Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 91:

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains the following subnets:

  1. AzureFirewallSubnet

  2. GatewaySubnet

  3. Subnet1

  4. Subnet2

  5. Subnet3

  Subnet2 has a delegation to the Microsoft.Web/serverfarms service.

  The subscription contains the resources shown in the following table.

  

  You need to implement an Azure application gateway named AG1 that will be integrated with an Azure Web Application Firewall (WAF). AG1 will be used to publish VMSS1.

  To which subnet should you connect AG1?

  A. GatewaySubnet
  B. AzureFirewallSubnet
  C. Subnet2
  D. Subnet1
  E. Subnet3
  E. Subnet3

  ---

  Explanation

  An application gateway is a dedicated deployment in your virtual network. Within your virtual network, a dedicated subnet is required for the application gateway. You can have multiple instances of a given application gateway deployment in a subnet. You can also deploy other application gateways in the subnet. But you can't deploy any other resource in the application gateway subnet.

  Subnet3 is not in use.

  Incorrect:

  Not A: GatewaySubnet is in use. It used by the Azure VPN gateway.

  Not B: AzureFirewallSubnet is in use. It used by an Azure Firewall.

  Not C: Subnet2 is already in use.

  Subnet2 has a delegation to the Microsoft.Web/serverfarms service.

  Not D: Networking for Azure Virtual Machine Scale Sets Note that the application gateway must be in the same virtual network as the scale set but must be in a different subnet from the scale set.

  References:

  https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure

  https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-networking

• Question 92:

  Your company has offices in New York and Amsterdam. The company has an Azure subscription. Both offices connect to Azure by using a Site-to-Site VPN connection.

  The office in Amsterdam uses resources in the North Europe Azure region. The office in New York uses resources in the East US Azure region.

  You need to implement ExpressRoute circuits to connect each office to the nearest Azure region. Once the ExpressRoute circuits are connected, the on-premises computers in the Amsterdam office must be able to connect to the on-premises servers in the New York office by using the ExpressRoute circuits.

  Which ExpressRoute option should you use?

  A. ExpressRoute FastPath
  B. ExpressRoute Global Reach
  C. ExpressRoute Direct
  D. ExpressRoute Local
  B. ExpressRoute Global Reach

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach

• Question 93:

  DRAG DROP

  You have a DNS domain named contoso.com that is hosted by a third-party domain name registrar.

  You have an Azure subscription.

  You need to ensure that all DNS queries for the contoso.com domain are resolved by using Azure DNS.

  What should you create in the registrar, and what should you create in Azure? To answer, drag the appropriate options to the correct targets. Each option may be used once, more than once, or not at all.

  You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: A delegation

  Delegate the domain

  Once the DNS zone gets created and you have the name servers, you'll need to update the parent domain with the Azure DNS name servers. Each registrar has its own DNS management tools to change the name server records for a domain.

  In the registrar's DNS management page, edit the NS records and replace the NS records with the Azure

  DNS name servers.

  When you delegate a domain to Azure DNS, you must use the name servers that Azure DNS provides.

  Use all four name servers, regardless of the name of your domain. Domain delegation doesn't require a name server to use the same top-level domain as your domain.

  Delegations that use name servers in your own zone, sometimes called vanity name servers, aren't currently supported in Azure DNS.

  Note: Azure DNS allows you to host a DNS zone and manage the DNS records for a domain in Azure. In order for DNS queries for a domain to reach Azure DNS, the domain has to be delegated to Azure DNS from the parent domain. Keep in mind Azure DNS isn't the domain registrar.

  Host your domain in Azure DNS Suppose you buy the domain contoso.com from a domain name registrar and then create a zone with the name contoso.com in Azure DNS. Since you're the owner of the domain, your registrar offers you the option to configure the name server (NS) records for your domain. The registrar stores the NS records in the .com parent zone. Internet users around the world are then directed to your domain in your Azure DNS zone when they try to resolve DNS records in contoso.com.

  Box 2: A public DNS zone Azure DNS provides an authoritative DNS service. It doesn't provide a recursive DNS service.

  References:

  https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns

• Question 94:

  You have an Azure application gateway named AGW1 that has a routing rule named Rule1. Rule 1 directs traffic for http://www.contoso.com to a backend pool named Pool1. Pool1 targets an Azure virtual machine scale set named VMSS1.

  You deploy another virtual machine scale set named VMSS2.

  You need to configure AGW1 to direct all traffic for http://www.adatum.com to VMSS2.

  The solution must ensure that requests to http://www.contoso.com continue to be directed to Pool1.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add a backend pool.
  B. Modify an HTTP setting.
  C. Add an HTTP setting.
  D. Add a listener.
  E. Add a rule.
  A. Add a backend pool.
  D. Add a listener.
  E. Add a rule.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/application-gateway/configuration-overview

• Question 95:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the virtual machines shown in the following table.

  

  You create a load balancer named LB1 that has the following configurations:

  1. SKU: Basic

  2. Type: Internal

  3. Subnet: Subnetl2

  4. Virtual network VNet1

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  

  

• Question 96:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.

  You need to configure a rate limit for incoming requests to AFD1.

  Solution: You add a rule to the rule set of AFD1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  References:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-configure

• Question 97:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

• Question 98:

  You need to configure the default route in Vnet2 and Vnet3. The solution must meet the virtual networking requirements.

  What should you use to configure the default route?

  A. a user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3
  B. a user-defined route assigned to GatewaySubnet in Vnet1
  C. BGP route exchange
  D. route filters
  C. BGP route exchange

  ---

  Explanation

  You must use BGP to advertise on-premises routes to the Microsoft Edge router. You cannot create user-defined routes to force traffic to the ExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type: ExpressRoute

  Source:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#border-gateway-protocol

• Question 99:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to restrict access to the storage35433841 storage account to ensure that only subnet1-2 can access the account.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  See explanation below.

  

  Restrict network access to a subnet By default, storage accounts accept network connections from clients in any network, including the internet. You can restrict network access from the internet, and all other subnets in all virtual networks (except the subnet-private subnet in the vnet-1 virtual network.)

  To restrict network access to a subnet:

  Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

  Step 2: Select your storage account storage35433841 Step 3: In Security + networking, select Networking.

  Step 4: In the Firewalls and virtual networks tab, select Enabled from selected virtual networks and IP addresses in Public network access.

  Step 5: In Virtual networks, select + Add existing virtual network.

  Step 6: In Add networks, enter or select the following information:

  Setting - Value Subscription: Select your subscription. Virtual networks: Select the available virtual network

  Subnets: Select subnet1-2.

  Step 7: Select Add.

  Step 8: Select Save to save the virtual network configurations.

  

  Note: Restrict network access to PaaS resources with virtual network service endpoints using the Azure portal

  Note: Virtual network service endpoints enable you to limit network access to some Azure service resources to a virtual network subnet. You can also remove internet access to the resources. Service endpoints provide direct connection from your virtual network to supported Azure services, allowing you to use your virtual network's private address space to access the Azure services. Traffic destined to Azure resources through service endpoints always stays on the Microsoft Azure backbone network.

  

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-restrict-network-access-to-resources

• Question 100:

  You have an Azure virtual network named Vnet1 that hosts an Azure firewall named FW1 and 150 virtual machines. Vnet1 is linked to a private DNS zone named contoso.com. All the virtual machines have their name registered in the contoso.com zone.

  Vnet1 connects to an on-premises datacenter by using ExpressRoute.

  You need to ensure that on-premises DNS servers can resolve the names in the contoso.com zone.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Modify the DNS server settings of Vnet1.
  B. For FW1, configure custom DNS server.
  C. For FW1, enable DNS proxy.
  D. On the on-premises DNS servers, configure forwarders that point to the frontend IP address of FW1.
  E. On the on-premises DNS servers, configure forwarders that point to the Azure provided DNS service at 168.63.129.16.
  C. For FW1, enable DNS proxy.
  D. On the on-premises DNS servers, configure forwarders that point to the frontend IP address of FW1.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns#on-premises-workloads-using-a-dns-forwarder

  https://azure.microsoft.com/en-gb/blog/new-enhanced-dns-features-in-azure-firewall-now-generally-available/