Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 271:

  HOTSPOT

  You have an Azure application gateway.

  You need to create a rewrite rule that will remove the origin port from the HTTP header of incoming requests that are being forwarded to the backend pool.

  How should you configure each setting? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  The X-Forwarded-For client request header field with the client_ip variable (see explanation later in this table) appended to it in the format IP1, IP2, IP3, and so on. If the X-Forwarded-For field isn't in the client request header, the add_x_forwarded_for_proxy variable is equal to the $client_ip variable. This variable is particularly useful when you want to rewrite the X-Forwarded-For header set by Application Gateway so that the header contains only the IP address without the port information.

  https://learn.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url

• Question 272:

  HOTSPOT

  Your on-premises network contains a server named DNS1 that runs Windows Server 2022. DNS1 has the DNS server role and an IP address of 10.1.0.1. The network contains computers that use DNS1 for name resolution.

  You have an Azure subscription that contains the resources shown in the following table.

  

  The on-premises network connects to Vnet1 by using a Site-to-Site VPN.

  You need to ensure that the computers on the on-premises network can resolve the IP address for sql1.private.fabrikam.com.

  What should you do on DNS1 and DNS2? To answer, drag the appropriate actions to the correct servers. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view

  content.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 273:

  HOTSPOT

  You have an Azure subscription that contains an Azure key vault named Vault1 and an app registration for an Azure AD app named App1.

  You have a DNS domain named contoso.com that is hosted by a third-party DNS provider.

  You plan to deploy App1 by using Azure App Service. App1 will have the following configurations:

  1.

  App1 will be hosted across five App Service apps.

  2.

  Users will access App1 by using a URL of https://app1.contoso.com.

  3.

  The user traffic of App1 will be managed by using Azure Front Door.

  4.

  The traffic between Front Door and the App Service apps will be sent by using HTTP.

  5.

  App1 will be secured by using an SSL certificate from a third-party certificate authority (CA).

  You need to support the Front Door deployment.

  Which two DNS records should you create, and to where should you import the SSL certificate for App1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 274:

  HOTSPOT

  Your on-premises network uses an IP address range of 10.1.0.0 to 10.1.255.255.

  You plan to deploy a new Azure virtual network solution that will include the following elements:

  A virtual network named VNet1

  A Site-to-Site (S2S) VPN connection between VNet1 and the on-premises network GatewaySubnet in VNet1, which will be used as a route-based virtual network gateway

  You need to recommend which subnet masks to assign to VNet1 and GatewaySubnet. The solution must meet the following requirements:

  Maximize the number of available IP addresses on VNet1.

  Minimize the number of available IP addresses on GatewaySubnet.

  Which address spaces should you assign to VNet1 and GatewaySubnet? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Explanation:

  Box 1: 10.0.0.0/24

  Maximize the number of available IP addresses on VNet1.

  Box 2: 10.0.0.0/27

  Minimize the number of available IP addresses on GatewaySubnet.

  Create a gateway subnet

  The virtual network gateway requires a specific subnet named GatewaySubnet. The gateway subnet is part of IP address range for your virtual network and contains the IP addresses that the virtual network gateway resources and services

  use.

  When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. The number of IP addresses needed depends on the VPN gateway configuration that you want to create. Some configurations require

  more IP addresses than others. It's best to specify /27 or larger (/26,/25 etc.) for your gateway subnet.

  Reference:

  https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

• Question 275:

  HOTSPOT

  You have an Azure subscription that contain a storage account named st1 in the East US Azure region.

  You have the virtual networks shown in the following table.

  

  You have the subnets shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Explanation:

  Box 1: No

  Azure Bastion subnet

  You must create this subnet in the same virtual network that you want to deploy Azure Bastion to. The subnet must have the following configuration: Subnet name must be AzureBastionSubnet. Subnet size must be /26 or larger (/25, /24 etc.).

  The subnet can't contain other resources.

  Box 2: Yes

  Subnet-1 has IP address range 10.2.1.0/25

  Total Number of Hosts: 128

  Number of Usable Hosts: 126

  Box 3: No

  Subnet3-1 has an IP address range of 10.3.1.0/26.

  Vnet3 has an IP address space of 10.3.0.0/16.

  10.3.1.0/6 would not be within the Vnet3 IP address range.

  Reference:

  https://learn.microsoft.com/en-us/azure/bastion/configuration-settings

  https://www.calculator.net/ip-subnet-calculator.html

• Question 276:

  HOTSPOT

  Your on-premises network contains the subnets shown in the following table.

  

  The network contains a firewall named FW1 that uses a public IP address of 131.107.100.200. You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to configure a Site-to-Site (S2S) VPN named VPN1 that will connect GW1 to FW1.

  You need to configure LNG1 to support VPN1. The solution must meet the following requirements:

  Ensure that the resources on Subnet1 and Subnet2 can communicate with the resources on VNet1.

  Minimize administrative effort.

  How should you configure LNG1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 277:

  HOTSPOT

  You have an Azure subscription that contains an Azure Firewall policy named FWPolicy1.

  You need to configure FWPolicy1 to meet the following requirements:

  Allow traffic based on the FQDN of the destination.

  Allow TCP traffic based on the source.

  Which types of rules should you use for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Explanation:

  Box 1: Application only

  Allow traffic based on the FQDN of the destination.

  You can use an FQDN tag in application rules to allow the required outbound network traffic through your firewall. For example, to manually allow Windows Update network traffic through your firewall, you need to create multiple application

  rules per the Microsoft documentation. Using FQDN tags, you can create an application rule, include the Windows Updates tag, and now network traffic to Microsoft Windows Update endpoints can flow through your firewall.

  Box 2: Network or DNAT only

  Allow TCP traffic based on the source.

  There are three types of rule collections:

  Application rules: Configure fully qualified domain names (FQDNs) that can be accessed from a Virtual Network.

  Network rules: Configure rules that contain source addresses, protocols, destination ports, and destination addresses.

  NAT rules: Configure DNAT rules to allow incoming Internet connections.

  Note NAT:

  Microsoft refers to the form of NAT as being Destination Network Address Translation (DNAT). The rules work with the following parameters:

  Name: A label for the rule.

  *-> Protocol: TCP or UDP.

  Source Address: * (Internet), a specific Internet address, or a CIDR block.

  Destination Address: Expect this to be renamed – this refers to the external address of the firewall that the rule will inspect.

  Destination Ports: The TCP or UDP ports that the rule will listen to on the external IP address of the firewall.

  Translated Address: The IP address of the service (virtual machine, internal load balancer, and so on) that privately hosts or presents the service.

  Translated Port: The port that the inbound traffic will be routed to by the Azure Firewall.

  Reference:

  https://learn.microsoft.com/en-us/azure/firewall/fqdn-tags

  https://learn.microsoft.com/en-us/azure/firewall/firewall-faq

  https://petri.com/the-three-different-types-of-rules-that-are-in-the-azure-firewall/

• Question 278:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to restrict access to storage1 and sql1 by using service endpoints. The solution must meet the following requirements:

  Allow access from Subnet1 to SQLDB1.

  Implement service endpoint policies to restrict access to supported resources.

  Allow access from Subnet1 to storage1 and the read-only replica of storage1 in the paired Azure region.

  What is the minimum number of service endpoints and service endpoint policies you should create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 279:

  HOTSPOT

  You need to recommend a configuration for the ExpressRoute connection from the Boston datacenter. The solution must meet the hybrid networking requirements and business requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  For the first question, only ExpressRoute GW SKU Ultra Performance support FastPath feature.

  For the second question, vnet1 will connect to ExpressRoute gw, once Vnet1 peers with Vnet2, the traffic from on-premise network will bypass GW and Vnet1, directly goes to Vnet2, while this feature is under public preview.

  ====Reference

  ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When

  enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

  To configure FastPath, the virtual network gateway must be either:

  Ultra Performance

  ErGw3AZ

  VNet Peering - FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway.

  https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

  Gateway SKU

  https://docs.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-networkgateways

• Question 280:

  HOTSPOT

  You need to restrict traffic from VMScaleSet1 to VMScaleSet2. The solution must meet the virtual networking requirements.

  What is the minimum number of custom NSG rules and NSG assignments required? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 2: One NSG

  The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way you would need two custom NSG rules.

  Box 1: Two custom rules

  With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic from VMScaleSet1. Then you would need to create another custom rule with a higher priority than the first rule that allows traffic on port 443.

  The default rules in the NSG will allow all other traffic to VMScaleSet2.