Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 21:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create a service endpoint policy as shown in the Policy exhibit. (Click the Policy tab.)

  

  You configure the Service Endpoints settings for Subnet3 as shown in the Subnets exhibit. (Click the Subnets tab.)

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No No - The resources on Subnet3 can access storage85348.

  Subnet3 has a service Microsoft.Storage endpoint and a Microsoft.SQL endpoint. Subnet3 has the Policy1 Service endpoint policy. Policy1 is defined for Microsoft.Storage for the storage85347 Storage account, not for storage85348.

  Note: By default, if no policies are attached to a subnet with endpoints, you can access all storage accounts in the service. Once a policy is configured on that subnet, only the resources specified in the policy can be accessed from compute instances in that subnet. Access to all other storage accounts is denied.

  Note 2: Virtual Network service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts over service endpoint, and allow data exfiltration to only specific Azure Storage accounts.

  Endpoint policies provide granular access control for virtual network traffic to Azure Storage when connecting over service endpoint.

  Box 2: No No - Policy1 can be linked simultaneously to Subnet1 and Subnet3. Endpoint policy is configured on a subnet in a virtual network. Service endpoints for Azure Storage should be enabled on the subnet to apply the policy. There is no Service Endpoint defined for Subnet1.

  Box 3: Yes Access from Subnet3 to DB1 can be restricted by applying Policy1.

  Subnet3 has a service Microsoft.Storage endpoint and a Microsoft.SQL endpoint. DB1 is an Azure SQL database.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

• Question 22:

  You plan to deploy an Azure Front Door.

  Which properties should you use to configure routing rules?

  A. HTTP protocols (HTTP/HTTPS)
  B. Hosts
  C. Paths
  D. Time stamp
  E. User certificates
  A. HTTP protocols (HTTP/HTTPS)
  B. Hosts
  C. Paths

  ---

  Explanation

  When evaluating routing rules, Front Door looks for matches in HTTP protocols (HTTP/HTTPS), Hosts, and Paths.

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-route-matching

• Question 23:

  You need to configure APPGW1 to support end-to-end encryption. The solution must meet the security requirements.

  What should you do?

  A. From the SSL settings, upload a TLS client certificate that is issued by the internal root CA and includes the full certificate chain.
  B. From the Backend settings, upload a wildcard TLS certificate that has a private key issued by the internal root CA.
  C. From the Backend settings, upload the internal root CA certificate.
  D. From the SSL settings, upload a TLS client certificate that is issued by the internal root CA.
  A. From the SSL settings, upload a TLS client certificate that is issued by the internal root CA and includes the full certificate chain.

• Question 24:

  HOTSPOT

  You have the network topology shown in the Topology exhibit. (Click the Topology tab.)

  

  You have the Azure firewall shown in the Firewall 1 exhibit. (Click the Firewall tab.)

  

  You have the route table shown in the RouteTable1 exhibit. (Click the RouteTable1 tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Resources in Subnet1 will use the Route2 and its Next hop ID address to the Firewall to reach the Internet.

  Box 2: Yes

  Yes, with network network peering.

  Box 3: No

  Resources in Subnet2 can only reach resources in Subnet1, as gateway transit for virtual network peering has not been configured.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

• Question 25:

  You have the resources shown in the following table.

  

  You need to protect the virtual machines by using Azure DDoS Network Protection plans.

  What is the minimum number of DDoS Network Protection plans you should deploy?

  A. 1
  B. 2
  C. 3
  D. 20
  C. 3

• Question 26:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to ensure that requests for www.relecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Stage 1: Create an Azure private DNS zone using the Azure portal.

  Step 1: On the portal search bar, type private dns zones in the search text box and press Enter.

  Step 2: Select Private DNS zone.

  Step 3: Select Create private dns zone.

  On the Create Private DNS zone page, type or select appropriate values:

  Resource group: Select Create new, enter something X, and select OK. The resource group name must be unique within the Azure subscription.

  Name: Type private.relecloud.com.

  Resource group location:

  Step 4: Select Review + Create.

  Step 5: Select Create.

  Stage 2: Create a CNAME DNS record

  Step 6: Open the X resource group you created earlier and select the private.relecloud.com private zone.

  You can enter private.relecloud.com the Filter by name box to find it more easily.

  Step 7: At the top of the DNS zone page, select + Record set.

  Step 8: On the Add record set page, type or select the following values:

  Name: Type www.

  Type: CNAME

  Record set properties: frontdoor1.azurefd.net

  Step 9: Select Save at the top of the page to save your settings. Then close the page.

  References:

  https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal

  https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets-portal

• Question 27:

  You plan to deploy Azure virtual network.

  You need to design the subnets.

  Which three types of resources require a dedicated subnet? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Azure Bastion
  B. Azure Active Directory Domain Services
  C. Azure Private Link
  D. Azure Application Gateway v2
  E. VPN gateway
  A. Azure Bastion
  D. Azure Application Gateway v2
  E. VPN gateway

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services

• Question 28:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  The virtual network topology is shown in the following exhibit.

  

  Firewall1 is configured as shown in following exhibit.

  

  FirewallPolicy1 contains the following rules:

  1. Allow outbound traffic from Vnet1 and Vnet2 to the internet.

  2. Allow any traffic between Vnet1 and Vnet2.

  No custom private endpoints. service endpoints. routing tables, or network security groups (NSGs) were created. For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Y - You need to add User Defined Route to the Firewall Appliance from the subnets (

  https:// learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal)

  N - The firewall is not a VPN Gateway, and we do not have any connection with On-Premises here (

  https:// learn.microsoft.com/en-us/answers/questions/516530/how-to-set-up-a-multi-spoke-virtual-network-in-azu)

  Y - Azure Firewall can filter by web categories (

  https://learn.microsoft.com/en-us/azure/firewall/web-categories)

• Question 29:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to configure a solution to meet the following requirements;

  1. App1 must be assigned a private endpoint

  2. Access to App1 from the internet must be routed via FD1.

  What should you configure on FD1?

  A. a rule that has the route configuration override action
  B. a route that redirects traffic
  C. an origin that enables the Azure Private Link service
  D. a security policy that redirects traffic
  C. an origin that enables the Azure Private Link service

• Question 30:

  DRAG DROP

  You have two Azure subscriptions named Sub1 and Sub2 that contain the resources shown in the following table.

  

  VNet1 and VNet2 are NOT connected.

  You plan to create an Azure Private Link service named Link1 that will be used to connect VNet1 and VNet2. You need to ensure that Link1 meets the following requirements:

  Ensures that VM1 can connect only to a web app hosted on VM2 ?Prevents VM1 from connecting to the other resources that are connected to VNet2

  Which additional resources should you create for each virtual network? To answer, drag the appropriate resources to the correct virtual networks. Each resource may be used once, more than once, or not at all.

  You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place: