Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 261:

  You plan to configure BGP for a Site-to-Site VPN connection between a datacenter and Azure.

  Which two Azure resources should you configure? Each correct answer presents a part of the solution. (Choose two.)

  NOTE: Each correct selection is worth one point.

  A. a virtual network gateway

  B. Azure Application Gateway

  C. Azure Firewall

  D. a local network gateway

  E. Azure Front Door

  Correct Answer: AD

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/bgp-howto

• Question 262:

  You need to ensure that only hosts on VNET1 can access the storage123456789 storage account. The solution must ensure that access occurs over the Azure backbone network.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Use private endpoints for Azure Storage You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

  Connect to a storage account using an Azure Private Endpoint

  Create a private endpoint

  Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

  Step 2: Locate and select the Storage Account storage123456789

  Step 3: Select the Networking tab or select Next: Advanced then Next: Networking.

  Step 4: In the Networking tab, under Network connectivity select Disable public access and use private access.

  Step 5: In Private endpoint, select + Add private endpoint.

  Step 6: In Create private endpoint enter or select the following information:

  *Details omitted*

  * Virtual network: Select VNET1.

  Step 7: Select OK.

  Step 8: Select Review.

  Step 9: Select Create.

  Reference:

  https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal

• Question 263:

  You are preparing to connect your on-premises network to VNET4 by using a Site-to-Site VPN. The on-premises endpoint of the VPN will be created on a firewall named Firewall1. The on-premises network has the following configuration:

  1.

  internal address range: 10.10.0.0/16

  2.

  Firewall1 internal IP address: 10.10.1.1

  3.

  Firewall public IP address: 131.107.50.60

  BGP is NOT used.

  You need to create the object that will provide the IP addressing configuration of the on-premises network to the Site-to-Site VPN. You do NOT need to create a virtual network gateway to complete this task.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Create a site-to-site VPN connection in the Azure portal We only create a local network gateway

  The local network gateway is a specific object that represents your on-premises location (the site) for routing purposes. You give the site a name by which Azure can refer to it, then specify the IP address of the on-premises VPN device to which you'll create a connection. You also specify the IP address prefixes that will be routed through the VPN gateway to the VPN device. The address prefixes you specify are the prefixes located on your on-premises network. If your on-premises network changes or you need to change the public IP address for the VPN device, you can easily update the values later.

  Step 1: From the Azure portal, in Search resources, services, and docs (G+/) type local network gateway. Locate local network gateway under Marketplace in the search results and select it. This opens the Create local network gateway page.

  Step 2: On the Create local network gateway page, on the Basics tab, specifiy the values for your local network gateway.

  *

  Select Endpoint type: IP address

  *

  Endpoint: Enter 131.107.50.60 (The Firewall public IP address)

  (IP address: If you have a static public IP address allocated from your Internet service provider for your VPN device, select the IP address option and fill in the IP address as shown in the example. This is the public IP address of the VPN

  device that you want Azure VPN gateway to connect to. If you don't have the IP address right now, you can use the values shown in the example, but you'll need to go back and replace your placeholder IP address with the public IP address

  of your VPN device. Otherwise, Azure won't be able to connect.)

  *

  Address Space: Enter 10.10.0.0/16 (The internal address range)

  Select the endpoint type for the on-premises VPN device - IP address or FQDN (Fully Qualified Domain Name).

  IP address: If you have a static public IP address allocated from your Internet service provider for your VPN device.

  

  Step 3: On the Advanced tab, you can configure BGP settings if needed. Skip this.

  Step 4: When you have finished specifying the values, select Review + create at the bottom of the page to validate the page.

  Step 5: Select Create to create the local network gateway object.

  Reference:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

• Question 264:

  You need to ensure that hosts on VNET2 can access hosts on both VNET1 and VNET3. The solution must prevent hosts on VNET1 and VNET3 from communicating through VNET2.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  We use VNET2 as hub, and VNET1 and VNET3 as spokes.

  The spoke virtual networks peer with the hub and can be used to isolate workloads.

  A hub-spoke topology can be used without a gateway if you don't need cross-premises network connectivity.

  Peer virtual networks

  Step 1: In the search box at the top of the Azure portal, look for VNET2. When VNET2 appears in the search results, select it.

  Step 2: Under Settings, select Peerings, and then select + Add, as shown in the following picture:

  

  Step 3: Enter or select the following information, accept the defaults for the remaining settings, and then select Add.

  * Virtual network - Select VNET1 for the name of the remote virtual network.

  Step 4: In the Peerings page, the Peering status is Connected, as shown in the following picture:

  

  Step 5: Repeat steps 1 to 4, but in Step 3 add VNET3 instead of VNET1.

  Reference: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke

• Question 265:

  HOTSPOT

  You have an on-premises datacenter.

  You have an Azure subscription that contains 10 virtual machines and a virtual network named VNet1 in the East US Azure region. The virtual machines are connected to VNet1 and replicate across three availability zones.

  You need to connect the datacenter to VNet1 by using ExpressRoute. The solution must meet the following requirements:

  1.

  Maintain connectivity to the virtual machines if two availability zones fail.

  2.

  Support 1000-Mbps connections.

  3.

  Minimize costs.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  1.

  https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview;

  2.

  https://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway

  3.

  https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways#gwsku

  When deploying an ErGw1AZ, it is possible to define its zone availability as "Zone-Redundant", in addition it is also essential that the ip used by the ER Gateway be "Standard", because at the time of provisioning this ip will become redundant between the availability zones . Regarding the ER Circuit, it can be "Local", but in this scenario it would be unlimited and more expensive than the "Standard" Limited in 1Gbps. In my opinion the best answer would be:

  1.

  One ExpressRoute Standard circuit

  2.

  One ExpressRoute gateway of the ErGw1AZ SKU

• Question 266:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the virtual machines shown in the following table.

  

  You create a load balancer named LB1 that has the following configurations:

  1.

  SKU: Basic

  2.

  Type: Internal

  3.

  Subnet: Subnetl2

  4.

  Virtual network VNet1

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 267:

  HOTSPOT

  You have the Azure resources shown in the following table.

  

  You need to link VNei2 to Circuit1

  What should you create in each subscription? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 268:

  HOTSPOT

  You have an Azure subscription.

  You plan to use Azure Virtual WAN.

  You need to deploy a virtual WAN hub that meets the following requirements:

  1.

  Supports 4 Gbps of Site-to-Site (S2S) VPN traffic

  2.

  Supports 8 Gbps of ExpressRoute traffic

  3.

  Minimizes costs

  How many scale units should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  For S2S 1 scale unit = 500 Mbps 4000/500 = 8 scale units https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings#s2s

  For ExpressRoute 1 scale unit = 2Gbps 8/2 = 4 https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-about#expressroute-performance

• Question 269:

  HOTSPOT

  You have an Azure subscription that contains 10 virtual machines. The virtual machines are assigned private IP addresses. The subscription contains the resources shown in the following table.

  

  You need to configure FWPolicy1 to meet the following requirements:

  1.

  Allow incoming connections to the virtual machines from the internet on port 4567.

  2.

  Block outbound connections from the virtual machines to an FQDN of *.fabrikam.com.

  What should you configure in FWPolicy1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 270:

  HOTSPOT

  You have the Azure firewall shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer: