Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 191:

  HOTSPOT

  You have an Azure subscription that contains multiple virtual machines in two Azure regions.

  You need to load balance network traffic across the virtual machines by using a cross-region load balancer solution.

  Which type of load balancer should you deploy to each region, and which type of rule should you configure for the cross-region load balancer? To answer, select the appropriate options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

• Question 192:

  You plan to implement Point-to-Site(P2S) VPN connection.

  Which of the following authentication methods you can use?

  A. Native Azure certificate authentication
  B. Native Azure active directory authentication
  C. RADIUS Server
  A. Native Azure certificate authentication
  B. Native Azure active directory authentication
  C. RADIUS Server

  ---

  Explanation

  Before Azure accepts a P2S VPN connection, the user has to be authenticated first. There are multiple mechanisms that Azure offers to authenticate a connecting user.

  Authenticate using native Azure certificate authentication - When using the native Azure certificate authentication, a client certificate that is present on the device is used to authenticate the connecting user.

  Authenticate using native Azure Active Directory authentication - Azure AD authentication allows users to connect to Azure using their Azure Active Directory credentials. Native Azure AD authentication is only supported for OpenVPN protocol and Windows 10 and requires the use of the Azure VPN Client

  Authenticate using Active Directory (AD) Domain Server - AD Domain authentication allows users to connect to Azure using their organization domain credentials. It requires a RADIUS server that integrates with the AD server. Organizations can also leverage their existing RADIUS deployment.

  https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

• Question 193:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to manage the public DNS records for a domain named fabrikam.com by using an Azure solution.

  You need to ensure that wvw.fabrikam.com resolves to 131.107.2.50.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  Create an Azure DNS zone [already done] and record using the Azure portal

  Create a DNS record

  DNS records are created for your domain inside the DNS zone. A new address record, known as an 'A' record, is created to resolve a host name to an IPv4 address.

  To create an 'A' record:

  Step 1: In the Azure portal, under All resources, open the fabrikam.com DNS zone. You can enter fabrikam.com in the Filter by name box to find it more easily.

  Step 2: In the Add a record set window, enter or select the following values:

  Step 3: At the top of the fabrikam.com DNS zone page, select + Record set.

  1. Name: Type www. This record name is the host name that you want to resolve to the specified IP address.

  2. Type: Select A. 'A' records are the most common, but there are other record types for mail servers (MX), IPv6 addresses (AAAA), and so on.

  3. TTL: Type

  1. Time-to-live of the DNS request specifies how long DNS servers and clients can cache a response.

  4. TTL unit: Select Hours. The time unit for the TTL entry is specified here.

  5. IP address: Type 131.107.2.50. This value is the IP address that the record name resolves to. In a real-world scenario, you would enter the public IP address for your web server.

  Step 4: Select OK to create the A record.

  References:

  https://learn.microsoft.com/en-us/azure/dns/dns-getstarted-portal

• Question 194:

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1.

  You deploy an instance of Azure Application Gateway v2 named AppGw1 to Subnet1. You create a network security group (NSG) named NSG1 and link NSG1 to Subnet1.

  You need to ensure that AppGw1 will only load balance traffic that originates from VNet1. The solution must minimize the impact on the functionality of AppGw1.

  What should you add to NSG1?

  A. an outbound rule that has a priority of 4096 and blocks all internet traffic
  B. an inbound rule that has a priority of 4096 and blocks all internet traffic
  C. an inbound rule that has a priority of 100 and blocks all internet traffic
  D. an outbound rule that has a priority 100 and blocks all internet traffic
  B. an inbound rule that has a priority of 4096 and blocks all internet traffic

• Question 195:

  HOTSPOT

  You have an Azure subscription that contains a virtual network named VNet1.

  You need to deploy an instance of Azure Application Gateway v2 named AppGw1 to VNet1. AppGw1 will include one basic listener and two multi-site listeners. The listeners will be accessible only from VNet1.

  What is the minimum number of IP addresses required for AppGw1? To answer, select the appropriate options in the answer area

  NOTE: Each correct selection is worth one point.

  

  

• Question 196:

  You have an Azure subscription that contains the following resources:

  A virtual network named Vnet1

  A subnet named Subnet1 in Vnet1

  A virtual machine named VM1 that connects to Subnet1

  Three storage accounts named storage1, storage2, and storage3

  You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

  To achieve the requirement, you create a network security group (NSG). You configure a service tag for Microsoft Storage and link the tag to Subnet1.

  Did you achieve the requirement?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  This will either allow or deny traffic to all storage accounts from all virtual machines in Subnet1.

• Question 197:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to deploy an appliance to subnet3-2. The appliance will perform packet inspection and will have an IP address of 10.3.2.100.

  You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Plan:

  Stage 1: Create a route table Stage 2: Create a route Stage 3: Associate a route table to a subnet

  Stage 1: Create a route table Step 1: On the Azure portal menu or from the Home page, select Create a resource.

  Step 2: In the search box, enter Route table. When Route table appears in the search results, select it.

  Step 3: In the Route table page, select Create.

  Step 4: In the Create route table dialog box:

  * Details omitted*

  Step 5: Select Review + create and then Create to create your new route table.

  Stage 2: Create a route

  Step 6: Make sure the route table you created is selected.

  Step 7: From the route table menu bar, choose Routes and then select + Add.

  Step 8: Enter a unique Route name for the route within the route table.

  

  Step 9: Enter the Address prefix, in Classless Inter-Domain Routing (CIDR) notation, that you want to route traffic to. The prefix can't be duplicated in more than one route within the route table, though the prefix can be within another prefix.

  For example, if you defined 10.0.0.0/16 as a prefix in one route, you can still define another route with the 10.0.0.0/22 address prefix. Azure selects a route for traffic based on longest prefix match.

  Enter the following:

  Address prefixes: 0.0.0.0/0

  Next hop type: Internet

  Next hop address: 10.3.2.100

  Step 10: Click Add.

  Stage 3: Associate a route table to a subnet

  Step 11: In the virtual network list, choose the virtual network that contains the subnet you want to associate a route table to.

  Step 12: In the virtual network menu bar, choose Subnets.

  Step 13: Select the subnet you want to associate the route table to. In our case select subnet3-1, (You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.)

  Step 14: In Route table, choose the route table you want to associate to the subnet. Select the one you created earlier.

  

  Step 15: Select Save.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a-route

• Question 198:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it as a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains an Azure Front Door Premium profile named AFD and an Azure Web Application Firewall (WAF) policy named WAF. AFD is associated with WAF.

  You need to configure a rate limit for incoming requests to AFD.

  Solution: You configure a custom rule for WAF.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  References:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-configure

• Question 199:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to deploy an app named App1 to meet the following requirements.

  1. External users must be able to access App1 from the internet.

  2. App1 will be load balanced across all the virtual machines.

  3. App1 will be hosted on VM1, VM2. VM3. and VM4.

  4. App1 must be available if an Azure region fails.

  5. Costs must be minimized.

  You need to implement a global load balancer solution for App.

  What should you configure? To answer, select the appropriate options in the answer area

  NOTE: Bach correct answer is worth one point.

  

  

• Question 200:

  You have the Azure resources shown in the following table.

  

  You configure storage1 to provide access to the subnet in Vnet1 by using a service endpoint.

  You need to ensure that you can use the service endpoint to connect to the read-only endpoint of storage1 in the paired Azure region.

  What should you do first?

  A. Configure the firewall settings for storage1.
  B. Fail over storage1 to the paired Azure region.
  C. Create a virtual network in the paired Azure region.
  D. Create another service endpoint.
  C. Create a virtual network in the paired Azure region.

  ---

  Explanation

  When planning for disaster recovery during a regional outage, you should create the VNets in the paired region in advance. Enable service endpoints for Azure Storage, with network rules granting access from these alternative virtual networks. Then apply these rules to your geo-redundant storage accounts.

  https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal