Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 161:

  You have an Azure subscription and an on-premises environment that is connected via ExpressRoute circuit.

  You have two additional branch offices that you need to connect to the network.

  Several employees work remotely.

  Employees change locations frequently but still need access to Azure resources.

  You need to deploy a solution at the earliest. The costs must be minimal.

  What should you deploy?

  A. Point-to-Site VPN
  B. Site-to-Site VPN
  C. Virtual WAN
  D. Hub-and-Spoke Network Topology
  C. Virtual WAN

  ---

  Explanation

  Correct Answer(s):

  The Virtual WAN architecture is a hub and spoke architecture for branches and users. It enables global transit network architecture, where the cloud-hosted network 'hub' enables transitive connectivity between endpoints that may be distributed across different types of 'spokes'. All hubs are connected in full mesh in a Standard Virtual WAN making it easy for the user to use the Microsoft backbone for any-to-any (any spoke) connectivity. This satisfies the requirement to provide the quickest set up at the lowest cost.

  https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

  Wrong Answers:

  Point-to-Site VPN - A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer.

  Site-to-Site VPN Site-to-Site VPN gateways provide cross-premises connectivity between customer premises and Azure.

  Hub-and-Spoke Network Topology.

  This is one of the architecture model used to deploy Azure environment.

• Question 162:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to ensure that hosts on VNET1 and VNET2 can communicate. The solution must minimize latency between the virtual networks.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Peer virtual networks Step 1: In the search box at the top of the Azure portal, look for VNet1. When VNET1 appears in the search results, select it.

  

  Step 2: Under Settings, select Peerings, and then select + Add, as shown in the following picture:

  

  Step 3: Enter or select the following information, accept the defaults for the remaining settings, and then select Add.

  * ..

  * Virtual network

  Select VNET2 for the name of the remote virtual network. The remote virtual network can be in the same region of VNET1 or in a different region.

  

  Step 4: Click Add

  In the Peerings page, the Peering status is Connected, as shown in the following picture:

  

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal

• Question 163:

  You have an Azure subscription that contains a virtual network.

  You plan to deploy an Azure VPN gateway and 90 Site-to-Site VPN connections. The solution must meet the following requirements:

  1. Ensure that the Site-to-Site VPN connections remain available if an Azure datacenter fails.

  2. Minimize costs.

  Which gateway SKU should you specify?

  A. VpnGw1AZ
  B. VpnGw2AZ
  C. VpnGw4AZ
  D. VpnGw5AZ
  C. VpnGw4AZ

  ---

  Explanation

  VpnGw4AZ supports 90 Site-to-Site VPN connections at a lower cost than VpnGw5AZ.

  VpnGw1AZ, VpnGw2AZ, and VpnGw4AZ supports max 30.

  Gateway SKUs by tunnel, connection, and throughput

  

  References:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

• Question 164:

  HOTSPOT

  Which virtual machines can VM1 and VM4 ping successfully? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: VM2, VM3 and VM4.

  VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

  There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocking inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

  Box 2:

  VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

• Question 165:

  You have an Azure subscription mat contains tour virtual networks named VNet1, VNet2, VNet3, and VNet4.

  You plan to deploy a hub and spoke topology by using virtual network peering.

  You need to configure VNet1 as the hub network. The solution must meet the following requirements:

  1. Support transitive routing between spokes.

  2. Maximize network throughput.

  What should you include in the solution?

  A. Azure VPN Gateway
  B. Azure Route Server
  C. Azure Private Link
  D. Azure Firewall
  D. Azure Firewall

  ---

  Explanation

  Azure Firewall is the best response Communication through an NVA

  If you need connectivity between spokes, consider deploying Azure Firewall or another NVA in the hub.

  Then create routes to forward traffic from a spoke to the firewall or NVA, which can then route to the second spoke. In this scenario, you must configure the peering connections to allow forwarded traffic.

  You can also use a VPN gateway to route traffic between spokes, although this choice affects latency and throughput. For configuration details, see Configure VPN gateway transit for virtual network peering.

  https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli

• Question 166:

  DRAG DROP

  You have two on-premises datacenters.

  You have an Azure subscription that contains four virtual networks named VNet1, VNet2, VNet3, and VNet4.

  You create an Azure virtual WAN named VWAN1. VWAN1 contains a single virtual hub that is connected to both on-premises datacenters and all the virtual networks in a full mesh topology.

  You create a route table named RT1.

  You need to configure VWAN1 to meet the following requirements:

  1. Connectivity between VNet1 and VNet2 and both on-premises datacenters must be allowed.

  2. Connectivity between VNet3 and VNet4 and both on-premises datacenters must be allowed.

  3. VNet1 and VNet2 must be isolated from VNet3 and VNet4.

  How should you configure routing for VNet1 and VNet2 and for both on-premises datacenters? To answer, drag the appropriate route tables and route table propagation to the correct requirements. Each route table and route table propagation may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 167:

  You have an Azure subscription that contains the resources shown in the following table.

  

  Subnet1 contains three virtual machines that host an app named App1. App1 is accessed by using the SFTP protocol.

  From NSG1, you configure an inbound security rule named Rule2 that allows inbound SFTP connections to ASG1.

  You need to ensure that the inbound SFTP connections are managed by using ASG1. The solution must minimize administrative effort.

  What should you do?

  A. From NSG1, modify the priority of Rule2.
  B. From each virtual machine, associate the network interface to ASG1.
  C. From Subnet1, create a subnet delegation.
  D. From ASG1, modify the role assignments.
  B. From each virtual machine, associate the network interface to ASG1.

  ---

  Explanation

  An application security group is a logical collection of virtual machines (NICs). You join virtual machines to the application security group, and then use the application security group as a source or destination in

  NSG rules.

  The Networking blade of virtual machine properties has a new button called Configure The Application Security Groups for each NIC in the virtual machine. If you click this button, a pop-up blade will appear and you can select which (none, one, many) application security groups that this NIC should join, and then click Save to commit the change.

  References:

  https://medium.com/awesome-azure/azure-application-security-group-asg-1e5e2e5321c3

• Question 168:

  HOTSPOT

  You have the Azure environment shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit?toc=/azure/virtual-network/toc.json

• Question 169:

  You have the Azure environment shown in the exhibit.

  

  VM1 is a virtual machine that has an instance-level public IP address (ILPIP).

  Basic Load Balancer uses a public IP address. VM1 and VM2 are in the backend pool.

  NAT Gateway uses a public IP address named IP3 that is associated to SubnetA.

  VNet1 has a virtual network gateway that has a public IP address named IP4.

  When initiating outbound traffic to the internet from VM1, which public address is used?

  A. IP1
  B. IP2
  C. IP3
  D. IP4
  C. IP3

• Question 170:

  HOTSPOT

  You have an Azure private DNS zone named contoso.com that is linked to the virtual networks shown in the following table.

  

  The links have auto registration enabled.

  You create the virtual machines shown in the following table.

  

  You manually add the following entry to the contoso.com zone:

  1. Name: VM1

  2. IP address: 10.1.10.9

  For each of the following statements, select Yes of the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  The manual DNS record will overwrite the auto-registered DNS record so VM1 will resolve to 10.1.10.9.

  Box 2: No

  The DNS record for VM1 is now a manually created record rather than an auto-registered record. Only auto-registered DNS records are deleted when a VM is deleted.

  Box 3: No

  This answer depends on how the IP address is changed. To change the IP address of a VM manually, you would need to select 'Static' as the IP address assignment. In this case, the DNS record will not be updated because only DHCP assigned IP addresses are auto-registered.

  References:

  https://docs.microsoft.com/en-us/azure/dns/dns-faq-private