Free AZ-700 Exam Dumps Preview

WAF policy settings control policy-wide behavior such as its operating state and mode; they do not define a per-client request threshold. Rate limiting is implemented through a custom rule that evaluates request rates and applies an action when the threshold is exceeded. Modifying only the policy settings therefore does not meet the goal.

The allow rule uses Vnet1's address range as the source and Sql.EastUS as the destination, permitting access specifically to Azure SQL in East US. The separate deny rule uses the same source scope and Storage as the destination, preventing access to Azure Storage. Rule priorities must place these explicit controls appropriately so the required SQL traffic is allowed and Storage traffic is denied.

A NAT gateway allocates its available SNAT connections from the ports associated with its public IP resources. Adding another public IP address expands that SNAT port pool, allowing more simultaneous outbound flows during peak usage. Binding the gateway to another subnet does not increase the port capacity available to the existing session hosts.

Box 1: https: Verify the Azure gateway health probe Open health probe by browsing to the following URL:

https://<YourVirtualNetworkGatewayIP>:8081/healthprobe
For Active/Acive gateways use the following to check the second public IP:
https://<YourVirtualNetworkGatewayIP2>:8083/healthprobe

Box 2: 8081

References:
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect

Network Performance Monitor measures network performance across hybrid paths, including the connection between an on-premises network and Azure virtual machines. It can track latency over time instead of performing only a single connection test. Effective routes describe routing decisions, while Service Map describes dependencies rather than the end-to-end network latency requirement.

Each office will have its own ExpressRoute circuit to a nearby Azure region, but ordinary circuit connectivity does not create a path between the two on-premises sites. ExpressRoute Global Reach connects the private peering of the circuits, allowing the Amsterdam and New York on-premises networks to communicate through Microsoft's network. The other options do not join the sites.

Azure Firewall Standard supports threat intelligence filtering, so AzFW1 can use that feature without changing tiers. TLS inspection and the network intrusion detection and prevention system are Premium capabilities. Because AzFW1 is Standard, those two features cannot be enabled on the existing instance, leaving threat intelligence as the only listed supported capability.

A Standard public load balancer must use a Standard SKU public IP address in the load balancer's region, and that address must use static assignment. IP3 and IP5 satisfy all three conditions: both are Standard, static, and located in West US. IP1 is Basic, IP2 is Basic and dynamic, and IP4 is both Basic and in West US 2.

FD1 must connect privately to App1 while remaining the internet-facing entry point. Configuring an origin with Azure Private Link enabled makes Front Door send origin traffic to App1 through its private connectivity path. Routes select and forward requests to that origin, but a redirect or security policy would not establish the private origin connection.

NSG processing for traffic addressed to a private endpoint requires private endpoint network policies on its subnet. Configuring that policy on Subnet1 allows NSG rules to control connections arriving from Site1 over the VPN. A route table, NAT gateway, or subnet delegation does not first enable NSG enforcement for the endpoint.

The X-Forwarded-For client request header field with the client_ip variable (see explanation later in this table) appended to it in the format IP1, IP2, IP3, and so on. If the X-Forwarded-For field isn't in the client request header, the add_x_forwarded_for_proxy variable is equal to the $client_ip variable. This variable is particularly useful when you want to rewrite the X-Forwarded-For header set by Application Gateway so that the header contains only the IP address without the port information.

https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url

Azure gateway resources require a dedicated subnet with the exact name GatewaySubnet. Create that subnet inside VNET2 and assign an address range large enough for both the VPN gateway and the ExpressRoute gateway; a /27 or larger range provides the planned gateway capacity. Preparing this reserved subnet is the virtual-network change required before the two gateway resources can be deployed.

The performance routing method directs a DNS query to the available endpoint expected to provide the lowest network latency for that user. This matches the requirement to choose among identical App Service deployments in ten regions by latency. Geographic routing follows location mappings, weighted routing follows configured proportions, and priority routing implements ordered failover.

VM2 has a direct peering path to VM1 through the bidirectional VNet1-VNet2 peering. Gateway transit on that peering lets VNet2 use VNet1's VPN gateway, extending VM2's reach to the on-premise datacenter. VM2 also has a separate bidirectional peering between VNet2 and VNet3, which provides a direct path to VM3 without relying on transitive peering.

Border Gateway Protocol exchanges reachability information over the ExpressRoute connections and can prefer the path to the closest on-premises site. If that site fails, its routes are withdrawn and BGP selects the remaining advertised path through the other site. HSRP and VRRP provide local first-hop gateway redundancy rather than routing between these sites and Azure regions.

Box 1: 1
How many origins and origin groups should I create?
An origin group represents a set of origins that are functionally able to serve the same kinds of requests.
You should use a separate origin group for each distinct application or workload.

For example, suppose you host an application on Azure App Service. The way that you configure Front Door depends on how many application instances you deploy:

* Multi-region active/passive deployment: Create a single origin group. Within that origin group, create an origin for each of the App Service apps. Configure each origin's priority to ensure that the primary application has a higher priority than the secondary application.

* Multi-region active/active deployment: Create a single origin group. Within that origin group, create an origin for each of the App Service apps. Configure each origin's priority to be the same. Configure each origin's weight to set the proportion of requests that should go to that origin.

* Single-region deployment: Create a single origin group.

Box 2: 8
Within an origin group, create an origin for each distinct server or service instance that can serve requests.

Note:
Origin
An origin refers to the application deployment that Azure Front Door retrieves contents from when caching isn't enabled or when a cache gets missed. Azure Front Door supports origins hosted in Azure and applications hosted in your on-premises datacenter or with another cloud provider. An origin shouldn't be confused with your database tier or storage tier. The origin should be viewed as the endpoint for your application backend.

Origin group
An origin group in Azure Front Door refers to a set of origins that receives similar traffic for their application. You can define the origin group as a logical grouping of your application instances across the world that receives the same traffic and responds with an expected behavior. These origins can be deployed across different regions or within the same region. All origins can be deployed in an Active/Active or Active/Passive configuration.

An origin group defines how origins get evaluated by health probes. It also defines the load balancing method between them.

References:
https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq
https://learn.microsoft.com/en-us/azure/frontdoor/origin

The existing Microsoft.Storage service endpoint is regional. Access through a service endpoint to the read-access geo-redundant secondary requires the global storage endpoint configuration, and the regional and global storage endpoint types cannot remain configured together on the subnet. Delete the existing endpoint first, then configure the required global endpoint.

A RADIUS server can validate VPN credentials against the on-premises Active Directory domain and return the authentication result to the Point-to-Site VPN gateway. This provides the required bridge between OpenVPN authentication and the existing domain identities. A certification authority would support certificate authentication, not authentication with Active Directory credentials.

Gateway transit is already configured for the peering, but Client1 must also have a route for Vnet2 in its Point-to-Site configuration. Enabling BGP on the Vnet1 gateway does not update the routes in the configuration already installed on the client. Consequently, this change alone does not enable Client1 to reach Vnet2.

Azure Firewall must be deployed in a dedicated subnet whose reserved name is exactly AzureFirewallSubnet. The service uses that subnet for its firewall instances and network interfaces. Generic names such as Default, DMZsubnet, or FirewallSubnet do not satisfy the naming requirement for an Azure Firewall deployment.

Bidirectional Forwarding Detection runs between the routers to detect forwarding-path failures much faster than normal routing-protocol timeout intervals. Configuring BFD on the DC1 routers enables rapid withdrawal and use of the surviving ExpressRoute link, meeting the subsecond failover requirement. FastPath changes data forwarding, not link-failure detection.

A service endpoint policy can restrict traffic from Subnet1 to specifically authorized Azure Storage resources, so VM1 and VM2 can be limited to storage1 instead of reaching every storage account. The storage account can retain its public endpoint and remain internet-accessible. A private endpoint would instead introduce private access and would not satisfy that public-access condition by itself.

References:
https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

Box 1: A private endpoint Traffic from SQLMIT to storage1

Private endpoints A private endpoint is an optional fixed IP address in another virtual network that conducts traffic to your SQL managed instance. One Azure SQL Managed Instance can have multiple private endpoints in multiple virtual networks. Private endpoints allow TDS traffic only to reach SQL Managed Instance on port 1433 and can't be used for integration scenarios, such as failover groups, Managed Instance link, and other similar technologies.

When connecting to a private endpoint, always use the domain name since connecting to Azure SQL Managed Instance via its IP address isn't supported yet.

Private Link is Azure technology that makes Azure SQL Managed Instance available in a virtual network of your choice. A network administrator can establish a private endpoint to Azure SQL Managed Instance in their virtual network, while the SQL administrator chooses to accept or reject the endpoint before it becomes active. Private endpoints establish secure, isolated connectivity between a service and multiple virtual networks without exposing your service's entire network infrastructure.

Box 2: A service endpoint policy Traffic from domain joined servers on VNet2 to storage

Virtual network service endpoint policies for Azure Storage Virtual Network service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts over service endpoint, and allow data exfiltration to only specific Azure Storage accounts. Endpoint policies provide granular access control for virtual network traffic to Azure Storage when connecting over service endpoint.

Incorrect:
* Microsoft Entra Private Access Microsoft Entra Private Access unlocks the ability to specify the fully qualified domain names (FQDNs) and IP addresses that you consider private or internal, so you can manage how your organization accesses them. With Private Access, you can modernize how your organization's users access private apps and resources. Remote workers don't need to use a VPN to access these resources if they have the Global Secure Access Client installed. The client quietly and seamlessly connects them to the resources they need.

Private Access provides two ways to configure the private resources that you want to tunnel through the service. You can configure Quick Access, which is the primary group of FQDNs and IP addresses that you want to secure. You can also configure a Global Secure Access app for per-app access, which allows you to specify a subset of private resources that you want to secure. The Global Secure Access app provides a granular approach to securing your private resources.

References:
https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/connectivity-architecture-overview
https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/private-endpoint-overview

For end-to-end encryption, APPGW1 must establish TLS to the backend and validate the certificate presented by that backend. Uploading the internal root CA certificate in Backend settings establishes the required trust for certificates issued by that CA. A client certificate belongs to client authentication, while uploading a wildcard certificate with its private key does not configure trust in the backend's certificate chain.

Restricting the firewall on storage1 controls which networks may connect inbound to storage1. It does not stop VM1 from initiating connections to storage2 or storage3, because their firewall settings and the subnet's outbound policy remain unchanged. The solution therefore permits storage1 access but fails to enforce the required prohibition against every other storage account.

Box 1: New-AzIpsecPolicy

Configure IPsec/IKE policy for S2S (Site-to-Site) VPN or VNet-to-VNet connections.

Create an S2S VPN connection with an IPsec/IKE policy

1. Create an IPsec/IKE policy

The following sample script creates an IPsec/IKE policy with the following algorithms and parameters:

• IKEv2: AES256, SHA384, DHGroup24
• IPsec: AES256, SHA256, PFS None, SA Lifetime 14400 seconds & 102400000 KB

• $ipsecpolicy6 = New-AzIpsecPolicy -IkeEncryption AES256 -IkeIntegrity SHA384 -DhGroup DHGroup24 -IpsecEncryption AES256 -IpsecIntegrity SHA256 -PfsGroup None -SALifeTimeSeconds 14400 -SADataSizeKilobytes 102400000

2. Create the S2S VPN connection with the IPsec/IKE policy

Create an S2S VPN connection and apply the IPsec/IKE policy created earlier.

$vnet1gw = Get-AzVirtualNetworkGateway -Name $GWName1 -ResourceGroupName $RG1

$lng6 = Get-AzLocalNetworkGateway -Name $LNGName6 -ResourceGroupName $RG1

New-AzVirtualNetworkGatewayConnection -Name $Connection16 -ResourceGroupName $RG1 -Location $Location1 -VirtualNetworkGateway1 $vnet1gw -LocalNetworkGateway2 $lng6 -ConnectionType IPsec -SharedKey 'AzureA1b2C3' -IpsecPolicies $ipsecpolicy6

Box 2: New-AzVirtualNetworkGatewayConnection

ExpressRoute FastPath requires a gateway SKU that supports the feature, while resilience to a single datacenter failure requires a zone-redundant SKU. ErGw3AZ combines the necessary FastPath-capable capacity with availability-zone deployment. The non-AZ performance SKUs do not meet the stated zone-resiliency requirement.

Box 1: Three ExpressRoute Standard circuits

Maintain connectivity to the virtual machines if two availability zones fail. Support 1000-Mbps connections. Minimize costs.

Availability Zone-aware ExpressRoute virtual network gateways

An Availability Zone in an Azure region is a combination of a fault domain and an update domain. If you opt for a zone-redundant Azure IaaS deployment, you may also want to configure zone-redundant virtual network gateways that terminate ExpressRoute private peering.

Incorrect:

• Premium is not required.
• 1000 Mbps is supported by ExpressRoute Standard.

Note: Connectivity for an ExpressRoute circuit is limited to a single geopolitical region. Connectivity can be expanded across geopolitical regions by enabling the ExpressRoute Premium add-on.

