Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 131:

  You have an Azure environment as shown below.

  

  You need to find to which environments/virtual machines that VM1 can communicate?

  A. VM2 Only

  B. VM2 and VM3 Only

  C. The on-premise datacenter and VM2 only

  D. The on-premise datacenter, VM2 and VM3 only

  Correct Answer: C

  VM1 is in VNET1. VNET1 has a Site-to-Site VPN connection with on-premise data center. So, VM1 can communicate with on-premise datacenter.

  VM1 is in VNET1. VNET1 is peered with VNET2. So, VM1 can communicate with VM2. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit?toc=/azure/virtual- network/toc.json

• Question 132:

  You plan to deploy an Azure App Service web app that will have multiple instances across multiple Azure regions. You need to deploy a load balancing service for the planned deployment. The solution must meet the following requirements:

  Maintain access to the app in the event of a regional outage.

  Support Azure Web Application Firewall (WAF).

  Support cookie-based affinity.

  Support URL routing.

  What should you deploy?

  A. Azure Front Door

  B. Azure Load Balancer

  C. Azure Traffic Manager

  D. Azure Application Gateway

  Correct Answer: A

  Correct Answer(s):

  Azure Front Door - Front Door is an application delivery network that provides global load balancing and site acceleration service for web applications. It offers Layer 7 capabilities for your application like SSL offload, path- based routing, fast

  failover, caching, etc. to improve performance and high-availability of your applications.

  https://docs.microsoft.com/en-us/azure/architecture/guide/technology-choices/load-balancing-overview#azure- load-balancing-services

  Wrong Answers:

  Azure Load Balancer - It is a regional load balancing service.

  Azure Traffic Manager - It does not support URL routing.

  Azure Application Gateway - It is a regional load balancing service.

• Question 133:

  You have an Azure subscription that contains the following resources:

  A virtual network named Vnet1

  A subnet named Subnet1 in Vnet1

  A virtual machine named VM1 that connects to Subnet1

  Three storage accounts named storage1, storage2, and storage3

  You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

  To achieve the requirement, you create a network security group (NSG). You configure a service tag for Microsoft Storage and link the tag to Subnet1.

  Did you achieve the requirement?

  A. Yes

  B. No

  Correct Answer: B

  This will either allow or deny traffic to all storage accounts from all virtual machines in Subnet1.

• Question 134:

  Which one of the following priority levels is highest for a security rule in Azure Firewall?

  A. 0

  B. 100

  C. 1000

  Correct Answer: B

  Priority settings can be any number between 100 and 65000. With 100 being the highest priority.

• Question 135:

  You have an Azure environment as shown below.

  

  You need to find to which environments/virtual machines that VM2 can communicate?

  A. VM1 Only

  B. VM1 and VM3 Only

  C. The on-premise datacenter and VM1 only

  D. The on-premise datacenter, VM1 and VM3 only

  Correct Answer: D

  VM2 is in VNET2. VNET2 is peered with VNET1. So, VM2 can connect to VM1.

  VM2 is in VNET2. VNET2 is peered with VNET1 with gateway transit enabled. So, VM2 can connect to on-premises datacenter.

  VM2 is in VNET2. VNET2 is peered with VNET3. So, VM2 can connect to VM3.

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit?toc=/azure/virtual- network/toc.json

• Question 136:

  You plan to deploy an Azure Front Door.

  Which properties should you use to configure routing rules?

  A. HTTP protocols (HTTP/HTTPS)

  B. Hosts

  C. Paths

  D. Time stamp

  E. User certificates

  Correct Answer: ABC

  When evaluating routing rules, Front Door looks for matches in HTTP protocols (HTTP/HTTPS), Hosts, and Paths. https://docs.microsoft.com/en-us/azure/frontdoor/front-door-route-matching

• Question 137:

  You have an Azure environment.

  You need to create a private connection between Azure PaaS and hosted services.

  Which Azure Service should you deploy?

  A. Azure Private Link

  B. Azure Service Endpoint

  C. Azure NaaS (network as a service)

  Correct Answer: A

  Correct Answer(s):

  Azure Private Link Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network.

  https://docs.microsoft.com/en-us/azure/private-link/private-link-overview

  Wrong Answers:

  Azure Service Endpoint - Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network.

  Azure NaaS (network as a service) - There is no such service as Azure NaaS.

• Question 138:

  You have an Azure subscription that contains the following resources:

  A virtual network named Vnet1

  A subnet named Subnet1 in Vnet1

  A virtual machine named VM1 that connects to Subnet1

  Three storage accounts named storage1, storage2, and storage3

  You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

  To achieve the requirement, you create a network security group (NSG) and associate the NSG to Subnet1.

  Did you achieve the requirement?

  A. Yes

  B. No

  Correct Answer: B

  Creating a NSG on the Subnet does not limit the traffic. You also need to define the NSG rules.

• Question 139:

  You need to provide VMware SD-WAN connectivity to your clients. Which Azure resource should you deploy?

  A. Network Virtual Appliance (NVA).

  B. Point-to-site VPN Gateway

  C. Local network gateway

  Correct Answer: A

  Correct Answer(s):

  Network Virtual Appliance (NVA) - Azure Virtual WAN supports connections from networking partners, such as VMware SD-WAN. These types of devices are known as network virtual appliances (NVAs).

  Wrong Answers:

  Point-to-site VPN Gateway - A point-to-site VPN Gateway supports connections from individual computers.

  Local network gateway - A local network gateway represents the on-premises network.

• Question 140:

  You have Azure virtual machines in three Azure regions.

  Each virtual machine has a public IP address assigned to its network interface. An application named App1 is installed in each virtual machine.

  You plan to implement Azure Front Door-based load balancing across all the virtual machines.

  You need to ensure that App1 on the virtual machines will only accept traffic routed from Azure Front Door.

  What should you implement?

  A. Azure Private Link

  B. Service endpoints

  C. Network security groups (NSGs) with service tags

  D. Network security groups (NSGs) with application security groups

  Correct Answer: C

  Correct Answer(s):

  Network security groups (NSGs) with service tags - To lock down your application to accept traffic only from your specific Front Door, you will need to set up IP ACLs for your backend and then restrict the traffic on your backend to the specific

  value of the header 'X-Azure-FDID' sent by Front Door. These steps are detailed out as below:

  Configure IP ACLing for your backends to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only.

  The above step basically means configure NSGs with service tags.

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-faq

  Wrong Answers:

  Azure Private Link - Azure Private Link enables you to access Azure PaaS Services over a private endpoint in your

  virtual network.

  Service endpoints - Service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. It does not restrict traffic.

  Network security groups (NSGs) with application security groups - ASG's allow you to group virtual machines and define network security policies based on those groups. You must also use service tag AzureFrontDoor.Backend in the network

  security groupsto restrict the traffic.