Microsoft Microsoft Certified: Azure Support Engineer for Connectivity Specialty AZ-720 Questions & Answers

• Question 11:

  A company has two subnet in a virtual network named VNe1m the subnet are named SubnetA and SubnetB. The company uses a site-to-site (S2) VPN in SubnetB to connect its on-premises environment to Azure. You deploy an Azure SQL Database named SQL1. You configure a service endpoint in SubnetA for Microsft.SqL

  A. Configure a DNS record for the private IP address of SQL1.

  B. Configure a network security group (NSG) to allow port 1433 on SubnetA

  C. Configure a service endpoint on SubnetB.

  D. Deploy a private endpoint for SQL1.

  E. Deploy an Azure ExpressRoute circuit for VNet1.

  Correct Answer: D

  To allow the on-premises environment to access the Azure SQL Database named SQL1 over a site-to-site (S2S) VPN in SubnetB, you should deploy a private endpoint for SQL1. A private endpoint is a network interface that connects you

  privately and securely to a service powered by Azure Private Link. Private Link allows you to access Azure PaaS services (for example, Azure Storage and SQL Database) and Azure-hosted customer/partner services over a private endpoint

  in your virtual network. So the correct answer is D. Deploy a private endpoint for SQL1.

  You can find more information about private endpoints in the official Microsoft documentation.

• Question 12:

  A company has a pay-as-you-go subscription named Subl1.

  The company has a virtual machine (VM) named VM1 in a subnet named Subnet1.

  You create the following network security group (NSG) named NSG1 and associate it with Subnet1.

  

  You observe that an application on VM1 is unable to send email to recipient outside the company

  You need to resolve the issue.

  What should you do?

  A. Configure the protocol for the NSG1 rule with priority of 100 to TCP.

  B. Configure the source and destination ports for the NSG1 rule with a priority of 100 to 587.

  C. Migrate Sub1 to a cloud service provider subscription

  D. Remove the NSG1 rule with a priority of 2000.

  E. Assign NSG1 to the network interface on VM1.

  Correct Answer: E

• Question 13:

  You manage an Azure subscription that contains the following resources:

  

  An on-premises environment is connected to VNet1 by using ERGW1.

  An administrator measures network latency for on-premises traffic that targets VM1 and VM2 by using the front-end IP address of the load balancer. The administrator enables ExpressRoute FastPath on ERGW1 and observes that the

  latency has not changed.

  You need to resolve the issue that is preventing the network latency improvements offered by ExpressRoute FastPath from taking effect.

  What should you do?

  A. Redeploy the load balancer as a Standard SKU.

  B. Change the SKU for the ExpressRoute gateway.

  C. Resize VM1 and VM2.

  D. Enable accelerated networking on VM1 and VM2

  Correct Answer: A

  To resolve the issue that is preventing the network latency improvements offered by ExpressRoute FastPath from taking effect, you should redeploy the load balancer as a Standard SKU. ExpressRoute FastPath is only supported on Standard Load Balancer SKUs. So the correct answer is A. Redeploy the load balancer as a Standard SKU.

• Question 14:

  A company uses Azure Backup Server to back up re deployed in an availability group. The company reports that a backup operation for a database fails. The following error message displays:

  Unable to configure protection.

  You need to ensure that the backup operation runs successfully.

  What should you do?

  A. Add a partitioned drive to the storage pool on the backup server.

  B. Add the Sysadmin role to the system account on the SQL Server instance.

  C. Run the following command on the backup server: net stop OBEngine

  D. Configure the availability group replicas to allow read and write operations on the SQL Server instance.

  Correct Answer: B

  To ensure that the backup operation for a database in an availability group using Azure Backup Server runs successfully, you should add the Sysadmin role to the system account on the SQL Server instance. The system account on the SQL Server instance must have the Sysadmin role to perform backup operations. So the correct answer is B. Add the Sysadmin role to the system account on the SQL Server instance. You can find more information about Azure Backup Server and its requirements in the official Microsoft documentation.

• Question 15:

  A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.

  The company reports that the Azure VM backup job is failing.

  You need to troubleshoot the issue.

  Solution: Configure the retention range for the current VM backup policy.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  It is unlikely that configuring the retention range for the current VM backup policy would resolve the issue of the Azure VM backup job failing after enabling backups for the VM through the Azure portal. To troubleshoot the issue, the

  administrator should first check the Azure VM backup job logs and identify the specific error message or code provided. This can help identify the underlying issue and the appropriate solution. Therefore, the solution mentioned in the question

  is incorrect and the answer is B. No.

  Reference:

  Troubleshoot Azure VM backup failures (Microsoft documentation)

• Question 16:

  A company deploys an Azure Virtual Network gateway. The company connects to the gateway by using a site-to-site VPN connection.

  The company's on-premises VPN gateway is reporting an issue with the Phase 1 proposal from the Azure Virtual Network gateway.

  You need to troubleshoot the issue by reviewing the logs.

  Which log should you analyze?

  A. P2SDiagnosticLog

  B. GatewayDiagnosticLog

  C. IKEDiagnosticLog

  D. RouteDiagnosticLog

  Correct Answer: C

  To troubleshoot an issue with the Phase 1 proposal from an Azure Virtual Network gateway when connecting to a site-to-site VPN connection by reviewing logs, you should analyze the IKE Diagnostic log. Therefore, option C is correct. You should analyze the IKE Diagnostic log.

• Question 17:

  A company implements self-service password reset (SSPR).

  After a firewall upgrade at the company's datacenter, SSPR stops working.

  You need to resolve the issue.

  Which two URLs must be present on the firewalls to allow SSPR to connect?

  A. *.update.microsoft.com

  B. *.servicebus.windows.net

  C. *.passwordreset. microsoftonline.com

  D. *.svc.ms

  E. *.adl.windows.com

  Correct Answer: BC

  https://techcommunity.microsoft.com/t5/azure/self-service-password-reset-urls-and-ip-address-ranges/m-p/443239

• Question 18:

  A company has virtual machines (VMs) in the following Azure regions:

  1.

  West Central US

  2.

  Australia East

  The company uses ExpressRoute private peering to provide connectivity to VMs hosted on each region and on-premises services.

  The company implements global VNet peering between a VNet in each region. After configuring VNet peering, VM traffic attempts to use ExpressRoute private peering.

  You need to ensure that traffic uses global VNet peering instead of ExpressRoute private peering. The solution must preserve existing on-premises connectivity to Azure VNets.

  What should you do?

  A. Add a user-defined route to the subnets route table.

  B. Add a filter to the on-premises routers.

  C. Add a second VNet to the virtual machines and configure VNet peering between the VNets.

  D. Disable the ExpressRoute peering connections for one of the regions.

  Correct Answer: A

  To ensure that traffic uses global VNet peering instead of ExpressRoute private peering, you should add a user-defined route to the subnets route table. According to 2, global VNet peering allows virtual networks across regions to communicate using private IP addresses as if they were in the same region. However, if there is an existing ExpressRoute private peering between two regions that also have global VNet peering enabled, traffic will prefer ExpressRoute over global VNet peering by default. To override this behavior and force traffic to use global VNet peering instead of ExpressRoute private peering for a specific subnet or virtual network gateway connection, you need to add a user-defined route with a next hop type of Virtual Network Peering.

• Question 19:

  A company has an Azure Active Directory (Azure AD) tenant. The company deploys Azure AD Connect to synchronize users from an Active Directory Domain Services (AD DS).

  The synchronization of a user object is failing.

  You need to troubleshoot the failing synchronization by using a built-in Azure AD Connect troubleshooting task. Which two pieces of information should you collect before you start troubleshooting?

  A. Object common name

  B. AD connector name

  C. Object globally unique identifier

  D. Azure AD connector name

  E. Object distinguished name

  Correct Answer: BE

  the two pieces of information that should be collected before starting to troubleshoot the failing synchronization by using a built-in Azure AD Connect troubleshooting task are: B. AD connector name E. Object distinguished name Azure AD Connect is a tool used to synchronize users from an on-premises Active Directory Domain Services (AD DS) to Azure AD. When troubleshooting synchronization issues, it is important to have information about the object that is failing to synchronize. The AD connector name refers to the name of the connector used to connect to the on- premises AD DS. The object distinguished name refers to the unique identifier of the object in the on-premises AD DS. Having this information can help identify and resolve synchronization issues.

• Question 20:

  A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.

  The company reports that the Azure VM backup job is failing.

  You need to troubleshoot the issue.

  Solution: Enable replication and create a recovery plan for the backup vault.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The solution does not meet the goal. Enabling replication and creating a recovery plan for the backup vault is not relevant to troubleshooting an Azure VM backup job failure. The administrator should troubleshoot the issue by checking the VM's disk configuration, checking the status of the VM guest agent, and ensuring that the backup policy is configured correctly.