Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 301:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to deploy an Azure Virtual Network NAT gateway named Gateway1. The solution must meet the following requirements:

  1. VM1 will access the internet by using its public IP address.

  2. VM2 will access the internet by using its public IP address.

  3. Administrative effort must be minimized.

  You need to ensure that you can deploy Gateway1 to Vnet1.

  What is the minimum number of subnets required on Vnet1?

  A. 2
  B. 3
  C. 4
  D. 5
  C. 4

  ---

  Explanation

  1. GatewaySubnet

  2. Subnet 2 3. Subnet 1 with Basic SKU for Public IP

  4. NAT Gatway requires in VNET 1 and hence 4. Otherwise you could have used Subnet2 to avoid creating 4th Subnet. Requirement is to create NAT GW in VNET1 so you need 4th Subnet.

  https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview

  Check out - NAT gateway and basic SKU resources section

• Question 302:

  HOTSPOT

  You have an Azure subscription that contains 200 virtual machines

  You need to use Azure Network Watcher to identify which virtual machines generate the most network traffic. The solution must minimize administrative effort.

  Which prerequisites should you deploy for Network Watcher, and which Network Watcher feature should you use to identify the virtual machines? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 303:

  You are planning an Azure Point-to-Site (P2S) VPN that will use OpenVPN.

  Users will authenticate by using an on-premises Active Directory domain.

  Which additional service should you deploy to support the VPN authentication?

  A. an Azure key vault
  B. a RADIUS server
  C. a certification authority
  D. Azure Active Directory (Azure AD) Application Proxy
  B. a RADIUS server

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

• Question 304:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to create an Azure Firewall instance named FW1 that meets the following requirements:

  1. Has an IP address from the address range of 10.1.255.0/24

  2. Uses a new Premium firewall policy named FW-policy1

  3. Routes traffic directly to the internet

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Step 1: On the Azure portal menu or from the Home page, select Create a resource.

  Step 2: Type firewall in the search box and press Enter.

  Step 3: Select Firewall and then select Create.

  Step 4: On the Create a Firewall page, use the following table to configure the firewall:

  * Name - Enter FW1

  * Firewall management - Select Use a Firewall Policy to manage this firewall.

  * Firewall policy - Select Add new, and enter FW-policy 1.

  * Choose a virtual network - Select Create new

  Step 4.1: Enter or select the appropriate values:

  Subscription - Select your Azure subscription.

  Resource group - Name - Region -

  Step 4.2 Select Next: IP addresses.

  Step 4.3 For IPv4 Address space, accept the default 10.0.0.0/16.

  Step 4.4 Under Subnet, select default.

  Subnet name - For Address range, type 10.1.255.0/24

  Step 4.5 Select Save.

  Step 4.6 Select Review + create.

  Step 4.7: Select Create.

  Step 5: Back to the Create a Firewall page:

  * Public IP address - Add new

  Step 6: Accept the other default values, then select Review + create.

  Step 7: Review the summary, and then select Create to create the firewall.

  References:

  https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal-policy

  https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

• Question 305:

  You have five virtual machines that run Windows Server. Each virtual machine hosts a different web app.

  You plan to use an Azure application gateway to provide access to each web app by using a hostname of www.contoso.com and a different URL path for each web app, for example: https://www.contoso.com/app1.

  You need to control the flow of traffic based on the URL path.

  What should you configure?

  A. HTTP settings
  B. listeners
  C. rules
  D. rewrites
  C. rules

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/application-gateway/url-route-overview

• Question 306:

  HOTSPOT

  You have an Azure subscription that contains multiple virtual machine scale sets and multiple Azure load balancers. The load balancers balance traffic across the scale sets.

  You plan to deploy Azure Front Door to load balance traffic across the load balancers.

  You need to identify which Front Door SKU to configure, and what to use to route the traffic to the load balancers. The solution must minimize costs.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Premium

  Premium is required for an Azure private link.

  Note: Azure Front Door offers two different tiers, Standard and Premium. Both Azure Front Door tier combines capabilities of Azure Front Door (classic), Azure CDN Standard from Microsoft (classic), and Azure WAF into a single secure cloud CDN platform with intelligent threat protection.

