WGU E031 TASK 2
IMPLEMENTATION &
VERIFICATION REPORT | AZURE
LATEST MOCK PRACTICE SET
140 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E031 TASK 2 IMPLEMENTATION & VERIFICATION REPORT | AZURE HYBRID CLOUD, VYOS, VLANS,
NSGS, IPSEC VPN & TESTING | PASSED 2026.. It contains 140 carefully selected questions that reflect the
most current exam content and testing strategies. Each question is accompanied by a correct answer and a
detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 140 Questions
Foundations - Application - WGU E031 TASK 2 Implementation & Verification Report Azure Hybrid Cloud
VYOS Vlans NSGS Ipsec VPN & Testing Passed 2026 Cloud Networking & Hybrid Infrastructure Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Azure Hybrid Cloud 1-24 Azure, Traffic, Router, On-premises, Network
Architecture
VYOS Configuration AND 25-48 Azure, On-premises, Network, Subnet, Ipsec
Routing
VLAN Design AND 49-72 Azure, On-premises, Traffic, Hybrid, Network
Implementation
Network Security Groups 73-96 Azure, On-premises, Traffic, Network, Hybrid
NSGS
Ipsec VPN Configuration 97-120 Azure, Traffic, Hybrid, On-premises, Ipsec
Network Testing AND 121-140 Azure, Traffic, Tunnel, On-premises, Ipsec
Verification
TOTAL 140 All questions include answers and detailed rationales
,Section A - Azure Hybrid Cloud Architecture
Q1.
In a hybrid Azure deployment, a VyOS router advertises the on-premises subnet
10.10.0.0/16 over BGP to an Azure VPN gateway. The gateway receives the route but does
not propagate it to the virtual network route table. Which configuration is the most likely
cause?
A. The VPN gateway is in active-passive B. The route is marked as a BGP route and
mode and the active instance does not have Azure does not automatically propagate
BGP enabled. BGP routes to the effective routes of a
virtual network.
C. The virtual network has a user-defined D. The VyOS router is using an AS number
route that overrides the BGP route with a that conflicts with the Azure BGP ASN,
longer prefix. causing the route to be rejected.
Correct: B - The route is marked as a BGP route and Azure does not automatically
propagate BGP routes to the effective routes of a virtual network.
Rationale:In Azure, BGP routes learned by a VPN gateway are automatically propagated to
the virtual network's effective routes, but they are not added to the route table as user-defined
routes; they appear as 'BGP' routes. Option A is plausible but not the most likely if the
gateway is functioning. Option C could override but would not prevent propagation. Option D
would cause BGP session failure, not silent route drop.
Q2.
A VyOS router is configured to perform source NAT for traffic from a trusted VLAN
(192.168.10.0/24) to the internet. However, traffic from that VLAN to a directly connected
subnet (192.168.20.0/24) is being incorrectly NATed. Which rule placement in the 'nat
source' rule set would prevent this?
A. Add a rule with destination B. Add a rule with source 192.168.10.0/24
192.168.20.0/24 and action 'accept' before and destination 192.168.20.0/24 and action
the NAT rule. 'accept' before the NAT rule.
C. Modify the existing NAT rule to exclude D. Add a rule with destination
destination 192.168.20.0/24 by using an 192.168.20.0/24 and action 'masquerade'
exclude parameter. after the NAT rule.
Correct: B - Add a rule with source 192.168.10.0/24 and destination 192.168.20.0/24 and
action 'accept' before the NAT rule.
Page 3
, Section A - Azure Hybrid Cloud Architecture
Rationale: In VyOS, source NAT rules are evaluated in order; the first matching rule with an
'accept' action bypasses NAT. Option A only specifies destination, which would also match
internet-bound traffic. Option C is not a standard VyOS feature. Option D would still NAT the
traffic, not prevent it.
Q3.
When configuring an IPsec site-to-site VPN between a VyOS router and an Azure VPN
gateway, which combination of parameters is essential for the IKE phase 1 to succeed
when using pre-shared key authentication?
A. Same encryption algorithm, integrity B. Same pre-shared key and identical local
algorithm, DH group, and pre-shared key. and remote network prefixes.
C. Same encryption algorithm, pre-shared D. Same pre-shared key and identical IPsec
key, and identical IKE lifetime. SA lifetime.
Correct: A - Same encryption algorithm, integrity algorithm, DH group, and pre-shared key.
Rationale:IKE phase 1 requires matching proposals for encryption, integrity, DH group, and
authentication method (including pre-shared key). Network prefixes are for phase 2, not
phase 1. Lifetimes can differ if the peer accepts the initiator's proposal, so C and D are not
strictly essential.
Q4.
An Azure network security group (NSG) has the following inbound rules: Rule 100 allows
from VirtualNetwork to VirtualNetwork, Rule 200 denies from Internet to any, and Rule 300
allows from 203.0.113.0/24 to 10.0.0.0/16. A packet from 203.0.113.10 to 10.0.0.5 is
evaluated. Which rule is applied and why?
A. Rule 100, because the source is part of a B. Rule 300, because it is the most specific
virtual network? No, 203.0.113.0/24 is not a match and has a higher priority number.
virtual network. The packet is denied by
Rule 200 because it comes from the
Internet.
C. Rule 200, because it matches the source D. Rule 100, because it is the first rule and
as Internet and has a lower priority number allows all virtual network traffic.
than Rule 300.
Correct: C - Rule 200, because it matches the source as Internet and has a lower priority
number than Rule 300.
Rationale:NSG rules are processed in priority order (lower number = higher priority). Rule
200 has priority 200 and matches (source Internet, destination any), so it is applied before
Rule 300 (priority 300). Rule 100 does not match because the source is not in a virtual
network. Thus the packet is denied.
Page 4
IMPLEMENTATION &
VERIFICATION REPORT | AZURE
LATEST MOCK PRACTICE SET
140 Questions with Answers and Detailed Rationales
100 PERCENT GUARANTEED PASS
INSTANT DOWNLOAD ANSWERS INCLUDED
IMPORTANCE OF THIS DOCUMENT
This comprehensive examination preparation guide has been meticulously developed to help you succeed in the
WGU E031 TASK 2 IMPLEMENTATION & VERIFICATION REPORT | AZURE HYBRID CLOUD, VYOS, VLANS,
NSGS, IPSEC VPN & TESTING | PASSED 2026.. It contains 140 carefully selected questions that reflect the
most current exam content and testing strategies. Each question is accompanied by a correct answer and a
detailed rationale that explains the underlying pathophysiology, pharmacology, or clinical reasoning.
Self-Assessment – Test your knowledge and Exam Preparation – Familiarize yourself with the
identify areas requiring further question format and content
study areas
Concept Reinforcement – Deepen your Confidence Building – Develop test-taking
understanding through strategies and reduce
evidence-based exam anxiety
rationales
Time Management – Practice answering
questions under simulated
exam conditions
Review Summary 140 Questions
Foundations - Application - WGU E031 TASK 2 Implementation & Verification Report Azure Hybrid Cloud
VYOS Vlans NSGS Ipsec VPN & Testing Passed 2026 Cloud Networking & Hybrid Infrastructure Graduate
All answers with rationales
,Table of Contents
Content Area Questions Key Topics
Azure Hybrid Cloud 1-24 Azure, Traffic, Router, On-premises, Network
Architecture
VYOS Configuration AND 25-48 Azure, On-premises, Network, Subnet, Ipsec
Routing
VLAN Design AND 49-72 Azure, On-premises, Traffic, Hybrid, Network
Implementation
Network Security Groups 73-96 Azure, On-premises, Traffic, Network, Hybrid
NSGS
Ipsec VPN Configuration 97-120 Azure, Traffic, Hybrid, On-premises, Ipsec
Network Testing AND 121-140 Azure, Traffic, Tunnel, On-premises, Ipsec
Verification
TOTAL 140 All questions include answers and detailed rationales
,Section A - Azure Hybrid Cloud Architecture
Q1.
In a hybrid Azure deployment, a VyOS router advertises the on-premises subnet
10.10.0.0/16 over BGP to an Azure VPN gateway. The gateway receives the route but does
not propagate it to the virtual network route table. Which configuration is the most likely
cause?
