Microsoft Microsoft Certified: Azure Network Engineer Associate AZ-700 Questions & Answers

• Question 251:

  You need to archive all the metrics of VNET1 to an existing storage account.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Monitoring Azure virtual network

  Azure virtual network uses Azure Monitor.

  Data platform

  Azure Monitor stores data in data stores for each of the pillars of observability: metrics, logs, distributed traces, and changes. Each store is optimized for specific types of data and monitoring scenarios.

  Retention of metrics

  You can send platform metrics for Azure Monitor resources to a Log Analytics workspace for long-term trending.

  Send to Azure Storage

  Send resource logs to Azure Storage to retain them for archiving. After you've created the diagnostic setting, a storage container is created in the storage account as soon as an event occurs in one of the enabled log categories.

  Create a diagnostic setting to send resource logs to a Log Analytics workspace or to a Storage Account.

  Archiving logs and metrics to a Storage account is useful for audit, static analysis, or backup. Compared to using Azure Monitor Logs or a Log Analytics workspace, Storage is less expensive, and logs can be kept there indefinitely.

  Create diagnostic settings

  You can configure diagnostic settings in the Azure portal either from the Azure Monitor menu or from the menu for the resource.

  Step 1: Select the Virtual Network VNET1.

  Step 2: Select Diagnostic settings under Monitoring on the resource's menu.

  

  Step 3: If no settings exist on the resource you've selected, you're prompted to create a setting. Select Add diagnostic setting.

  

  If there are existing settings on the resource, you see a list of settings already configured. Select Add diagnostic setting to add a new setting. Or select Edit setting to edit an existing one. Each setting can have no more than one of each of the destination types.

  

  Step 4: Give your setting a name if it doesn't already have one.

  Step 5: Logs and metrics to route: Select AllMetrics if you want to store metrics in Azure Monitor Logs too.

  

  Step 6: Destination details. Select Archive to a storage account

  

  Step 7: Storage: Select the Subscription, Storage account, and Retention policy.

  Step 8: Select Save.

  Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-platform-metrics

• Question 252:

  You plan to deploy 100 virtual machines to subnet-1. The virtual machines will NOT be assigned a public IP address. The virtual machines will call the same API which is hosted by a third party. The virtual machines will make more than 10,000 calls per minute to the API.

  You need to minimize the risk of SNAT port exhaustion. The solution must minimize administrative effort.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  SNAT exhaustion occurs when a backend instance runs out of given SNAT Ports. A load balancer can still have unused SNAT ports. If a backend instance's used SNAT ports exceed its given SNAT ports, it will be unable to establish new

  outbound connections.

  Use a NAT gateway for outbound connectivity to the Internet

  Virtual network NAT gateway is a highly resilient and scalable Azure service that provides outbound connectivity to the internet from your virtual network. A NAT gateway's unique method of consuming SNAT ports helps resolve common

  SNAT exhaustion and connection issues.

  (Basic load balancers and basic public IP addresses aren't compatible with NAT.)

  Create a NAT gateway

  Step 1: Sign in to the Azure portal.

  Step 2: In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  Step 3: Select + Create.

  Step 4: In Create network address translation (NAT) gateway, enter or select this information in the Basics tab.

  * Details omitted *

  Step 5: Select the Outbound IP tab, or select the Next: Outbound IP button at the bottom of the page.

  Step 6: In the Outbound IP tab, enter or select the following information:

  * Public IP addresses

  Select Create a new public IP address.

  In Name, enter myPublicIP.

  Select OK.

  Step 7: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 8: Select Create.

  Reference: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections https://learn.microsoft.com/en-us/azure/load-balancer/troubleshoot-outbound-connection

• Question 253:

  You plan to deploy an appliance to subnet3-2. The appliance will perform packet inspection and will have an IP address of 10.3.2.100. You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Plan:

  Stage 1: Create a route table

  Stage 2: Create a route

  Stage 3: Associate a route table to a subnet

  Stage 1: Create a route table

  Step 1: On the Azure portal menu or from the Home page, select Create a resource.

  Step 2: In the search box, enter Route table. When Route table appears in the search results, select it.

  Step 3: In the Route table page, select Create.

  Step 4: In the Create route table dialog box:

  * Details omitted*

  Step 5: Select Review + create and then Create to create your new route table.

  Stage 2: Create a route

  Step 6: Make sure the route table you created is selected.

  Step 7: From the route table menu bar, choose Routes and then select + Add.

  

  Step 8: Enter a unique Route name for the route within the route table.

  Step 9: Enter the Address prefix, in Classless Inter-Domain Routing (CIDR) notation, that you want to route traffic to. The prefix can't be duplicated in more than one route within the route table, though the prefix can be within another prefix. For example, if you defined 10.0.0.0/16 as a prefix in one route, you can still define another route with the 10.0.0.0/22 address prefix. Azure selects a route for traffic based on longest prefix match.

  Enter the following: Address prefixes: 0.0.0.0/0 Next hop type: Internet Next hop address: 10.3.2.100

  (You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.)

  Step 14: In Route table, choose the route table you want to associate to the subnet. Select the one you created earlier.

  

  Step 10: Click Add.

  Stage 3: Associate a route table to a subnet

  Step 11: In the virtual network list, choose the virtual network that contains the subnet you want to associate a route table to.

  Step 12: In the virtual network menu bar, choose Subnets.

  Step 13: Select the subnet you want to associate the route table to. In our case select subnet3-1,

  Step 15: Select Save.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a-route

• Question 254:

  You plan to use VNET4 for an Azure API Management implementation.

  You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canada. You do NOT need to create the application gateway to complete this task.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Azure Front Door web application firewall (WAF) protects web applications from common vulnerabilities and exploits. Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats.

  You can restrict access to your web applications by country/region.

  Plan:

  Stage 1: Create a WAF policy Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal.

  Step 1: On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create.

  Step 2: On Create a WAF policy page, Basics tab, enter or select the following information and accept the defaults for the remaining settings:

  * details omitted *

  Step 3: On the Association tab, select Add association, then select one of the following settings:

  Application Gateway: Select the application gateway, and then select Add.

  HTTP Listener: Select the application gateway, select the listeners, then select Add.

  Route Path: Select the application gateway, select the listener, select the routing rule, and then select Add.

  

  Step 4: Select Review + create, then select Create.

  Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada Configure WAF rules When you create a WAF policy, by default it is in Detection mode. In Detection mode, WAF doesn't block any requests. Instead, the matching WAF rules are logged in the WAF logs. To see WAF in action, you can change the mode settings to Prevention. In Prevention mode, matching rules defined in the CRS Ruleset you selected are blocked and/or logged in the WAF logs.

  Custom rules

  Step 5: To create a custom rule, select Add custom rule under the Custom rules tab. This opens the custom rule configuration page.

  

  Step 6: To create a geo-filtering custom rule in the Azure portal, simply select Geo location as the Match Type, and then select the country/region or countries/regions you want to allow/block from your application.

  

  Step 7: Select Add Custom rule

  Step 8: Select Geo location

  Create your Custom Rule with an appropriate name and priority, then choose ‘Geo location’ from the Match type drop down as above. Next, you’ll want to ensure you choose RemoteAddr as the match variable, and decide what logic you want to apply. By logic I mean the pattern that will fire the rule. In this example, I want all traffic except Ireland blocked. So I will choose the Operation ‘Is not’, then location Ireland, then Deny. If I wanted all traffic allowed and Ireland blocked, I would simply choose the Operation ‘Is’. I recommend figuring out your pattern then working your way through the final section of the CR.

  Step 9: Set Match variable to Canada, choose IS NOT, Choose country Canada, and finally Then: Deny traffic.

  

  Step 10: Repeat steps 5 to 9 but instead use: Operation: IS Country/Region: Canada Then: Allow traffic

  Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

  Step 11: Finish the creation of the policy. Click Review+Create

  Reference: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs https://wedoazure.ie/2021/08/09/how-to-enable-web-application-firewall-geomatch-custom-rules/ https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

• Question 255:

  You plan to deploy several virtual machines to subnet1-2.

  You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2. The solution must minimize administrative effort.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  You can use a network security group to filter inbound and outbound network traffic to and from Azure resources in an Azure virtual network. Plan Stage 1: Create a network security group

  Stage 2: Associate network security group to subnet Stage 3: Create security rule Stage 1: Create a network security group

  A network security group (NSG) secures network traffic in your virtual network.

  Step 1: From the Azure portal menu, select + Create a resource > Networking > Network security group, or search for Network security group in the portal search box.

  Step 2: Select Create.

  Step 3: On the Basics tab of Create network security group, enter or select this information:

  *Details omitted*

  Step 4: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 5: Select Create.

  Stage 2: Associate network security group to subnet

  In this section, you'll associate the network security group with the subnet of the virtual network you created earlier.

  Step 6: Search for myNsg (the name you give in stage 1) in the portal search box.

  Step 7: Select Subnets from the Settings section of myNSG.

  Step 8: In the Subnets page, select + Associate:

  

  Step 9: Under Associate subnet, select myVNet (the virtual network that is available) for Virtual network.

  Step 10: Select subnet1-2 for Subnet, and then select OK.

  Stage 3: Create security rule

  Step 11: Select Inbound security rules from the Settings section of myNSG.

  

  Step 12: In Inbound security rules page, select + Add:

  Step 13: Create a security rule that blocks TCP port 5585 to the network security group you created earlier. In Add inbound security rule page, enter or select this information:

  (You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2.)

  Source: Leave the default of Any.

  Source port ranges: Leave the default of (*).

  Destination: Select Network security group.

  Destination Network security groups: Select the network security group you created earlier.

  Service: Leave the default of Custom.

  Destination port ranges: Enter 5585

  Protocol: Select TCP.

  Action: Deny

  Priority Leave the default of 100.

  Name: Enter something

  

  Step 14: Select Add.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic

• Question 256:

  You need to ensure that only hosts on VNET1 can access the storage123456789 storage account. The solution must ensure that access occurs over the Azure backbone network.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Use private endpoints for Azure Storage You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

  Connect to a storage account using an Azure Private Endpoint

  Create a private endpoint

  Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

  Step 2: Locate and select the Storage Account storage123456789

  Step 3: Select the Networking tab or select Next: Advanced then Next: Networking.

  Step 4: In the Networking tab, under Network connectivity select Disable public access and use private access.

  Step 5: In Private endpoint, select + Add private endpoint.

  Step 6: In Create private endpoint enter or select the following information:

  *Details omitted*

  * Virtual network: Select VNET1.

  Step 7: Select OK.

  Step 8: Select Review.

  Step 9: Select Create.

  Reference:

  https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal

• Question 257:

  You are preparing to connect your on-premises network to VNET4 by using a Site-to-Site VPN. The on-premises endpoint of the VPN will be created on a firewall named Firewall1. The on-premises network has the following configuration:

  1.

  internal address range: 10.10.0.0/16

  2.

  Firewall1 internal IP address: 10.10.1.1

  3.

  Firewall public IP address: 131.107.50.60

  BGP is NOT used.

  You need to create the object that will provide the IP addressing configuration of the on-premises network to the Site-to-Site VPN. You do NOT need to create a virtual network gateway to complete this task.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Create a site-to-site VPN connection in the Azure portal We only create a local network gateway

  The local network gateway is a specific object that represents your on-premises location (the site) for routing purposes. You give the site a name by which Azure can refer to it, then specify the IP address of the on-premises VPN device to which you'll create a connection. You also specify the IP address prefixes that will be routed through the VPN gateway to the VPN device. The address prefixes you specify are the prefixes located on your on-premises network. If your on-premises network changes or you need to change the public IP address for the VPN device, you can easily update the values later.

  Step 1: From the Azure portal, in Search resources, services, and docs (G+/) type local network gateway. Locate local network gateway under Marketplace in the search results and select it. This opens the Create local network gateway page.

  Step 2: On the Create local network gateway page, on the Basics tab, specifiy the values for your local network gateway.

  *

  Select Endpoint type: IP address

  *

  Endpoint: Enter 131.107.50.60 (The Firewall public IP address)

  (IP address: If you have a static public IP address allocated from your Internet service provider for your VPN device, select the IP address option and fill in the IP address as shown in the example. This is the public IP address of the VPN

  device that you want Azure VPN gateway to connect to. If you don't have the IP address right now, you can use the values shown in the example, but you'll need to go back and replace your placeholder IP address with the public IP address

  of your VPN device. Otherwise, Azure won't be able to connect.)

  *

  Address Space: Enter 10.10.0.0/16 (The internal address range)

  Select the endpoint type for the on-premises VPN device - IP address or FQDN (Fully Qualified Domain Name).

  IP address: If you have a static public IP address allocated from your Internet service provider for your VPN device.

  

  Step 3: On the Advanced tab, you can configure BGP settings if needed. Skip this.

  Step 4: When you have finished specifying the values, select Review + create at the bottom of the page to validate the page.

  Step 5: Select Create to create the local network gateway object.

  Reference:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

• Question 258:

  You need to ensure that hosts on VNET2 can access hosts on both VNET1 and VNET3. The solution must prevent hosts on VNET1 and VNET3 from communicating through VNET2.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  We use VNET2 as hub, and VNET1 and VNET3 as spokes.

  The spoke virtual networks peer with the hub and can be used to isolate workloads.

  A hub-spoke topology can be used without a gateway if you don't need cross-premises network connectivity.

  Peer virtual networks

  Step 1: In the search box at the top of the Azure portal, look for VNET2. When VNET2 appears in the search results, select it.

  Step 2: Under Settings, select Peerings, and then select + Add, as shown in the following picture:

  

  Step 3: Enter or select the following information, accept the defaults for the remaining settings, and then select Add.

  * Virtual network - Select VNET1 for the name of the remote virtual network.

  Step 4: In the Peerings page, the Peering status is Connected, as shown in the following picture:

  

  Step 5: Repeat steps 1 to 4, but in Step 3 add VNET3 instead of VNET1.

  Reference: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke

• Question 259:

  You need to configure GW1 to meet the network security requirements for the P2S VPN users. Which Tunnel type should you select in the Point-to-site configuration settings of GW1?

  A. IKEv2 and OpenVPN (SSL)

  B. IKEv2

  C. IKEv2 and SSTP (SSL)

  D. OpenVPN (SSL)

  E. SSTP (SSL)

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 260:

  What should you implement to meet the virtual network requirements for the virtual machines that connect to Vnet4 and Vnet5?

  A. a private endpoint

  B. a routing table

  C. a service endpoint

  D. a private link service

  E. a virtual network peering

  Correct Answer: E

  There is no virtual network peering between VM4's VNet (VNet3) and VM5's VNet (VNet4). To enable the VMs to communicate over the Microsoft backbone network a VNet peering is required between VNet3 and VNet4.