Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 321:

  HOTSPOT

  You have an Azure subscription. The subscription contains virtual machines that host websites as shown in the following table.

  

  You have the Azure Traffic Manager profiles shown in the following table.

  

  You have the endpoints shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  VM1, which is hosting site1.contoso.com, is located in East US. The VM1 endpoint status is degraded.

  Endpoint monitoring health checks are failing. The endpoint isn't included in DNS responses and doesn't receive traffic.

  When an endpoint has a Degraded status, it's no longer returned in response to DNS queries. Instead, an alternative endpoint is chosen and returned. The traffic-routing method configured in the profile determines how the alternative endpoint is chosen.

  Priority. Endpoints form a prioritized list. The first available endpoint on the list is always returned. If an endpoint status is Degraded, then the next available endpoint is returned.

  The user will connect to site2.us.contoso.com instead.

  Box 2: No

  VM3, which is hosting site2.contoso.com, is located in in East US. The VM3 endpoint status is CheckingEndpoint. The endpoint is monitored, but the results of the first probe haven't been received yet.

  CheckingEndpoint is a temporary state that usually occurs immediately after adding or enabling an endpoint in the profile. An endpoint in this state is included in DNS responses and can receive traffic.

  User will connect to site2.contoso.com, not to site2.uk.contoso.com

  Box 3: No

  VM3, which is hosting site2.contoso.com, is located in in East US. The VM1 endpoint status is CheckingEndpoint, which is OK (see above).

  User will connect to site2.contoso.com, not to site2.japan.contoso.com

  References:

  https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoring

• Question 322:

  You plan to create a Point-to-Site (P2S) VPN connection for a remote user to connect to your Azure environment.

  Which of the following protocols should you use?

  A. OpenVPN
  B. IPSec
  C. Secure Socket Tunneling Protocol (SSTP)
  D. IKEv2 VPN
  E. FTP
  A. OpenVPN
  C. Secure Socket Tunneling Protocol (SSTP)
  D. IKEv2 VPN

  ---

  Explanation

  Point-to-site VPN can use one of the following protocols:

  OpenVPN?Protocol, an SSL/TLS based VPN protocol. A TLS VPN solution can penetrate firewalls, since most firewalls open TCP port 443 outbound, which TLS uses. OpenVPN can be used to connect from Android, iOS (versions 11.0 and above), Windows, Linux, and Mac devices (macOS versions 10.13 and above).

  Secure Socket Tunneling Protocol (SSTP), a proprietary TLS-based VPN protocol. A TLS VPN solution can penetrate firewalls, since most firewalls open TCP port 443 outbound, which TLS uses. SSTP is only supported on Windows devices.

  Azure supports all versions of Windows that have SSTP and support TLS 1.2 (Windows 8.1 and later).

  IKEv2 VPN, a standards-based IPsec VPN solution. IKEv2 VPN can be used to connect from Mac devices (macOS versions 10.11 and above).

  https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about#protocol

• Question 323:

  DRAG DROP

  You have 100 on-premises servers with IP addresses from the 10.0.0.0/24 IP address space.

  You have an Azure subscription that contains a virtual network named VNet1, an Azure VPN gateway named VGW1. and 100 virtual machines. VNet1 has an IP address space of 10.0.0.0/22. VGW1 uses the VpnGw1 SKU.

  You need to ensure that the Azure virtual machines and the on-premises servers can communicate by using VGW1. The solution must minimize administrative effort.

  Select and Place:

  

  

• Question 324:

  You have an Azure application gateway that has Azure Web Application Firewall (WAF) enabled.

  You configure the application gateway to direct traffic to the URL of the application gateway.

  You attempt to access the URL and receive an HTTP 403 error. You view the diagnostics log and discover the following error.

  

  You need to ensure that the URL is accessible through the application gateway from any IP address.

  Solution: You configure a custom cookie and an exclusion rule.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  The log shows that WAF rule with ruleId 920300 was trigged. Instead we should disable the WAF rule that has a ruleId 920300.

  References:

  https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/web-application-firewall-troubleshoot

• Question 325:

  HOTSPOT

  You have an Azure subscription that contain a storage account named st1 in the East US Azure region.

  You have the virtual networks shown in the following table.

  

  You have the subnets shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  Azure Bastion subnet

  You must create this subnet in the same virtual network that you want to deploy Azure Bastion to. The subnet must have the following configuration: Subnet name must be AzureBastionSubnet. Subnet size must be /26 or larger (/25, /24 etc.).

  The subnet can't contain other resources.

  Box 2: Yes

  Subnet-1 has IP address range 10.2.1.0/25

  Total Number of Hosts: 128

  Number of Usable Hosts: 126

  Box 3: No

  Subnet3-1 has an IP address range of 10.3.1.0/26.

  Vnet3 has an IP address space of 10.3.0.0/16. 10.3.1.0/6 would not be within the Vnet3 IP address range.

  References:

  https://learn.microsoft.com/en-us/azure/bastion/configuration-settings

  https://www.calculator.net/ip-subnet-calculator.html

• Question 326:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to configure FW1 to filter traffic that originates from VNet1 and targets the FQDN of SQLDB1.

  Which type of rule should you use?

  A. infrastructure
  B. application
  C. DNAT
  D. network
  B. application

• Question 327:

  HOTSPOT

  You have an Azure subscription that contains a virtual network named VNet1.

  You need to implement hybrid connectivity between an on-premises network and VNet1. The solution must meet the following requirements:

  1. All cross-premises network traffic must traverse an ExpressRoute circuit.

  2. All cross-premises network traffic must be encrypted by using a Site-to-Site (S2S) VPN.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Private Type of ExpressRoute peering:

  Configure a Site-to-Site VPN connection over ExpressRoute private peering You can configure a Site-to-Site VPN to a virtual network gateway over an ExpressRoute private peering using an RFC 1918 IP address. This configuration provides the following benefits:

  Traffic over private peering is encrypted.

  Point-to-site users connecting to a virtual network gateway can use ExpressRoute (via the Site-to-Site tunnel) to access on-premises resources.

  It's possible to deploy Site-to-Site VPN connections over ExpressRoute private peering at the same time as Site-to-Site VPN connections via the Internet on the same VPN gateway. Box 2: A more specific prefixes on the VPN BGP session than the ExpressRoute BGP session. Prefixes to advertise for the ExpressRoute and VPN connections Traffic from on-premises networks to Azure For traffic from on-premises networks to Azure, the Azure prefixes are advertised via both the ExpressRoute private peering BGP, and the VPN BGP if BGP is configured on your VPN Gateway. The result is two network routes (paths) toward Azure from the on-premises networks.

  Traffic from Azure to on-premises networks.

  The same requirement applies to the traffic from Azure to on-premises networks. To ensure that the IPsec path is preferred over the direct ExpressRoute path (without IPsec), you have two options:

  *-> Advertise more specific prefixes on the VPN BGP session for the VPN-connected network. You can advertise a larger range that encompasses the VPN-connected network over ExpressRoute private peering, then more specific ranges in the VPN BGP session. For example, advertise 10.0.0.0/16 over

  ExpressRoute, and 10.0.1.0/24 over VPN.

  1. Advertise disjoint prefixes for VPN and ExpressRoute. If the VPN-connected network ranges are disjoint from other ExpressRoute connected networks, you can advertise the prefixes in the VPN and ExpressRoute BGP sessions respectively.

  References:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/site-to-site-vpn-private-peering

• Question 328:

  You have an Azure subscription that contains multiple virtual machines in the West US Azure region.

  You need to use Traffic Analytics.

  Which two resources should you create? Each correct answer presents part of the solution. (Choose two.)

  NOTE: Each correct answer selection is worth one point.

  A. an Azure Monitor workbook
  B. a Log Analytics workspace
  C. a storage account
  D. an Azure Sentinel workspace
  E. an Azure Monitor data collection rule
  B. a Log Analytics workspace
  C. a storage account

  ---

  Explanation

  A storage acccount is used to store network security group flow logs.

  A Log Analytics workspace is used by Traffic Analytics to store the aggregated and indexed data that is then used to generate the analytics.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics

• Question 329:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You have two servers that are each hosted by a separate service provider in New York and Germany. The server hosted in New York is accessible by using a host name of ny.contoso.com. The server hosted in Germany is accessible by using a host name of de.contoso.com.

  You need to provide a single host name to access both servers. The solution must ensure that traffic originating from Germany is routed to de.contoso.com. All other traffic must be routed to ny.contoso.com.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  Rewrite HTTP request and response headers with Azure Application Gateway - Azure portal

  Sign in to Azure Step 1: Sign in to the Azure portal with your Azure account.

  Configure header rewrite

  In this example, we'll modify a redirection URL by rewriting the location header in the HTTP response sent by a backend application.

  Step 2: Select All resources, and then select your application gateway.

  Step 3: Select Rewrites in the left pane.

  Step 4: Select Rewrite set.

  Step 5: Provide a name for the rewrite set and associate it with a routing rule.

  Step 5a: Enter the name for the rewrite set in the Name box.

  Step 5b: Select one or more of the rules listed in the Associated routing rules list. You can select only rules that haven't been associated with other rewrite sets. The rules that have already been associated with other rewrite sets are dimmed.

  Step 5c: Select Next.

  Step 6: Create a rewrite rule.

  Step 6a: Select Add rewrite rule.

  Step 6b: Enter a name for the rewrite rule in the Rewrite rule name box. Enter a number in the Rule sequence box.

  Step 7: In this example, we'll rewrite the location header only when it contains a reference to azurewebsites.net. To do this, add a condition to evaluate whether the location header in the response contains azurewebsites.net.

  Step 7a: Select Add condition and then select the box containing the If instructions to expand it.

  Step 7b:

  In the Type of variable to check list, select HTTP header.

  In the Header type list, select Response.

  Because in this example we're evaluating the location header, which is a common header, select Common header under Header name.

  In the Common header list, select Location.

  Under Case-sensitive, select No.

  In the Operator list, select equal (=).

  Step 7c: Enter a regular expression pattern. In this example, we'll use the pattern (https?)://.azurewebsites.net(.)$. Enter ny.contoso.com.

  Step 7d: Select OK.

  Step 8: Add an action to rewrite the location header.

  Step 8a: In the Action type list, select Set.

  In the Header type list, select Response.

  Under Header name, select Common header.

  In the Common header list, select Location.

  Step 8b: Enter the header value. In this example, we'll use {http_resp_Location_1}://contoso.com{http_resp_Location_2} as the header value. This value will replace azurewebsites.net with contoso.com in the location header. Enter exactly like in the example: {http_resp_Location_1}://contoso.com{http_resp_Location_2}.

  Step 8c: Select OK.

  Step 9: Repeat steps 6 to 8c but in step 7c enter de.contoso.com instead of ny.contoso.com.

  Step 10: Select Create to create the rewrite set.

  Step 11: The Rewrite set view will open. Verify that the rewrite set you created is in the list of rewrite sets.

• Question 330:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to control access to storage1 by using NSG1.

  What should you configure first?

  A. the Azure Private Link service
  B. an application security group
  C. a private endpoint network policy
  D. a service endpoint
  C. a private endpoint network policy