A. The VPN gateway is in active-passive B. The route is marked as a BGP route and
mode and the active instance does not have Azure does not automatically propagate
BGP enabled. BGP routes to the effective routes of a
virtual network.
C. The virtual network has a user-defined D. The VyOS router is using an AS number
route that overrides the BGP route with a that conflicts with the Azure BGP ASN,
longer prefix. causing the route to be rejected.
Correct: B - The route is marked as a BGP route and Azure does not automatically
propagate BGP routes to the effective routes of a virtual network.
Rationale:In Azure, BGP routes learned by a VPN gateway are automatically propagated to
the virtual network's effective routes, but they are not added to the route table as user-defined
routes; they appear as 'BGP' routes. Option A is plausible but not the most likely if the
gateway is functioning. Option C could override but would not prevent propagation. Option D
would cause BGP session failure, not silent route drop.
Q2.
A VyOS router is configured to perform source NAT for traffic from a trusted VLAN
(192.168.10.0/24) to the internet. However, traffic from that VLAN to a directly connected
subnet (192.168.20.0/24) is being incorrectly NATed. Which rule placement in the 'nat
source' rule set would prevent this?
A. Add a rule with destination B. Add a rule with source 192.168.10.0/24
192.168.20.0/24 and action 'accept' before and destination 192.168.20.0/24 and action
the NAT rule. 'accept' before the NAT rule.
C. Modify the existing NAT rule to exclude D. Add a rule with destination
destination 192.168.20.0/24 by using an 192.168.20.0/24 and action 'masquerade'
exclude parameter. after the NAT rule.
Correct: B - Add a rule with source 192.168.10.0/24 and destination 192.168.20.0/24 and
action 'accept' before the NAT rule.
Page 3
, Section A - Azure Hybrid Cloud Architecture
Rationale: In VyOS, source NAT rules are evaluated in order; the first matching rule with an
'accept' action bypasses NAT. Option A only specifies destination, which would also match
internet-bound traffic. Option C is not a standard VyOS feature. Option D would still NAT the
traffic, not prevent it.
Q3.
When configuring an IPsec site-to-site VPN between a VyOS router and an Azure VPN
gateway, which combination of parameters is essential for the IKE phase 1 to succeed
when using pre-shared key authentication?
A. Same encryption algorithm, integrity B. Same pre-shared key and identical local
algorithm, DH group, and pre-shared key. and remote network prefixes.
C. Same encryption algorithm, pre-shared D. Same pre-shared key and identical IPsec
key, and identical IKE lifetime. SA lifetime.
Correct: A - Same encryption algorithm, integrity algorithm, DH group, and pre-shared key.
Rationale:IKE phase 1 requires matching proposals for encryption, integrity, DH group, and
authentication method (including pre-shared key). Network prefixes are for phase 2, not
phase 1. Lifetimes can differ if the peer accepts the initiator's proposal, so C and D are not
strictly essential.
Q4.
An Azure network security group (NSG) has the following inbound rules: Rule 100 allows
from VirtualNetwork to VirtualNetwork, Rule 200 denies from Internet to any, and Rule 300
allows from 203.0.113.0/24 to 10.0.0.0/16. A packet from 203.0.113.10 to 10.0.0.5 is
evaluated. Which rule is applied and why?
A. Rule 100, because the source is part of a B. Rule 300, because it is the most specific
virtual network? No, 203.0.113.0/24 is not a match and has a higher priority number.
virtual network. The packet is denied by
Rule 200 because it comes from the
Internet.
C. Rule 200, because it matches the source D. Rule 100, because it is the first rule and
as Internet and has a lower priority number allows all virtual network traffic.
than Rule 300.
Correct: C - Rule 200, because it matches the source as Internet and has a lower priority
number than Rule 300.
Rationale:NSG rules are processed in priority order (lower number = higher priority). Rule
200 has priority 200 and matches (source Internet, destination any), so it is applied before
Rule 300 (priority 300). Rule 100 does not match because the source is not in a virtual
network. Thus the packet is denied.
Page 4
