Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 381:

  HOTSPOT

  You are implementing the virtual network requirements for VM-Analyze.

  What should you include in a custom route that is linked to Subnet2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

• Question 382:

  You have a web application that will be deployed to an Azure App Service Web App.

  The web application has following requirements: Secure all communications by using Secured Socket layer (SSL).

  SSL encryption and decryption must be processed efficiently to support high traffic load on the web application.

  What should you consider?

  A. Use Azure Application Gateway
  B. Use Azure Monitor
  C. Use Azure Security Centre
  D. Use Azure Traffic Manager
  A. Use Azure Application Gateway

  ---

  Explanation

  Correct Answer(s):

  Use Azure Application Gateway - Azure Application Gateway supports end-to-end encryption of traffic.

  Application Gateway terminates the SSL connection at the application gateway. The gateway then applies the routing rules to the traffic, re-encrypts the packet, and forwards the packet to the appropriate back-end server based on the routing rules defined.

  https://docs.microsoft.com/en-us/azure/application-gateway/features#secure-sockets-layer-ssltls-termination

  Azure provides a suite of fully managed load-balancing solutions for your scenarios. If you are looking for Transport Layer Security (TLS) protocol termination ("SSL offload") or per-HTTP/HTTPS request, application-layer processing, review Application Gateway. If you are looking for regional load balancing, review Load Balancer.

  Wrong Answers:

  Use Azure Monitor - Azure Monitor is a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments.

  Use Azure Security Centre - Azure Security Center is a unified infrastructure security management system that strengthens the security posture of your data centers and provides advanced threat protection across your hybrid workloads in the cloud.

  Use Azure Traffic Manager - Traffic Manager does not support SSL offloading.

• Question 383:

  HOTSPOT

  You have the Azure App Service app shown in the App Service exhibit.

  

  The VNet Integration settings for as12 are configured as shown in the Vnet Integration exhibit.

  

  The Private Endpoint connections settings for as12 are configured as shown in the Private Endpoint connections exhibit.

  

  For each of the following statements, select Yes of the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. Yes: Virtual Network Integration supports only one virtual interface per worker. One virtual interface per worker means one regional virtual network integration per App Service plan. All the apps in the same App Service plan can use the same virtual network integration.

  https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration

  under section "How regional virtual network integration works".

  2. Yes: "When regional virtual network integration is enabled, your app makes outbound calls through your virtual network. The outbound addresses that are listed in the app properties portal are the addresses still used by your app.".

  https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration

  under section "How regional virtual network integration works".

  3. No: "you can't use virtual network integration to provide inbound access to your app.", if you need Inbound access to the App you will need to setup a Service Endpoint or Private Endpoint.

  https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration

  under " Regional virtual network integration".

• Question 384:

  You have an Azure subscription that contains the Azure App Service web apps shown in the following table.

  

  You need to deploy Azure Traffic Manager. The solution must meet the following requirements:

  1. Traffic to https://www.fabrikam.com must be directed to App1eu.

  2. If App1eu becomes unresponsive, all the traffic to https://www.fabrikam.com must be directed to App1us.

  You need to implement Traffic Manager to meet the requirements.

  Which two resources should you create? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a Traffic Manager profile that uses the priority routing method
  B. a Traffic Manager profile that uses the geographic routing method
  C. a CNAME record in a DNS domain named fabrikam.com
  D. a TXT record in a DNS domain named fabricam.com
  E. a real user measurements key in Traffic Manager
  A. a Traffic Manager profile that uses the priority routing method
  C. a CNAME record in a DNS domain named fabrikam.com

  ---

  Explanation

  Disaster recovery using Azure DNS and Traffic Manager

  Automatic failover using Azure Traffic Manager (A) Step 1: Create a new Azure Traffic Manager profile Create a new Azure Traffic manager profile with the name contoso123 and select the Routing method as Priority.

  Priority Routing ?Priority routing is based on health checks of endpoints. By default, Azure Traffic manager sends all traffic to the highest priority endpoint, and upon a failure or disaster, Traffic Manager routes the traffic to the secondary endpoint.

  Incorrect:

  * geographic routing Geographic: Select Geographic routing to direct users to specific endpoints (Azure, External, or Nested) based on where their DNS queries originate from geographically. With this routing method, it enables you to be in compliance with scenarios such as data sovereignty mandates, localization of content & user experience and measuring traffic from different regions.

  Step 2: Create endpoints within the Traffic Manager profile

  Step 3: Set up health check and failover configuration

  C: Create a DNS zone Create DNS zone records Update CNAME record

  Only CNAME records are supported when you configure a domain name using the Traffic Manager endpoint. Because A records are not supported, a root domain mapping, such as contoso.com is also not supported.

  References:

  https://learn.microsoft.com/en-us/azure/networking/disaster-recovery-dns-traffic-manager

  https://learn.microsoft.com/en-us/azure/app-service/configure-domain-traffic-manager

  https://learn.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

• Question 385:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that VM1 and VM2 can connect only to storage1. The solution must meet the following requirements:

  1. Prevent VM1 and VM2 from accessing any other storage accounts.

  2. Ensure that storage1 is accessible from the internet.

  What should you use?

  A. a network security group (NSG)
  B. a private endpoint
  C. a private link
  D. a service endpoint policy
  D. a service endpoint policy

  ---

  Explanation

  Virtual network service endpoint policies for Azure Storage Virtual Network (VNet) service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts over service endpoint, and allow data exfiltration to only specific Azure Storage accounts. Endpoint policies provide granular access control for virtual network traffic to Azure Storage when connecting over service endpoint.

  Incorrect:

  * a network security group (NSG)

  Azure service tags for network security groups allow you to restrict virtual network outbound traffic to specific Azure Storage regions. However, this allows traffic to any account within selected Azure Storage region.

  * a private endpoint

  You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

  * Private link

  Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network.

  Traffic between your virtual network and the service travels the Microsoft backbone network. Exposing your service to the public internet is no longer necessary. You can create your own private link service in your virtual network and deliver it to your customers. Setup and consumption using Azure Private Link is consistent across Azure PaaS, customer-owned, and shared partner services.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

  https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

  https://learn.microsoft.com/en-us/azure/private-link/private-link-overview

• Question 386:

  DRAG DROP

  You need to deploy Azure Virtual Network Manager. The solution must support the planned changes and meet the connectivity requirements.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 387:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have two Azure virtual networks named Vnet1 and Vnet2.

  You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.

  You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.

  You discover that Client1 cannot communicate with Vnet2.

  You need to ensure that Client1 can communicate with Vnet2.

  Solution: You reset the gateway of Vnet1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

• Question 388:

  HOTSPOT

  You need to implement a P2S VPN for the users in the branch office. The solution must meet the hybrid networking requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 389:

  You have an Azure subscription. You plan to deploy an app named App1 that will be accessed by using Azure Application Gateway. You need to deploy the application gateway for App1.

  What should you create first?

  A. a user-assigned managed identity
  B. a subnet
  C. an X.509 certificate
  D. an Azure Web Application Firewall (WAF) policy
  B. a subnet

• Question 390:

  HOTSPOT

  You have an Azure subscription that contains 1.000 virtual machines.

  You collect network security group (NSG) flow logs.

  You need to identify all the virtual machines that have interacted with non-Azure public IP addresses during the last 30 days

  How should you complete the query? To answer, select the appropriate options in the answer area

  NOTE; Each correct selection is worth one point.