Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 401:

  You have an Azure application gateway for a web app named App1. The application gateway allows end-to-end encryption.

  You configure the listener for HTTPS by uploading an enterprise-signed certificate.

  You need to ensure that the application gateway can provide end-to-end encryption for App1.

  What should you do?

  A. Increase the Unhealthy threshold setting in the custom probe.
  B. Enable the SSL profile to the listener.
  C. Set Listener type to Multi site.
  D. Upload the public key certificate to the HTTP settings.
  D. Upload the public key certificate to the HTTP settings.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/application-gateway/end-to-end-ssl-portal

  https://docs.microsoft.com/en-us/azure/application-gateway/create-ssl-portal#configuration-tab

• Question 402:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to ensure that subnet 4-3 can accommodate 507 hosts.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  Step 1: Go to the Azure portal to view your virtual networks. Search for and select Virtual Networks.

  Step 2: Select the name of the virtual network containing the subnet you want to change.

  Step 3: From Settings, select Subnets.

  Step 4: In the list of subnets, select the subnet you want to change settings for. We select subnet 4-3.

  Step 5: On the subnet page, change the Subnet address range setting:

  1. For 507 hosts, we need a 9-bit address range or larger, which is /23.

  2. Change the address to /23. For example: 10.0.0.0/23 will work fine.

  Note:

  For example, in a virtual network with address space 10.0.0.0/16, you might define a subnet address space of 10.0.0.0/22.

  The smallest range you can specify is /29, which provides eight IP addresses for the subnet.

  Azure reserves:

  1. The first and last address in each subnet for protocol conformance.

  2. Three additional addresses for Azure service usage.

  As a result, defining a subnet with a /29 address range results in three usable IP addresses in the subnet.

  Step 6: Select Save.

• Question 403:

  Your company has a remote office that contains a macOS device named Device1. Device1 has an IKEv2

  VPN client installed.

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that Device1 can access the resources on VNet1 by using the VPN connections of VPNGW1. The solution must minimize administrative effort.

  What should you do first?

  A. To VNet1, deploy a virtual machine that contains a RADIUS server.
  B. On Device1, install the OpenVPN client.
  C. On Device1, add an X.509 certificate.
  D. From Devices in the Microsoft Entra admin center, configure the Device settings.
  D. From Devices in the Microsoft Entra admin center, configure the Device settings.

• Question 404:

  HOTSPOT

  You have two Azure subscriptions named Sub1 and Sub2 that contain the resources shown in the following table.

  

  You need to ensure that App1 can access Resource1 by using the Azure Private Link service.

  Which should you deploy to each virtual network to meet the prerequisites of the Private Link service? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  To establish a connection between the resource in Sub1 and the app in Sub2 using Azure Private Link, the following components are required in each

  Virtual Network:

  Box 1: A load balancer Vnet1

  Virtual Network in Sub1 (Service Provider) Azure Standard Load Balancer: You must place a Standard Load Balancer in front of the virtual machine hosting the resource.

  Private Link Service: A Private Link Service resource must be created and associated with the frontend IP configuration of the Standard Load Balancer.

  NAT Subnet: A dedicated subnet (or sufficient space in an existing one) is needed for the Private Link Service to perform Source NAT (SNAT) on incoming traffic.

  Box 2: A private endpoint Vnet2

  Virtual Network in Sub2 (Service Consumer) Private Endpoint: You must create a Private Endpoint within a subnet in this VNet. This endpoint will be assigned a private IP address from Sub2's VNet address space to represent the resource in Subscription1.

  Private DNS Zone: To resolve the resource's service name to the Private Endpoint's internal IP, you should configure an Azure Private DNS Zone (e.g., privatelink.database.windows.net) and link it to the VNet in Sub2.

  Connection Approval: After creating the Private Endpoint using the Resource ID of the Private Link Service from Sub1, the connection must be approved in Subscription1 before traffic can flow.

  References:

  https://learn.microsoft.com/en-us/azure/private-link/how-to-approve-private-link-cross-subscription

• Question 405:

  You have a network security group named NSG1.

  You need to enable network security group (NS) flow logs for NSG1. The solution must support retention policies.

  What should you create first?

  A. A standard general-purpose v2 Azure Storage account
  B. An Azure Log Analytics workspace
  C. A standard general-purpose v1 Azure Storage account
  D. A premium Block blobs Azure Storage account
  A. A standard general-purpose v2 Azure Storage account

  ---

  Explanation

  NSG flow logging considerations Storage account considerations:

  Location: The storage account used must be in the same region as the NSG.

  Performance Tier: Currently, only standard tier storage accounts are supported.

  Note:

  Flow Logs have a retention feature that allows automatically deleting the logs up to a year after their creation.

  Retention is available only if you use General purpose v2 Storage accounts (GPv2).

  References:

  https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

• Question 406:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You establish BGP peering between NVA1 and Hub1.

  You need to implement transit connectivity between VNet1 and VNet3 via Hub1 by using BGP peering.

  The solution must minimize costs.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 407:

  You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.

  You need to configure a rate limit for incoming requests to AFD1.

  Solution: You configure a managed rule for WAF1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  References:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-configure

• Question 408:

  You have three on-premises networks.

  You have an Azure subscription that contains a Basic Azure virtual WAN. The virtual WAN contains a single virtual hub and a virtual network gateway that is limited to a throughput of 1 Gbps.

  The on-premises networks connect to the virtual WAN by using Site-to-Site (S2S) VPN connections.

  You need to increase the throughput of the virtual WAN to 3 Gbps. The solution must minimize administrative effort.

  What should you do?

  A. Upgrade the virtual WAN to the Standard SKU.
  B. Add an additional VPN gateway to the Azure subscription.
  C. Create an additional virtual hub.
  D. Increase the number of gateway scale units.
  D. Increase the number of gateway scale units.

  ---

  Explanation

  https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings#s2s

• Question 409:

  DRAG DROP

  You have an on-premises network

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway named Gateway 1.

  You need to implement an ExpressRoute solution from a third-party provider named Fabrikam, Inc. The solution must ensure that devices on the on-premises network can connect to the Azure resources on VNet1.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 410:

  You purchase an Azure subscription.

  You plan to deploy resources shown in the following table to then subscription.

  

  You need to create a NSG1 rule named Rule1 to meet the following requirements:

  1. Enable the search servers of App1 to establish outbound HTTP connections to internet services.

  2. Minimize administrative effort when new search servers are deployed.

  3. Use the principle of least privilege.

  What should you select as the source for Rule1?

  A. IP Addresses
  B. Any
  C. Virtual Network
  D. Application security group
  A. IP Addresses