Microsoft Microsoft Certified: Azure Support Engineer for Connectivity Specialty AZ-720 Questions & Answers

• Question 21:

  A company connects their on-premises network by using Azure VPN Gateway. The on- premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).

  A new subnet should be unreachable from the on-premises network.

  You need to implement a solution.

  Solution: Scale the gateway to Generation2.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Scaling the gateway to Generation2 will not prevent the on-premises network from reaching the new subnet. Scaling the gateway changes the hardware configuration of the VPN gateway, but it does not affect the routing or connectivity

  between the on- premises network and the virtual network.

  A better solution would be to create a network security group (NSG) and associate it with the new subnet. The NSG can be configured to deny traffic from the on-premises network to the new subnet. This way, the new subnet will be isolated

  from the on-premises network.

  Reference:

  VPN Gateway Generation: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwgen2

• Question 22:

  A company uses an Azure Virtual Network (VNet) gateway named VNetGW1. VNetGW1 connects to a partner site by using a site-to-site VPN connection with dynamic routing.

  The company observes that the VPN disconnects from time to time. You need to troubleshoot the cause for the disconnections.

  What should you verify?

  A. The partner's VPN device and VNetGW1 are configured using the same shared key.

  B. VNetGW1 has exceeded the subnet Security Association pairs.

  C. The partner's VPN device and VNetGW1 are configured with the same virtual network address space.

  D. The public IP address of the partner's VPN device is configured in the local network gateway address space on VNetGW1.

  Correct Answer: A

• Question 23:

  A company uses an Azure Virtual Network (VNet) gateway named VNetGW1. VNetGW1 connects to a partner site by using a site-to-site VPN connection with dynamic routing.

  The company observes that the VPN disconnects from time to time.

  You need to troubleshoot the cause for the disconnections.

  What should you verify?

  A. The partner's VPN device and VNetGW1 are configured using the same shared key.

  B. The partner's VPN device is configured for one VPN tunnel per subnet pair.

  C. The public IP address of the partner's VPN device is configured in the local network gateway address space on VNetGW1.

  D. The partner's VPN device and VNetGW1 are configured with the same virtual network address space.

  Correct Answer: B

  To troubleshoot the cause for the VPN disconnections between VNetGW1 and the partner site, you should verify that the partner's VPN device is configured for one VPN tunnel per subnet pair.

• Question 24:

  A company plans to use an Azure PaaS service by using Azure Private Link service. The azure Private Link service and an endpoint have been configured.

  The company reports that the endpoint is unable to connect to the service.

  You need to resolve the connectivity issue.

  What should you do?

  A. Disable the endpoint network policies.

  B. Validate the VPN device.

  C. Approve the connection state.

  D. Disable the service network policies.

  Correct Answer: C

  To resolve the connectivity issue, you should approve the connection state. According to 1, Azure Private Link service requires manual approval of connection requests from private endpoints by default. You can approve or reject a connection request by using PowerShell cmdlets or Azure portal.

• Question 25:

  A company enables just-in-time (JIT) virtual machine (VM) access in Azure.

  An administrator observes a list of VMs on the Unsupported tab of the JIT VM access page in the Microsoft Defender for Cloud portal.

  You need to determine why some VMs are not supported for JIT VM access.

  What should you conclude?

  A. The administrator does not have the SecurityReader role.

  B. The administrator is using the Microsoft Defender for Cloud free tier.

  C. The client firewall does not allow port 22 on the VMs.

  D. A network security group is not associated with the VMs.

  Correct Answer: D

• Question 26:

  A company deploys a new file sharing application on four Standard_D2_v3 virtual machines (VMs) behind an Azure Load Balancer. The company implements Azure Firewall.

  Users report that the application is slow during peak usage periods. An engineer reports that the peak usage for each VM is approximately 1 Gbps.

  You need to implement a solution that support a minimum of 10 Gbps.

  What should you do to increase the throughput?

