Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 421:

  DRAG DROP

  You need to prepare Vnet1 for the deployment of an ExpressRoute gateway. The solution must meet the hybrid connectivity requirements and the business requirements.

  Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  1. Delete VPN GW1.

  2. Set the subnet mask of Gateway Subnet to /27.

  3. Create a VPN gateway by using the VPN GW1 SKU.

  https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal

  "To configure coexisting connections for an already existing VNet: 1- Delete the existing ExpressRoute or Site-to-site VPN gateway. 2 - Delete and recreate the GatewaySubnet to have prefix of /27 or shorter. 3- Configure a VNet with a Site-to-Site connection and then Configure the ExpressRoute gateway. 4 - Once the ExpressRoute gateway is deployed, you can link the virtual network to the ExpressRoute circuit."

• Question 422:

  Your company has four branch offices and an Azure subscription. The subscription contains an Azure VPN gateway named GW1.

  The branch offices are configured as shown in the following table.

  

  The branch office routers provide internet connectivity and Site-to-Site VPN connections to GW1.

  The users in Branch1 report that they can connect to internet resources, but cannot access Azure resources.

  You need to ensure that the Branch1 users can connect to the Azure resources. The solution must meet the following requirements:

  1. Minimize downtime for all users.

  2. Minimize administrative effort.

  What should you do first?

  A. Recreate LNG1.
  B. Reset RTR1.
  C. Reset Connection1.
  D. Reset GW1.
  C. Reset Connection1.

  ---

  Explanation

  Azure VPN gateway Site-to-Site VPN connections local network gateway Resetting an Azure VPN gateway or gateway connection is helpful if you lose cross-premises VPN connectivity on one or more site-to-site VPN tunnels. In this situation, your on-premises VPN devices are all working correctly, but aren't able to establish IPsec tunnels with the Azure VPN gateways.

  Connection reset

  When you select to reset a connection, the gateway doesn't reboot. Only the selected connection is reset and restored.

  Incorrect:

  Not D: Resetting GW1 would affect all VPN connections.

  Gateway reset

  A VPN gateway is composed of two VM instances running in an active-standby configuration. When you reset the gateway, it reboots the gateway, and then reapplies the cross-premises configurations to it.

  References:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/reset-gateway

• Question 423:

  HOTSPOT

  You have an on-premises server named Server1 that runs Windows Server and has the DNS Server role installed.

  You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. VNet1 contains an Azure Firewall instance named FW1. VNet1 peers with VNet2.

  The on-premises network is connected to VNet1 by using ExpressRoute. The on-premises network is inaccessible from VNet2.

  You need to ensure that virtual machines connected to VNet2 use Server1 to perform name resolution.

  The solution must minimize administrative effort.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  Box 1: A custom DNS server On VNet1, configure:

  Hybrid DNS resolution.

  This article provides guidance on how to configure hybrid DNS resolution by using an Azure DNS Private Resolver with a DNS forwarding ruleset. In this scenario, your Azure DNS resources are connected to an on-premises network using a VPN or ExpressRoute connection.

  Azure DNS Private Resolver The Azure DNS Private Resolver is a service that can resolve on-premises DNS queries for Azure DNS private zones. Previously, it was necessary to deploy a VM-based custom DNS resolver, or use non-Microsoft DNS, DHCP, and IPAM (DDI) solutions to perform this function.

  Box 2: The private IP address of FW1 On VNET2, set DNS to: Gateways and on-premises connectivity Each virtual network, including a peered virtual network, can have its own gateway. A virtual network can use its gateway to connect to an on-premises network. You can also configure virtual network-to-virtual network connections by using gateways, even for peered virtual networks. When you configure both options for virtual network interconnectivity, the traffic between the virtual networks flows through the peering configuration. The traffic uses the Azure backbone.

  You can also configure the gateway in the peered virtual network as a transit point to an on-premises network. In this case, the virtual network that is using a remote gateway can't have its own gateway. A virtual network could have only one gateway, the gateway should be either local or remote gateway in the peered virtual network as shown in the following diagram:

  References:

  https://learn.microsoft.com/en-us/azure/dns/private-resolver-hybrid-dns

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

• Question 424:

  You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.

  Hub1 has a security status of Unsecured.

  You need to ensure that the security status of Hub1 is marked as Secured.

  Solution: You implement an Azure Front Door profile.

  Does this meet the requirement?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Correct Solution: You implement Azure Firewall.

  What is a secured virtual hub?

  A virtual hub is a Microsoft-managed virtual network that enables connectivity from other resources. When a virtual hub is created from a Virtual WAN in the Azure portal, a virtual hub VNet and gateways (optional) are created as its components.

  A secured virtual hub is an Azure Virtual WAN Hub with associated security and routing policies configured by Azure Firewall Manager.

  Create a secured virtual hub Using Firewall Manager in the Azure portal, you can either create a new secured virtual hub, or convert an existing virtual hub that you previously created using Azure Virtual WAN.

  References:

  https://learn.microsoft.com/en-us/azure/firewall-manager/secured-virtual-hub

• Question 425:

  HOTSPOT

  You have an Azure subscription. The subscription contains 500 virtual machines that run either Windows 11 or Linux.

  You need to identify which Linux virtual machines are accessible from the internet. The solution must minimize administrative effort.

  What should you use, and what should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 426:

  You need to ensure that the URL is accessible through the application gateway.

  To achieve the requirement, you disable the WAF rule that has a ruleId 920300.

  Did you achieve the requirement?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  This will disable the WAF rule that is generating the error.

• Question 427:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to ensure that traffic to host.fabrikam.com is directed to the Traffic Manager profile.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  Manage an Azure Traffic Manager profile

  Traffic Manager profiles use traffic-routing methods to control the distribution of traffic to your cloud services or website endpoints Add Traffic Manager endpoint Step 1: In the portal's search bar, search for the Traffic Manager. Select the profile in the results that are displayed Step 2: In Traffic Manager profile, in the Settings section, select Endpoints > Add.

  Step 3: Enter or select the following information. Accept the defaults for the other settings, and then select OK

  Setting Value Type: Enter the Azure endpoint

  Name: Enter myEndpoint Target resource type: Select Host name.

  Targetresource:host.fabrikam.com

  WeightEnter100.

  Step 4: When the addition of the endpoints is complete, it is displayed in the Traffic Manager profile along with its monitoring status as Online

  References:

  https:/learn.microsoft.com/en-us/azure/traffic-manager/tutorial-traffic-manager-weighted-endpoint-routing

• Question 428:

  You have the Azure virtual networks shown in the following table.

  

  You have the Azure resources shown in the following table.

  

  You need to check latency between the resources by using connection monitors in Azure Network Watcher.

  What is the minimum number of connection monitors that you must create?

  A. 1
  B. 2
  C. 3
  D. 4
  E. 5
  B. 2

  ---

  Explanation

  As per MS guidelines

  *Region: Select a region for your connection monitor. You can select only the source VMs that are created in this region. Here you see only VMs or Virtual Machine Scale Sets that are bound to the region that you specified when you created the connection monitor. By default, VMs and Virtual Machine Scale Sets are grouped into the subscription that they belong to * Destination can be anywhere as per this

  Destinations: You can monitor connectivity to an Azure VM, an on-premises machine, or any endpoint (a public IP, URL, or FQDN) by specifying it as a destination. In a single test group, you can add Azure VMs, on-premises machines, Office 365 URLs, Dynamics 365 URLs, and custom endpoints.

  https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-create-using-portal

• Question 429:

  HOTSPOT

  You have an Azure subscription. The subscription contains multiple Azure SQL Database resources and a virtual network named VNet1 that has five subnets. All the subnets are associated with a network security group (NSG) named NSG1. NSG1 blocks all outbound traffic, unless specifically allowed by a rule.

  Each subnet contains 50 virtual machines. Multiple virtual machines host instances of SQL Server on Virtual Machines and will be configured to replicate with the Azure SQL Database resources.

  You need to configure a new outbound rule in NSG1 to allow the SQL Server on Virtual Machines instances to connect to the Azure SQL Database resources. The solution must meet the following requirements:

  1. Minimize modifications to NSG1 when additional instances of SQL Server on Virtual Machines are deployed.

  2. Ensure that only SQL Server on Virtual Machines instances can connect to the Azure SQL Database resources.

  How should you configure each setting for the new outbound rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 430:

  You need to identify a security rule that prevents a network packet from reaching an Azure virtual machine.

  What should you use?

  A. IP flow verify
  B. Next hop
  C. Packet capture
  D. Security group view
  E. Traffic Analytics
  A. IP flow verify

  ---

  Explanation

  Correct Answer(s):

  IP flow verify - The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and informs you if the connection succeeds or fails.

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

  Wrong Answers:

  Next hop -- Next hop helps you determine if traffic is being directed to the intended destination, or whether the traffic is being sent nowhere.

  Packet capture --Packet capture allows you to create packet capture sessions to track traffic to and from a virtual machine.

  Security group view --Using Effective security rules view, you can assess a VM for network vulnerabilities such as open ports.

  Traffic Analytics It provides visibility into user and application activity in cloud networks.