Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 61:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You need to ensure that the storage12345678 storage account will only accept connections from the hosts on VNET1.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. Placeholder
  C. Placeholder
  D. Placeholder
  A. See explanation below.

  ---

  Explanation

  Azure storage account accepts connections from Virtual network.

  Use private endpoints for Azure Storage

  You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

  Link the private endpoint to the existing storage account Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

  Step 2: Select or Search&find storage account storage12345678

  Step 3: Select the Networking tab or select

  Next: Advanced then

  Next: Networking.

  Step 4: In the Networking tab, under Network connectivity select Disable public access and use private access.

  Step 5: In Private endpoint, select + Add private endpoint.

  Step 6: In the Basics tab of Create a private endpoint, enter or select basic information for the endpoint.

  Step 7:

  Select Next: Resource.

  Step 8: In the Resource pane, enter or select basic information for the resource.

  Step 9:

  Select Next: Virtual Network.

  Step 10: In Virtual Network, enter or select:

  * Virtual network: VNET1.

  Step 11:

  Select Next: DNS.

  Step 12: Leave the defaults in DNS. Select Next: Tags, then

  Next: Review + create.

  Step 13: Select Create.

  Back in the setting of settings of the Storage Account.

  Step 14: Save.

  References:

  https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal

  https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal

• Question 62:

  You have two Azure virtual networks named VNet1 and VNet2 that are peered with each other. VNet1 hosts 10 virtual machines that contain web servers. VNet2 hosts five virtual machines that contain database servers.

  You need to configure a security solution that meets the following requirements:

  1. Ensures that the database servers can accept connections only from the web servers

  2. Ensures that the web servers can initiate connections only to the database servers

  3. Ensures that all network security groups (NSGs) are associated only with subnets

  4. Use application security groups to implement the solution

  What is the minimum number of application security groups required?

  A. 1
  B. 2
  C. 4
  D. 8
  B. 2

• Question 63:

  HOTSPOT

  You have an Azure application gateway.

  You need to create a rewrite rule that will remove the origin port from the HTTP header of incoming requests that are being forwarded to the backend pool.

  How should you configure each setting? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  The X-Forwarded-For client request header field with the client_ip variable (see explanation later in this table) appended to it in the format IP1, IP2, IP3, and so on. If the X-Forwarded-For field isn't in the client request header, the add_x_forwarded_for_proxy variable is equal to the $client_ip variable. This variable is particularly useful when you want to rewrite the X-Forwarded-For header set by Application Gateway so that the header contains only the IP address without the port information.

  https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url

• Question 64:

  You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.

  Hub1 has a security status of Unsecured.

  You need to ensure that the security status of Hub1 is marked as Secured.

  Solution: You implement Azure NAT Gateway.

  Does this meet the requirement?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Correct Solution: You implement Azure Firewall.

  What is a secured virtual hub?

  A virtual hub is a Microsoft-managed virtual network that enables connectivity from other resources. When a virtual hub is created from a Virtual WAN in the Azure portal, a virtual hub VNet and gateways (optional) are created as its components.

  A secured virtual hub is an Azure Virtual WAN Hub with associated security and routing policies configured by Azure Firewall Manager.

  Create a secured virtual hub Using Firewall Manager in the Azure portal, you can either create a new secured virtual hub, or convert an existing virtual hub that you previously created using Azure Virtual WAN.

  References:

  https://learn.microsoft.com/en-us/azure/firewall-manager/secured-virtual-hub

• Question 65:

  HOTSPOT

  You have an Azure subscription that contains six Azure App Service apps. The apps have an identical configuration and are deployed across multiple Azure regions.

  You plan to deploy Azure Front Door to load balance traffic across the apps.

  You need to ensure that the round robin load-balancing algorithm will send traffic only to a limited number App Service apps based on their proximity to a user. The solution must minimize administrative effort.

  What should you modify, and what should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 66:

  You have an Azure environment.

  You are planning to deploy an Azure Firewall in a subscription named Subscription1.

  What is the name of the subnet that must be created?

  A. Default
  B. DMZsubnet
  C. AzureFirewallSubnet
  D. FirewallSubnet
  C. AzureFirewallSubnet

  ---

  Explanation

  Correct Answer(s):

  AzureFirewallSubnet - The firewall will be in this subnet, and the subnet name must be AzureFirewallSubnet.

  https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

  Wrong Answers:

  Default The default subnet that gets created along with virtual network. Azure firewall should have a dedicated subnet named AzureFirewallSubnet.

  DMZsubnet - Not a valid option.

  FirewallSubnet Not a valid option.

• Question 67:

  DRAG DROP

  You have an Azure subscription that contains the resources shown in the following table.

  

  You discover that users connect directly to App1.

  You need to meet the following requirements:

  - Administrators must only access App1 by using a private endpoint.

  - All user connections to App1 must be routed through FD1.

  - The downtime of connections to App1 must be minimized.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 68:

  You need to manage connectivity from NYCNet to the Azure services that use private endpoints. The solution must meet the security requirements.

  What should you do first?

  A. Add a route table to SUBNET-PL
  B. Enable a network policy for SUBNET-PE.
  C. From Azure Virtual Network Manager, create a security admin configuration.
  D. From Azure Viitual Network Manager, create a network group that has Member type set to Subnet
  B. Enable a network policy for SUBNET-PE.

• Question 69:

  Your company has five offices. Each office has a firewall device and a local internet connection. The offices connect to a third-party SD-WAN.

  You have an Azure subscription that contains a virtual network named Vnet1. Vnet1 contains a virtual network gateway named Gateway1. Each office connects to Gateway1 by using a Site-to-Site VPN connection.

  You need to replace the third-party SD-WAN with an Azure Virtual WAN.

  What should you include in the solution?

  A. Delete Gateway1.
  B. Create new Point-to-Site (P2S) VPN connections on the firewall devices.
  C. Create an Azure Traffic Manager profile.
  D. Enable active-active mode on Gateway1.
  A. Delete Gateway1.

  ---

  Explanation

  Virtual Wan requires a Wan Hub Gateway, so Gateway1 should be deleted (after the new gateway is connected).

  https://learn.microsoft.com/en-us/azure/virtual-wan/migrate-from-hub-spoke-topology#step-5-transition-connectivity-to-virtual-wan-hub

• Question 70:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to identify the number of established outbound connections from the virtual machines.

  Which resource and metric should you review? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.