Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 361:

  You need to use Traffic Analytics to monitor the usage of applications deployed to Azure virtual machines.

  Which Azure Network Watcher feature should you implement first?

  A. Connection monitor
  B. Packet capture
  C. NSG flow logs
  D. IP flow verify
  C. NSG flow logs

  ---

  Explanation

  Network Watcher: A regional service that enables you to monitor and diagnose conditions at a network scenario level in Azure. You can turn NSG flow logs on and off with Network Watcher.

  Network security group (NSG) flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG.

  Why use NSG Flow Logs?

  It is vital to monitor, manage, and know your own network for uncompromised security, compliance, and performance.

  Common use cases include

  Network Monitoring: Identify unknown or undesired traffic. Monitor traffic levels and bandwidth consumption. Filter flow logs by IP and port to understand application behavior.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

• Question 362:

  You have an Azure virtual network that contains the subnets shown in the following table.

  

  You deploy an Azure firewall to AzureFirewallSubnet. You route all traffic from Subnet2 through the firewall.

  You need to ensure that all the hosts on Subnet2 can access an external site located at https://*.contoso.com.

  What should you do?

  A. In a firewall policy, create a DNAT rule.
  B. Create a network security group (NSG) and associate the NSG to Subnet2.
  C. In a firewall policy, create a network rule.
  D. In a firewall policy, create an application rule.
  D. In a firewall policy, create an application rule.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

• Question 363:

  HOTSPOT

  You have the Azure environment shown in the Azure Environment exhibit.

  

  The settings for each subnet are shown in the following table.

  

  The Firewalls and virtual networks settings for storage1 are configured as shown in the Storage1 exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  The firewall allows VNet1\Subnet1 through the service endpoint.

  Box 2: No

  The firewall does not allow VNet1\Subnet2 through the service endpoint.

  Box 3: No

  The firewall allows 132.124.53.0/26 which means it allows all IP addresses between 132.124.53.0 and 132.124.53.63. The public IP of VM3 is 132.124.53.76 which is outside the allowed range.

• Question 364:

  You have an Azure subscription that contains a virtual network named VNet1.

  You plan to deploy Point-to-Site (P2S) VPN access to VNet1.

  You need to recommend an authentication method for the deployment. The solution must meet the following requirements:

  Require the use of a FIDO2 security key Analyze user sign-in behavior Require a user to change their password if their sign-in behavior is identified as risky.

  What should you recommend?

  A. RADIUS
  B. Microsoft Entra
  C. smart card
  D. Azure certificate
  B. Microsoft Entra

• Question 365:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that network traffic is routed over the Azure backbone network for the following scenarios:

  1. Traffic from SQIMI1 to storage1

  2. Traffic from domain joined servers on VNet2 to storage1

  The solution must minimize costs.

  What should you configure for each scenario? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 366:

  Your company has offices in London, Tokyo, and New York.

  The company has a web app named App1 that has the Azure Traffic Manager profile shown in the following table.

  

  In Asia, you plan to deploy an additional endpoint that will host an updated version of App1.

  You need to route 10 percent of the traffic from the Tokyo office to the new endpoint during testing.

  What should you configure in Traffic Manager?

  A. one profile and five endpoints
  B. two profiles and four endpoints
  C. three profiles and four endpoints
  D. two profiles and five endpoints
  B. two profiles and four endpoints

• Question 367:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to deploy several virtual machines to subnet1-2.

  You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2. The solution must minimize administrative effort.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  You can use a network security group to filter inbound and outbound network traffic to and from Azure resources in an Azure virtual network.

  Plan Stage 1: Create a network security group Stage 2: Associate network security group to subnet Stage 3: Create security rule

  Stage 1: Create a network security group

  A network security group (NSG) secures network traffic in your virtual network.

  Step 1: From the Azure portal menu, select + Create a resource > Networking > Network security group, or search for Network security group in the portal search box.

  Step 2: Select Create.

  Step 3: On the Basics tab of Create network security group, enter or select this information:

  *Details omitted*

  Step 4: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 5: Select Create.

  Stage 2: Associate network security group to subnet

  In this section, you'll associate the network security group with the subnet of the virtual network you created earlier.

  Step 6: Search for myNsg (the name you give in stage 1) in the portal search box.

  Step 7: Select Subnets from the Settings section of myNSG.

  Step 8: In the Subnets page, select +

  Associate:

  

  Step 9: Under Associate subnet, select myVNet (the virtual network that is available) for Virtual network.

  Step 10: Select subnet1-2 for Subnet, and then select OK.

  Stage 3: Create security rule

  Step 11: Select Inbound security rules from the Settings section of myNSG.

  Step 12: In Inbound security rules page, select +

  Add:

  

  Step 13: Create a security rule that blocks TCP port 5585 to the network security group you created earlier. In Add inbound security rule page, enter or select this information: (You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2.)

  Source: Leave the default of Any.

  Source port ranges: Leave the default of (*).

  Destination: Select Network security group.

  Destination Network security groups: Select the network security group you created earlier.

  Service: Leave the default of Custom.

  Destination port ranges: Enter 5585

  Protocol: Select TCP.

  Action: Deny

  Priority Leave the default of 100.

  Name: Enter something

  

  Step 14: Select Add.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic

• Question 368:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create a virtual network named Vnet2 in the West US region.

  You plan to enable peering between Vnet1 and Vnet2.

  You need to ensure that the virtual machines connected to Vnet2 can connect to VM1 and VM2 via LB1.

  What should you do?

  A. From the Peerings settings of Vnet2, set Traffic forwarded from remote virtual network to Allow.
  B. Change the Floating IP configurations of LB1.
  C. From the Peerings settings of Vnet1, set Traffic forwarded from remote virtual network to Allow.
  D. Change the SKU of LB1.
  D. Change the SKU of LB1.

  ---

  Explanation

  What are the constraints related to Global VNet Peering and Load Balancers?

  If the two virtual networks in two different regions are peered over Global VNet Peering, you cannot connect to resources that are behind a Basic Load Balancer through the Front End IP of the Load Balancer. This restriction does not exist for a Standard Load Balancer.

  Note: The following resources can use Basic Load Balancers which means you cannot reach them through the Load Balancer's Front End IP over Global VNet Peering. You can however use Global VNet peering to reach the resources directly through their private VNet IPs, if permitted.

  VMs behind Basic Load Balancers

  Virtual machine scale sets with Basic Load Balancers Redis Cache Application Gateway (v1) SKU Service Fabric

  API Management (stv1)

  Active Directory Domain Service (ADDS)

  Logic Apps

  HDInsight

  Azure Batch

  App Service Environment

  You can connect to these resources via ExpressRoute or VNet-to-VNet through VNet Gateways.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#what-are-the-constraints-related-to-global-vnet-peering-and-load-balancers

• Question 369:

  HOTSPOT

  You need to recommend a configuration for the ExpressRoute connection from the Boston datacenter. The solution must meet the hybrid networking requirements and business requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  For the first question, only ExpressRoute GW SKU Ultra Performance support FastPath feature.

  For the second question, vnet1 will connect to ExpressRoute gw, once Vnet1 peers with Vnet2, the traffic from on-premise network will bypass GW and Vnet1, directly goes to Vnet2, while this feature is under public preview.

  ====Reference

  ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

  To configure FastPath, the virtual network gateway must be either: Ultra Performance ErGw3AZ

  VNet Peering - FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway.

  https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

  Gateway SKU

  https://docs.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-networkgateways

• Question 370:

  You have an Azure virtual network that contains a subnet named Subnet1. Subnet1 is associated to a network security group (NSG) named NSG1. NSG1 blocks all outbound traffic that is not allowed explicitly.

  Subnet1 contains virtual machines that must communicate with the Azure Cosmos DB service.

  You need to create an outbound security rule in NSG1 to enable the virtual machines to connect to Azure Cosmos DB.

  What should you include in the solution?

  A. a service tag
  B. a private endpoint
  C. a subnet delegation
  D. an application security group
  A. a service tag

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview