Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 441:

  You have an on-premises DNS server named Server1 that hosts a primary DNS zone named fabrikam.com.

  You have an Azure subscription that contains the resources shown in the following table.

  

  Users on the on-premises network access resources on all the virtual networks by using a Site-to-Site (S2S) VPN. You need to deploy an Azure DNS Private Resolver solution that meets the following requirements:

  1. Resources connected to the virtual networks must be able to resolve DNS names for fabrikam.com.

  2. Server1 must be able to resolve the DNS names of the resources in contoso.com.

  3. The solution must minimize costs and administrative effort.

  What is the minimum number of resolvers you should deploy?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

• Question 442:

  HOTSPOT

  You have an Azure subscription that contains an app named App1. App1 is deployed to the Azure App Service apps shown in the following table.

  

  You need to publish App1 by using Azure Front Door. The solution must ensure that all the requests to App1 are load balanced between all the available worker instances.

  What is the minimum number of origin groups and origins that you should configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: 1

  How many origins and origin groups should I create?

  An origin group represents a set of origins that are functionally able to serve the same kinds of requests.

  You should use a separate origin group for each distinct application or workload.

  For example, suppose you host an application on Azure App Service. The way that you configure Front Door depends on how many application instances you deploy:

  * Multi-region active/passive deployment: Create a single origin group. Within that origin group, create an origin for each of the App Service apps. Configure each origin's priority to ensure that the primary application has a higher priority than the secondary application.

  * Multi-region active/active deployment: Create a single origin group. Within that origin group, create an origin for each of the App Service apps. Configure each origin's priority to be the same. Configure each origin's weight to set the proportion of requests that should go to that origin.

  * Single-region deployment: Create a single origin group.

  Box 2: 8

  Within an origin group, create an origin for each distinct server or service instance that can serve requests.

  Note:

  Origin

  An origin refers to the application deployment that Azure Front Door retrieves contents from when caching isn't enabled or when a cache gets missed. Azure Front Door supports origins hosted in Azure and applications hosted in your on-premises datacenter or with another cloud provider. An origin shouldn't be confused with your database tier or storage tier. The origin should be viewed as the endpoint for your application backend.

  Origin group

  An origin group in Azure Front Door refers to a set of origins that receives similar traffic for their application. You can define the origin group as a logical grouping of your application instances across the world that receives the same traffic and responds with an expected behavior. These origins can be deployed across different regions or within the same region. All origins can be deployed in an Active/Active or Active/Passive configuration.

  An origin group defines how origins get evaluated by health probes. It also defines the load balancing method between them.

  References:

  https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq

  https://learn.microsoft.com/en-us/azure/frontdoor/origin

• Question 443:

  You have an Azure virtual network named Vnet1.

  You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be prevented from accessing any Azure Storage resources.

  Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a deny rule that has a source of VirtualNetwork and a destination of Sql
  B. an allow rule that has the IP address range of Vnet1 as the source and destination of Sql.EastUS
  C. a deny rule that has a source of VirtualNetwork and a destination of 168.63.129.0/24
  D. a deny rule that has the IP address range of Vnet1 as the source and destination of Storage
  B. an allow rule that has the IP address range of Vnet1 as the source and destination of Sql.EastUS
  D. a deny rule that has the IP address range of Vnet1 as the source and destination of Storage

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview

• Question 444:

  HOTSPOT

  You have an Azure subscription that contains the resource groups shown in the following table.

  

  You have the virtual networks shown in the following table.

  

  Vnet1 contains two virtual machines named VM1 and VM2. Vnet2 contains two virtual machines named

  VM3 and VM4.

  You have the network security groups (NSGs) shown in the following table that include only default rules.

  

  You have the Azure load balancers shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  VM2 is in Vnet1.

  Vnet1 is located in East US.

  Vnet1 has the two subnets Sb1 and Sb2, both in RG1.

  Lb2 is in West US and has the Backend pool in Vnet2.

  Note: The backend resources must be in the same virtual network as the load balancer for IP based LBs

  Box 2: Yes

  VM4 and VM3 are both in Vnet2.

  Lb2 is also in Vnet2. Lb2 is an internal load balancer. VM3 is in the backend pool of Lb2. Rule is TCP port 1433, backend port 1433.

  Note: Public Load Balancers are used to load balance internet traffic to your VMs. An internal (or private) load balancer is used where private IPs are needed at the frontend only. Internal load balancers are used to load balance traffic inside a virtual network.

  Box 3: Yes

  VM1 is in the backend pool of Lb1. Lb1 is a public load balancer.

  Rule is TCP port 80, backend port 80.

  Note: A public load balancer can provide outbound connections for virtual machines (VMs) inside your virtual network. These connections are accomplished by translating their private IP addresses to public IP addresses. Public Load Balancers are used to load balance internet traffic to your VMs.

  References:

  https://learn.microsoft.com/en-us/azure/load-balancer/backend-pool-management

  https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

• Question 445:

  You have a hub-and-spoke topology. The topology includes multiple on-premises locations that connect to a hub virtual network in Azure via ExpressRoute circuits.

  You have an Azure Application Gateway named GW1 that provides a single point of ingress from the internet.

  You plan to migrate the hub-and-spoke topology to Azure Virtual WAN.

  You need to identify which changes must be applied to the existing topology. The solution must ensure that you maintain a single point of ingress from the internet.

  Which three changes should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add user-defined routes.
  B. Add virtual network peerings.
  C. Replace the user-defined routes used by the current topology.
  D. Create virtual network connections.
  E. Remove the existing virtual network peerings.
  F. Redeploy GW1.
  C. Replace the user-defined routes used by the current topology.
  D. Create virtual network connections.
  E. Remove the existing virtual network peerings.

  ---

  Explanation

  Transition connectivity to virtual WAN hub: Step 1. (E) Delete the existing peering connections from Spoke virtual networks to the old customer-managed hub. Access to applications in spoke virtual networks is unavailable until steps 1-3 are complete.

  Step 2. (D) Connect the spoke virtual networks to the Virtual WAN hub via VNet connections.

  Step 3. (C) Remove any user-defined routes (UDR) previously used within spoke virtual networks for spoke-to-spoke communications. This path is now enabled by dynamic routing available within the Virtual

  WAN hub.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology

• Question 446:

  DRAG DROP

  You have the resources shown in the following table.

  

  From the Microsoft Entra admin center, you register the Azure VPN application as an enterprise application.

  You need to enable Microsoft Entra authentication for the P2S VPN connections. The solution must meet

  the following requirements;

  1. Ensure that only the members of Group1 can establish VPN connections to VPNGW1.

  2. Ensure that only the members of Group2 can establish VPN connections to VPNGW2.

  In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 447:

  You have deployed multiple websites in Internet Information Server (IIS) by using Azure virtual machine scale sets (VMSS).

  User sessions must be routed to the same server by using cookie-based session affinity. The below image depicts the network traffic flow for the websites to the VMSS.

  

  What should you configure to make sure web traffic arrives at the appropriate server in the VMSS?

  A. Routing rules and backend listeners
  B. CNAME and A records
  C. Routing method and DNS time to live (TTL)
  D. Path-based redirection and websockets
  A. Routing rules and backend listeners

  ---

  Explanation

  Correct Answer(s):

  Routing rules and backend listeners - You can configure the hosting of multiple web sites when you create an application gateway. You need to define backend address pools using virtual machines. You then configure listeners and rules based on domains that you own to make sure web traffic arrives at the appropriate servers in the pools.

  https://docs.microsoft.com/bs-latn-ba/azure//application-gateway/create-multiple-sites-portal

  Wrong Answers:

  CNAME and A records - These are used for domain registrations.

  Routing method and DNS time to live (TTL) - DNS TTL (time to live) is a setting that tells the DNS resolver how long to cache a query before requesting a new one. This is nothing to do with routing.

  Path-based redirection and websockets - Path Based Routing allows you to route traffic to back-end server pools based on URL Paths of the request.

• Question 448:

  HOTSPOT

  You have an Azure subscription that contains a virtual network gateway named VNetGwy1. VNetGwy1 has a public IP address of 20.25.32.214.

  You need to query the health probe of VNetGwy1,

  How should you complete the URI? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect#step-7-verify-the-azure-gateway-health-probe

• Question 449:

  You have an on-premises datacenter and an Azure subscription.

  You plan to implement ExpressRoute FastPath.

  You need to create an ExpressRoute gateway. The solution must minimize downtime if a single Azure datacenter fails.

  Which SKU should you use?

  A. ErGw1AZ
  B. High performance
  C. Ultra performance
  D. ErGw3AZ
  E. ErGw2AZ
  D. ErGw3AZ

  ---

  Explanation

  ErGw3Az and Ultra Performance SKU supports FastPath.

  ErGw3Az is Zone-redundant, but not Ultra Performance SKU.

• Question 450:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  You have a virtual machine named VM5 that has the following IP address configurations:

  1. IP address:10.4.0.5

  2. Subnet mask:255.255.255.0

  3. Default gateway: 10.4.0.1

  4. DNS server: 168.63.129.16

  You have an Azure Private DNS zone named fabrikam.com that contains the records shown in the following table.

  

  The virtual network links in the fabrikam.com DNS zone are configured as shown in the exhibit. (Click the Exhibit tab.)

  

  VMS fails to resolve the IP address for app1.fabrikam.com.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  VM5 is in VNET3 and VNET3 isn't linked to the fabrikam.com private DNS zone. This means it won't be able to resolve anything in that private DNZ zone until it is linked.