Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 291:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to implement an Azure application gateway in the East US Azure region. The application gateway will have Web Application Firewall (WAF) enabled.

  You need to create a policy that can be linked to the planned application gateway. The policy must block connections from IP addresses in the 131.107.150.0/24 range. You do NOT need to provision the application gateway to complete this

  task.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Web Application Firewall Policies contain all the WAF settings and configurations. This includes exclusions, custom rules, managed rules, and so on. These policies are then associated to an application gateway (global), a listener (per-site), or a path-based rule (per-URI) for them to take effect.

  Part 1: Create a WAF policy Create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal.

  Step 1: On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create.

  Step 2: On Create a WAF policy page, Basics tab, enter or select the following information and accept the defaults for the remaining settings: Policy for - Regional WAF (Application Gateway)

  Subscription - Select your subscription name

  Resource group - Select your resource group

  Policy name - Type a unique name for your WAF policy.

  Location: East US

  Step 3: On the Association tab, select Add association, then select one of the following settings:

  Setting - Value

  Application Gateway-Select the application gateway, and then select Add.

  HTTP Listener - Select the application gateway, select the listeners, then select Add.

  Route Path - Select the application gateway, select the listener, select the routing rule, and then select Add.

  Step 4: Select Review + create, then select Create.

  

  Part 2: Configure WAF rule

  When you create a WAF policy, by default it is in Detection mode. In Detection mode, WAF doesn't block any requests. Instead, the matching WAF rules are logged in the WAF logs. To see WAF in action, you can change the mode settings to Prevention. In Prevention mode, matching rules defined in the CRS Ruleset you selected are blocked and/or logged in the WAF logs.

  Custom rules Step 5: To create a custom rule, select Add custom rule under the Custom rules tab.

  This opens the custom rule configuration page.

  Step 6: On the Add custom rule page, use the following test values to create a custom rule: Setting - Value Custom rule name - AnyName Status - Enabled Rule type-Match Priority - 100

  Match type-IP address

  Match variable - SocketAddr (for example)

  Operation - Does contain

  IP address or range - 131.107.150.0/24

  Then Deny traffic

  

  Step 7: Select Add.

  Step 8:

  Select Next: Association.

  Step 9: Select Associate a WAF policy.

  Step 10: For WAF policy, select your WAF policy.

  Step 11: For Domain, select the domain.

  Step 12. Select Add.

  Step 13: Select Review + create.

  Step 14: After your policy validation passes, select Create.

  References:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

  https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-ip-restriction#configure-a-waf-policy-with-the-azure-portal

• Question 292:

  Which rules should you configure in Azure firewall to allow inbound internet connections?

  A. Application rules
  B. Network rules
  C. NAT rules
  C. NAT rules

  ---

  Explanation

  Correct Answer(s):

  NAT rules: Configure DNAT rules to allow incoming Internet connections.

  https://docs.microsoft.com/en-us/azure/firewall/firewall-faq#what-are-some-azure-firewall-concepts

  Wrong Answers:

  Application rules - Configure fully qualified domain names (FQDNs) that can be accessed from a subnet.

  Network rules - Configure rules that contain source addresses, protocols, destination ports, and destination addresses.

• Question 293:

  HOTSPOT

  You have an Azure subscription.

  You have the on-premises sites shown the following table.

  

  You plan to deploy Azure Virtual WAN.

  You are evaluating Virtual WAN Basic and Virtual WAN Standard.

  Which type of Virtual WAN can you use for each site? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

• Question 294:

  You need to implement name resolution for the cloud.healthengine.com.

  The solution must meet the networking requirements.

  What should you do to implement name resolution of clould.healthengine.com DNS records from on-premises locations?

  A. Enable the Azure Firewall DNS proxy
  B. Create SRV records in cloud.healthengine.com
  C. Deploy an Azure virtual machine configured as DNS server to Vnet1
  C. Deploy an Azure virtual machine configured as DNS server to Vnet1

  ---

  Explanation

  DNS forwarding also enables DNS resolution between virtual networks, and allows your on-premises machines to resolve Azure-provided host names. In order to resolve a VM's host name, the DNS server VM must reside in the same virtual network, and be configured to forward host name queries to Azure.

  The following image shows two virtual networks and an on-premises network doing DNS resolution between virtual networks.

  

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances#name-resolution-that-uses-your-own-dns-server

• Question 295:

  You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements.

  Which two actions should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. On the peering from Vnet1, select Allow gateway transit.
  B. On the peerings from Vnet2 and Vnet3, select Use remote gateways.
  C. On the peerings from Vnet2 and Vnet3, select Allow gateway transit.
  D. On the peering from Vnet1, select Use remote gateways.
  E. On the peering from Vnet1, select Allow forwarded traffic.
  A. On the peering from Vnet1, select Allow gateway transit.
  B. On the peerings from Vnet2 and Vnet3, select Use remote gateways.

  ---

  Explanation

  Virtual network peering seamlessly connects two Azure virtual networks, merging the two virtual networks into one for connectivity purposes. Gateway transit is a peering property that lets one virtual network use the VPN gateway in the peered virtual network for cross-premises or VNet-to-VNet connectivity. The following diagram shows how gateway transit works with virtual network peering.

  

  In the diagram, gateway transit allows the peered virtual networks to use the Azure VPN gateway in Hub-RM. Connectivity available on the VPN gateway, including S2S, P2S, and VNet-to-VNet connections, References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

• Question 296:

  HOTSPOT

  You have an Azure environment shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. VM1 Can Communicate with On-Premise datacenter due to S2S VPN and VM2 due to Bi-Directional

  VNet Peering 2. VM2 an Communicate with On-Premise datacenter, VM1 due Gateway transit( VNET1-VNET2) & S2S

  VPN (VNET1-Datacenter), and VM3 (VNET2-VNET3 VNet Peering)

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit?toc=/azure/virtual-network/toc.json

• Question 297:

  You have an application named App1 that listens for incoming requests on a preconfigured group of 50 TCP ports and UDP ports.

  You install App1 on 10 Azure virtual machines.

  You need to implement load balancing for App1 across all the virtual machines. The solution must minimize the number of load balancing rules.

  What should you include in the solution?

  A. Azure Application Gateway V2 that has multiple listeners
  B. Azure Standard Load Balancer that has Floating IP enabled
  C. Azure Standard Load Balancer that has high availability (HA) ports enabled
  D. Azure Application Gateway v2 that has multiple site hosting enabled
  C. Azure Standard Load Balancer that has high availability (HA) ports enabled

  ---

  Explanation

  C. Azure Standard Load Balancer that has high availability (HA) ports enabled App1 is installed on 10 VMs which can be put in a Backend pool. The req is to minimize the number of load balancing rules. If you select HA it will allow you to have 1 rule for TCP and UDP ports, if you don't select HA you will need to have a minimum of 2 rules for TCP and UDP with a * range.

• Question 298:

  HOTSPOT

  You have an Azure subscription that contains an Azure application gateway named AGW1.

  You need to create a rewrite rule on AGW1 that will convert web requests as follows:

  1. Input: https://www.contoso.com/fashion/shirts

  2. Output: https://www.contoso.com/buy.aspx?category=fashion&product=shirts

  The rewrite rule will have the following settings:

  Type of variable to check: Server variable.

  1. Case-sensitive: No

  2. Operator: equal (=)

  To what should you set Server variable and Pattern to match? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: uri_path Server variable: uri_path This variable evaluates the path portion of the URL

  Box 2: /(.*)/(.*) Pattern to match: /(.*)/(.*)$

  The first (.*) captures "brand" and the second captures "shorts". These are stored as backreferences

  {var_uri_path_1} and {var_uri_path_2} respectively.

  Incorrect: /(*)/(*)

  References:

  https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-url-portal

• Question 299:

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 has a subnet mask of/24.

  You plan to implement an Azure application gateway that will have the following configurations:

  1. Public endpoints: 1

  2. Private endpoints: 1

  3. Minimum instances: 1

  4. Maximum instances: 10

  You need to configure the address space for the subnet of the application gateway. The solution must minimize the number of IP addresses allocated to the application gateway subnet.

  What is the minimum number of assignable IP addresses required?

  A. 1
  B. 2
  C. 11
  D. 12
  E. 20
  C. 11

  ---

  Explanation

  Application Gateway uses one private IP address per instance, plus another private IP address if a private frontend IP is configured.

  https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#size-of-the-subnet

• Question 300:

  DRAG DROP

  You have two Azure subscriptions named Sub1 and Sub2. Each subscription is linked to a separate Microsoft Entra tenant. Sub1 contains a virtual machine scale set that hosts an app named App1. Sub2 contains a virtual network named VNet1.

  You need to connect VNet1 to App1 by using an Azure Private Link service.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  To connect a virtual network in one subscription to an application hosted by a virtual machine scale set in a different subscription using Azure Private Link, you'll need to create a Private Link service in the subscription [Sub1] hosting the scale set and then create a Private Endpoint in the virtual network in the other subscription [Sub2]. This allows secure, private connections between the two without exposing the application to the public internet.

  Step 1: Configure DB1 to run behind a standard Azure Load Balancer Here's a step-by-step breakdown:

  1. Configure the Application and Load Balancer: Ensure your application is running behind a standard load balancer in the subscription hosting the virtual machine scale set. If you don't already have a load balancer set up, create one and configure it to direct traffic to your scale set's instances. This load balancer will be used by the Private Link service to expose your application. Step 2: In Sub1, create a Private Link service to reference the load balancer.

  1. Create the Private Link Service: In the subscription where the load balancer is located, create a Private

  Link service. When configuring the Private Link service, select the frontend IP configuration of your load balancer that you want to use for incoming traffic. Choose a subnet for the NAT IP addresses for the Private Link service. Azure documentation recommends at least eight NAT IP addresses for optimal performance.

  Step 3: In Sub2, create a private endpoint by using the Private Link service ID.

  1. Create a Private Endpoint: In the subscription containing the virtual network, create a Private Endpoint.

  During Private Endpoint creation, select the Private Link service you created in the other subscription. The Private Endpoint will be provisioned in a subnet of your virtual network. The Private Endpoint connection will initially be in a "Pending" state until it's approved by the service provider (the subscription hosting the Private Link service).

  Step 4: Approve the connection request.

  1. Approve the Private Endpoint Connection: In the subscription where the Private Link service is located, navigate to Private Endpoints and find the pending connection. Approve the connection request from the virtual network's subscription.

  1. Connect and Test

  References:

  https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview