Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 131:

  You need to provide VMware SD-WAN connectivity to your clients.

  Which Azure resource should you deploy?

  A. Network Virtual Appliance (NVA).
  B. Point-to-site VPN Gateway
  C. Local network gateway
  A. Network Virtual Appliance (NVA).

  ---

  Explanation

  Correct Answer(s):

  Network Virtual Appliance (NVA) - Azure Virtual WAN supports connections from networking partners, such as VMware SD-WAN. These types of devices are known as network virtual appliances (NVAs).

  Wrong Answers:

  Point-to-site VPN Gateway - A point-to-site VPN Gateway supports connections from individual computers.

  Local network gateway - A local network gateway represents the on-premises network.

• Question 132:

  HOTSPOT

  You have an Azure subscription that contains an app named Appl. App1 is hosted on the Azure App Service instances shown in the following table.

  

  You need to implement Azure Traffic Manager to meet the following requirements:

  1. App1 traffic must be assigned equally to each App Service instance in each Azure region.

  2. App1 traffic from North Europe must be routed to the Appl instances in the North Europe region.

  3. App1 traffic from North America must be routed to the Appl instances in the East US Azure region.

  4. If an App Service instance fails, all the traffic for that instance must be routed to the remaining instances in the same region.

  How should you configure the Traffic Manager profiles? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: 2

  Need one profile for each region.

  Note: Azure Traffic Manager supports six traffic-routing methods to determine how to route network traffic to the various service endpoints. For any profile, Traffic Manager applies the traffic-routing method associated to it to each DNS query it receives. The traffic-routing method determines which endpoint is returned in the DNS response.

  Box 2: Geographic

  The following traffic routing methods are available in Traffic Manager:

  * Geographic: Select Geographic routing to direct users to specific endpoints (Azure, External, or Nested) based on where their DNS queries originate from geographically. With this routing method, it enables you to be in compliance with scenarios such as data sovereignty mandates, localization of content & user experience and measuring traffic from different regions.

  * Priority: Select Priority routing when you want to have a primary service endpoint for all traffic. You can provide multiple backup endpoints in case the primary or one of the backup endpoints is unavailable.

  * Weighted: Select Weighted routing when you want to distribute traffic across a set of endpoints based on their weight. Set the weight the same to distribute evenly across all endpoints.

  * Performance: Select Performance routing when you have endpoints in different geographic locations and you want end users to use the "closest" endpoint for the lowest network latency.

  * Etc.

  References:

  https://learn.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

• Question 133:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following resources:

  1. A virtual network named Vnet1

  2. A subnet named Subnet1 in Vnet1

  3. A virtual machine named VM1 that connects to Subnet1

  4. Three storage accounts named storage1, storage2, and storage3

  You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

  Solution: You configure the firewall on storage1 to only accept connections from Vnet1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 134:

  HOTSPOT

  You have an Azure subscription that contains virtual networks, network security groups (NSGs), and virtual machines.

  You need to perform the following actions:

  1. Identify unknown traffic between the resources.

  2. Check the network connectivity between the virtual machines.

  What should you use to perform each action? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 135:

  You have an Azure Virtual Desktop deployment that has 500 session hosts.

  All outbound traffic to the internet uses a NAT gateway.

  During peak business hours. some users report that they cannot access internet resources. In Azure Monitor, you discover many failed SNAT connections.

  You need to increase the available SNAT connections.

  What should you do?

  A. Bind the NAT gateway to another subnet.
  B. Add a public IP address.
  C. Deploy Azure Standard Load Balancer that has outbound rules.
  B. Add a public IP address.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource

• Question 136:

  You have an Azure subscription.

  You plan to deploy Azure Firewall Premium, enable all the Premium features, and configure both network and application rules.

  Which type of rule will the firewall process first?

  A. infrastructure
  B. network
  C. threat intelligence
  D. application
  B. network

• Question 137:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to configure VNET1 to log all events and metrics. The solution must ensure that you can query the events and metrics directly from the Azure portal by using KQL.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Plan Stage 1: Determine the resource group of VNET1

  Stage 2: In Azure Monitor set up monitoring with the VNET's Resource Group as source, and Log Analytics workspace as destination

  Stage 1: Determine the resource group of VNET1

  Step 1: In Azure portal locate VNET1 and detect which resource group it is in (here we use XGroup).

  Stage 2: In Azure Monitor set up monitoring with the VNET's Resource Group as source, and Log Analytics workspace as destination

  Create diagnostic settings

  Step 2: You can configure diagnostic settings in the Azure portal either from the Azure Monitor menu or from the menu for the resource (XGroup in our case).

  Where you configure diagnostic settings in the Azure portal depends on the resource:

  For a single resource, select Diagnostic settings under Monitoring on the resource's menu.

  

  Step 3: If no settings exist on the resource you've selected, you're prompted to create a setting. Select Add diagnostic setting.

  

  Step 4: Give your setting a name if it doesn't already have one.

  

  Step 5: Logs and metrics to route: For logs, either choose a category group or select the individual checkboxes for each category of data you want to send to the destinations specified later. The list of categories varies for each Azure service.

  Select AllMetrics if you want to store metrics in Azure Monitor Logs too.

  We do the following:

  Categories: Select AuditEvent

  Metrics: Select AllMetrics

  (to log all events and metrics)

  Destination details: Select Send to Log Analytics workspace (To be able to query using KQL)

  

  Step 6: Destination details -skip

  Step 7: Select Save.

  Note: Azure virtual network collects the same kinds of monitoring data as other Azure resources.

  Azure virtual network uses Azure Monitor.

  Collection and routing

  Platform metrics and the Activity log are collected and stored automatically, but can be routed to other locations by using a diagnostic setting.

  Each Azure resource requires its own diagnostic setting, which defines the following criteria:

  Sources: The type of metric and log data to send to the destinations defined in the setting. The available types vary by resource type.

  Destinations: One or more destinations to send to.

  Destinations

  Platform logs and metrics can be sent to the destinations listed in the following table.

  * Log Analytics workspace

  Metrics are converted to log form. This option might not be available for all resource types. Sending them to the Azure Monitor Logs store (which is searchable via Log Analytics) helps you to integrate them into queries, alerts, and visualizations with existing log data.

  * Etc.

  References:

  https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings

  https://learn.microsoft.com/en-us/azure/virtual-network/monitor-virtual-network

• Question 138:

  You have 10 Azure App Service instances. Each instance hosts the same web app. Each instance is in a different Azure region.

  You need to configure Azure Traffic Manager to direct users to the instance that has the lowest latency.

  Which routing method should you use?

  A. geographic
  B. weighted
  C. performance
  D. priority
  C. performance

  ---

  Explanation

  Select Performance routing when you have endpoints in different geographic locations and you want end users to use the "closest" endpoint for the lowest network latency.

  References:

  https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

• Question 139:

  HOTSPOT

  You have two Azure App Service instances that host the web apps shown the following table.

  

  You deploy an Azure 2 that has one public frontend IP address and two backend pools.

  You need to publish all the web apps to the application gateway. Requests must be routed based on the HTTP host headers.

  What is the minimum number of listeners and routing rules you should configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: 2

  Listeners

  One listener for As1.contoso.com, and one listener for As2.contoso.com.

  Note: Multiple site hosting enables you to configure more than one web application on the same port of application gateways using public-facing listeners. It allows you to configure a more efficient topology for your deployments by adding up to 100+ websites to one application gateway. Each website can be directed to its own backend pool. For example, three domains, contoso.com, fabrikam.com, and adatum.com, point to the IP address of the application gateway. You'd create three multi-site listeners and configure each listener for the respective port and protocol setting.

  You can also define wildcard host names in a multi-site listener and up to 5 host names per listener.

  Box 2: 2

  Routing rules

  Application Gateway request routing rules

  Rule type

  When you create a rule, you choose between basic and path-based.

  * Choose basic if you want to forward all requests on the associated listener (for example, blog.contoso.com/*) to a single backend pool.

  * Choose path-based if you want to route requests from specific URL paths to specific backend pools. The path pattern is applied only to the path of the URL, not to its query parameters.

  Associated backend pool

  Associate to the rule the backend pool that contains the backend targets that serve requests that the listener receives.

  * For a basic rule, only one backend pool is allowed. All requests on the associated listener are forwarded to that backend pool.

  * For a path-based rule, add multiple backend pools that correspond to each URL path. The requests that match the URL path that's entered are forwarded to the corresponding backend pool. Also, add a default backend pool. Requests that don't match any URL path in the rule are forwarded to that pool.

  References:

  https://learn.microsoft.com/en-us/azure/application-gateway/multiple-site-overview

• Question 140:

  You have an Azure subscription that contains the following resources:

  A virtual network named Vnet1

  A subnet named Subnet1 in Vnet1

  A virtual machine named VM1 that connects to Subnet1

  Three storage accounts named storage1, storage2, and storage3

  You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

  To achieve the requirement, you configure the firewall on storage1 to only accept connections from Vnet1.

  Did you achieve the requirement?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  If you configure the firewall on storage1 to only accept connections from Vnet1, any virtual machine from Vnet1 will be able to connect to the storage 1. VM1 can also access other storage accounts depending on the firewall settings on other storage accounts.