Microsoft Microsoft Certified: Azure Network Engineer Associate AZ-700 Questions & Answers

• Question 1:

  DRAG DROP

  You need to implement outbound connectivity for VMScaleSet1. The solution must meet the virtual networking requirements and the business requirements.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/load-balancer/skus

  https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections#outboundrules

• Question 2:

  DRAG DROP

  You need to prepare Vnet1 for the deployment of an ExpressRoute gateway. The solution must meet the hybrid connectivity requirements and the business requirements.

  Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Delete the VPN GW1.

  The existing VPN GW1 GatewaySubnet is too small with /29.

  Users must be able to connect to Vnet1 by using a Point-to-Site (P2S) VPN when working remotely. Connections must be authenticated by Azure AD.

  

  Litware wants to minimize costs whenever possible, as long as all other requirements are met.

  Step 2: Create a VPN gateway by using Basic SKU.

  Basic SKU is good enough.

  Note The Basic gateway SKU does not support IKEv2 or RADIUS authentication. If you plan on having Mac clients connect to your virtual network, do not use the Basic

  SKU.

  Step 3: Set the subnet mask of Gateway Subnet to /27.

  When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. The number of IP addresses needed depends on the VPN gateway configuration that you want to create. Some configurations require

  more IP addresses than others. We [Microsoft] recommend that you create a gateway subnet that uses a /27 or /28.

  It's best to specify /27 or larger (/26,/25 etc.). This allows enough IP addresses for future changes, such as adding an ExpressRoute gateway.

  Reference:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

• Question 3:

  HOTSPOT

  You need to implement name resolution for the cloud.liwareinc.com. The solution must meet the networking requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

• Question 4:

  HOTSPOT

  You need to implement a P2S VPN for the users in the branch office. The solution must meet the hybrid networking requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 5:

  HOTSPOT

  You need to restrict traffic from VMScaleSet1 to VMScaleSet2. The solution must meet the virtual networking requirements.

  What is the minimum number of custom NSG rules and NSG assignments required? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 2: One NSG

  The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way you would need two custom NSG rules.

  Box 1: Two custom rules

  With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic from VMScaleSet1. Then you would need to create another custom rule with a higher priority than the first rule that allows traffic on port 443.

  The default rules in the NSG will allow all other traffic to VMScaleSet2.

• Question 6:

  HOTSPOT

  You need to recommend a configuration for the ExpressRoute connection from the Boston datacenter. The solution must meet the hybrid networking requirements and business requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  For the first question, only ExpressRoute GW SKU Ultra Performance support FastPath feature.

  For the second question, vnet1 will connect to ExpressRoute gw, once Vnet1 peers with Vnet2, the traffic from on-premise network will bypass GW and Vnet1, directly goes to Vnet2, while this feature is under public preview.

  ====Reference

  ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When

  enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

  To configure FastPath, the virtual network gateway must be either:

  Ultra Performance

  ErGw3AZ

  VNet Peering - FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway.

  https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

  Gateway SKU

  https://docs.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-networkgateways

• Question 7:

  HOTSPOT

  You need to meet the network security requirements for the NSG flow logs.

  Which type of resource do you need, and how many instances should you create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A storage account

  Network security group (NSG) flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG. Flow data is sent to Azure Storage accounts from where you can access it as well as

  export it to any visualization tool, SIEM, or IDS of your choice.

  NSG flow logging considerations

  Storage account considerations:

  Location: The storage account used must be in the same region as the NSG.

  Note:

  Network Security Requirements

  Contoso network security requirements include:

  Enable NSG flow logs for NSG3 and NSG4.

  The NSGs are associated to the network interfaces on the virtual machines. Each NSG has one custom security rule that allows RDP connections from the internet. The firewall on each virtual machine allows ICMP traffic.

  NSG3 is related to VM3. VM3 is located in Central US.

  NSG4 is related to VM4. VM4 is located in Central US.

  Box 2: 1

  One storage account is enough.

  Reference: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

• Question 8:

  HOTSPOT

  You are implementing the Virtual network requirements for Vnet6.

  What is the minimum number of subnets and service endpoints you should create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 3 Subnets

  *

  One subnet for the three VMs

  Virtual network and subnets

  A subnet is a range of IP addresses in the virtual network. You can divide a virtual network into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one virtual network. NICs connected to subnets

  (same or different) within a virtual network can communicate with each other without any extra configuration.

  *

  One gateway subnet for the incoming VPN connection.

  About the gateway subnet

  The virtual network gateway uses specific subnet called the gateway subnet. The gateway subnet is part of the virtual network IP address range that you specify when configuring your virtual network. It contains the IP addresses that the

  virtual network gateway resources and services use. The subnet must be named 'GatewaySubnet' in order for Azure to deploy the gateway resources.

  *

  One subnet for the two container groups

  To deploy to a new virtual network and have Azure create the network resources for you automatically, specify the following when you execute az container create:

  Virtual network name

  Virtual network address prefix in CIDR format

  Subnet name

  Subnet address prefix in CIDR format

  Once you've deployed your first container group with this method, you can deploy to the same subnet by specifying the virtual network and subnet names, or the network profile that Azure automatically creates for you. Because Azure

  delegates the subnet to Azure Container Instances, you can deploy only container groups to the subnet.

  Note:

  Contoso has the following virtual network requirements:

  Create a virtual network named Vnet6 in West US that will contain the following resources and configurations:

  Two container groups that connect to Vnet6

  Three virtual machines that connect to Vnet6

  Allow VPN connections to be established to Vnet6

  Allow the resources in Vnet6 to access KeyVault1, DB1, and Vnet1 over the Microsoft backbone network.

  Box 2: 2

  *

  One Service Endpoint for the Azure KeyVault KeyVault1.

  The virtual network service endpoints for Azure Key Vault allow you to restrict access to a specified virtual network.

  *

  One Service Endpoint for the Azure SQL Database DB1.

  Service endpoints are a networking feature in Azure designed to help you better identify traffic coming into your Azure SQL Database as originating from one or more of your VNets.

  Note: Service endpoints are a networking feature in Azure designed to help you better identify traffic coming into your Azure SQL Database as originating from one or more of your VNets.

  Service endpoints are available for the following Azure services and regions.

  Azure SQL Database

  Azure Key Vault

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/network-overview

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell

  https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

  https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints

• Question 9:

  HOTSPOT

  You create NSG10 and NSG11 to meet the network security requirements.

  For each of the following statements, select Yes of the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  NSG10 which is attached to VM1's subnet blocks RDP (port TCP 3389) to ‘Any’ which means the port is blocked to all destinations.

  Box 2: Yes

  NSG10 blocks ICMP from VNet4 (source 10.10.0.0/16) but it is not blocked from VM2's subnet (VNet1/Subnet2).

  Box 3: No

  NSG11 blocks RDP (port TCP 3389) destined for ‘VirtualNetwork’. VirtualNetwork is a service tag and means the address space of the virtual network (VNet1) which in this case is 10.1.0.0/16. Therefore, RDP traffic from subnet2 to

  anywhere else in VNet1 is blocked.

• Question 10:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Zone2.contoso.com is not linked to any virtual networks. Therefore, no VMs are able to resolve names in the zone.

  Box 2: Yes

  VM4 is in VNet3. Zone1.contoso.com has a link to VNet3 and auto-registration is enabled on the link.

  Box3: No

  VNet3 is linked to zone1.contoso.com and auto-registration is enabled on the link. A virtual network can only have one registration zone. You can link zone2.contoso.com to VNet3 but you won't be able to enable auto-registration on the link.