Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 251:

  You have an Azure subscription that contains the public IP addresses shown in the following table.

  

  You plan to deploy a NAT gateway named NAT1.

  Which public IP addresses can be used as the public IP address for NAT1?

  A. IP3 only

  B. IP5 only

  C. IP2 and IP4 only

  D. IP1, IP3 and IP5 only

  E. IP3 and IP5 only

  Correct Answer: A

  Only static IPv4 addresses in the Standard SKU are supported. IPv6 doesn't support NAT.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview

• Question 252:

  You have an Azure application gateway named AGW1 that has a routing rule named Rule1. Rule 1 directs traffic for http://www.contoso.com to a backend pool named Pool1. Pool1 targets an Azure virtual machine scale set named VMSS1.

  You deploy another virtual machine scale set named VMSS2.

  You need to configure AGW1 to direct all traffic for http://www.adatum.com to VMSS2.

  The solution must ensure that requests to http://www.contoso.com continue to be directed to Pool1.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add a backend pool.

  B. Modify an HTTP setting.

  C. Add an HTTP setting.

  D. Add a listener.

  E. Add a rule.

  Correct Answer: ADE

  Reference: https://docs.microsoft.com/en-us/azure/application-gateway/configuration-overview

• Question 253:

  You have an Azure application gateway that has Azure Web Application Firewall (WAF) enabled.

  You configure the application gateway to direct traffic to the URL of the application gateway.

  You attempt to access the URL and receive an HTTP 403 error. You view the diagnostics log and discover the following error.

  

  You need to ensure that the URL is accessible through the application gateway.

  Solution: You add a rewrite rule for the host header.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  https://docs.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url#limitations

• Question 254:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have two Azure virtual networks named Vnet1 and Vnet2.

  You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.

  You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.

  You discover that Client1 cannot communicate with Vnet2.

  You need to ensure that Client1 can communicate with Vnet2.

  Solution: You download and reinstall the VPN client configuration.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

• Question 255:

  You plan to deploy Azure virtual network.

  You need to design the subnets.

  Which three types of resources require a dedicated subnet? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Azure Bastion

  B. Azure Active Directory Domain Services

  C. Azure Private Link

  D. Azure Application Gateway v2

  E. VPN gateway

  Correct Answer: ADE

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services

• Question 256:

  Note: This question is part ofa series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have two Azure virtual networks named Vnet1 and Vnet2.

  You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.

  You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.

  You discover that Client1 cannot communicate with Vnet2.

  You need to ensure that Client1 can communicate with Vnet2.

  Solution: You enable BGP on the gateway of Vnet1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

• Question 257:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have two Azure virtual networks named Vnet1 and Vnet2.

  You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to- Site (P2S) IKEv2 VPN.

  You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.

  You discover that Client1 cannot communicate with Vnet2.

  You need to ensure that Client1 can communicate with Vnet2.

  Solution: You reset the gateway of Vnet1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

• Question 258:

  You fail to establish a Site-to-Site VPN connection between your company's main office and an Azure virtual network.

  You need to troubleshoot what prevents you from establishing the IPsec tunnel.

  Which diagnostic log should you review?

  A. IKEDiagnosticLog

  B. RouteDiagnosticLog

  C. GatewayDiagnosticLog

  D. TunnelDiagnosticLog

  Correct Answer: A

  IKEDiagnosticLog = The IKEDiagnosticLog table offers verbose debug logging for IKE/IPsec. This is very useful to review when troubleshooting disconnections, or failure to connect VPN scenarios.

  GatewayDiagnosticLog = Configuration changes are audited in the GatewayDiagnosticLog table.

  TunnelDiagnosticLog = The TunnelDiagnosticLog table is very useful to inspect the historical connectivity statuses of the tunnel.

  RouteDiagnosticLog = The RouteDiagnosticLog table traces the activity for statically modified routes or routes received via BGP.

  P2SDiagnosticLog = The last available table for VPN diagnostics is P2SDiagnosticLog. This table traces the activity for Point to Site.

  Reference:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics

• Question 259:

  Your company has a single on-premises datacenter in Washington DC. The East US Azure region has a peering location in Washington DC.

  The company only has Azure resources in the East US region.

  You need to implement ExpressRoute to support up to 1 Gbps. You must use only ExpressRoute Unlimited data plans. The solution must minimize costs.

  Which type of ExpressRoute circuits should you create?

  A. ExpressRoute Local

  B. ExpressRoute Direct

  C. ExpressRoute Premium

  D. ExpressRoute Standard

  Correct Answer: A

  Expressroute Local supports this particular networking scenario for two reasons.

  1) The Washington DC peering location has East US as its Local Azure region. So, you don't need access to all the Geopolitical locations in order to connect the on-prem DC to Azure. Which means you won't necessarily need Expressroute

  standard.

  2) ExpressRoute Local is a more economical solution compared to the standard.

  https://learn.microsoft.com/en-us/azure/expressroute/expressroute-faqs#what-are-the-benefits-of-expressroute-local

  https://learn.microsoft.com/en-us/azure/expressroute/expressroute-locations-providers#global-commercial-azure

• Question 260:

  You are planning an Azure Point-to-Site (P2S) VPN that will use OpenVPN. Users will authenticate by using an on-premises Active Directory domain. Which additional service should you deploy to support the VPN authentication?

  A. an Azure key vault

  B. a RADIUS server

  C. a certification authority

  D. Azure Active Directory (Azure AD) Application Proxy

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about