (source IP 198.51.100.5) destined to
10.0.1.10.
A. Permitted because rule 300 allows the B. Denied because rule 200 explicitly denies
specific IP range. internet traffic to that subnet.
C. Permitted because rule 100 allows all D. Denied because rule 300 is lower priority
virtual network traffic. and overrides rule 200.
Correct: B - Denied because rule 200 explicitly denies internet traffic to that subnet.
Rationale:NSG rules are evaluated in priority order; rule 200 (priority 200) matches the
internet source and denies the traffic before rule 300 (priority 300) can be considered. Rule
100 does not apply because the source is not in the VirtualNetwork. Option D is incorrect
because higher priority (lower number) is applied first.
Q5.
Which Azure component is essential for monitoring and logging IPsec tunnel status in a
hybrid network, and what is its primary function?
Page 4
PROJECT PROPOSAL | SECURE
AZURE HYBRID-CLOUD
LATEST MOCK PRACTICE SET
140 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E031 TASK 1 CAPSTONE PROJECT PROPOSAL | SECURE AZURE HYBRID-CLOUD NETWORK,
VYOS, VLANS, IPSEC VPN & NSGS | PASSED 2026. It contains 140 carefully selected questions that reflect the
most current exam content and testing strategies. Each question is accompanied by a correct answer and a
detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 140 Questions
Foundations - Application - WGU E031 TASK 1 Capstone Project Proposal Secure Azure Hybrid-cloud
Network VYOS Vlans Ipsec VPN & NSGS Passed 2026 Cloud Networking AND Security Architecture
Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Cloud Architecture AND 1-24 Azure, Ipsec, Tunnel, On-premises, Network
Azure Networking
Fundamentals
Hybrid Network Design AND 25-48 Azure, Traffic, On-premises, Network, Router
Connectivity VPN
Expressroute
Network Segmentation AND 49-72 Azure, Traffic, Network, On-premises, Ensure
VLAN Configuration
Routing AND VYOS 73-96 Azure, Traffic, On-premises, Network, Ipsec
Configuration
Security Group 97-120 Azure, Network, Traffic, Configuration, On-premises
Implementation AND NSG
Rules
Ipsec VPN Configuration 121-140 Azure, Network, On-premises, Ipsec, Ensure
AND Troubleshooting
TOTAL 140 All questions include answers and detailed rationales
,Section A - Cloud Architecture AND Azure Networking
Fundamentals
Q1.
In an Azure hybrid-cloud network, a VyOS instance is deployed to connect on-premises
and Azure VNets. Which routing approach ensures that traffic between the on-premises
network and Azure VNets uses the IPsec tunnel while allowing VNet-to-VNet traffic to stay
within Azure?
A. Configure VyOS with BGP to advertise B. Create user-defined routes (UDRs) on
on-premises prefixes to Azure and rely on Azure subnets that force all traffic to the
Azure Route Server for dynamic routing. VyOS NVA, with VyOS performing IPsec
encapsulation for on-premises destinations
and direct forwarding for VNet destinations.
C. Implement Azure Route Server and D. Set up VNet peering between all VNets
attach it to the gateway subnet, delegating and the on-premises network via
all routing decisions to the Route Server. ExpressRoute, bypassing VyOS for
VNet-to-VNet traffic.
Correct: B - Create user-defined routes (UDRs) on Azure subnets that force all traffic to
the VyOS NVA, with VyOS performing IPsec encapsulation for on-premises destinations
and direct forwarding for VNet destinations.
Rationale:UDRs on Azure subnets direct traffic to the VyOS NVA, which then applies IPsec
for on-premises destinations and routes VNet-to-VNet traffic natively. Option A is incorrect
because BGP alone does not control Azure internal routing. Option C misplaces Route
Server, which is not a replacement for NVA routing. Option D eliminates the IPsec tunnel
requirement.
Q2.
When designing VLANs for an Azure hybrid network using VyOS, which consideration is
critical for ensuring that broadcast domains are correctly mapped to Azure virtual
networks?
A. Assign each VLAN a unique subnet and B. Use the same VLAN ID across all Azure
ensure that VyOS has a virtual interface VNets to simplify configuration and reduce
(VIF) for each VLAN, with Azure VNet overhead.
address spaces matching those subnets.
C. Configure Azure VNet peering to D. Enable VLAN trunking on Azure virtual
propagate VLAN tags across VNets. switches to allow multiple VLANs per
subnet.
Correct: A - Assign each VLAN a unique subnet and ensure that VyOS has a virtual
interface (VIF) for each VLAN, with Azure VNet address spaces matching those subnets.
Page 3
, Section A - Cloud Architecture AND Azure Networking Fundamentals
Rationale: Each VLAN must correspond to a distinct subnet and VIF on VyOS, and Azure
VNet address spaces must align to avoid overlapping broadcast domains. Option B is wrong
because VLAN IDs must be unique per segment. Option C is incorrect because VNet peering
does not carry VLAN tags. Option D is invalid because Azure does not support VLAN trunking
on virtual switches.
Q3.
In a VyOS-based IPsec VPN, which parameter ensures that the tunnel can negotiate a
shared key without exposing the pre-shared key in transit?
A. Using IKEv2 with certificate-based B. Enabling Perfect Forward Secrecy (PFS)
authentication instead of pre-shared keys. on the IKE phase.
C. Configuring the VPN to use Aggressive D. Setting the lifetime to a high value to
Mode with pre-shared keys. reduce rekey frequency.
Correct: A - Using IKEv2 with certificate-based authentication instead of pre-shared keys.
Rationale:Certificate-based authentication (IKEv2) eliminates the need to transmit a
pre-shared key, as authentication is based on digital certificates. PFS (option B) protects
session keys but does not address key exchange security. Aggressive Mode (option C) is less
secure and can expose the PSK. Lifetime (option D) does not affect key transmission.
Q4.
Given the following Azure NSG rule priorities, which traffic flow will be permitted or
denied? Priority 100: Allow inbound from VirtualNetwork to VirtualNetwork. Priority 200:
Deny inbound from Internet to 10.0.1.0/24. Priority 300: Allow inbound from 203.0.113.0/24
to 10.0.1.0/24. A packet arrives from the internet (source IP 198.51.100.5) destined to
10.0.1.10.
A. Permitted because rule 300 allows the B. Denied because rule 200 explicitly denies
specific IP range. internet traffic to that subnet.
C. Permitted because rule 100 allows all D. Denied because rule 300 is lower priority
virtual network traffic. and overrides rule 200.
Correct: B - Denied because rule 200 explicitly denies internet traffic to that subnet.
Rationale:NSG rules are evaluated in priority order; rule 200 (priority 200) matches the
internet source and denies the traffic before rule 300 (priority 300) can be considered. Rule
100 does not apply because the source is not in the VirtualNetwork. Option D is incorrect
because higher priority (lower number) is applied first.
Q5.
Which Azure component is essential for monitoring and logging IPsec tunnel status in a
hybrid network, and what is its primary function?
Page 4
