Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 101:

  HOTSPOT

  You have an Azure Traffic Manager parent profile named TM1. TM1 has two child profiles named TM2 and

  TM3.

  TM1 uses the performance traffic-routing method and has the endpoints shown in the following table.

  

  TM2 uses the weighted traffic-routing method with MinChildEndpoint = 2 and has the endpoints shown in the following table.

  

  TM3 uses priority traffic-routing method and has the endpoints shown in the following table.

  

  The App2, App4, and App6 endpoints have a degraded monitoring status.

  To which endpoint is traffic directed? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-nested-profiles

• Question 102:

  You have a web application that uses a hostname of www.healthengine.com

  You have an Azure Front Door instance that provides access to the web application.

  You have the routing rules shown in the following table.

  

  Which rule will apply to www.healthengine.com/abc/def incoming request?

  A. RuleA
  B. RuleB
  C. RuleC
  D. RuleD
  A. RuleA

  ---

  Explanation

  Correct Answer(s):

  RuleA - When a request lands on a Front Door environment one of the first things that Front Door does is determine which particular routing rule to match the request to and then take the defined action in the configuration. It uses the below logic.

  Look for any routing rule with an exact match on the Path.

  If no exact match Paths, look for routing rules with a wildcard Path that matches.

  If no routing rules are found with a matching Path, then reject the request and return a 400: Bad Request error HTTP response.

  The path defined in RuleA is an exact match.

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-route-matching

  Wrong Answers:

  RuleB The path defined in the RuleB is not a match with incoming request.

  RuleC There is an exact match with RuleA. The path defined in the RuleB is not an exact match with incoming request.

  RuleD There is an exact match with RuleA. The path defined in the RuleB is not an exact match with incoming request.

• Question 103:

  DRAG DROP

  You have an Azure subscription that contains the resources shown in the following table.

  VNet1 and VNet2 are peered with each other. Subnet1 contains only VM1.

  

  You need to configure Subnet11 to support 500 IP addresses. The solution must ensure that all traffic is routed between VNet1 and VNet2 and users can access App1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 104:

  You have an Azure subscription that contains 100 network security groups (NSGs).

  You need to ensure that you log the application of specific NSG rules.

  Which type of log should you configure?

  A. flow log
  B. activity log
  C. Azure resource log
  D. audit log
  A. flow log

• Question 105:

  HOTSPOT

  You have the Azure firewall shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

• Question 106:

  You are planning the IP addressing for the subnets in Azure virtual networks.

  Which type of resource requires IP addresses in the subnets?

  A. Azure DDoS Protection for virtual networks
  B. private endpoints
  C. Azure Virtual Network NAT
  D. service endpoint policies
  B. private endpoints

  ---

  Explanation

  A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link.

  By enabling a private endpoint, you're bringing the service into your virtual network.

  Private endpoint properties

  A private endpoint specifies the following properties:

  * Name

  * Subnet

  The subnet to deploy, where the private IP address is assigned.

  * Etc.

  A read-only network interface is automatically created for the lifecycle of the private endpoint. The interface is assigned a dynamic private IP address from the subnet that maps to the private-link resource. The value of the private IP address remains unchanged for the entire lifecycle of the private endpoint.

  References:

  https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview

• Question 107:

  HOTSPOT

  You have a firewall that is managed by using an Azure Firewall Premium policy named Policy1.

  You need to configure Policy1 to block outbound traffic to the following locations:

  1. Malicious addresses identified by Microsoft.

  2. Social networking sites.

  The solution must minimize administrative effort.

  What should you configure in Policy1 for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 108:

  You have an Azure subscription that contains the public IP addresses shown in the following table.

  

  You plan to deploy a NAT gateway named NAT1.

  Which public IP addresses can be used as the public IP address for NAT1?

  A. IP3 only
  B. IP5 only
  C. IP2 and IP4 only
  D. IP1, IP3 and IP5 only
  E. IP3 and IP5 only
  A. IP3 only

  ---

  Explanation

  Only static IPv4 addresses in the Standard SKU are supported. IPv6 doesn't support NAT.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview

• Question 109:

  HOTSPOT

  Your on-premises network contains a VPN device.

  You have an Azure subscription that contains a virtual network and a virtual network gateway.

  You need to create a Site-to-Site VPN connection that has a custom cryptographic policy.

  How should you complete the PowerShell script? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: New-AzIpsecPolicy

  Configure IPsec/IKE policy for S2S (Site-to-Site) VPN or VNet-to-VNet connections Create a S2S VPN connection with an IPsec/IKE policy

  1. Create an IPsec/IKE policy

  The following sample script creates an IPsec/IKE policy with the following algorithms and parameters:

  IKEv2: AES256, SHA384, DHGroup24

  IPsec: AES256, SHA256, PFS None, SA Lifetime 14400 seconds & 102400000KB

  $ipsecpolicy6 = New-AzIpsecPolicy -IkeEncryption AES256 -IkeIntegrity SHA3

  2. Create the S2S VPN connection with the IPsec/IKE policy

  Create an S2S VPN connection and apply the IPsec/IKE policy created earlier.

  $vnet1gw = Get-AzVirtualNetworkGateway -Name $GWName1 -ResourceGroupName $RG1

  $lng6 = Get-AzLocalNetworkGateway -Name $LNGName6 -ResourceGroupName $RG1

  New-AzVirtualNetworkGatewayConnection -Name $Connection16 -ResourceGroup

  Box 2: New-AzVirtualNetworkGatewayConnection

  References:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell

• Question 110:

  You need to recommend a configuration for the ExpressRoute connection from the Boston datacenter. The solution must meet the hybrid networking requirements and business requirements.

  What type of ExpressRoute gateway should you recommend?

  A. High Performance (ERGw2AZ)
  B. Standard Performance (ERGw1AZ)
  C. Ultra-Performance (ERGw3AZ)
  C. Ultra-Performance (ERGw3AZ)

  ---

  Explanation

  Scenario: The Boston datacenter must connect to the Azure virtual networks by using an ExpressRoute FastPath connection.

  To configure FastPath, the virtual network gateway must be either:

  Ultra-Performance

  ErGw3AZ

  https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath#gateways