Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 331:

  HOTSPOT

  You have two Azure subscriptions.

  You need to perform the following actions in the East US Azure region of each subscription:

  1. Deploy 50 virtual machines to availability zone 1.

  2. Deploy 50 virtual machines to availability zone 2.

  3. Deploy 50 virtual machines to availability zone 3.

  What is the minimum number of virtual networks and /25 subnets you should create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 332:

  You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1.

  You need to deploy Azure Firewall to RG1. The solution must minimize administrative effort.

  What should you do first?

  A. Create a secured virtual hub named AzureFirewallHub.
  B. Create a new resource group named AzureFirewallResourceGroup.
  C. Create a new virtual network named AzureFirewallNetwork.
  D. On VNet1, create a virtual subnet named AzureFirewallSubnet.
  D. On VNet1, create a virtual subnet named AzureFirewallSubnet.

• Question 333:

  HOTSPOT

  You have an Azure subscription that contains a virtual network named VNet1.

  Your on-premises network connects to VNet1 by using a Site-to-Site (S2S) VPN connection.

  You need to ensure that Azure Network Watcher generates an alert if the VPN connection fails.

  Which Network Watcher feature should you use to generate the alert, and which data source should the feature query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: VPN troubleshoot Feature

  Network Watcher, VPN troubleshoot overview Virtual network gateways provide connectivity between on-premises resources and Azure Virtual Networks. Monitoring virtual network gateways and their connections are critical to ensure communication isn't broken. Azure Network Watcher VPN troubleshoot provides the capability to troubleshoot virtual network gateways and their connections. VPN troubleshoot can be called through the Azure portal, Azure PowerShell, Azure CLI, or REST API. When called, Network Watcher diagnoses the health of the gateway, or connection, and returns the appropriate results. The request is a long running transaction. The results are returned once the diagnosis is complete.

  

  Box 2: Network security group (NSG) flow logs Data source

  Network Watcher, Log network traffic to and from a virtual machine using the Azure portal Network security group flow logging is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through a network security group.

  Use NSG flow logs to log a virtual machine's network traffic that flows through the network security group associated to its network interface.

  

  References:

  https://learn.microsoft.com/en-us/azure/network-watcher/vpn-troubleshoot-overview

  https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-tutorial

• Question 334:

  You have an on-premises and Azure environment connected with ExpressRoute circuit.

  You need to open a support ticket with ExpressRoute circuit provider.

  What property of an ExpressRoute circuit is useful?

  A. Service key.
  B. Circuit name.
  C. Circuit number.
  A. Service key.

  ---

  Explanation

  Correct Answer(s):

  Service key - A service key uniquely identifies an ExpressRoute circuit. If you need assistance from Microsoft or from an ExpressRoute partner to troubleshoot an ExpressRoute issue, provide the service key to readily identify the circuit.

  Wrong Answers:

  Circuit name - The Circuit name may not be unique or easily searchable for the service provider.

  Circuit number - This may help you, but it is not the quickest way to check.

• Question 335:

  HOTSPOT

  You have an Azure subscription that contains a virtual machine scale set named VMSS1 and a public standard Azure load balancer named LB1. VMSS1 contains eight virtual machines that have private IP addresses only. VMSS1 is configured as a backend pool of LB1. LB1 has two frontend IP addresses and one outbound rule that provides internet connectivity to VMSS1.

  What is the maximum number of ports available to the virtual machines in VMSS1, and what should you change to increase the maximum number of SNAT ports available to VMSS1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 336:

  You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements.

  Which connectivity method should you use?

  A. a private endpoint
  B. Azure Firewall
  C. Azure Front Door
  D. a service endpoint
  A. a private endpoint

  ---

  Explanation

  wsrudmen Highly Voted 1 year ago

  Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network.

  Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP

  Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK

• Question 337:

  DRAG DROP

  Your on-premises network uses an IP address space of 10.0.0.0/20.

  You have an Azure subscription that contains the resources shown in the following table.

  

  The on-premises network is connected to HubVnet by using a Site-to-Site (S2S) VPN.

  You deploy an Azure firewall named AZFW1 to HubVNet.

  You need to ensure that AZFW1 can inspect all the traffic between the on-premises network and SpokeVNet.

  What should you do in RT1? To answer, drag the appropriate destination to the correct route. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 338:

  You are configuring two network virtual appliances (NVAs) in an Azure virtual network. The NVAs will be used to inspect all the traffic within the virtual network.

  You need to provide high availability for the NVAs. The solution must minimize administrative effort.

  What should you include in the solution?

  A. Azure Standard Load Balancer
  B. Azure Application Gateway
  C. Azure Traffic Manager
  D. Azure Front Door
  A. Azure Standard Load Balancer

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha?tabs=cli

• Question 339:

  You have an Azure subscription that contains a virtual network named VNet1.

  You deploy several web apps and configure the apps to use private endpoints on VNet1.

  You need to identify which DNS records the web apps registered automatically.

  Where will the records be created?

  A. an Azure DNS zone named privatelink.azurewebsites.net
  B. an Azure Private DNS zone named azurewebsites.net
  C. an Azure Private DNS zone named privatelink.azurewebsites.net
  D. an Azure DNS zone named azurewebsites.net
  C. an Azure Private DNS zone named privatelink.azurewebsites.net

  ---

  Explanation

  On creating a private endpoint in portal: Your private endpoint will be integrated with the private DNS zone 'privatelink.azurewebsites.net' in the resource group of the selected subnet. If the private DNS zone does not exist, it will be created automatically.

  C. an Azure Private DNS zone named privatelink.azurewebsites.net

• Question 340:

  HOTSPOT

  You have two Azure virtual networks named Vnet1 and Vnet2 in an Azure region that has three availability zones.

  You deploy 12 virtual machines to each virtual network, deploying four virtual machines per zone. The virtual machines in Vnet1 host an app named App1. The virtual machines in Vnet2 host an app named App2.

  You plan to use Azure Virtual Network NAT to implement outbound connectivity for App1 and App2.

  You need to identify the minimum number of subnets and Virtual Network NAT instances required to meet the following requirements:

  1. A failure of two zones must NOT affect the availability of either App1 or App2.

  2. A failure of two zones must NOT affect the outbound connectivity of either App1 or App2.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  6 Subnets and 6 GW

  https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-availability-zones#zonal-nat-gateway-resource-for-each-zone-in-a-region-to-create-zone-resiliency

  "The pattern you want to use for zone isolation is creating a "zonal stack" per availability zone. This "zonal stack" consists of virtual machine instances, a NAT gateway resource with public IP addresses or prefix on a subnet all in the same zone.

  Failure of outbound connectivity due to a zone outage is isolated to the specific zone affected. The outage won't affect the other zonal stacks where other NAT gateways are deployed with their own subnets and zonal public IPs."