Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 181:

  You have an Azure subscription that contains the resources shown in the following table.

  

  NSG1 is associated to the NIC of VM1 and contains the rules shown in the following table.

  

  You collect NSG flow logs for five minutes for the following activities:

  1. Two RDP sessions from VM1 to VM2, each initiated from a different TCP port

  2. Three SSH sessions from VM2 to VM1, each initiated from a different TCP port

  You analyze the logs by using Traffic Analytics in Azure Network Watcher.

  How many aggregated flow entries will Traffic Analytics identify?

  A. 1
  B. 2
  C. 5
  D. 10
  C. 5

• Question 182:

  You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a virtual machine named VM1.

  You plan to make VM1 available to the resources in Sub2 by using Azure Private Link.

  You need to ensure that the private link service can be configured to provide access to VM1.

  What should you configure in Sub1 first?

  A. a service endpoint
  B. an Azure Private DNS zone
  C. a private endpoint
  D. an Azure load balancer
  D. an Azure load balancer

• Question 183:

  HOTSPOT

  You have two Azure subscriptions named Subscription1 and Subscription2. There are no connections between the virtual networks in two subscriptions.

  You configure a private link service as shown in the privatelinkservice1 exhibit. (Click the privatelinkservice1 tab.)

  

  You create a load balancer name in Subscription1 and configure the backend pool shown in the lb1 exhibit. (Click tie 1b1 tab.)

  

  You create a private endpoint in Subscription2 as shown in the privateendpoint4 exhibit. (Click the privateendpoint4)

  

  For each of the following statements, select YES if the statement is true. Otherwise. select No.

  

  

• Question 184:

  You have an Azure Front Door instance named FD that contains an origin group named OG1.

  You need to configure a health probe for OG1. The solution must minimize the amount of traffic generated by the health probe.

  Which HTTP method should you use?

  A. CONNECT
  B. HEAD
  C. TRACE
  D. GET
  B. HEAD

• Question 185:

  HOTSPOT

  You need to identify which IP address space to allocate for the planned deployment of PRDNS1 to HubVNet and SpokeVNet. The solution must meet the general requirements

  What should you identify for each virtual network? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 186:

  You have an Azure Front Door instance named FD1 that is protected by using Azure Web Application Firewall (WAF).

  FD1 uses a frontend host named app1.healthengine.com to provide access to Azure web apps hosted in the East US Azure region and the West US Azure region.

  You need to configure FD1 to block requests to app1.healthengine.com from all countries other than the United States.

  What should you include in the WAF policy?

  A. a frontend host association
  B. a managed rule set
  C. a custom rule that uses a rate limit rule
  D. a custom rule that uses a match rule
  D. a custom rule that uses a match rule

  ---

  Explanation

  Correct Answer(s):

  a custom rule that uses a match rule - Custom rules allow you to create tailored rules to suit the exact needs of your applications and security policies. Now, you can restrict access to your web applications by country/region. As with all custom rules, this logic can be compounded with other rules to suit the needs of your application.

  To create a geo-filtering custom rule in the Azure portal, simply select Geo location as the Match Type, and then select the country/region or countries/regions you want to allow/block from your application.

  https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/geomatch-custom-rules

  Wrong Answers:

  a frontend host association.

  This is to add a frontend profile.

  a managed rule set - Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats.

  a custom rule that uses a rate limit rule - A rate control rule limits abnormally high traffic from any client IP address.

• Question 187:

  HOTSPOT

  You have an Azure subscription that contains a user named User1 and the resources shown in the following table.

  

  You need to ensure that User1 can associate Policy1 to FW1 by using Azure Firewall Manager. The solution must follow the principle of least privilege.

  Which role should you assign to User1 for each resource group? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 188:

  You have an Azure virtual network and an on-premises datacenter.

  You need to implement a Site-to-Site VPN connection between the datacenter and the virtual network.

  Which two resources should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. a virtual network gateway
  B. Azure Firewall
  C. a local network gateway
  D. Azure Web Application Firewall (WAF)
  E. an on-premises data gateway
  F. an Azure application gateway
  G. a user-defined route
  A. a virtual network gateway
  C. a local network gateway

  ---

  Explanation

  a virtual network gateway a local network gateway

  To establish a Site-to-Site VPN connection between an on-premises datacenter and an Azure virtual network, you must include two resources in your plan: a virtual network gateway in Azure and a local network gateway in the datacenter.

  A virtual network gateway acts as the VPN endpoint in Azure and allows the VPN connection to be established with the datacenter.

  A local network gateway represents the on-premises VPN device and its IP address. This allows Azure to establish a VPN connection with the datacenter over the public Internet.

  The virtual network gateway and the local network gateway work together to create the VPN connection, allowing secure communication between the datacenter and the virtual network.

• Question 189:

  DRAG DROP

  You have an Azure subscription.

  You need to create an Azure application gateway named AGW1 that will have Azure Web Application Firewall (WAF) enabled. The solution must ensure that WAF blocks all requests to AGW1 from any IP address in the 100.64.0.0/24 range.

  Which five PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  To block a specific IP range using an Azure Application Gateway with WAF enabled, you must define a custom rule within a WAF policy and then associate that policy with the gateway.

  Step 1: New-AzApplicationGatewayFirewallMatchVariable Required PowerShell Cmdlets (In Order)

  1. New-AzApplicationGatewayFirewallMatchVariable: Defines the variable to be inspected. For IP blocking, use -VariableName RemoteAddr.

  Step 2: New-AzApplicationGatewayFirewallCondition

  1. New-AzApplicationGatewayFirewallCondition: Creates the specific match condition. Use -Operator

  IPMatch and provide the IP range in the -MatchValue parameter. Uses the variable created in step 1.

  Step 3: New-AzApplicationGatewayFirewallCustomRule

  1. New-AzApplicationGatewayFirewallCustomRule: Defines the custom rule using the condition created above. Set -Action Block and assign a unique -Priority.

  Step 4: New-AzApplicationGatewayFirewallPolicy

  1. New-AzApplicationGatewayFirewallPolicy: Creates the WAF policy resource and includes the custom rule in the -CustomRule parameter.

  Step 5: New-AzApplicationGateway

  1. New-AzApplicationGateway: Creates the Application Gateway and associates it with the WAF policy using the -FirewallPolicy parameter.

  References:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies

• Question 190:

  You have a web application that will be deployed to an Azure App Service Web App.

  You need to optimize web application responsiveness and reliability by routing HTTP request and responses to the endpoint with the lowest network latency for the client.

  What should you consider?

  A. Use Azure Application Gateway
  B. Use Azure Monitor
  C. Use Azure Security Centre
  D. Use Azure Traffic Manager
  D. Use Azure Traffic Manager

  ---

  Explanation

  Correct Answer(s):

  Use Azure Traffic Manager - Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions, while providing high availability and responsiveness.

  Traffic Manager improves application responsiveness by directing traffic to the endpoint with the lowest network latency for the client.

  https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview

  Wrong Answers:

  Use Azure Application Gateway - Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. Application Gateway cannot distribute traffic based on network latency.

  Use Azure Monitor - Azure Monitor delivers a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments. It is not a load balancer.

  Use Azure Security Centre - Azure Security Center is a unified infrastructure security management system that strengthens the security posture of your data centers, and provides advanced threat protection across your hybrid workloads in the cloud. It is not a load balancer.