Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 41:

  You have an Azure application gateway named AppGW1 that balances requests to a web app named App1.

  You need to modify the server variables in the response header of App1.

  What should you configure on AppGW1?

  A. HTTP settings
  B. rewrites
  C. rules
  D. listeners
  B. rewrites

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url

• Question 42:

  DRAG DROP

  Your on-premises network contains two subnets named Subnet1 and Subnet2. Subnet2 contains a Hyper- V host that contains two virtual machines named VM1 and VM2. VM1 and VM2 are connected to Subnet2.

  You have an Azure virtual network named VNet1 that contains GatewaySubnet and a subnet named VSubnet1. VNet1 is connected to the on-premises network by using a Site-to-Site (S2S) VPN connection.

  You plan to migrate VM1 to VNet1 and maintain the existing IP address of VM1. VM2 will remain on Subnet2.

  You need to prepare the environment to ensure that VM1 can communicate with VM2 once the migration is complete.

  Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.'

  Select and Place:

  

  

• Question 43:

  You have Azure virtual machines in three Azure regions.

  Each virtual machine has a public IP address assigned to its network interface. An application named App1 is installed in each virtual machine.

  You plan to implement Azure Front Door-based load balancing across all the virtual machines.

  You need to ensure that App1 on the virtual machines will only accept traffic routed from Azure Front Door.

  What should you implement?

  A. Azure Private Link
  B. Service endpoints
  C. Network security groups (NSGs) with service tags
  D. Network security groups (NSGs) with application security groups
  C. Network security groups (NSGs) with service tags

  ---

  Explanation

  Correct Answer(s):

  Network security groups (NSGs) with service tags - To lock down your application to accept traffic only from your specific Front Door, you will need to set up IP ACLs for your backend and then restrict the traffic on your backend to the specific value of the header 'X-Azure-FDID' sent by Front Door. These steps are detailed out as below:

  Configure IP ACLing for your backends to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only.

  The above step basically means configure NSGs with service tags.

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-faq

  Wrong Answers:

  Azure Private Link - Azure Private Link enables you to access Azure PaaS Services over a private endpoint in your virtual network.

  Service endpoints - Service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. It does not restrict traffic.

  Network security groups (NSGs) with application security groups - ASG's allow you to group virtual machines and define network security policies based on those groups. You must also use service tag AzureFrontDoor.Backend in the network security groupsto restrict the traffic.

• Question 44:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to restrict access to storage1 and sql1 by using service endpoints. The solution must meet the following requirements:

  1. Allow access from Subnet1 to SQLDB1.

  2. Implement service endpoint policies to restrict access to supported resources.

  3. Allow access from Subnet1 to storage1 and the read-only replica of storage1 in the paired Azure region.

  What is the minimum number of service endpoints and service endpoint policies you should create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 45:

  You have an Azure environment as shown below.

  

  You need to find to which environments/virtual machines that VM2 can communicate?

  A. VM1 Only
  B. VM1 and VM3 Only
  C. The on-premise datacenter and VM1 only
  D. The on-premise datacenter, VM1 and VM3 only
  D. The on-premise datacenter, VM1 and VM3 only

  ---

  Explanation

  VM2 is in VNET2. VNET2 is peered with VNET1. So, VM2 can connect to VM1.

  VM2 is in VNET2. VNET2 is peered with VNET1 with gateway transit enabled. So, VM2 can connect to on-premises datacenter.

  VM2 is in VNET2. VNET2 is peered with VNET3. So, VM2 can connect to VM3.

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit?toc=/azure/virtual-network/toc.json

• Question 46:

  You fail to establish a Site-to-Site VPN connection between your company's main office and an Azure virtual network.

  You need to troubleshoot what prevents you from establishing the IPsec tunnel.

  Which diagnostic log should you review?

  A. IKEDiagnosticLog
  B. RouteDiagnosticLog
  C. GatewayDiagnosticLog
  D. TunnelDiagnosticLog
  A. IKEDiagnosticLog

  ---

  Explanation

  IKEDiagnosticLog = The IKEDiagnosticLog table offers verbose debug logging for IKE/IPsec. This is very useful to review when troubleshooting disconnections, or failure to connect VPN scenarios.

  GatewayDiagnosticLog = Configuration changes are audited in the GatewayDiagnosticLog table.

  TunnelDiagnosticLog = The TunnelDiagnosticLog table is very useful to inspect the historical connectivity statuses of the tunnel.

  RouteDiagnosticLog = The RouteDiagnosticLog table traces the activity for statically modified routes or routes received via BGP.

  P2SDiagnosticLog = The last available table for VPN diagnostics is P2SDiagnosticLog. This table traces the activity for Point to Site.

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

• Question 47:

  HOTSPOT

  You have an on-premises datacenter.

  You have an Azure subscription that contains 10 virtual machines and a virtual network named VNet1 in the East US Azure region. The virtual machines are connected to VNet1 and replicate across three availability zones.

  You need to connect the datacenter to VNet1 by using ExpressRoute. The solution must meet the following requirements:

  1. Maintain connectivity to the virtual machines if two availability zones fail.

  2. Support 1000-Mbps connections.

  3. Minimize costs.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1.

  https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview;

  2.

  https://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway3.

  https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways#gwsku

  When deploying an ErGw1AZ, it is possible to define its zone availability as "Zone-Redundant", in addition it is also essential that the ip used by the ER Gateway be "Standard", because at the time of provisioning this ip will become redundant between the availability zones . Regarding the ER Circuit, it can be "Local", but in this scenario it would be unlimited and more expensive than the "Standard" Limited in 1Gbps. In my opinion the best answer would be:

  1. One ExpressRoute Standard circuit

  2. One ExpressRoute gateway of the ErGw1AZ SKU

• Question 48:

  You need to ensure that the URL is accessible through the application gateway.

  To achieve the requirement, you add a rewrite rule for the host header.

  Did you achieve the requirement?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Rewrites are not supported when the application gateway is configured to redirect the requests.

• Question 49:

  HOTSPOT

  You have 50 on-premises networks. Each network contains a server that runs Windows Server.

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a database server named DB1.

  You plan to deploy an app named App1 that will be hosted on the on-premises servers and will connect to DB1 by using Azure Network Adapter.

  What should you use to support the Azure Network Adapter connections to VNet1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure VPN Gateway For inbound connections to the subscription.

  Windows Server, Use Azure Network Adapter to connect a server to an Azure Virtual Network

  Windows Admin Center and Azure Network Adapter provide a one-click experience to connect the server with your virtual network using a Point-to-Site VPN connection. The process automates configuring the virtual network gateway and the on-premises VPN client.

  If there is no existing Azure Virtual Network gateway, Windows Admin Center creates one for you. The setup process can take up to 25 minutes. After the Azure Network Adapter is created, you can start to access VMs in the virtual network directly from your server.

  Note: A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer.

  Box 2: Point-to-Site VPN For the connections beetween the on-premises servers and VNet1:

  Note: A lot of workloads running on-premises and in multi-cloud environments require connections to virtual machines (VMs) running in Microsoft Azure. To connect a server to an Azure Virtual Network, you have several options, including Site-to-Site VPN, Azure Express Route, and Point-to-Site VPN.

  References:

  https://learn.microsoft.com/en-us/windows-server/manage/windows-admin-center/azure/use-azure-network-adapter

• Question 50:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that the virtual machines can access storage1, storage2, and DB1 by using service endpoints.

  What is the minimum number of service endpoints you should create?

  A. 2
  B. 3
  C. 4
  D. 12
  B. 3