Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 281:

  HOTSPOT

  You need to implement name resolution for the cloud.liwareinc.com. The solution must meet the networking requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

• Question 282:

  HOTSPOT

  You need to implement a P2S VPN for the users in the branch office. The solution must meet the hybrid networking requirements.

  What should you do? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 283:

  HOTSPOT

  Which virtual machines can VM1 and VM4 ping successfully? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: VM2, VM3 and VM4.

  VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

  There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocking inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

  Box 2:

  VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks

  inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

• Question 284:

  HOTSPOT

  You are implementing the virtual network requirements for VM-Analyze.

  What should you include in a custom route that is linked to Subnet2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

• Question 285:

  HOTSPOT

  You create NSG10 and NSG11 to meet the network security requirements.

  For each of the following statements, select Yes of the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  1.

  From VM1 to inbound RDP VM2, there are no NSGs blocking this. There is only a custom inbound NSG for VM1, and a custom outbound NSG for VM2-- neither of which will block our connection

  2.

  VM2 outbound NSG has no rules blocking ping (ICMP). Next review the inbound NSG for VM1. There is an priority rule 1000 -- inbound ICMP deny, but the source is pointing to VNET4 (tricky!)

  3.

  Blocked. VM2 NSG has an outbound deny for 3389 RDP.

• Question 286:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Zone2.contoso.com is not linked to any virtual networks. Therefore, no VMs are able to resolve names in the zone.

  Box 2: Yes

  VM4 is in VNet3. Zone1.contoso.com has a link to VNet3 and auto-registration is enabled on the link.

  Box3: No

  VNet3 is linked to zone1.contoso.com and auto-registration is enabled on the link. A virtual network can only have one registration zone. You can link zone2.contoso.com to VNet3 but you won't be able to enable auto-registration on the link.

• Question 287:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 288:

  HOTSPOT

  In which NSGs can you use ASG1 and to which virtual machine network interfaces can you associate ASG1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  box1: only vnets 1 and 4 are in westUS, so only NSGs in this region can re-use the existing ASG1

  result: NSG1, NSG2 and NSG5

  box2:

  All network interfaces assigned to an application security group have to exist in the same virtual network that

  the first network interface assigned to the application security group is in. For example,

  if the first network interface assigned to an application security group named AsgWeb is in the virtual network named VNet1,

  then all subsequent network interfaces assigned to ASGWeb must exist in VNet1.

  You cannot add network interfaces from different virtual networks to the same application security group.

  source:https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups

  result:Vm2 only (was already assigned to VM1, which is in vnet1)

• Question 289:

  HOTSPOT

  You are implementing the Virtual network requirements for Vnet6.

  What is the minimum number of subnets and service endpoints you should create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 3 Subnets

  *

  One subnet for the three VMs

  Virtual network and subnets

  A subnet is a range of IP addresses in the virtual network. You can divide a virtual network into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one virtual network. NICs connected to subnets

  (same or different) within a virtual network can communicate with each other without any extra configuration.

  *

  One gateway subnet for the incoming VPN connection.

  About the gateway subnet

  The virtual network gateway uses specific subnet called the gateway subnet. The gateway subnet is part of the virtual network IP address range that you specify when configuring your virtual network. It contains the IP addresses that the

  virtual network gateway resources and services use. The subnet must be named 'GatewaySubnet' in order for Azure to deploy the gateway resources.

  *

  One subnet for the two container groups

  To deploy to a new virtual network and have Azure create the network resources for you automatically, specify the following when you execute az container create:

  Virtual network name

  Virtual network address prefix in CIDR format

  Subnet name

  Subnet address prefix in CIDR format

  Once you've deployed your first container group with this method, you can deploy to the same subnet by specifying the virtual network and subnet names, or the network profile that Azure automatically creates for you. Because Azure

  delegates the subnet to Azure Container Instances, you can deploy only container groups to the subnet.

  Note:

  Contoso has the following virtual network requirements:

  Create a virtual network named Vnet6 in West US that will contain the following resources and configurations:

  Two container groups that connect to Vnet6

  Three virtual machines that connect to Vnet6

  Allow VPN connections to be established to Vnet6

  Allow the resources in Vnet6 to access KeyVault1, DB1, and Vnet1 over the Microsoft backbone network.

  Box 2: 2

  *

  One Service Endpoint for the Azure KeyVault KeyVault1.

  The virtual network service endpoints for Azure Key Vault allow you to restrict access to a specified virtual network.

  *

  One Service Endpoint for the Azure SQL Database DB1.

  Service endpoints are a networking feature in Azure designed to help you better identify traffic coming into your Azure SQL Database as originating from one or more of your VNets.

  Note: Service endpoints are a networking feature in Azure designed to help you better identify traffic coming into your Azure SQL Database as originating from one or more of your VNets.

  Service endpoints are available for the following Azure services and regions.

  Azure SQL Database

  Azure Key Vault

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/network-overview

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-create-site-to-site-rm-powershell

  https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

  https://learn.microsoft.com/en-us/azure/key-vault/general/overview-vnet-service-endpoints

• Question 290:

  HOTSPOT

  You need to meet the network security requirements for the NSG flow logs.

  Which type of resource do you need, and how many instances should you create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A storage account

  Network security group (NSG) flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG. Flow data is sent to Azure Storage accounts from where you can access it as well as

  export it to any visualization tool, SIEM, or IDS of your choice.

  NSG flow logging considerations

  Storage account considerations:

  Location: The storage account used must be in the same region as the NSG.

  Note:

  Network Security Requirements

  Contoso network security requirements include:

  Enable NSG flow logs for NSG3 and NSG4.

  The NSGs are associated to the network interfaces on the virtual machines. Each NSG has one custom security rule that allows RDP connections from the internet. The firewall on each virtual machine allows ICMP traffic.

  NSG3 is related to VM3. VM3 is located in Central US.

  NSG4 is related to VM4. VM4 is located in Central US.

  Box 2: 1

  One storage account is enough.

  Reference: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview