Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 251:

  You need to configure a security rule for APPGW1-NSG1. The solution must support the planned changes.

  Which service tag should you use?

  A. AzureFrontDoor.FirstParty
  B. AzureFrontDoor.Infra
  C. AzureFrontDoor.Backend
  D. AzureFrontDoor.Frontend
  C. AzureFrontDoor.Backend

• Question 252:

  HOTSPOT

  You have an on premises web server that hosts a web app named App1 and has the following configurations:

  1. IP address 131.107.50.60

  2. FQDN server1.contoso.com

  You have an Azure subscription.

  You need to publish App1 by using Azure Front Door. The solution must meet the following requirements:

  1. Ensure that internet users can connect to App1 by using an FQDN of appl.contoso.com.

  2. Minimize the changes required to the configuration of Front Door if Server 1 is migrated to Azure.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 253:

  You have the Azure load balancer shown in the Load Balancer exhibit.

  

  LB2 has the backend pools shown in the Backend Pools exhibit.

  

  You need to ensure that LB2 distributes traffic to all the members of VMSS1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add a network interface to VMSS1.
  B. Add a load balancing rule.
  C. Configure a health probe.
  D. Add a public IP address to each member of VMSS1.
  B. Add a load balancing rule.
  C. Configure a health probe.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-portal?tabs=option-1-create-load-balancer-standard

• Question 254:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to deploy 100 virtual machines to subnet-1. The virtual machines will NOT be assigned a public IP address. The virtual machines will call the same API which is hosted by a third party. The virtual machines will make more than 10,000 calls per minute to the API.

  You need to minimize the risk of SNAT port exhaustion. The solution must minimize administrative effort.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  SNAT exhaustion occurs when a backend instance runs out of given SNAT Ports. A load balancer can still have unused SNAT ports. If a backend instance's used SNAT ports exceed its given SNAT ports, it will be unable to establish new outbound connections.

  Use a NAT gateway for outbound connectivity to the Internet Virtual network NAT gateway is a highly resilient and scalable Azure service that provides outbound connectivity to the internet from your virtual network. A NAT gateway's unique method of consuming SNAT ports helps resolve common SNAT exhaustion and connection issues.

  (Basic load balancers and basic public IP addresses aren't compatible with NAT.)

  Create a NAT gateway Step 1: Sign in to the Azure portal.

  Step 2: In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  Step 3: Select + Create.

  Step 4: In Create network address translation (NAT) gateway, enter or select this information in the Basics tab.

  * Details omitted *

  Step 5: Select the Outbound IP tab, or select the Next: Outbound IP button at the bottom of the page.

  Step 6: In the Outbound IP tab, enter or select the following information:

  * Public IP addresses

  Select Create a new public IP address.

  In Name, enter myPublicIP.

  Select OK.

  Step 7: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 8: Select Create.

  References:

  https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections

  https://learn.microsoft.com/en-us/azure/load-balancer/troubleshoot-outbound-connection

• Question 255:

  You have an Azure Front Door instance named FD1 that is protected by using Azure Web Application Firewall (WAF).

  FD1 uses a frontend host named app1.contoso.com to provide access to Azure web apps hosted in the East US Azure region and the West US Azure region.

  You need to configure FD1 to block requests to app1.contoso.com from all countries other than the United States.

  What should you include in the WAF policy?

  A. a frontend host association
  B. a managed rule set
  C. a custom rule that uses a rate limit rule
  D. a custom rule that uses a match rule
  C. a custom rule that uses a rate limit rule

• Question 256:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that remote users can establish RDP connections to the virtual machines by using Bastion1.

  How should you configure the rules for NSG1 for traffic from the internet to AzureBastionSubnet and for traffic from AzureBastionSubnet to Subnet1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Enable TCP port 443 inbound Traffic from the internet to AzureBastionSubnet

  AzureBastionSubnet Azure Bastion is deployed specifically to AzureBastionSubnet.

  Ingress Traffic: Ingress Traffic from public internet: The Azure Bastion will create a public IP that needs port 443 enabled on the public IP for ingress traffic. Port 3389/22 are NOT required to be opened on the AzureBastionSubnet. Note that the source can be either the Internet or a set of public IP addresses that you specify.

  Box 2: Enable TCP port 3389 outbound Traffic from AzureBastionSubnet to Subnet1: Egress Traffic to target

  VMs: Azure Bastion will reach the target VMs over private IP. The NSGs need to allow egress traffic to other target VM subnets for port 3389 and 22. If you're utilizing the custom port functionality within the Standard SKU, ensure that NSGs allow outbound traffic to the service tag VirtualNetwork as the destination.

  Note: Working with NSG access and Azure Bastion When working with Azure Bastion, you can use network security groups (NSGs).

  

  In this diagram:

  The Bastion host is deployed to the virtual network. The user connects to the Azure portal using any HTML5 browser. The user navigates to the Azure virtual machine to RDP/SSH. Connect Integration - Single-click RDP/SSH session inside the browser No public IP is required on the Azure VM.

  References:

  https://learn.microsoft.com/en-us/azure/bastion/bastion-nsg

• Question 257:

  You have an Azure virtual network and an on-premises datacenter.

  You are planning a Site-to-Site VPN connection between the datacenter and the virtual network.

  Which two resources should you include in your plan? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a user-defined route
  B. a virtual network gateway
  C. Azure Firewall
  D. Azure Web Application Firewall (WAF)
  E. an on-premises data gateway
  F. an Azure application gateway
  G. a local network gateway
  B. a virtual network gateway
  G. a local network gateway

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

• Question 258:

  HOTSPOT

  You have an Azure virtual network and an on-premises datacenter that connect by using a Site-to-Site

  VPN tunnel.

  You need to ensure that all traffic from the virtual network to the internet is routed through the datacenter.

  How should you complete the PowerShell script to configure forced tunneling? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Get-AzLocalNetworkGateway See step 5 below.

  Configure forced tunneling

  1. Create a resource group.

  New-AzResourceGroup -Name 'ForcedTunneling' -Location 'North Europe'

  2. Create a virtual network and specify subnets.

  3. Create the local network gateways.

  Example:

  $lng1 = New-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName "ForcedTunneling" -

  Location "North Europe" -GatewayIpAddress "111.111.111.111" -AddressPrefix "192.168.1.0/24"

  4. Create the virtual network gateway.

  5. Assign a default site to the virtual network gateway. The -GatewayDefaultSite is the cmdlet parameter that allows the forced routing configuration to work, so take care to configure this setting properly.

  $LocalGateway = Get-AzLocalNetworkGateway -Name "DefaultSiteHQ" -ResourceGroupName

  "ForcedTunneling"

  $VirtualGateway = Get-AzVirtualNetworkGateway -Name "Gateway1" -ResourceGroupName

  "ForcedTunneling"

  Set-AzVirtualNetworkGatewayDefaultSite -GatewayDefaultSite $LocalGateway -VirtualNetworkGateway

  $VirtualGateway

  6. Establish the Site-to-Site VPN connections.

  Details omitted.

  Box 2: Set-AzVirtualNetworkGatewayDefaultSite

  References:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

• Question 259:

  You have an Azure subscription that contains two virtual networks named VritualNetwork1 and VritualNetwork2.

  You have a Windows 10 device that connects to VritualNetwork1 by using a Point-to-Site (P2S) IKEv2 VPN. You have implemented virtual network peering between VritualNetwork1 and VritualNetwork2.

  VritualNetwork1 allows gateway transit. VritualNetwork2 can use the remote gateway. You discover that you cannot communicate with VritualNetwork2 from Windows 10 device. You need to ensure that you can communicate with VritualNetwork2 from Windows 10 device.

  To achieve the requirement, you reset the gateway of VritualNetwork1.

  Did you achieve the requirement?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

  If you make a change to the topology of your network and have Windows VPN clients, the VPN client package for Windows clients must be downloaded and installed again in order for the changes to be

  applied to the client.

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

• Question 260:

  HOTSPOT

  You have an Azure subscription that contains two virtual machines.

  You monitor traffic between the virtual machines by using NSG flow logs.

  You have a network security group (NSG) flow log that has the following entries.

  1493763938,185.170.185.105,10.2.0.4,35370,23,T,I,A,B,,,, 1493695838,185.170.185.105,10.2.0.4,35370,23,T,I,A,C,200,500,100,300 1493696138,185.170.185.105,10.2.0.4,35370,23,T,I,A,E,1000,6000,500,1200

  You need to identify the following metrics from the log entries:

  1. The total number of packets transferred between the virtual machines

  2. The total amount of bytes transferred between the virtual machines.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.