Microsoft AZ-700 Online Practice Questions and Exam Preparation

Microsoft AZ-700 Online Questions & Answers

• Question 71:

  You have an Azure virtual network that contains two subnets named Subnet1 and Subnet2. Subnet1 contains a virtual machine named VM1. Subnet2 contains a virtual machine named VM2.

  You have two network security groups (NSGs) named NSG1 and NSG2. NSG1 has 100 inbound security rules and is associated to VM1. NSG2 has 200 inbound security rules and is associated to Subnet1.

  VM2 cannot connect to VM1.

  You suspect that an NSG rule blocks connectivity.

  You need to identify which rule blocks the connection. The issue must be resolved as quickly as possible.

  Which Azure Network Watcher feature should you use?

  A. Effective security rules
  B. Connection troubleshoot
  C. NSG diagnostic
  D. NSG flow logs
  C. NSG diagnostic

• Question 72:

  HOTSPOT

  You have an Azure firewall shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1:

  If forced tunneling was enabled, the Firewall Subnet would be named AzureFirewallManagementSubnet.

  Forced tunneling can only be enabled during the creation of the firewall. It cannot be enabled after the firewall has been deployed.

  Box 2:

  The "Visit Azure Firewall Manager to configure and manage this firewall" link in the exhibit shows that the firewall is managed by Azure Firewall Manager.

• Question 73:

  You have an Azure virtual network named VNet1 that contains the subnets shown in the following table.

  

  You need to deploy an Azure application gateway named AppGW1 to VNet1.

  To where can you deploy AppGW1?

  A. GatewaySubnet only
  B. Subnet2 only
  C. Subnet1 or Subnet2 only
  D. Subnet2 or GatewaySubnet only
  E. Subnet1, Subnet2, and GatewaySubnet
  B. Subnet2 only

  ---

  Explanation

  An application gateway is a dedicated deployment in your virtual network. Within your virtual network, a dedicated subnet is required for the application gateway. You can have multiple instances of a given application gateway deployment in a subnet. You can also deploy other application gateways in the subnet. But you can't deploy any other resource in the application gateway subnet.

  Subnet3 is not in use.

  Incorrect:

  Not A, not D, not

  E: GatewaySubnet is in use.

  Not C: Subnet1 is already in use.

  References:

  https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure

• Question 74:

  HOTSPOT

  You have two on-premises sites named Site1 and Site2. Each site connects to the internet by using a local firewall device.

  You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. VNet1 and VNet2 reside in the East US Azure region and are connected by using virtual network peering.

  You need to configure a Site-to-Site (S2S) VPN solution that meets the following requirements:

  1. Site1 and Site2 must connect directly to the Azure subscription by using their local firewall device.

  2. The computers in Site1 and Site2 must be able to connect to the resources on VNet1 and VNet2.

  3. The solution must include a virtual network gateway that uses three availability zones.

  What is the minimum number of virtual network gateways and local network gateways that you should deploy to Azure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: 1 Virtual network gateways

  You only need one virtual network gateway to fulfill this requirement. While your environment includes two on-premises sites and two peered Azure virtual networks (VNets), Azure's gateway transit feature allows you to centralize connectivity in a single gateway.

  Configuration Details:

  The Gateway: You deploy one VPN gateway in one of the VNets (acting as a "hub").

  This gateway must be a Generation 2 SKU (e.g., VpnGw2AZ or higher) to support the required three availability zones.

  On-Premises Connectivity: You create two separate S2S connections on that single gateway-one for each on-premises site's local firewall.

  VNet Peering (Gateway Transit): By enabling "Allow gateway transit" on the hub VNet peering and "Use remote gateways" on the spoke VNet peering, the resources in the spoke VNet can communicate with both on-premises sites using the hub's single gateway.

  Box 2: 2 Local network gateways

  To configure a Site-to-Site (S2S) VPN solution for your two on-premises sites connecting to Azure, you need two Local Network Gateways. Each Local Network Gateway in Azure represents the specific configuration of an individual on-premises VPN device, including its public IP address and local address spaces.

  Here is why your configuration requires this specific setup: One Gateway per

  Site: Since you have two on-premises sites each with its own local firewall device, you must create one Local Network Gateway for each distinct device to establish independent tunnels.

  Central Virtual Network Gateway: A single Azure Virtual Network Gateway (using an "AZ" SKU for availability zones) can host multiple S2S connections. [Box 1]

  Inter-VNet Connectivity: Because your two virtual networks are already connected via VNet peering, computers at both on-premises sites will be able to reach resources in both VNets through the single gateway, provided Gateway Transit is configured.

  References:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

  https://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway

• Question 75:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have two Azure virtual networks named Vnet1 and Vnet2.

  You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2

  VPN.

  You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.

  You discover that Client1 cannot communicate with Vnet2.

  You need to ensure that Client1 can communicate with Vnet2.

  Solution: You download and reinstall the VPN client configuration.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

  References:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

• Question 76:

  SIMULATION

  

  Username and password

  Use the following login credentials as needed:

  To enter your username, place your cursor in the Sign in box and click on the username below.

  To enter your password, place your cursor in the Enter password box and click on the password below.

  Azure Username: [email protected] Azure Password: xxxxxxxxxx

  If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

  The following information is for technical support purposes only:

  Lab Instance: 12345678

  You plan to configure a VPN tunnel for VNET2.

  You need to ensure that all internet traffic from subnet2-1 is routed through an on-premises firewall before reaching the destination. The solution must be achieved without using dynamic routing protocols.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.
  B. PlaceHolder
  C. PlaceHolder
  D. PlaceHolder
  A. See explanation below.

  ---

  Explanation

  Route network traffic with a route table using the Azure portal

  Azure routes traffic between all subnets within a virtual network by default. You can create your own routes to override Azure's default routing. Custom routes are helpful when, for example, you want to route traffic between subnets through a network virtual appliance (NVA) or a firewall.

  Send Traffic from Azure Firewall to Internet

  Even if the Azure Firewall is created with support for Forced Tunneling, you do not have to add a Route Table here at all. The default behavior will provide outbound connectivity to the Internet just like a regular firewall.

  Phase 1: Create a route table

  In this section, create a route table to define the route of the traffic through the NVA virtual machine. The route table is associated with the subnet-1 subnet where the vm-public virtual machine is deployed.

  Step 1: In the search box at the top of the portal, enter Route table. Select Route tables in the search results.

  Step 2: Select + Create.

  Step 3: In Create Route table, enter or select the following information:

  Details omitted. *

  Step 4: Select Review + create.

  Step 5: Select Create.

  Phase 2: Create a route

  In this section, create a route in the route table that you created in the previous steps.

  Step 1: In the search box at the top of the portal, enter Route table. Select Route tables in the search results.

  Step 2: Select route-table-public.

  Step 3: In Settings, select Routes.

  Step 4: Select + Add in Routes.

  Step 5: Enter or select the following information in Add route:

  Route name: to-firewall Destination type: Select IP Addresses Destination IP addresses/CIDR ranges: Enter 0.0.0.0/0

  Use 0.0.0.0/0 for any unmatched routes

  Next hop type: Select Virtual appliance.

  Next hop address: Enter the IP address of the Firewall.

  This is the IP address of the Firewall.

  Step 6: Select Add.

  Step 7: In Settings, select Subnets.

  Step 8: Select + Associate.

  Step 9: Enter or select the following information in Associate subnet:

  Setting: Value

  Virtual network: Select VNET2

  Subnet: Select subnet2-1.

  Step 10: Select OK.

  Note: Route network traffic with a route table using the Azure portal. Azure routes traffic between all subnets within a virtual network by default. You can create your own routes to override Azure's default routing. Custom routes are helpful when, for example, you want to route traffic between subnets through a network virtual appliance (NVA).

  

• Question 77:

  You plan to implement an Azure virtual network that will contain 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.

  You need to recommend which subnet mask size to use for the virtual subnets.

  What should you recommend?

  A. /64
  B. /120
  C. /48
  D. /24
  A. /64

  ---

  Explanation

  IPv6-only Virtual Machines or Virtual Machines Scale Sets aren't supported, each NIC must include at least one IPv4 IP configuration.

  https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview

  So in that case its dual-stack, the ipv4 subnet mask for 200 VMs is /24. And Ipv6 subnet mask is /64. But its not clear mask which is asked in the question... assuming it is referring to ipv6 as mentioned initially, answer will be /64

• Question 78:

  HOTSPOT

  You need to configure the P2S VPN to meet the connectivity requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 79:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You test DDoSplan1 by running a simulation that targets IP1.

  You need to review the DDoS Protection mitigation reports.

  What should you use?

  A. DDos protection plan in the Azure portal
  B. Log Analytics
  C. Microsoft Defender for Cloud
  D. Azure Monitor Network Insights
  A. DDos protection plan in the Azure portal

• Question 80:

  DRAG DROP

  You have an on-premises network.

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 is connected to an Azure Virtual WAN hub named Hub1. You need to enable connectivity between the on-premises network and VNet1 by using Hub1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place: