Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 411:

  HOTSPOT

  Your company has 40 branch offices across North America and Europe.

  You have an Azure subscription that contains the following virtual networks:

  1. Two networks in the East US Azure region

  2. Three networks in the West Europe Azure region

  You need to implement Azure Virtual WAN. The solution must meet the following requirements:

  1. Each branch office in North America must have an ExpressRoute circuit and a Site-to-Site VPN that connects to the East US region.

  2. Each branch office in Europe must have an ExpressRoute circuit and a Site-to-Site VPN that connects to the West Europe region.

  3. Transitive connections must be supported between all the branch offices and all the virtual networks.

  4. Costs must be minimized.

  What is the minimum number of Virtual WAN resources required? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Two Standard virtual WANs.

  Need Standard for ExpressRoute.

  Two VLANs: One for North America, and one for Europe.

  Note:

  Virtual WAN: The virtualWAN resource represents a virtual overlay of your Azure network and is a collection of multiple resources. It contains links to all your virtual hubs that you would like to have within the virtual WAN. Virtual WANs are isolated from each other and can't contain a common hub. Virtual hubs in different virtual WANs don't communicate with each other.

  Virtual WAN types

  There are two types of virtual WANs: Basic and Standard. The following table shows the available configurations for each type.

  * Basic

  Site-to-site VPN only

  * Standard

  ExpressRoute

  User VPN (P2S)

  VPN (site-to-site)

  Inter-hub and VNet-to-VNet transiting through the virtual hub Azure Firewall NVA in a virtual WAN

  Box 2: Five Virtual WAN hubs

  One virtual WAN hub for each site; two in East US and three in West Europe.

  Note:

  Hub: A virtual hub is a Microsoft-managed virtual network. The hub contains various service endpoints to enable connectivity. From your on-premises network (vpnsite), you can connect to a VPN gateway inside the virtual hub, connect ExpressRoute circuits to a virtual hub, or even connect mobile users to a point-to-site gateway in the virtual hub. The hub is the core of your network in a region. Multiple virtual hubs can be created in the same region.

  A hub gateway isn't the same as a virtual network gateway that you use for ExpressRoute and VPN Gateway. For example, when using Virtual WAN, you don't create a site-to-site connection from your on-premises site directly to your VNet. Instead, you create a site-to-site connection to the hub. The traffic always goes through the hub gateway. This means that your VNets don't need their own virtual network gateway. Virtual WAN lets your VNets take advantage of scaling easily through the virtual hub and the virtual hub gateway.

  Box 3: Two virtual network gateways

  One virtual gateway for East US and one for West Europe.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

• Question 412:

  You have an Azure subscription that is linked to an Azure AD tenant named contoso.onmicrosoft.com. The subscription contains the following resources:

  1. A virtual network named Vnet1

  2. An App Service plan named ASPI

  3. An Azure App Service named webapp1

  4. An Azure private DNS zone named private.contoso.com

  5. Virtual machines on Vnet1 that cannot communicate outside the virtual network

  You need to ensure that the virtual machines on Vnet1 can access webapp1 by using a URL of https:/ Avwwprivate.contosocom.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create a CNAME record that maps www.private.contoso.com to webapp1.contoso.onmicrosoft.com.
  B. Create a CNAME record that maps www.private.contoso.com to webapp1.private.contoso.com.
  C. Create a service endpoint for webapp1.
  D. Register an enterprise application in Azure AD for webapp1.
  E. Create a private endpoint for webapp1.
  F. Create a CNAME record that maps www.private.contoso.com to webapp1.privatelink.azurewebsites.net.
  E. Create a private endpoint for webapp1.
  F. Create a CNAME record that maps www.private.contoso.com to webapp1.privatelink.azurewebsites.net.

  ---

  Explanation

  E: You can use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone can be linked to your virtual network to resolve specific domains.

  When you use Private Endpoint for Web App, the requested URL must match the name of your Web App.

  When you deploy a Private Endpoint, we update the DNS entry to point to the canonical name mywebapp.privatelink.azurewebsites.net. For example, the name resolution will be (Name, Type, Value):

  mywebapp.azurewebsites.net CNAME mywebapp.privatelink.azurewebsites.net

  References:

  https://docs.microsoft.com/en-us/azure/app-service/networking/private-endpoint

• Question 413:

  HOTSPOT

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You plan to deploy Azure virtual machines and Azure Bastion to VNet1.

  You need to recommend an IP subnetting configuration for VNet1. The solution must maximize the number of IP addresses that can be assigned to the virtual machines

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 414:

  You need to monitor the latency between your on-premises network and the Azure virtual machines.

  What should you use?

  A. Service Map
  B. Connection troubleshoot
  C. Network Performance Monitor
  D. Effective routes
  C. Network Performance Monitor

  ---

  Explanation

  Correct Answer(s):

  Network Performance Monitor - Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you monitor network performance between various points in your network infrastructure.

  It also helps you monitor network connectivity to service and application endpoints and monitor the performance of Azure ExpressRoute.

  You can monitor network connectivity across cloud deployments and on-premises locations, multiple data centers, and branch offices and mission-critical multitier applications or microservices. With Performance Monitor, you can detect network issues before users complain.

  https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-performance-monitor

  Wrong Answers:

  Service Map - Service Map automatically discovers application components on Windows and Linux systems.

  Connection troubleshoot - enable you to troubleshoot network performance and connectivity issues in Azure.

  Effective routes You can use effective routes to determinewhy you can't connect to the VM.

• Question 415:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to deploy a firewall to subnet1-2. The firewall will have an IP address of 10.1.2.4.

  You need to ensure that traffic from subnet1-1 to the IP address range of 192.168.10.0/24 is routed through the firewall that will be deployed to subnet 1-2. The solution must be achieved without using dynamic routing protocol.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Custom routes, User-defined

  You can create custom, or user-defined(static), routes in Azure to override Azure's default system routes, or to add more routes to a subnet's route table. In Azure, you create a route table, then associate the route table to zero or more virtual network subnets. Each subnet can have zero or one route table associated to it.

  Create a route table (Skip Step 1 to Step 4 if route table already present= Step 1: From the Azure portal menu, select + Create a resource > Networking > Route table, or search for Route table in the portal search box.

  Step 2: Select Create.

  Step 3: On the Basics tab of Create route table, enter or select information:

  

  Step 4: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Create a route

  In this section, you'll create a route in the route table that you created in the previous steps.

  Step 5: Select Go to resource or Search for myRouteTablePublic (The route table you created earlier) in the portal search box.

  Step 6: In the myRouteTablePublic page, select Routes from the Settings section.

  Step 7: In the Routes page, select the + Add button.

  Step 8: In Add route, enter or select this information: Route name: SomeName Address prefix destination: Select IP Addresses.

  Destination IP addresses/CIDR ranges: Enter 192.168.10.0/24 - The address range of to be routed from.

  Next hop type: Select Virtual appliance.

  Next hop address: Enter 10.1.2.4 (The address of the firewall in the sbunet1-2 subnet).

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

  https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

• Question 416:

  You have a web application that uses a hostname of www.healthengine.com

  You have an Azure Front Door instance that provides access to the web application.

  You have the routing rules shown in the following table.

  

  Which rule will apply to www.healthengine.com/default.htm incoming request?

  A. RuleA
  B. RuleB
  C. RuleC
  D. RuleD
  C. RuleC

  ---

  Explanation

  Correct Answer(s):

  RuleC - When a request lands on a Front Door environment one of the first things that Front Door does is determine which particular routing rule to match the request to and then take the defined action in the configuration. It uses the below logic.

  Look for any routing rule with an exact match on the Path.

  If no exact match Paths, look for routing rules with a wildcard Path that matches.

  If no routing rules are found with a matching Path, then reject the request and return a 400: Bad Request error HTTP response.

  The path defined in RuleC is not an exact match, but it matches with wildcard path.

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-route-matching

  Wrong Answers:

  RuleA The path defined in the RuleA is not a match with incoming request.

  RuleB The path defined in the RuleA is not a match with incoming request.

  RuleD The path defined in the RuleA is not a match with incoming request.

• Question 417:

  HOTSPOT

  You need to implement name resolution for the cloud.liwareinc.com. The solution must meet the networking requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  References:

  https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

• Question 418:

  You have an Azure subscription that contains an Azure Front Door named FD1.

  You plan to deploy an app named App1 by using Azure App Service. Users will access App1 by using

  FD1.

  You need to provide FD1 with access to App1. The solution must meet the following requirements:

  1. Ensure that users can only access App1 by using FD1.

  2. Ensure that users cannot access App1 directly from the internet.

  What should you create for App1?

  A. an access restriction
  B. a private endpoint
  C. a subnet delegation
  D. a service endpoint
  A. an access restriction

  ---

  Explanation

  Create a Rule pointing to Azure Front Door

  https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure-front-door-to-azure-app-service-as/ba-p/2000173

• Question 419:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the Virtual networks exhibit.

  

  You create an Azure DNS Private Resolver as shown in the DNS private resolvers exhibit.

  

  DNS-resolver-inbound-endpoint-1 is configured as shown in the Inbound endpoints exhibit.

  

  DNS-resolver-rule-1 is configured as shown in the Rules exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No No - VNet1 can be linked to DNS-resolver-ruleset-1.

  Vnet1 is in RG1 in East US. The DNS private resolver is in RG1 in West Europe in Vnet3, and has DNS-resolver-ruleset-1.

  Note: A DNS resolver can only reference a virtual network in the same region as the DNS resolver.

  Box 2: Yes Yes - VNet2 must be configured to use 10.3.1.4 as the preferred DNS server.

  Vnet1 is in RG1 in East US. Vnet2 is in RG1 in East US. Endpoint DNS-resolver-inbound-endpoint-1 has

  IP address 10.3.1.4.

  Note: When you create an Azure DNS Private Resolver inside a virtual network, one or more inbound endpoints are established that can be used as the destination for DNS queries.

  Box 3: Yes Yes - Virtual machines connected to VNet3 can resolve names in the MargiesTravel.com domain.

  DNS-resolver-.ruleset-1 has Domain name MargiesTravel.com, is configured with a Destination IP:Port, and the rule is enabled.

  Note: The resolver's outbound endpoint processes DNS queries based on a DNS forwarding ruleset that you configure. DNS queries that are initiated in networks linked to a ruleset can be sent to other DNS servers.

  References:

  https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview

• Question 420:

  You have a website that uses an FQDN of www.contoso.com. The DNS record for www.contoso.com resolves to an on-premises web server.

  You plan to migrate the website to an Azure web app named Web1. The website on Web1 will be published by using an Azure Front Door instance named ContosoFD1.

  You build the website on Web1.

  You plan to configure ContosoFD1 to publish the website for testing.

  When you attempt to configure a custom domain for www.contoso.com on ContosoFD1, you receive the error message shown in the exhibit. (Click the Exhibit tab.)

  You need to test the website and ContosoFD1 without affecting user access to the on-premises web server.

  

  Which record should you create in the contoso.com DNS domain?

  A. a CNAME record that maps afdverify.www.contoso.com to ContosoFD1.azurefd.net
  B. a CNAME record that maps www.contoso.com to ContosoFD1.azurefd.net
  C. a CNAME record that maps afdverify.www.contoso.com to afdverify.ContosoFD1.azurefd.net
  D. a CNAME record that maps www.contoso.com to Web1.contoso.com
  C. a CNAME record that maps afdverify.www.contoso.com to afdverify.ContosoFD1.azurefd.net

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain#map-the-temporary-afdverify-subdomain