Microsoft Microsoft Certified: Azure Network Engineer Associate AZ-700 Questions & Answers

• Question 261:

  You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements. Which connectivity method should you use?

  A. a private endpoint

  B. Azure Firewall

  C. Azure Front Door

  D. a service endpoint

  Correct Answer: A

  wsrudmen Highly Voted 1 year ago Selected Answer: A Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network. Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP

  Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK

• Question 262:

  You need to provide access to storage1. The solution must meet the PaaS networking requirements and the business requirements.

  What should you include in the solution?

  A. a private endpoint

  B. Azure Traffic Manager

  C. Azure Front Door

  D. a service endpoint

  Correct Answer: A

  service endpoint limitation Endpoints are enabled on subnets configured in Azure virtual networks. Endpoints can't be used for traffic from your premises to Azure services

• Question 263:

  You need to configure the default route in Vnet2 and Vnet3. The solution must meet the virtual networking requirements. What should you use to configure the default route?

  A. a user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3

  B. a user-defined route assigned to GatewaySubnet in Vnet1

  C. BGP route exchange

  D. route filters

  Correct Answer: C

  You must use BGP to advertise on-premises routes to the Microsoft Edge router. You cannot create user-defined routes to force traffic to the ExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type: ExpressRoute

  Source: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#border-gateway-protocol

• Question 264:

  You need to configure the default route on Vnet2 and Vnet3. The solution must meet the virtual networking requirements. What should you use to configure the default route?

  A. route filters

  B. BGP route exchange

  C. a user-defined route assigned to GatewaySubnet in Vnet1

  D. a user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3

  Correct Answer: B

  You cannot specify a virtual network gateway created as type ExpressRoute in a user-defined route because with ExpressRoute, you must use BGP for custom routes https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

• Question 265:

  You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements.

  Which two actions should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. On the peering from Vnet1, select Allow gateway transit.

  B. On the peerings from Vnet2 and Vnet3, select Use remote gateways.

  C. On the peerings from Vnet2 and Vnet3, select Allow gateway transit.

  D. On the peering from Vnet1, select Use remote gateways.

  E. On the peering from Vnet1, select Allow forwarded traffic.

  Correct Answer: AB

  Virtual network peering seamlessly connects two Azure virtual networks, merging the two virtual networks into one for connectivity purposes. Gateway transit is a peering property that lets one virtual network use the VPN gateway in the peered virtual network for cross-premises or VNet-to-VNet connectivity. The following diagram shows how gateway transit works with virtual network peering.

  

  In the diagram, gateway transit allows the peered virtual networks to use the Azure VPN gateway in Hub-RM. Connectivity available on the VPN gateway, including S2S, P2S, and VNet-to-VNet connections,

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

• Question 266:

  You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements.

  Which two actions should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. On the peering from Vnet1, select Allow for Traffic forwarded from remote virtual network.

  B. On the peerings from Vnet2 and Vnet3, select Allow for Traffic forwarded from remote virtual network.

  C. On the peering from Vnet1, select Use the remote virtual network's gateway or Route Server.

  D. On the peering from Vnet1, select Allow for Traffic to remote virtual network.

  E. On the peerings from Vnet2 and Vnet3, select Use the remote virtual network's gateway or Route Server.

  Correct Answer: BE

  Correct answer is: BE.

  The justification is as follows:

  -E IS obviously an answer because without it the requirements cannot be met.

  - D is NOT an answer, because: The case study says that "There is bidirectional peering between Vnet1 and Vnet2. There is bidirectional peering between Vnet1 and Vnet3." This means that "Traffic to remote virtual network" is already allowed for Vnet1<...>Vnet2 and Vnet1<...>.

  -C is a total nonsense.

  -B IS an answer, because Vnet1 contains the VPN gateway that forwards the traffic between Vnet2 and Vnet3.

  -A is NOT an answer, because Vnet2 and Vnet3 don't have VPN gateways so they cannot forward traffic to Vnet1. Documentation: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal#create-a-peering https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways