Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 371:

  HOTSTOP

  You need to connect an on-premises network and an Azure environment. The solution must use ExpressRoute and support failing over to a Site-to-Site VPN connection if there is an ExpressRoute failure.

  What should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-coexist-resource-manager

• Question 372:

  Which one of the following priority levels is highest for a security rule in Azure Firewall?

  B. 100
  C. 1000
  B. 100

  ---

  Explanation

  Priority settings can be any number between 100 and 65000. With 100 being the highest priority.

• Question 373:

  DRAG DROP

  You have three on-premises sites. Each site has a third-party VPN device.

  You have an Azure virtual WAN named VWAN1 that has a hub named Hub1. Hub1 connects two of the three on-premises sites by using a Site-to-Site VPN connection.

  You need to connect the third site to the other two sites by using Hub1.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal

• Question 374:

  You have an Azure subscription that contains an instance of Azure Firewall Standard named AzFW1.

  You plan to enable the following:

  1. TLS inspection

  2. Threat intelligence

  3. A network intrusion detection and prevention system (IDPS)

  What can you enable by using AzFW1?

  A. TLS inspection only
  B. threat intelligence only
  C. TLS inspection and the IDPS only
  D. threat intelligence and the IDPS only
  E. TLS inspection, threat intelligence, and the IDPS
  E. TLS inspection, threat intelligence, and the IDPS

• Question 375:

  HOTSPOT

  You have an Azure virtual network named Vnet1 that contains two subnets named Subnet1 and Subnet2.

  You have the NAT gateway shown in the NATgateway1 exhibit.

  

  You have the virtual machine shown in the VM1 exhibit.

  

  Subnet1 is configured as shown in the Subnet1 exhibit.

  

  For each of the following statements, select Yes of the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Q1: The answer is yes, even though the NAT gateway is in a different availability zone to the virtual machine, VM1 can still browse the internet and is given one of the IP addresses from the IP prefix that is used by the NAT gateway.

  Q2: The answer is no, there is no mention about the configuration of subnet 2 in the question, however when you look at the NAT gateway configuration it shows that it's attached to a single subnet, which is subnet 1 in this scenario.

  Q3: The answer is no, the NAT gateway is using an IP address prefix, this means that potentially the virtual machines can be given one of the IP addresses in the IP prefix. IP prefixes allow for 2, 4, 8 and 16 IP addresses.

• Question 376:

  You have an Azure subscription that contains the resources shown in the following table.

  

  VNet1 contains a subnet named Subnet.

  You need to ensure that the resources connected to Subnet1 can access only storage1 and storage3. The solution must minimize administrative effort.

  What should you configure?

  A. an application security group
  B. Azure Private Link
  C. a service endpoint policy
  D. a service tag
  C. a service endpoint policy

• Question 377:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to use VNET4 for an Azure API Management implementation.

  You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canada. You do NOT need to create the application gateway to complete this task.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Azure Front Door web application firewall (WAF) protects web applications from common vulnerabilities and exploits. Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats.

  You can restrict access to your web applications by country/region.

  Plan:

  Stage 1: Create a WAF policy Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal.

  Step 1: On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create.

  Step 2: On Create a WAF policy page, Basics tab, enter or select the following information and accept the defaults for the remaining settings:

  * details omitted *

  Step 3: On the Association tab, select Add association, then select one of the following settings:

  Application Gateway: Select the application gateway, and then select Add.

  HTTP Listener: Select the application gateway, select the listeners, then select Add.

  Route Path: Select the application gateway, select the listener, select the routing rule, and then select Add.

  Step 4: Select Review + create, then select Create.

  

  Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada Configure WAF rules.

  When you create a WAF policy, by default it is in Detection mode. In Detection mode, WAF doesn't block any requests. Instead, the matching WAF rules are logged in the WAF logs. To see WAF in action, you can change the mode settings to Prevention. In Prevention mode, matching rules defined in the CRS Ruleset you selected are blocked and/or logged in the WAF logs.

  Custom rules

  Step 5: To create a custom rule, select Add custom rule under the Custom rules tab. This opens the custom rule configuration page.

  

  Step 6: To create a geo-filtering custom rule in the Azure portal, simply select Geo location as the Match Type, and then select the country/region or countries/regions you want to allow/block from your application.

  Step 7: Select Add Custom rule

  

  Step 8: Select Geo location

  Create your Custom Rule with an appropriate name and priority, then choose 'Geo location' from the Match type drop down as above. Next, you'll want to ensure you choose RemoteAddr as the match variable, and decide what logic you want to apply. By logic I mean the pattern that will fire the rule. In this example, I want all traffic except Ireland blocked. So I will choose the Operation 'Is not', then location Ireland, then Deny. If I wanted all traffic allowed and Ireland blocked, I would simply choose the Operation 'Is'. I recommend figuring out your pattern then working your way through the final section of the CR.

  Step 9: Set Match variable to Canada, choose IS NOT, Choose country Canada, and finally.

  Then: Deny traffic.

  

  Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

  Step 10: Repeat steps 5 to 9 but instead use:

  Operation:

  IS Country/Region: Canada.

  Then: Allow traffic

  Step 11: Finish the creation of the policy. Click Review+Create

  References:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs

  https://wedoazure.ie/2021/08/09/how-to-enable-web-application-firewall-geomatch-custom-rules/

  https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

• Question 378:

  You are planning the IP addressing for the subnets in Azure virtual networks.

  Which type of resource requires IP addresses in the subnets?

  A. Azure Virtual Network NAT
  B. virtual network peering
  C. service endpoints
  D. private endpoints
  A. Azure Virtual Network NAT

• Question 379:

  HOTSPOT

  You have an Azure subscription that contains the route tables and routes shown in the following table.

  

  The subscription contains the subnets shown in the following table.

  

  The subscription contains the virtual machines shown in the following table.

  

  The subscription contains the local network gateways shown in the following table.

  

  There is a Site-to-Site VPN connection to each local network gateway.

  For each of the following statements, select Yes of the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

• Question 380:

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an Azure Virtual Desktop host pool named Pool1.

  You need to implement Azure Firewall and TLS inspection for all the outbound traffic from Pool1.

  Which two resources should you configure? Each correct answer present part of the solution.

  NOTE: Each correct answer is worth one point

  A. an Azure Private DNS zone
  B. a private endpoint
  C. an Azure key vault
  D. an Azure NAT gateway
  E. a Microsoft Entra enterprise app
  F. a managed identity
  D. an Azure NAT gateway
  F. a managed identity