Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 201:

  You have an Azure application gateway for a web app named App1. The application gateway allows end-to-end encryption.

  You configure the listener for HTTPS by uploading an enterprise signed certificate.

  You need to ensure that the application gateway can provide end-to-end encryption for App1. What should you do?

  A. Set Listener type to Multi site.

  B. Increase the Unhealthy threshold setting in the custom probe.

  C. Upload the public key certificate to the HTTPS settings.

  D. Enable the SSL profile for the listener.

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/azure/application-gateway/end-to-end-ssl-portal https://docs.microsoft.com/en-us/azure/application-gateway/create-ssl-portal#configuration-tab

• Question 202:

  You have an Azure subscription that contains a user named Admin1 and a resource group named RG1.

  RG1 contains an Azure Network Watcher instance named NW1.

  You need to ensure that Admin1 can place a lock on NW1. The solution must use the principle of least privilege.

  Which role should you assign to Admin1?

  A. User Access Administrator

  B. Network Contributor

  C. Resource Policy Contributor

  D. Monitoring Contributor

  Correct Answer: A

  As an administrator, you can lock an Azure subscription, resource group, or resource to protect them from accidental user deletions and modifications. The lock overrides any user permissions.

  Unlike role-based access control (RBAC), you use management locks to apply a restriction across all users and roles.

  Who can create or delete locks

  To create or delete management locks, you need access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Only the Owner and the User Access Administrator built-in roles can create and delete management locks. You

  can create a custom role with the required permissions.

  Note: Azure Network Watcher provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. Network Watcher is designed to monitor and repair the network health of IaaS

  (Infrastructure-as-a-Service) products including Virtual Machines (VM), Virtual Networks, Application Gateways, Load balancers, etc.

  Reference: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

• Question 203:

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  You plan to deploy an Azure firewall named AF1 to RG1 in the West US Azure region. To which virtual networks can you deploy AF1?

  A. Vnet1 and Vnet4 only

  B. Vnet1, Vnet2, Vnet3, and Vnet4

  C. Vnet1 only

  D. Vnet1 and Vnet2 only

  E. Vnet1, Vnet2, and Vnet4 only

  Correct Answer: C

  Azure Firewall operates in a single VNET.

  Azure Firewall is a regional service.

  Yes. Vnet1: Same VNET and same region.

  No. Vnet2: Same Resource Group but different VNET and different region. Must be in the same region.

  No. Vnet3: Different VNET, different region. Must be in the same region.

  No. Vnet4: Different VNET, same region.

  Reference:

  https://docs.microsoft.com/en-us/azure/architecture/networking/guide/well-architected-framework-azure-firewall

• Question 204:

  You have an Azure subscription that is linked to an Azure AD tenant named contoso.onmicrosoft.com. The subscription contains the following resources:

  1.

  A virtual network named Vnet1

  2.

  An App Service plan named ASPI

  3.

  An Azure App Service named webapp1

  4.

  An Azure private DNS zone named private.contoso.com

  5.

  Virtual machines on Vnet1 that cannot communicate outside the virtual network

  You need to ensure that the virtual machines on Vnet1 can access webapp1 by using a URL of https:/Avwwprivate.contosocom.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create a CNAME record that maps www.private.contoso.com to webapp1.contoso.onmicrosoft.com.

  B. Create a CNAME record that maps www.private.contoso.com to webapp1.private.contoso.com.

  C. Create a service endpoint for webapp1.

  D. Register an enterprise application in Azure AD for webapp1.

  E. Create a private endpoint for webapp1.

  F. Create a CNAME record that maps www.private.contoso.com to webapp1.privatelink.azurewebsites.net.

  Correct Answer: EF

  E: You can use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone can be linked to your virtual network to resolve specific domains.

  When you use Private Endpoint for Web App, the requested URL must match the name of your Web App. When you deploy a Private Endpoint, we update the DNS entry to point to the canonical name

  mywebapp.privatelink.azurewebsites.net. For example, the name resolution will be (Name, Type, Value): mywebapp.azurewebsites.net CNAME mywebapp.privatelink.azurewebsites.net

  Reference: https://docs.microsoft.com/en-us/azure/app-service/networking/private-endpoint

• Question 205:

  You have an Azure virtual network that contains two subnets named Subnet1 and Subnet2. Subnet1 contains a virtual machine named VM1. Subnet2 contains a virtual machine named VM2.

  You have two network security groups (NSGs) named NSG1 and NSG2. NSG1 has 100 inbound security rules and is associated to VM1. NSG2 has 200 inbound security rules and is associated to Subnet1.

  VM2 cannot connect to VM1.

  You suspect that an NSG rule blocks connectivity.

  You need to identify which rule blocks the connection. The issue must be resolved as quickly as possible.

  Which Azure Network Watcher feature should you use?

  A. Effective security rules

  B. Connection troubleshoot

  C. NSG diagnostic

  D. NSG flow logs

  Correct Answer: C

• Question 206:

  You have 10 Azure App Service instances. Each instance hosts the same web app. Each instance is in a different Azure region.

  You need to configure Azure Traffic Manager to direct users to the instance that has the lowest latency.

  Which routing method should you use?

  A. geographic

  B. weighted

  C. performance

  D. priority

  Correct Answer: C

  Select Performance routing when you have endpoints in different geographic locations and you want end users to use the "closest" endpoint for the lowest network latency.

  Reference: https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

• Question 207:

  You have the Azure Traffic Manager profiles shown in the following table.

  

  You plan to add the endpoints shown in the following table.

  

  Which endpoints can you add to Profile2?

  A. Endpoint1 and Endpoint4 only

  B. Endpoint1, Endpoint2, Endpoint3, and Endpoint4

  C. Endpoint1 only

  D. Endpoint2 and Endpoint3 only

  E. Endpoint3 only

  Correct Answer: A

• Question 208:

  You have an application named App1 that listens for incoming requests on a preconfigured group of 50 TCP ports and UDP ports.

  You install App1 on 10 Azure virtual machines.

  You need to implement load balancing for App1 across all the virtual machines. The solution must minimize the number of load balancing rules.

  What should you include in the solution?

  A. Azure Application Gateway V2 that has multiple listeners

  B. Azure Standard Load Balancer that has Floating IP enabled

  C. Azure Standard Load Balancer that has high availability (HA) ports enabled

  D. Azure Application Gateway v2 that has multiple site hosting enabled

  Correct Answer: C

  C. Azure Standard Load Balancer that has high availability (HA) ports enabled App1 is installed on 10 VMs which can be put in a Backend pool. The req is to minimize the number of load balancing rules. If you select HA it will allow you to have 1 rule for TCP and UDP ports, if you don't select HA you will need to have a minimum of 2 rules for TCP and UDP with a * range.

• Question 209:

  You have the Azure resources shown in the following table.

  

  You configure storage1 to provide access to the subnet in Vnet1 by using a service endpoint.

  You need to ensure that you can use the service endpoint to connect to the read-only endpoint of storage1 in the paired Azure region.

  What should you do first?

  A. Configure the firewall settings for storage1.

  B. Fail over storage1 to the paired Azure region.

  C. Create a virtual network in the paired Azure region.

  D. Create another service endpoint.

  Correct Answer: C

  When planning for disaster recovery during a regional outage, you should create the VNets in the paired region in advance. Enable service endpoints for Azure Storage, with network rules granting access from these alternative virtual networks. Then apply these rules to your geo-redundant storage accounts. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

• Question 210:

  You have an Azure Front Door instance that has a single frontend named Frontend1 and an Azure Web Application Firewall (WAF) policy named Policy1. Policy1 redirects requests that have a header containing "string1" to https://

  www.contoso.com/redirect1. Policy1 is associated to Frontend1.

  You need to configure additional redirection settings. Requests to Frontend1 that have a header containing "string2" must be redirected to https://www.contoso.com/redirect2.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create a custom rule.

  B. Create a policy.

  C. Create a frontend host.

  D. Create a frontend host.

  E. Add a custom rule to Policy1.

  F. Create an association.

  Correct Answer: ABF

  the question itself makes no sense as already have the policy1 created hence the available options tends you to do the all process again.

  B. Create a policy.

  A. Create a custom rule.

  F. Create an association.