Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 51:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to ensure that all hosts deployed to subnet3-2 connect to the internet by using the same static public IP address. The solution must minimize administrative effort when adding hosts to the subnet.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  NAT gateway provides outbound internet connectivity for one or more subnets of a virtual network. Once NAT gateway is associated to a subnet, NAT provides source network address translation (SNAT) for that subnet. NAT gateway specifies which static IP addresses virtual machines use when creating outbound flows.

  Plan:

  Stage 1: Create a NAT gateway Stage 2: Edit subnet subnet3-2 and link it to the NAT gateway

  Stage 1: Create a NAT gateway Step 1: Sign in to the Azure portal.

  Step 2: In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  Step 3: Select + Create.

  Step 4: In Create network address translation (NAT) gateway, enter or select this information in the Basics tab:

  * NAT gateway name: Enter myNATgateway

  Step 5: Select the Outbound IP tab, or select the Next: Outbound IP button at the bottom of the page.

  Step 6: In the Outbound IP tab, enter or select the following information: Public IP addresses - Select Create a new public IP address.

  In Name, enter myPublicIP.

  Select OK.

  Step 7: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 8: Select Create.

  Stage 2: Edit subnet subnet3-2 and link it to the NAT gateway Change subnet settings

  Step 1: Go to the Azure portal to view your virtual networks. Search for and select Virtual networks.

  Step 2: Select the name of the virtual network containing the subnet you want to change.

  Step 3: From Settings, select Subnets.

  Step 4: In the list of subnets, select the subnet you want to change settings for. Here choose subnet3-2 connect.

  Step 5: In the subnet page, change the NAT Gateway to myNATgateway (the one we created in Stage 1).

  Step 6: Select Save.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource

  https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/quickstart-create-nat-gateway-portal

• Question 52:

  You have an on-premises datacenter in Seattle.

  You have an Azure subscription that contains an Azure Network Watcher resource in the West US 2 Azure region.

  You need to document network latency between the on-premises datacenter and the West US 2 region and between the on-premises datacenter and the East US 2 public Azure region. The solution must minimize administrative effort.

  What should you do first?

  A. Run the Get-AzNetworkWatcherConnectionMonitor cmdlet.
  B. Run the Get-AzNetworkWatcherReachabilityProvidersList cmdlet.
  C. Create a Network Watcher resource in the East US 2 region.
  D. Create a Connection Monitor resource in the West US 2 region.
  B. Run the Get-AzNetworkWatcherReachabilityProvidersList cmdlet.

• Question 53:

  HOTSPOT

  You need to meet the network security requirements for the NSG flow logs.

  Which type of resource do you need, and how many instances should you create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: A storage account Network security group (NSG) flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG. Flow data is sent to Azure Storage accounts from where you can access it as well as export it to any visualization tool, SIEM, or IDS of your choice.

  NSG flow logging considerations

  Storage account considerations:

  Location: The storage account used must be in the same region as the NSG.

  Note:

  Network Security Requirements

  Contoso network security requirements include:

  Enable NSG flow logs for NSG3 and NSG4.

  The NSGs are associated to the network interfaces on the virtual machines. Each NSG has one custom security rule that allows RDP connections from the internet. The firewall on each virtual machine allows ICMP traffic.

  NSG3 is related to VM3. VM3 is located in Central US.

  NSG4 is related to VM4. VM4 is located in Central US.

  Box 2: 1

  One storage account is enough.

  References:

  https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

• Question 54:

  Which three actions should you perform in sequence from the below list of actions?

  1. Create a health probe

  2. Create a public load balancer in the Standard SKU

  3. Create a public load balancer in the Basic SKU

  4. Create a backend pool that contains VMScaleSet1

  5. Create a NAT rule

  6. Create an outbound rule

  A. 1,4,6
  B. 3,4,5
  C. 3,4,6
  D. 2,4,6
  E. 2,4,5
  D. 2,4,6

  ---

  Explanation

  Only standard SKU load balancer supports outbound connections.

  The backend pool must be VMScaleSet1 since the requirement is to implement outbound connectivity for VMScaleSet1.

  Outbound rules allow you to explicitly define SNAT(source network address translation) for a public standard load balancer.

  https://docs.microsoft.com/en-us/azure/load-balancer/skus

  https://docs.microsoft.com/en-us/azure/load-balancer/outbound-rules

• Question 55:

  DRAG DROP

  You have an on-premises network.

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway.

  You need to connect VNet1 to the on-premises network by using an ExpressRoute circuit.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 56:

  Your on-premises network contains a DNS server named Server1.

  You have an Azure subscription that contains the resources shown in the following table.

  

  The on-premises network is connected to VNet1 by using a Site-to-Site (S2S) VPN.

  You need to ensure that Server1 can resolve the DNS name of storage1. The solution must minimize costs and administrative effort.

  What should you use?

  A. Azure DNS Private Resolver
  B. an Azure public DNS zone
  C. an Azure Private DNS zone
  D. an Azure virtual machine that hosts a DNS service
  A. Azure DNS Private Resolver

  ---

  Explanation

  Azure DNS Private Resolver is a new service that enables you to query Azure DNS private zones from an on-premises environment and vice versa without deploying VM based DNS servers.

  https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview

• Question 57:

  HOTSPOT

  You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named Tenant1.

  Sub1 contains an Azure VPN gateway named VNetGW1.

  You manually register the Azure VPN Client in Tenant1.

  You need to configure VNetGW1 to support the Microsoft Entra authentication of Point-to-Site (P2S) VPN connections. The solution must ensure that users can establish P2S VPN connections by using the Azure

  VPN Client.

  To what should you set Tenant and Issuer in the Point-to-site configuration settings of VNetGW1?

  To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 58:

  You are planning the IP addressing for the subnets in Azure virtual networks.

  Which type of resource requires IP addresses in the subnets?

  A. Azure DDoS Protection for virtual networks
  B. virtual network peering
  C. internal load balancers
  D. service endpoints
  C. internal load balancers

  ---

  Explanation

  During the creation of the load balancer, you'll configure:

  1. Frontend IP address

  2. Backend pool

  3. Inbound load-balancing rules

  When you create an internal load balancer, a virtual network is configured as the network for the load balancer.

  A private IP address in the virtual network is configured as the frontend for the load balancer. The frontend IP address can be Static or Dynamic.

  Incorrect:

  * service endpoints

  A service endpoint is created in a virtual subnet, but there is no IP address defined for the Service endpoint.

  Service endpoints are a way for Azure DevOps to connect to external systems or services. They're a bundle of properties securely stored by Azure DevOps, which includes but isn't limited to the following properties:

  Service name

  Description

  Server URL

  Certificates or tokens

  User names and passwords

  * service endpoint policies

  Service Endpoint Policy object, example.

  "serviceEndpointPolicyDefinitions": [

  {

  "description": null,

  "name": "MySEP-Definition",

  "resourceGroup": "MySEPDeployment",

  "service": "Microsoft.Storage",

  "serviceResources": [

  "/subscriptions/subscriptionID/resourceGroups/MySEPDeployment/providers/Microsoft.Storage/

  storageAccounts/mystgacc"

  ], "type": "Microsoft.Network/serviceEndpointPolicies/serviceEndpointPolicyDefinitions"

  }

  ]

  References:

  https://learn.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-internal-portal

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview

• Question 59:

  HOTSPOT

  You have two on-premises networks named Network1 and Network2. Network1 is assigned an IP address space of 10.0.0.0/23. Network2 is assigned an IP address space of 10.10.0.0/24. Each on-premises network contains a policy-based VPN device.

  You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. VNet1 is assigned an IP address space of 192.168.0.0/22. VNet2 is assigned an IP address space of 172.16.0.0/24.

  VNet1 peers with VNet2.

  You need to configure connectivity to meet the following requirements:

  1. Ensure that packets from Network1 can be routed to VNet1 and VNet2.

  2. Ensure that packets from Network2 can be routed to VNet1 and VNet2.

  3. Minimize administrative effort.

  4. Minimize costs.

  What is the minimum number of Azure VPN gateways and traffic selectors you should deploy? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  To minimize costs and administrative effort while meeting your requirements, you should deploy the following:

  1 Route-based Gateway (deployed in one VNet with gateway transit enabled). 4 Traffic Selectors (one for each combination of the two on-premises and two Azure address prefixes).

  Box 1: 1 VPN gateways

  Number of route-based Azure VPN gateways: 1 Since your two Azure Virtual Networks (VNets) are peered, you can use gateway transit. Deploy a single route-based VPN gateway in one VNet (the "hub") and configure the peering to allow the other VNet (the "spoke") to use this gateway. Modern route-based Azure VPN gateways (excluding the Basic SKU) support multiple site-to-site connections and can interact with multiple on-premises policy-based devices.

  Box 2: 4 Traffic selectors

  Number of traffic selectors: 4 When connecting a route-based Azure gateway to a policy-based on-premises device, you must enable PolicyBasedTrafficSelectors on the connection. Policy-based devices require specific "traffic selectors" (SA pairs) for every combination of local and remote address prefixes.

  You have two on-premises address spaces (10.0.0.0/23 and 10.10.0.0/24) and two Azure address spaces (192.168.0.0/22 and 172.16.0.0/24). To allow both on-premises networks to communicate with both Azure VNets, the gateway must maintain: On-prem 1 <->Azure VNet1

  On-prem 1 <->Azure VNet2

  On-prem 2 <->Azure VNet1

  On-prem 2 <->Azure VNet2

• Question 60:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following resources:

  1. A virtual network named Vnet1

  2. A subnet named Subnet1 in Vnet1

  3. A virtual machine named VM1 that connects to Subnet1

  4. Three storage accounts named storage1, storage2, and storage3

  You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

  Solution: You create a network security group (NSG) and associate the NSG to Subnet1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No