Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 211:

  You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements.

  Which two actions should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. On the peering from Vnet1, select Allow for Traffic forwarded from remote virtual network.
  B. On the peerings from Vnet2 and Vnet3, select Allow for Traffic forwarded from remote virtual network.
  C. On the peering from Vnet1, select Use the remote virtual network's gateway or Route Server.
  D. On the peering from Vnet1, select Allow for Traffic to remote virtual network.
  E. On the peerings from Vnet2 and Vnet3, select Use the remote virtual network's gateway or Route Server.
  B. On the peerings from Vnet2 and Vnet3, select Allow for Traffic forwarded from remote virtual network.
  E. On the peerings from Vnet2 and Vnet3, select Use the remote virtual network's gateway or Route Server.

  ---

  Explanation

  Correct answer is: BE.

  The justification is as follows:

  - E IS obviously an answer because without it the requirements cannot be met.

  - D is NOT an answer, because: The case study says that "There is bidirectional peering between Vnet1 and Vnet2. There is bidirectional peering between Vnet1 and Vnet3." This means that "Traffic to remote virtual network" is already allowed for Vnet1<...>Vnet2 and Vnet1<...>.

  - C is a total nonsense.

  - B IS an answer, because Vnet1 contains the VPN gateway that forwards the traffic between Vnet2 and Vnet3.

  - A is NOT an answer, because Vnet2 and Vnet3 don't have VPN gateways so they cannot forward traffic to Vnet1.

  Documentation:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal#create-a-peering

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

• Question 212:

  HOTSPOT

  You have an Azure subscription that contains an Azure application gateway named AG1 and two Azure App Service apps named App1 and App2 that have the following configurations:

  1. Both apps are accessible by using HTTP and HTTPS.

  2. HTTP host headers are used to route requests to the appropriate apps.

  3. Both apps are hosted in a single App Service Environment in the West Europe Azure region.

  You need to publish the apps by using AG1. The solution must ensure that AG1 provides both HTTP and HTTPS access.

  What is the minimum number of resources required for AG1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 213:

  You have an Azure application gateway that has Azure Web Application Firewall (WAF) enabled.

  You configure the application gateway to direct traffic to the URL of the application gateway.

  You attempt to access the URL and receive an HTTP 403 error. You view the diagnostics log and discover the following error.

  

  You need to ensure that the URL is accessible through the application gateway.

  Solution: You disable the WAF rule that has a ruleId 920300.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 214:

  DRAG DROP

  You have an Azure subscription that contains an Azure Firewall Premium policy named FWP1.

  To FWP1, you plan to add the rule collections shown in the following table.

  

  Which priority should you assign to each rule collection? To answer, drag the appropriate priority values to the correct rule collections. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: 200

  RC1 Network

  Rule collection groups

  A rule collection group is used to group rule collections. They're the first unit to be processed by the Azure Firewall and they follow a priority order based on values. There are three default rule collection groups, and their priority values are preset by design. They're processed in the following order:

  * Default Network rule collection group

  Priority: 200

  Box 2: 300

  RC2 Application

  Default Application rule collection group 300

  Box 3: 100

  RC3 DNAT

  * Default DNAT (Destination Network Address Translation) rule collection group Priority 100

  Note:

  References:

  https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets

• Question 215:

  Azure virtual networks in the East US Azure region as shown in the following table.

  

  The virtual networks are peered to one another. Each virtual network contains four subnets.

  You plan to deploy a virtual machine named VM1 that will inspect and route traffic between all the subnets on both the virtual networks.

  What is the minimum number of IP addresses that you must assign to VM1?

  A. 1
  B. 2
  C. 4
  D. 8
  A. 1

  ---

  Explanation

  https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#can-azure-firewall-forward-and-filter-network-traffic-between-subnets-in-the-same-virtual-network-or-peered-virtual-networks

  Can Azure Firewall forward and filter network traffic between subnets in the same virtual network or peered virtual networks?

  Yes. However, configuring the UDRs to redirect traffic between subnets in the same VNET requires additional attention. While using the VNET address range as a target prefix for the UDR is sufficient, this also routes all traffic from one machine to another machine in the same subnet through the Azure Firewall instance. To avoid this, include a route for the subnet in the UDR with a next hop type of VNET. Managing these routes might be cumbersome and prone to error.

  The recommended method for internal network segmentation is to use Network Security Groups, which don't require UDRs.

• Question 216:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to archive all the metrics of VNET1 to an existing storage account.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Monitoring Azure virtual network

  Azure virtual network uses Azure Monitor.

  Data platform

  Azure Monitor stores data in data stores for each of the pillars of observability: metrics, logs, distributed traces, and changes. Each store is optimized for specific types of data and monitoring scenarios.

  Retention of metrics

  You can send platform metrics for Azure Monitor resources to a Log Analytics workspace for long-term trending.

  Send to Azure Storage Send resource logs to Azure Storage to retain them for archiving. After you've created the diagnostic setting, a storage container is created in the storage account as soon as an event occurs in one of the enabled log categories.

  Create a diagnostic setting to send resource logs to a Log Analytics workspace or to a Storage Account.

  Archiving logs and metrics to a Storage account is useful for audit, static analysis, or backup. Compared to using Azure Monitor Logs or a Log Analytics workspace, Storage is less expensive, and logs can be kept there indefinitely.

  Create diagnostic settings

  You can configure diagnostic settings in the Azure portal either from the Azure Monitor menu or from the menu for the resource.

  Step 1: Select the Virtual Network VNET1.

  Step 2: Select Diagnostic settings under Monitoring on the resource's menu.

  

  Step 3: If no settings exist on the resource you've selected, you're prompted to create a setting. Select Add diagnostic setting.

  

  If there are existing settings on the resource, you see a list of settings already configured. Select Add diagnostic setting to add a new setting. Or select Edit setting to edit an existing one. Each setting can have no more than one of each of the destination types.

  

  Step 4: Give your setting a name if it doesn't already have one.

  Step 5: Logs and metrics to route: Select AllMetrics if you want to store metrics in Azure Monitor Logs too.

  

  Step 6: Destination details. Select Archive to a storage account

  Step 7:

  Storage: Select the Subscription, Storage account, and Retention policy.

  

  Step 8: Select Save.

  References:

  https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings

  https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-platform-metrics

• Question 217:

  You have an on-premises network that uses an IP address space of 172.16.0.0/16.

  You plan to create a new Azure subscription and deploy 25 virtual machines.

  The requirements are as follows:

  All Azure virtual machines must be placed on the same subnet named Subnet1.

  All the Azure virtual machines must be able to communicate with all on-premises servers.

  The servers must be able to communicate between the on-premises network and Azure by using a site-to-site VPN.

  What should you include in the recommendation for Subnet1 and Gateway subnet IP address space?

  A. 172.16.0.0/16 & 172.16.1.0/28
  B. 172.16.0.0/16 & 192.168.0.0/24
  C. 172.16.1.0/28 & 192.168.0.0/24
  D. 192.168.0.0/24 & 172.16.1.0/28
  E. 192.168.0.0/24 & 192.168.1.0/28
  E. 192.168.0.0/24 & 192.168.1.0/28

  ---

  Explanation

  We cannot use these IP address spaces - 172.16.0.0/16 & 172.16.1.0/28 in Azure as these overlap with on-premises IP address space. The virtual network gateway uses specific subnet called the gateway subnet. The gateway subnet is part of the virtual network IP address range that you specify when configuring your virtual network. It contains the IP addresses that the virtual network gateway resources and services use.

  When you create the gateway subnet, you specify the number of IP addresses that the subnet contains.

  The number of IP addresses needed depends on the VPN gateway configuration that you want to create.

  Some configurations require more IP addresses than others. We recommend that you create a gateway subnet that uses a /27 or /28.

  So, the subnet1 IP address space must be 192.168.0.0/24 and Gateway subnet IP address space must be 192.168.1.0/28

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal#VNetGateway

  Wrong Answers:

  172.16.0.0/16 & 172.16.1.0/28 - Overlaps with on-premises IP address space.

  172.16.0.0/16 & 192.168.0.0/24 - Overlaps with on-premises IP address space.

  172.16.1.0/28 & 192.168.0.0/24 - Overlaps with on-premises IP address space. 192.168.0.0/24 & 172.16.1.0/28 - Overlaps with on-premises IP address space.

• Question 218:

  HOTSPOT

  You have on-premises datacenters in New York and Seattle.

  You have an Azure subscription that contains the ExpressRoute circuits shown in the following table.

  

  You need to ensure that all the data sent between the datacenters is routed via the ExpressRoute circuits.

  The solution must minimize costs.

  How should you configure the network? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Global Reach

  ExpressRoute Global Reach is the service where if you have two datacenters, which are located at different geo-locations and both are connected to Microsoft Azure via Express Route then these two datacenters can also connect to each other securely via Microsoft's backbone.

  Incorrect:

  FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

  Box 2: Private

  With ExpressRoute Global Reach, you can link ExpressRoute circuits together to make a private network between your on-premises networks.

  References:

  https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach

• Question 219:

  You need to configure GW1 to meet the network security requirements for the P2S VPN users.

  Which Tunnel type should you select in the Point-to-site configuration settings of GW1?

  A. IKEv2 and OpenVPN (SSL)
  B. IKEv2
  C. IKEv2 and SSTP (SSL)
  D. OpenVPN (SSL)
  E. SSTP (SSL)
  D. OpenVPN (SSL)

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 220:

  HOTSPOT

  You have the Azure resources shown in the following table.

  

  You need to link VNei2 to Circuit1

  What should you create in each subscription? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.