  A. Request an increase in networking quotas.

  B. Increase the size of the VM instance.

  C. Disable the Azure Firewall and implement network security groups in its place.

  D. Move two of the servers behind a separate load balancer and configure round robin routing in Traffic Manager.

  Correct Answer: B

  According to the given scenario, the application deployed on four Standard_D2_v3 virtual machines behind an Azure Load Balancer is experiencing slow performance during peak usage periods It is reported that the peak usage for each VM is approximately 1 Gbps, and the goal is to increase the throughput to a minimum of 10 Gbps. To achieve this goal, the best option is to increase the size of the VM instance. The Standard_D2_v3 virtual machine size has a maximum network bandwidth of 1 Gbps, so increasing the size of the VM instance to a higher tier, such as Standard_D8_v3 or higher, will provide more network bandwidth and improve the application's performance. Option A, requesting an increase in networking quotas, may not be sufficient to achieve the required network bandwidth.

  Option C, disabling the Azure Firewall and implementing network security groups, may not have a significant impact on the network bandwidth. Option D, moving two of the servers behind a separate load balancer and configuring round-robin

  routing in Traffic Manager, may improve availability and performance but will not increase the network bandwidth.

  Source:

  [1] https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes-general

  [2] https://docs.microsoft.com/en-us/azure/virtual-network/designing-hub-spoke-topologies#optimize-data-transfer-between-hub-and-spoke-vnets

• Question 27:

  A company hosts a network virtual appliance (VNA) and Azure Route Server in different virtual networks (VNets). Border Gateway Protocol (BGP) peering is enabled between the NVA loses internet connectivity after it advertises the default

  route to the route server.

  You need to resolve the problem with the NVA.

  What should you do?

  A. Configure a user-defined route on the NVA subnet.

  B. Move the route server to the same VNet as the NVA.

  C. Configure a unique autonomous system number (ASN) on the NVA.

  D. Configure a public IP address on the route server.

  Correct Answer: A

  https://learn.microsoft.com/en-us/azure/route-server/troubleshoot-route-server

• Question 28:

  A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.

  The company reports that the Azure VM backup job is failing.

  You need to troubleshoot the issue.

  Solution: Create a new manual backup in Backup center.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  It is unlikely that creating a new manual backup in Backup center would resolve the issue of an Azure VM backup job failing after enabling backups for the VM through the Azure portal. To troubleshoot the issue, the administrator should first

  check the Azure VM backup job logs and identify the specific error message or code provided. This can help identify the underlying issue and the appropriate solution. Therefore, the solution mentioned in the question is incorrect and the

  answer is B. No.

  Reference:

  Troubleshoot Azure VM backup failures (Microsoft documentation)

• Question 29:

  A company migrates existing Ubuntu Linux servers from their on-premises vSphere infrastructure to Azure.

  The virtual machines (VMs) are experiencing a low network throughput of 20 Mbps. The VMs are expected to sustain 300 Mbps.

  You need to ensure that the VMs are compatible with Azure.

  Which change should you make?

  A. Install a kernel name that ends with -azure.

  B. Configure the network interfaces to 1000 Mbps/full duplex.

  C. Redeploy the VM with Accelerated Networking enabled.

  D. Increase the TCP buffers and window size kernel parameters.

  Correct Answer: C

  To ensure that Ubuntu Linux servers are compatible with Azure and to increase network throughput from 20 Mbps to 300 Mbps, you should redeploy the VM with Accelerated Networking enabled. Therefore, option C is correct. You should redeploy the VM with Accelerated Networking enabled.

• Question 30:

  A company uses Azure virtual machines (VMs) in multiple regions. The VMs have the following configuration:

  

  The backend pool of an internal Azure Load Balancer (ILB) named ILB1 contains VM1 and VM2. The ILB uses the Basic SKU and is in a resource group RG2.

  Virtual network peering has been configured between VNet1 and VNet2.

  Users report that they are unable to connect to resources on VM1 and VM2 by using ILB1 from VM3.

  You need to resolve the connectivity issues.

  What should you do?

  A. Redeploy VM1 and VM2 into availability zones.

  B. Move ILB1 to RG1.

  C. Redeploy the ILB using the Standard SKU.

  D. Move VM1 and VM2 into RG3.

  Correct Answer: C

  To resolve the connectivity issues, you need to redeploy the ILB using the Standard SKU. According to 1, Basic Load Balancer does not support Global VNet Peering, which is required for cross-region communication between VMs in different VNets. Standard Load Balancer supports Global VNet Peering and can load balance traffic across regions and availability zones.