  Azure Front Door Standard iscontent deliveryoptimized,offering both static and dynamic content acceleration,global load balancing, SSLoffload, domain and certificate management, enhanced traffic analytics,and basic securitycapabilities.

  Azure Front Door Premium builds on capabilities of Azure Front Door Standard, and addsextensive security capabilities across WAF,BOT protection,Azure Private Link support, integration with Microsoft Threat Intelligence, and security analytics. WAF and Private Link pricing is included in Azure Front Door Premium.

  Box 2: Azure private link

  Example:

  When you use other internet-facing services, like Azure Front Door, it's important to consider whether they support Private Link for inbound traffic. If they don't, consider how your traffic flows through each path to your solution.

  For example, suppose you build an internet-facing application that runs on a virtual machine scale set. You use Azure Front Door, including its web application firewall (WAF), for security and traffic acceleration, and you configure Front Door to send its traffic through a private endpoint to your backend (origin) service.

  Tenant A connects to your solution by using a public endpoint, and tenant B connects by using a private endpoint. Because Front Door doesn't support Private Link for incoming connections, tenant B's traffic bypasses your Front Door and its WAF:

  

  References:

  https://learn.microsoft.com/en-us/azure/frontdoor/standard-premium/tier-comparison

  https://learn.microsoft.com/en-us/azure/architecture/guide/multitenant/service/private-link

• Question 307:

  You have an Azure subscription that contains the following resources: A virtual network named Vnet1

  A subnet named Subnet1 in Vnet1

  A virtual machine named VM1 that connects to Subnet1

  Three storage accounts named storage1, storage2, and storage3

  You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

  To achieve the requirement, you create a network security group (NSG) and associate the NSG to Subnet1.

  Did you achieve the requirement?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Creating a NSG on the Subnet does not limit the traffic. You also need to define the NSG rules.

• Question 308:

  HOTSPOT

  You have the hybrid network shown in the Network Diagram exhibit.

  

  You have a peering connection between Vnet1 and Vnet2 as shown in the Peering-Vnet1-Vnet2 exhibit.

  

  You have a peering connection between Vnet1 and Vnet3 as shown in the Peering-Vnet1-Vnet3 exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Virtual network peering seamlessly connects two Azure virtual networks, merging the two virtual networks into one for connectivity purposes.

  Box 2: No

  No Virtual Gateway is used.

  Gateway transit is a peering property that lets one virtual network use the VPN gateway in the peered virtual network for cross-premises or VNet-to-VNet connectivity. The following diagram shows how gateway transit works with virtual network peering.

  

  In the diagram, gateway transit allows the peered virtual networks to use the Azure VPN gateway in Hub-RM. Connectivity available on the VPN gateway, including S2S, P2S, and VNet-to-VNet connections, applies to all three virtual networks.

  Box 3: No

  No Virtual Gateway is used.

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

• Question 309:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create a service endpoint policy that has the following settings:

  Associated subnets: Subnet1

  Service: Microsoft.Storage

  Scope: Single account

  Resource: storage1.

  Which resources can VM1 access?

  A. storage1 in the East US Azure region and its replica in the paired region
  B. storage1 in the East US Azure region only
  C. storage1 and storage2 in the East US Azure region only
  D. storage1 and storage2 in the East US Azure region and their replicas in the paired region
  B. storage1 in the East US Azure region only

• Question 310:

  HOTSPOT

  You configure a route table named RT1 that has the routes shown in the following table.

  

  You have an Azure virtual network named Vnet1 that has the subnets shown in the following table.

  

  You have the resources shown in the following table.

  

  Vnet1 connects to an ExpressRoute circuit. The on-premises router advertises the following routes:

  1. 0.0.0.0/0

  2. 10.0.0.0/16

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  NVA1 with IP (NVA-network virtual appliance) 192.168.0.4 is on the DMZ subnet. It will use route 10.0.0.0/16 to the on-premises network.

  Box 2: No

  VM2 has IP address 192.168.2.4 and is on the BackEnd subnet. VM2 will not use the RT1 route table, and will not reach the on-premises network through NVA1.

  Box 3: Yes

  VM1 with IP address 192.168.1.4 is on the FrontEnd subnet, and will use the RT1 routing table. It will use Route2 and Next Hop IP address 192.168.0.4, IP address of NVA1, to reach VM2.