Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 301:

  DRAG DROP

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain named contoso.com that has an internal certification authority (CA).

  You have an Azure subscription.

  You deploy an Azure application gateway named AppGwy1 and perform the following actions:

  1.

  Configure an HTTP listener

  2.

  Associate a routing rule with the listener

  You need to configure AppGwy1 to perform mutual authentication for requests from domain-joined computers to contoso.com.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: From AppGw1, create a frontend IP configuration

  Step 2: From AppGw1, create an SSL profile

  Set up a listener-specific SSL policy.

  To set up a listener-specific SSL policy, you'll need to first go to the SSL settings tab in the Portal and create a new SSL profile. When you create an SSL profile, you'll see two tabs: Client Authentication and SSL Policy. The SSL Policy tab is

  to configure a listener-specific SSL policy. The Client Authentication tab is where to upload a client certificate(s) for mutual authentication. (Step 3)

  Step 3: From an on-premises computer, upload a certificate to Appgwy1.

  Configure mutual authentication

  To configure an existing Application Gateway with mutual authentication, you'll need to first go to the SSL settings tab in the Portal and create a new SSL profile. (Step 2)

  When you create an SSL profile, you'll see two tabs: Client Authentication and SSL Policy. The Client Authentication tab is where you'll upload your client certificate(s).

  Step 4: From AppGw1, add an HTTP listener and associate the listener to the SSL profile

  Now that we've created an SSL profile with a listener-specific SSL policy, we need to associate the SSL profile to the listener to put the listener-specific policy in action.

  Navigate to your existing Application Gateway. If you just completed the steps above, you don't need to do anything here.

  Select Listeners from the left-side menu.

  Click on Add listener if you don't already have an HTTPS listener set up. If you already have an HTTPS listener, click on it from the list.

  Fill out the Listener name, Frontend IP, Port, Protocol, and other HTTPS Settings to fit your requirements. (Frontend IP created in Step 1)

  Check the Enable SSL Profile checkbox so that you can select which SSL Profile to associate with the listener.

  Select the SSL profile you created from the dropdown list.

  Etc.

  Reference:

  https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-configure-listener-specific-ssl-policy https://learn.microsoft.com/en-us/azure/application-gateway/mutual-authentication-portal

• Question 302:

  DRAG DROP

  You have an Azure subscription that contains the resources shown in the following table.

  

  You discover that users connect directly to App1. You need to meet the following requirements:

  Administrators must only access App1 by using a private endpoint.

  All user connections to App1 must be routed through FD1.

  The downtime of connections to App1 must be minimized.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

• Question 303:

  DRAG DROP

  You have two on-premises datacenters.

  You have an Azure subscription that contains four virtual networks named VNet1, VNet2, VNet3, and VNet4.

  You create an Azure virtual WAN named VWAN1. VWAN1 contains a single virtual hub that is connected to both on-premises datacenters and all the virtual networks in a full mesh topology.

  You create a route table named RT1.

  You need to configure VWAN1 to meet the following requirements:

  1.

  Connectivity between VNet1 and VNet2 and both on-premises datacenters must be allowed.

  2.

  Connectivity between VNet3 and VNet4 and both on-premises datacenters must be allowed.

  3.

  VNet1 and VNet2 must be isolated from VNet3 and VNet4.

  How should you configure routing for VNet1 and VNet2 and for both on-premises datacenters? To answer, drag the appropriate route tables and route table propagation to the correct requirements. Each route table and route table

  propagation may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 304:

  DRAG DROP

  You have an on-premises network.

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway.

  You need to connect VNet1 to the on-premises network by using an ExpressRoute circuit.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

• Question 305:

  DRAG DROP

  You have an Azure subscription that contains an Azure VPN gateway named GW1. GW1 provides Point-to-Site (P2S) VPN connectivity.

  Users connect to GW1 from a Windows 11 device by using an SSTP connection.

  You need to ensure that the P2S VPN connections support Azure AD authentication.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

  Select and Place:

  

  Correct Answer:

  

• Question 306:

  DRAG DROP

  You have an Azure subscription.

  You plan to deploy Azure Front Door with Azure Web Application Firewall (WAF).

  You plan to implement custom rules and managed rules that meet the following requirements:

  1.

  Block malicious bots.

  2.

  Throttle client IP addresses that exceed 100 connections per minute.

  You need to identify which Front Door SKU to configure, and which type of rule to configure for each requirement. The solution must minimize administrative effort and costs.

  What should you identify? To answer, drag the appropriate options to the correct targets. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 307:

  DRAG DROP

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to associate Gateway1 with Subnet1. The solution must minimize downtime on VM1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Explanation:

  Step 1: Disassociate PIP1 from NIC1 Azure NAT Gateway resources enable outbound Internet connections from subnets in a virtual network. Resources deployed in the NAT gateway virtual network subnet must be the standard SKU. Deployment of a NAT gateway to a virtual network subnet with basic SKU resources is unsupported.

  Resource using Basic SKU public IP addresses, Decision path

  * Virtual Machine or Virtual Machine Scale Sets (flex model) Disassociate IP(s) and utilize the upgrade options detailed after the table.

  Step 2: Change the Pip1 SKU to standard

  Step 3: Associate PIP1 from NIC1

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-basic-upgrade-guidance https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-nat-gateway

• Question 308:

  DRAG DROP

  You have an Azure subscription that contains an Azure Firewall Premium policy named FWP1.

  To FWP1, you plan to add the rule collections shown in the following table.

  

  Which priority should you assign to each rule collection? To answer, drag the appropriate priority values to the correct rule collections. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Explanation:

  Box 1: 200 RC1 Network

  Rule collection groups A rule collection group is used to group rule collections. They're the first unit to be processed by the Azure Firewall and they follow a priority order based on values. There are three default rule collection groups, and their priority values are preset by design. They're processed in the following order:

  * Default Network rule collection group Priority: 200

  Box 2: 300 RC2 Application Default Application rule collection group Box 3: 100 RC3 DNAT

  * Default DNAT (Destination Network Address Translation) rule collection group Priority 100

  Note:

  Reference: https://learn.microsoft.com/en-us/azure/firewall/policy-rule-sets

• Question 309:

  DRAG DROP

  You need to implement outbound connectivity for VMScaleSet1. The solution must meet the virtual networking requirements and the business requirements.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/load-balancer/skus

  https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections#outboundrules

• Question 310:

  DRAG DROP

  You need to prepare Vnet1 for the deployment of an ExpressRoute gateway. The solution must meet the hybrid connectivity requirements and the business requirements.

  Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  1.

  Delete VPN GW1.

  2.

  Set the subnet mask of Gateway Subnet to /27.

  3.

  Create a VPN gateway by using the VPN GW1 SKU.

  https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal

  "To configure coexisting connections for an already existing VNet:

  1- Delete the existing ExpressRoute or Site-to-site VPN gateway.

  2 - Delete and recreate the GatewaySubnet to have prefix of /27 or shorter.

  3- Configure a VNet with a Site-to-Site connection and then Configure the ExpressRoute gateway.

  4 - Once the ExpressRoute gateway is deployed, you can link the virtual network to the ExpressRoute circuit."