Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 11:

  HOTSPOT

  You have an Azure subscription that contains a single virtual network and a virtual network gateway.

  You need to ensure that administrators can use Point-to-Site (P2S) VPN connections to access resources in the virtual network. The connections must be authenticated by Azure Active Directory (Azure AD).

  What should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: An enterprise application Enable Azure AD authentication on the VPN gateway:

  1. Locate the Directory ID of the directory that you want to use for authentication. It's listed in the properties section of the Active Directory page.

  2. Under your Azure AD, in Enterprise applications, you see Azure VPN listed.

  Copy the Directory ID.

  3. Sign in to the Azure portal as a user that is assigned the Global administrator role.

  4. Next, give admin consent. Copy and paste the URL that pertains to your deployment location in the address bar of your browser.

  5. Select the Global Admin account if prompted.

  6. Select Accept when prompted.

  

  7. Under your Azure AD, in Enterprise applications, you see Azure VPN listed.

  

  Box 2: Open VPN (SSL)

  When you connect to your VNet using Point-to-Site, you have a choice of which protocol to use. The protocol you use determines the authentication options that are available to you. If you want to use Azure Active Directory authentication, you can do so when using the OpenVPN protocol.

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 12:

  You plan to implement an Azure virtual network that will contain 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.

  You need to recommend a load balancing solution for the virtual network. The solution must meet the following requirements:

  1. The virtual machines and the load balancer must be accessible only from the virtual network.

  2. Costs must be minimized.

  What should you include in the recommendation?

  A. Basic Azure Load Balancer
  B. Azure Application Gateway v1
  C. Azure Standard Load Balancer
  D. Azure Application Gateway v2
  C. Azure Standard Load Balancer

• Question 13:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to ensure that only hosts on VNET1 can access the storage123456789 storage account. The solution must ensure that access occurs over the Azure backbone network.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Use private endpoints for Azure Storage

  You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

  Connect to a storage account using an Azure Private Endpoint Create a private endpoint

  Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

  Step 2: Locate and select the Storage Account storage123456789

  Step 3: Select the Networking tab or select

  Next: Advanced then

  Next: Networking.

  Step 4: In the Networking tab, under Network connectivity select Disable public access and use private access.

  Step 5: In Private endpoint, select + Add private endpoint.

  Step 6: In Create private endpoint enter or select the following information:

  *Details omitted*

  * Virtual network: Select VNET1.

  Step 7: Select OK.

  Step 8: Select Review.

  Step 9: Select Create.

  References:

  https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

  https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal

• Question 14:

  You have an Azure subscription that contains a virtual network named VNet1 and the virtual machines shown in the following table.

  

  All the virtual machines are connected to Vnet1.

  You need to ensure that the applications hosted on the virtual machines can be accessed from the internet. The solution must ensure that the virtual machines share a single public IP address.

  What should you use?

  A. an internal load balancer
  B. Azure Application Gateway
  C. a NAT gateway
  D. a public load balancer
  D. a public load balancer

  ---

  Explanation

  A public load balancer can provide outbound connections for virtual machines (VMs) inside your virtual network. These connections are accomplished by translating their private IP addresses to public IP addresses. Public Load Balancers are used to load balance internet traffic to your VMs.

  Load Balancer load-balances traffic at layer 4 (TCP or UDP).

  Incorrect:

  Not A: An internal (or private) load balancer is used where private IPs are needed at the frontend only.

  Internal load balancers are used to load balance traffic inside a virtual network. A load balancer frontend can be accessed from an on-premises network in a hybrid scenario.

  Not B: How do Application Gateway and Azure Load Balancer differ?

  Application Gateway is a layer 7 load balancer, which means it works only with web traffic (HTTP, HTTPS, WebSocket, and HTTP/2). It supports capabilities such as TLS termination, cookie-based session affinity, and round robin for load-balancing traffic. Load Balancer load-balances traffic at layer 4 (TCP or UDP).

  What protocols does Application Gateway support?

  Application Gateway supports HTTP, HTTPS, HTTP/2, and WebSocket.

  Not C: NAT gateway is for outbound access.

  References:

  https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

  https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-faq

• Question 15:

  HOTSPOT

  Your on-premises network contains a server named DNS1 that runs Windows Server 2022. DNS1 has the DNS server role and an IP address of 10.1.0.1. The network contains computers that use DNS1 for name resolution.

  You have an Azure subscription that contains the resources shown in the following table.

  

  The on-premises network connects to Vnet1 by using a Site-to-Site VPN.

  You need to ensure that the computers on the on-premises network can resolve the IP address for sql1.private.fabrikam.com.

  What should you do on DNS1 and DNS2? To answer, drag the appropriate actions to the correct servers.

  Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  

  

• Question 16:

  Which virtual machines can VM1 ping successfully?

  A. VM2 only
  B. VM2 and VM4 only
  C. VM2, VM3 and VM4 only
  D. VM2, VM3, VM4 and VM5 only
  C. VM2, VM3 and VM4 only

  ---

  Explanation

  VM1 is in VNet1/Subnet1.

  VNet1 is peered with VNet2 and VNet3.

  There is no NSG rule blocking outbound ICMP from VNet1.

  There are no NSG rule blocking inbound ICMP to VNet1/Subnet2, VNet2 or VNet3.

  Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

• Question 17:

  HOTSPOT

  You have an Azure subscription that contains a dual-stack virtual network named VNet1.

  VNet1 has the following IP address spaces:

  1. IPv4:192.168.0.0/24

  2. IPv6: fd0adbftdeca: deed: y48

  You plan to deploy an Azure VPN gateway and multiple virtual machines to VNet1.

  You need to configure the subnet masks for VNet1. The solution must meet the following requirements:

  1. Maximize the number of usable IP addresses.

  2. Support the deployment of the VPN gateway and the virtual machines.

  Which subnet mask should you use for each address space? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 18:

  You plan to deploy five virtual machines to a subnet named Subnet1.

  Each virtual machine requires the same inbound and outbound security rules.

  What is the minimum number of network security groups that you require?

  A. 1
  B. 5
  C. 10
  A. 1

  ---

  Explanation

  The rules are same for all virtual machines, so one NSG should suffice the requirement.

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

  https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

• Question 19:

  DRAG DROP

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to associate Gateway1 with Subnet1. The solution must minimize downtime on VM1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Disassociate PIP1 from NIC1

  Azure NAT Gateway resources enable outbound Internet connections from subnets in a virtual network.

  Resources deployed in the NAT gateway virtual network subnet must be the standard SKU. Deployment of a NAT gateway to a virtual network subnet with basic SKU resources is unsupported.

  Resource using Basic SKU public IP addresses, Decision path

  * Virtual Machine or Virtual Machine Scale Sets (flex model)

  Disassociate IP(s) and utilize the upgrade options detailed after the table.

  Step 2: Change the Pip1 SKU to standard

  Step 3: Associate PIP1 from NIC1

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance

  https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-nat-gateway

• Question 20:

  You have the Azure Traffic Manager profiles shown in the following table.

  

  You plan to add the endpoints shown in the following table.

  

  Which endpoints can you add to Profile2?

  A. Endpoint1 and Endpoint4 only
  B. Endpoint1, Endpoint2, Endpoint3, and Endpoint4
  C. Endpoint1 only
  D. Endpoint2 and Endpoint3 only
  E. Endpoint3 only
  A. Endpoint1 and Endpoint4 only