Box 2: One ExpressRoute gateway of the ErGw1Az SKU

Zone-redundant gateways

To automatically deploy your virtual network gateway across availability zones, you can use a zone-redundant ExpressRoute virtual network gateway. Zone-redundant ExpressRoute gateway instances are distributed across multiple availability zones and provide resiliency against a zone-level failure.

Feature support by gateway SKU

The ErGw1Az SKU supports up to 1,000 Mbps and is the lowest-cost availability zone-enabled ExpressRoute gateway SKU that meets the 1000-Mbps requirement.

References:

https://learn.microsoft.com/en-us/azure/vpn-gateway/about-zone-redundant-vnet-gateways

https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways

The internet destination is represented by the default prefix 0.0.0.0/0. A route for that prefix with Virtual appliance as the next-hop type and 10.3.2.100 as the next-hop address redirects internet-bound packets to the inspection appliance. Associating the route table with subnet3-1 applies the route to traffic leaving that source subnet.

An Azure Private Link service publishes a service through the frontend configuration of an Azure load balancer. VM1 must therefore first be placed behind that load balancer in Sub1, after which the Private Link service can expose the frontend to private endpoints in Sub2. DNS zones and private endpoints are consumer-side components, not the service foundation.

Box 1: 2
Need one profile for each region.

Note: Azure Traffic Manager supports six traffic-routing methods to determine how to route network traffic to the various service endpoints. For any profile, Traffic Manager applies the traffic-routing method associated to it to each DNS query it receives. The traffic-routing method determines which endpoint is returned in the DNS response.

Box 2: Geographic
The following traffic routing methods are available in Traffic Manager:

* Geographic: Select Geographic routing to direct users to specific endpoints (Azure, External, or Nested) based on where their DNS queries originate from geographically. With this routing method, it enables you to be in compliance with scenarios such as data sovereignty mandates, localization of content & user experience and measuring traffic from different regions.

* Priority: Select Priority routing when you want to have a primary service endpoint for all traffic. You can provide multiple backup endpoints in case the primary or one of the backup endpoints is unavailable.

* Weighted: Select Weighted routing when you want to distribute traffic across a set of endpoints based on their weight. Set the weight the same to distribute evenly across all endpoints.

* Performance: Select Performance routing when you have endpoints in different geographic locations and you want end users to use the "closest" endpoint for the lowest network latency.

* Etc.

References:
https://learn.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

An AFD1 rule-set rule modifies request or response processing and routing behavior; it is not the WAF control that counts incoming requests against a threshold. Rate limiting must be defined as a custom rule in the associated WAF policy. Adding a rule only to the Front Door rule set therefore does not meet the goal.

Both rules use backend port 80 for the same VM network interfaces while presenting different frontend IP addresses. Enabling Floating IP permits that backend port to participate in rules for the separate frontend addresses without rewriting the destination to a conflicting backend configuration. Session persistence controls how repeated client flows are distributed and does not enable this frontend-IP and backend-port arrangement.

Box 1: 200
RC1 Network

Rule collection groups
A rule collection group is used to group rule collections. They're the first unit to be processed by the Azure Firewall and they follow a priority order based on values. There are three default rule collection groups, and their priority values are preset by design. They're processed in the following order:

* Default Network rule collection group
Priority: 200

Box 2: 300
RC2 Application
Default Application rule collection group
300

Box 3: 100
RC3 DNAT

* Default DNAT (Destination Network Address Translation) rule collection group
Priority 100

Note:

References:
https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets

Traffic Manager decides whether an endpoint remains eligible by probing it and evaluating the configured endpoint monitoring behavior. Its endpoint monitor settings control the health-check parameters and failure threshold that trigger removal of the active endpoint and use of the standby region. SQL failover groups govern the database tier, not front-end Traffic Manager failover.

The reachability report workflow requires a supported provider and location to be identified before latency measurements are requested. Get-AzNetworkWatcherReachabilityProvidersList returns the available providers and geographic locations that can be used for the Seattle source. Those values can then be used to generate reports comparing the on-premises location with West US 2 and East US 2 without deploying another Network Watcher resource.

Resetting the Vnet1 gateway restarts the gateway but does not add Vnet2's address space to the routes used by Client1. The Point-to-Site client configuration predates the peering change, so the client still lacks the route needed to send Vnet2 traffic through the VPN. A gateway reset therefore does not meet the communication requirement.

Traffic from HP1 to App1 uses HTTPS, so the payload is encrypted and cannot be fully inspected by IDPS unless TLS inspection is enabled on FW1. Azure Firewall Premium TLS inspection requires a certificate stored in Azure Key Vault. FW1 uses this certificate to decrypt outbound TLS traffic, inspect the unencrypted content for threats with IDPS, and then re-encrypt the traffic before forwarding it to Server1.

Connection Troubleshoot performs an on-demand connectivity test from the virtual machine to a specified destination and port. It can determine whether the external host is reachable and report network conditions that prevent the outbound connection. Next hop only identifies a routing target, while flow logs and Traffic Analytics analyze recorded traffic rather than directly validating the requested connection.

Box 1: Yes
Move an Azure virtual network to another region by using Azure PowerShell.
There are various scenarios for moving an existing Azure virtual network from one region to another. For example, you might want to create a virtual network with the same configuration for testing and availability as your existing virtual network. Or you might want to move a production virtual network to another region as part of your disaster recovery planning.

You can use an Azure Resource Manager template to complete the move of the virtual network to another region. You do this by exporting the virtual network to a template, modifying the parameters to match the destination region, and then deploying the template to the new region.

Move networking resources to new resource group or subscription.
You can move virtual networks and other networking resources to a new resource group or Azure subscription.
Azure Resource Mover helps you move Azure resources between Azure regions.

All Azure resources are created in an Azure region and subscription. A resource can only be created in a virtual network that exists in the same region and subscription as the resource.

Note: VNet1 is in East US. Vnet1 is in RG1. RG1 is in East US.
RG3 is in UK West.

Box 2: No
VNet1 is the only virtual network in East US. Vnet1 has one subnet Subnet1-1 with IP address range 10.1.1.0/24. This address range has only 256 unique IP addresses.

Box 3: No
RG2 already has a VNET named Vnet2.

Scope
All Azure resource types have a scope that defines the level of that resource and that the resource names must be unique. A resource must have a unique name within its scope.

For example, a virtual network has a resource group scope, which means that there can be only one network named vnet-prod-westus-001 in a given resource group. Other resource groups could have their own virtual network named vnet-prod-westus-001.

References:
https://learn.microsoft.com/en-us/azure/virtual-network/move-across-regions-vnet-powershell
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming

User-defined routes can govern private endpoint traffic only when private endpoint network policies are enabled for the subnet. Enabling the network policy on Subnet1 allows the routing policy to be evaluated for traffic between the endpoint and the Private Link service. Delegation and service endpoints do not enable that UDR processing.

DDoS Protection mitigation reports are emitted as diagnostic data for the protected public IP resource. Sending that diagnostic category to a Log Analytics workspace makes the simulation's mitigation reports available for querying and review. The protection plan defines coverage, while Log Analytics is the destination used to examine the generated report records.

The private endpoint assigns the storage account's blob service an address from the 10.1.1.0/24 subnet. The privatelink.blob.core.windows.net private DNS zone supplies the required private name resolution, while its virtual network link makes that resolution available to clients in the network. An A record named storage12345678 maps the requested name to the endpoint's private IP address.

References:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

Placing a resource lock requires permission for the lock operations under authorization. User Access Administrator includes the authorization-management capability needed to create or manage such locks and is the least-privileged listed role that supplies it. Network Contributor and Monitoring Contributor manage their service resources, while Resource Policy Contributor manages policy-related configuration.

Box 1: Yes
The firewall allows VNet1\Subnet1 through the service endpoint.

Box 2: No
The firewall does not allow VNet1\Subnet2 through the service endpoint.

Box 3: No
The firewall allows 132.124.53.0/26 which means it allows all IP addresses between 132.124.53.0 and 132.124.53.63. The public IP of VM3 is 132.124.53.76 which is outside the allowed range.

Administrative changes to VNET3 are recorded as activity log events, so an activity log alert must be scoped to that virtual network and filtered to the Administrative category. When a matching operation occurs, the alert invokes its action group. Configuring that group to notify the Azure Resource Manager Owner role directs the notification to the resource owner without hard-coding one person's address.

Azure Firewall priorities use lower numeric values as higher precedence, and 100 is the highest permitted priority value for this rule configuration. Assigning 100 therefore causes the security rule to be considered before rules configured with larger permitted priority numbers, which is the required ordering behavior.

Azure Firewall can protect inbound connections for protocols beyond HTTP and HTTPS by applying network and NAT processing to supported TCP and UDP traffic. It also supports forced tunneling, which directs internet-bound traffic through a designated path for inspection or further processing. These capabilities are compatible with its role as a stateful service alongside, rather than as a replacement for, network security groups.

Azure Virtual WAN attaches spoke virtual networks to a virtual hub through virtual network connections, so those connections must be created. The existing spoke peerings belong to the former hub-and-spoke design and must be removed when the spokes move to the virtual hub. GW1 must be redeployed in the resulting connected topology so it can remain the single internet ingress point.

Box 1: No
VM1, which is hosting site1.contoso.com, is located in East US. The VM1 endpoint status is degraded.
Endpoint monitoring health checks are failing. The endpoint isn't included in DNS responses and doesn't receive traffic.
When an endpoint has a Degraded status, it's no longer returned in response to DNS queries. Instead, an alternative endpoint is chosen and returned. The traffic-routing method configured in the profile determines how the alternative endpoint is chosen.

Priority. Endpoints form a prioritized list. The first available endpoint on the list is always returned. If an endpoint status is Degraded, then the next available endpoint is returned.

The user will connect to site2.us.contoso.com instead.

Box 2: No
VM3, which is hosting site2.contoso.com, is located in in East US. The VM3 endpoint status is CheckingEndpoint. The endpoint is monitored, but the results of the first probe haven't been received yet.
CheckingEndpoint is a temporary state that usually occurs immediately after adding or enabling an endpoint in the profile. An endpoint in this state is included in DNS responses and can receive traffic.
User will connect to site2.contoso.com, not to site2.uk.contoso.com

Box 3: No
VM3, which is hosting site2.contoso.com, is located in in East US. The VM1 endpoint status is CheckingEndpoint, which is OK (see above).
User will connect to site2.contoso.com, not to site2.japan.contoso.com

References:
https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoring

Connection monitor continuously observes connectivity between configured source and destination endpoints and records performance measurements such as round-trip time. Configuring VM1 as the source and VM2 as the destination provides the average RTT needed to investigate the slowdown. IP flow verify checks security rules, while NSG flow logs record flow metadata rather than directly monitoring RTT.

Virtual network peering alone is not transitive, so direct spoke-to-spoke forwarding requires a routing component in the hub. Azure Firewall can serve as that hub routing point when user-defined routes direct spoke traffic through it. This provides transitive spoke connectivity without sending the traffic through a VPN gateway.

The destination 10.61.1.5 matches the 10.61.0.0/16 route advertised by all three branches. Branch2 is less preferred because its AS path is prepended with repeated occurrences of 64551. Branch1 and Branch3 have shorter paths, and the ExpressRoute path is preferred for the remaining tie, selecting the connection to Branch3.

Box 1: 27

On Subnet1, configure a service endpoint to connect to storage1 and a service endpoint to connect to the Microsoft Entra tenant.

Service endpoints does not consume IP addresses in the subnet of a virtual network. Five IP addresses are used by Azure.

Remaining: 32-5 -> 27

Note: Azure reserves five IP addresses within each subnet. Factor in those addresses when you're sizing virtual networks and encompassed subnets.

Note 2: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.

Box 2: 25

On Subnet2, configure a private endpoint to connect to App1 and a private endpoint to connect to DB1.

Two private endpoints IP addresses will be used. Five IP addresses are used by Azure.
Remaining: 32-2-5 -> 25

Note: A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network.

The service could be an Azure service such as: Azure Storage Azure Cosmos DB Azure SQL Database Your own service, using Private Link service.

References:
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/plan-for-ip-
addressing (https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview)
https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

Step 1: Deploy an Azure Load Balancer in front of the application server Configure your application to run behind a standard load balancer in your virtual network.

Step 2: In Subscription 1, create a private link service and attach the service to the frontend IP configuration of the load balancer.

Create a Private Link Service referencing the load balancer above.

Step 3: In Subscription 2, create a private endpoint by using the private link service.
Private Link service can be accessed from approved private endpoints in any public region. The private endpoint can be reached from the same virtual network, regionally peered VNets, globally peered VNets and on premises using private VPN or ExpressRoute connections.

Step 4: In Subscription1, accept the private endpoint connection request.
Network connections can be initiated only by clients that are connecting to the private endpoint.

Not:
Incorrect: Enable virtual network peering between Vnet1 and Vnet2.

References:
https://docs.microsoft.com/en-us/azure/private-link/private-link-service-overview
https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview

An A record provides the required direct mapping from a host name to an IPv4 address. In the fabrikam.com public DNS zone, a record named wvw forms wvw.fabrikam.com and maps it to 131.107.2.50. The domain must also be delegated to the Azure DNS name servers when that delegation is not already present, so public DNS queries reach the zone containing the record.