Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 201:

  DRAG DROP

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain named contoso.com that has an internal certification authority (CA).

  You have an Azure subscription.

  You deploy an Azure application gateway named AppGwy1 and perform the following actions:

  1. Configure an HTTP listener

  2. Associate a routing rule with the listener

  You need to configure AppGwy1 to perform mutual authentication for requests from domain-joined computers to contoso.com.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: From AppGw1, create a frontend IP configuration

  Step 2: From AppGw1, create an SSL profile Set up a listener-specific SSL policy.

  To set up a listener-specific SSL policy, you'll need to first go to the SSL settings tab in the Portal and create a new SSL profile. When you create an SSL profile, you'll see two tabs: Client Authentication and SSL Policy. The SSL Policy tab is to configure a listener-specific SSL policy. The Client Authentication tab is where to upload a client certificate(s) for mutual authentication. (Step 3)

  Step 3: From an on-premises computer, upload a certificate to Appgwy1.

  Configure mutual authentication

  To configure an existing Application Gateway with mutual authentication, you'll need to first go to the SSL settings tab in the Portal and create a new SSL profile. (Step 2)

  When you create an SSL profile, you'll see two tabs: Client Authentication and SSL Policy. The Client Authentication tab is where you'll upload your client certificate(s).

  Step 4: From AppGw1, add an HTTP listener and associate the listener to the SSL profile Now that we've created an SSL profile with a listener-specific SSL policy, we need to associate the SSL profile to the listener to put the listener-specific policy in action.

  Navigate to your existing Application Gateway. If you just completed the steps above, you don't need to do anything here.

  Select Listeners from the left-side menu.

  Click on Add listener if you don't already have an HTTPS listener set up. If you already have an HTTPS listener, click on it from the list.

  Fill out the Listener name, Frontend IP, Port, Protocol, and other HTTPS Settings to fit your requirements. (Frontend IP created in Step 1)

  Check the Enable SSL Profile checkbox so that you can select which SSL Profile to associate with the listener.

  Select the SSL profile you created from the dropdown list.

  Etc.

  References:

  https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-configure-listener-specific-ssl-policy

  https://learn.microsoft.com/en-us/azure/application-gateway/mutual-authentication-portal

• Question 202:

  You need to configure a custom rule for APPGWI-WAFPolicy to allow only connections that originate from FD1. The solution must support the planned changes.

  Which Match type and Match variable should you select?

  A. String and RequestCookies
  B. IP address and RemoteAddr
  C. String and RequestHeaders
  D. Geo location and RemoteAddr
  B. IP address and RemoteAddr

• Question 203:

  HOTSPOT

  You have an Azure subscription that contains the resource groups shown in the following table.

  

  You have the virtual networks shown in the following table.

  

  You have the subnets shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Move an Azure virtual network to another region by using Azure PowerShell.

  There are various scenarios for moving an existing Azure virtual network from one region to another. For example, you might want to create a virtual network with the same configuration for testing and availability as your existing virtual network. Or you might want to move a production virtual network to another region as part of your disaster recovery planning.

  You can use an Azure Resource Manager template to complete the move of the virtual network to another region. You do this by exporting the virtual network to a template, modifying the parameters to match the destination region, and then deploying the template to the new region.

  Move networking resources to new resource group or subscription.

  You can move virtual networks and other networking resources to a new resource group or Azure subscription.

  Azure Resource Mover helps you move Azure resources between Azure regions.

  All Azure resources are created in an Azure region and subscription. A resource can only be created in a virtual network that exists in the same region and subscription as the resource.

  Note: VNet1 is in East US. Vnet1 is in RG1. RG1 is in East US.

  RG3 is in UK West.

  Box 2: No

  VNet1 is the only virtual network in East US. Vnet1 has one subnet Subnet1-1 with IP address range 10.1.1.0/24. This address range has only 256 unique IP addresses.

  Box 3: No

  RG2 already has a VNET named Vnet2.

  Scope

  All Azure resource types have a scope that defines the level of that resource and that the resource names must be unique. A resource must have a unique name within its scope.

  For example, a virtual network has a resource group scope, which means that there can be only one network named vnet-prod-westus-001 in a given resource group. Other resource groups could have their own virtual network named vnet-prod-westus-001.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/move-across-regions-vnet-powershell

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/resource-naming

• Question 204:

  You have an Azure environment that contains two subscriptions named Subscription1 and Subscription2.

  Each subscription is associated to a different Azure AD tenant.

  Subscription1 contains a virtual network named VNet1.

  VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.3.0/24.

  Subscription2 contains a virtual network named VNet2.

  Vnet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.190.0.0/24.

  You need to connect VNet1 to VNet2.

  What should you do first?

  A. Modify the IP address space of VNet2
  B. Provision virtual network gateways
  C. Move VM1 to Subscription2
  D. Move VNet1 to Subscription2
  B. Provision virtual network gateways

  ---

  Explanation

  Provision virtual network gateways - Virtual network gateway allows to establish connectivity between two virtual networks. Virtual networks can be in different regions and from different subscriptions. When you connect VNets from different subscriptions, the subscriptions don't need to be associated with the same Active Directory tenant.

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal

  Wrong Answers:

  Modify the IP address space of VNet2 - IP addresses are not overlapping. So, modification to IP range is not required.

  Move VM1 to Subscription2 - The requirement is to connect VNets. Moving a VM to a different VNet does not provide connectivity between VNets. Move VNet1 to Subscription2 - VNets are logical isolation of cloud resources. Moving VNet1 to the Subscription2 does not provide connectivity between VNets. Also, Subscription2 is in a different Azure AD tenant.

• Question 205:

  You have an on-premises datacenter named Site1 that contains a firewall named FW1.

  FW1 connects to the internet.

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to connect Site1 to Hub1 by using a site-to-site connection.

  You need to configure the site-to-site connection to FW1.

  What should you create in VWAN1?

  A. a VPN site
  B. a virtual network connection
  C. a network virtual appliance (NVA)
  D. a User VPN configuration
  A. a VPN site

• Question 206:

  HOTSPOT

  You have an Azure subscription.

  You plan to use Azure Virtual WAN.

  You need to deploy a virtual WAN hub that meets the following requirements:

  1. Supports 4 Gbps of Site-to-Site (S2S) VPN traffic

  2. Supports 8 Gbps of ExpressRoute traffic

  3. Minimizes costs

  How many scale units should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  For S2S 1 scale unit = 500 Mbps

  4000/500 = 8 scale units

  https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings#s2s

  For ExpressRoute 1 scale unit = 2Gbps

  8/2 = 4

  https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-about#expressroute-performance

• Question 207:

  You have an Azure virtual machine named VM1.

  You need to capture all the network traffic of VM1 by using Azure Network Watcher.

  To which locations can the capture be written?

  A. blob storage only
  B. blob storage, a file path on VM1, and a premium storage account
  C. a file path on VM1 only
  D. blob storage and a file path on VM1 only
  E. blob storage and a premium storage account only
  F. a premium storage account only
  D. blob storage and a file path on VM1 only

  ---

  Explanation

  Once your packet capture session has completed, the capture file is uploaded to blob storage or to a local file on the virtual machine. The storage location of the packet capture is defined during creation of the packet capture.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-manage-portal

• Question 208:

  HOTSPOT

  Your company has an Azure virtual network named Vnet1 that uses an IP address space of 192.168.0.0/20. Vnet1 contains a subnet named Subnet1 that uses an IP address space of 192.168.0.0/24.

  You create an IPv6 address range to Vnet1 by using a CIDR suffix of /48.

  You need to enable the virtual machines on Subnet1 to communicate with each other by using IPv6 addresses assigned by the company. The solution must minimize the number of additional IPv4 addresses.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-overview

  https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-add-to-existing-vnet-powershell

• Question 209:

  You have an Azure subscription that contains an Azure App Service app. The app uses a URL of https://www.contoso.com.

  You need to use a custom domain on Azure Front Door for www.contoso.com. The custom domain must use a certificate from an allowed certification authority (CA).

  What should you include in the solution?

  A. an enterprise application in Azure Active Directory (Azure AD)
  B. Active Directory Certificate Services (AD CS)
  C. Azure Key Vault
  D. Azure Application Gateway
  C. Azure Key Vault

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https

• Question 210:

  HOTSPOT

  You are implementing the Virtual network requirements for Vnet6.

  What is the minimum number of subnets and service endpoints you should create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: 3

  Subnets

  * One subnet for the three VMs

  Virtual network and subnets

  A subnet is a range of IP addresses in the virtual network. You can divide a virtual network into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one virtual network. NICs connected to subnets (same or different) within a virtual network can communicate with each other without any extra configuration.

  * One gateway subnet for the incoming VPN connection.

  About the gateway subnet

  The virtual network gateway uses specific subnet called the gateway subnet. The gateway subnet is part of the virtual network IP address range that you specify when configuring your virtual network. It contains the IP addresses that the virtual network gateway resources and services use. The subnet must be named 'GatewaySubnet' in order for Azure to deploy the gateway resources.

  * One subnet for the two container groups

  To deploy to a new virtual network and have Azure create the network resources for you automatically, specify the following when you execute az container create:

  Virtual network name

  Virtual network address prefix in CIDR format Subnet name Subnet address prefix in CIDR format

  Once you've deployed your first container group with this method, you can deploy to the same subnet by specifying the virtual network and subnet names, or the network profile that Azure automatically creates for you. Because Azure delegates the subnet to Azure Container Instances, you can deploy only container groups to the subnet.

  Note:

  Contoso has the following virtual network requirements:

  Create a virtual network named Vnet6 in West US that will contain the following resources and configurations: Two container groups that connect to Vnet6

  Three virtual machines that connect to Vnet6

  Allow VPN connections to be established to Vnet6

  Allow the resources in Vnet6 to access KeyVault1, DB1, and Vnet1 over the Microsoft backbone network.

  Box 2: 2

  * One Service Endpoint for the Azure KeyVault KeyVault1.

  The virtual network service endpoints for Azure Key Vault allow you to restrict access to a specified virtual network.

  * One Service Endpoint for the Azure SQL Database DB1.

  Service endpoints are a networking feature in Azure designed to help you better identify traffic coming into your Azure SQL Database as originating from one or more of your VNets.

  Note: Service endpoints are a networking feature in Azure designed to help you better identify traffic coming into your Azure SQL Database as originating from one or more of your VNets.

  Service endpoints are available for the following Azure services and regions.

  Azure SQL Database

  Azure Key Vault

  Etc.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/network-overview

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell

  https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

  https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints