Microsoft Microsoft Certified: Azure Network Engineer Associate AZ-700 Questions & Answers

• Question 11:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 12:

  HOTSPOT

  In which NSGs can you use ASG1 and to which virtual machine network interfaces can you associate ASG1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  box1: only vnets 1 and 4 are in westUS, so only NSGs in this region can re-use the existing ASG1

  result: NSG1, NSG2 and NSG5

  box2:

  All network interfaces assigned to an application security group have to exist in the same virtual network that

  the first network interface assigned to the application security group is in. For example,

  if the first network interface assigned to an application security group named AsgWeb is in the virtual network named VNet1,

  then all subsequent network interfaces assigned to ASGWeb must exist in VNet1.

  You cannot add network interfaces from different virtual networks to the same application security group.

  source:https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups

  result:Vm2 only (was already assigned to VM1, which is in vnet1)

• Question 13:

  HOTSPOT

  Which virtual machines can VM1 and VM4 ping successfully? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: VM2, VM3 and VM4.

  VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

  There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocking inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

  Box 2:

  VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks

  inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

• Question 14:

  HOTSPOT

  You are implementing the virtual network requirements for VM-Analyze.

  What should you include in a custom route that is linked to Subnet2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

• Question 15:

  HOTSPOT

  You have an Azure load balancer that has the following configurations:

  1.

  Name: LB1

  2.

  Location: East US 2

  3.

  SKU: Standard

  4.

  Private IP address: 10.3.0.7

  5.

  Load balancing rule: rule1 (Tcp/80)

  6.

  Health probe: probe1 (Http:80)

  7.

  NAT rules: 0 inbound

  The backend pool of LB1 has the following configurations:

  1.

  Name: backend1

  2.

  Virtual network: Vnet2

  3.

  Backend pool configuration: NIC

  4.

  IP version: IPv4

  5.

  Virtual machines: VM1, VM2, VM3

  You have an Azure virtual machine named VM4 that has the following network configurations:

  1.

  Network interface: vm4981

  2.

  Virtual network/subnet: Vnet3/Subnet3

  3.

  NIC private IP address: 10.4.0.4

  4.

  Accelerated networking: Enabled

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  VM4 is in Vnet3/Subnet3.

  LB1 is in Vnet2. LB1 is a NIC based backend pool.

  The backend resources must be in the same virtual network as the load balancer for IP based LBs

  Box 2: Yes

  VM1 is in the backend pool of LB1. LB1 is in Vnet2.

  Box 3: No

  The Load balancing rule: rule1 (Tcp/80)

  However, HTTPS URLs begin with "https://" and use port 443 by default, whereas, HTTP URLs begin with "http://" and use port 80 by default.

  Reference: https://learn.microsoft.com/en-us/azure/load-balancer/backend-pool-management

• Question 16:

  HOTSPOT

  You have an Azure application gateway named AppGw1.

  You need to create a rewrite rulefor AppGw1. The solution must rewrite the URL of requests from https://www.contoso.com/fashion/shirts to ttps://www.contoso.com/buy.aspx?category-fashionandproduct=shirts.

  How should you complete the rule? To answer NOTE: Each correct selection is worth onepoint appropriate options in the answer area.

  Hot Area:

  

  Correct Answer:

  

• Question 17:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks.shown in the following table.

  

  You have a virtual machine named VM5 that has the following IP address configurations:

  1.

  IP address: 10.4.0.5

  2.

  Subnet mask:255.255.255.0

  3.

  Default gateway:10.4.0.1

  4.

  DNSserver:168.63.129.16

  You have an Azure Private DNS zone named, fabrikam.com that contains the records shown in, the following table.

  

  The virtual network linksin the fabrikam.com DNS /one are configured as shown in the exhibit. (Click the Exhibit tab.)

  VMS fails to resolve the IP address for.appKfabrik3in.com.

  For each of the following statements, select Yes if, the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 18:

  HOTSPOT

  You have an Azure virtual network and an on-premises datacenter that connect by using a Site-to-Site VPN tunnel.

  You need to ensure that all traffic from the virtual network to the internet is routed through the datacenter.

  How should you complete the PowerShell script to configure forced tunneling? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Get-AzLocalNetworkGateway See step 5 below.

  Configure forced tunneling

  1.

  Create a resource group.

  New-AzResourceGroup -Name 'ForcedTunneling' -Location 'North Europe'

  2.

  Create a virtual network and specify subnets.

  3.

  Create the local network gateways.

  Example:

  $lng1 = New-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName "ForcedTunneling" -Location "North Europe" -GatewayIpAddress "111.111.111.111" -AddressPrefix "192.168.1.0/24"

  4.

  Create the virtual network gateway.

  5.

  Assign a default site to the virtual network gateway. The -GatewayDefaultSite is the cmdlet parameter that allows the forced routing configuration to work, so take care to configure this setting properly.

  $LocalGateway = Get-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName "ForcedTunneling" $VirtualGateway = Get-AzVirtualNetworkGateway -Name "Gateway1" -ResourceGroupName "ForcedTunneling" Set-AzVirtualNetworkGatewayDefaultSite -GatewayDefaultSite $LocalGateway -VirtualNetworkGateway $VirtualGateway

  6.

  Establish the Site-to-Site VPN connections. Details omitted.

  Box 2: Set-AzVirtualNetworkGatewayDefaultSite

  Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

• Question 19:

  HOTSPOT

  Your on-premises network contains a VPN device.

  You have an Azure subscription that contains a virtual network and a virtual network gateway.

  You need to create a Site-to-Site VPN connection that has a custom cryptographic policy.

  How should you complete the PowerShell script? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: New-AzIpsecPolicy Configure IPsec/IKE policy for S2S (Site-to-Site) VPN or VNet-to-VNet connections Create a S2S VPN connection with an IPsec/IKE policy

  1. Create an IPsec/IKE policy

  The following sample script creates an IPsec/IKE policy with the following algorithms and parameters:

  IKEv2: AES256, SHA384, DHGroup24 IPsec: AES256, SHA256, PFS None, SA Lifetime 14400 seconds and 102400000KB

  $ipsecpolicy6 = New-AzIpsecPolicy -IkeEncryption AES256 -IkeIntegrity SHA3

  2. Create the S2S VPN connection with the IPsec/IKE policy

  Create an S2S VPN connection and apply the IPsec/IKE policy created earlier. $vnet1gw = Get-AzVirtualNetworkGateway -Name $GWName1 -ResourceGroupName $RG1 $lng6 = Get-AzLocalNetworkGateway -Name $LNGName6 -ResourceGroupName $RG1

  New-AzVirtualNetworkGatewayConnection -Name $Connection16 -ResourceGroup Box 2: New-AzVirtualNetworkGatewayConnection Reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-ipsecikepolicy-rm-powershell

• Question 20:

  HOTSPOT

  You have on-premises datacenters in New York and Seattle.

  You have an Azure subscription that contains the ExpressRoute circuits shown in the following table.

  

  You need to ensure that all the data sent between the datacenters is routed via the ExpressRoute circuits. The solution must minimize costs.

  How should you configure the network? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Global Reach

  ExpressRoute Global Reach is the service where if you have two datacenters, which are located at different geo-locations and both are connected to Microsoft Azure via Express Route then these two datacenters can also connect to each

  other securely via Microsoft's backbone.

  Incorrect:

  FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

  Box 2: Private

  With ExpressRoute Global Reach, you can link ExpressRoute circuits together to make a private network between your on-premises networks.

  Reference:

  https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach