Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 51:

  HOTSPOT

  You plan to deploy Azure Virtual WAN.

  You need to deploy a virtual WAN hub that meets the following requirements:

  1.

  Supports 10 sites that will connect to the virtual WAN hub by using a Site-to-Site VPN connection

  2.

  Supports 8 Gbps of ExpressRoute traffic

  3.

  Minimizes costs

  What should you configure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

• Question 52:

  HOTSPOT

  You have the Azure environment shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit?toc=/azure/virtual-network/toc.json

• Question 53:

  HOTSPOT

  You have an Azure private DNS zone named contoso.com that is linked to the virtual networks shown in the following table.

  

  The links have auto registration enabled.

  You create the virtual machines shown in the following table.

  

  You manually add the following entry to the contoso.com zone:

  Name: VM1

  IP address: 10.1.10.9

  For each of the following statements, select Yes of the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  The manual DNS record will overwrite the auto-registered DNS record so VM1 will resolve to 10.1.10.9.

  Box 2: No

  The DNS record for VM1 is now a manually created record rather than an auto-registered record. Only auto-registered DNS records are deleted when a VM is deleted.

  Box 3: No

  This answer depends on how the IP address is changed. To change the IP address of a VM manually, you would need to select ‘Static’ as the IP address assignment. In this case, the DNS record will not be updated because only DHCP

  assigned IP addresses are auto-registered.

  Reference:

  https://docs.microsoft.com/en-us/azure/dns/dns-faq-private

• Question 54:

  HOTSPOT

  Your company has an Azure virtual network named Vnet1 that uses an IP address space of 192.168.0.0/20. Vnet1 contains a subnet named Subnet1 that uses an IP address space of 192.168.0.0/24.

  You create an IPv6 address range to Vnet1 by using a CIDR suffix of /48.

  You need to enable the virtual machines on Subnet1 to communicate with each other by using IPv6 addresses assigned by the company. The solution must minimize the number of additional IPv4 addresses.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-overview https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-add-to-existing-vnet-powershell

• Question 55:

  You plan to deploy several virtual machines to subnet1-2.

  You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2. The solution must minimize administrative effort.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  You can use a network security group to filter inbound and outbound network traffic to and from Azure resources in an Azure virtual network. Plan Stage 1: Create a network security group

  Stage 2: Associate network security group to subnet Stage 3: Create security rule Stage 1: Create a network security group

  A network security group (NSG) secures network traffic in your virtual network.

  Step 1: From the Azure portal menu, select + Create a resource > Networking > Network security group, or search for Network security group in the portal search box.

  Step 2: Select Create.

  Step 3: On the Basics tab of Create network security group, enter or select this information:

  *Details omitted*

  Step 4: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 5: Select Create.

  Stage 2: Associate network security group to subnet

  In this section, you'll associate the network security group with the subnet of the virtual network you created earlier.

  Step 6: Search for myNsg (the name you give in stage 1) in the portal search box.

  Step 7: Select Subnets from the Settings section of myNSG.

  

  Step 8: In the Subnets page, select + Associate:

  Step 9: Under Associate subnet, select myVNet (the virtual network that is available) for Virtual network.

  Step 10: Select subnet1-2 for Subnet, and then select OK.

  Stage 3: Create security rule

  Step 11: Select Inbound security rules from the Settings section of myNSG.

  

  Step 12: In Inbound security rules page, select + Add:

  Step 13: Create a security rule that blocks TCP port 5585 to the network security group you created earlier. In Add inbound security rule page, enter or select this information:

  (You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2.)

  Source: Leave the default of Any.

  Source port ranges: Leave the default of (*).

  Destination: Select Network security group.

  Destination Network security groups: Select the network security group you created earlier.

  Service: Leave the default of Custom.

  Destination port ranges: Enter 5585

  Protocol: Select TCP.

  Action: Deny

  Priority Leave the default of 100.

  Name: Enter something

  

  Step 14: Select Add.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic

• Question 56:

  You plan to use VNET4 for an Azure API Management implementation.

  You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canada. You do NOT need to create the application gateway to complete this task.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Azure Front Door web application firewall (WAF) protects web applications from common vulnerabilities and exploits. Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats.

  You can restrict access to your web applications by country/region.

  Plan:

  Stage 1: Create a WAF policy Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

  First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal.

  Step 1: On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create.

  Step 2: On Create a WAF policy page, Basics tab, enter or select the following information and accept the defaults for the remaining settings:

  * details omitted *

  Step 3: On the Association tab, select Add association, then select one of the following settings:

  Application Gateway: Select the application gateway, and then select Add.

  HTTP Listener: Select the application gateway, select the listeners, then select Add.

  Route Path: Select the application gateway, select the listener, select the routing rule, and then select Add.

  Step 4: Select Review + create, then select Create.

  

  Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada Configure WAF rules When you create a WAF policy, by default it is in Detection mode. In Detection mode, WAF doesn't block any requests. Instead, the matching WAF rules are logged in the WAF logs. To see WAF in action, you can change the mode settings to Prevention. In Prevention mode, matching rules defined in the CRS Ruleset you selected are blocked and/or logged in the WAF logs.

  Custom rules

  Step 5: To create a custom rule, select Add custom rule under the Custom rules tab. This opens the custom rule configuration page.

  

  Step 6: To create a geo-filtering custom rule in the Azure portal, simply select Geo location as the Match Type, and then select the country/region or countries/regions you want to allow/block from your application. Step 7: Select Add Custom rule

  

  Step 8: Select Geo location

  Create your Custom Rule with an appropriate name and priority, then choose ‘Geo location’ from the Match type drop down as above. Next, you’ll want to ensure you choose RemoteAddr as the match variable, and decide what logic you want to apply. By logic I mean the pattern that will fire the rule. In this example, I want all traffic except Ireland blocked. So I will choose the Operation ‘Is not’, then location Ireland, then Deny. If I wanted all traffic allowed and Ireland blocked, I would simply choose the Operation ‘Is’. I recommend figuring out your pattern then working your way through the final section of the CR.

  Step 9: Set Match variable to Canada, choose IS NOT, Choose country Canada, and finally Then: Deny traffic.

  

  Step 10: Repeat steps 5 to 9 but instead use: Operation: IS Country/Region: Canada Then: Allow traffic

  Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

  Step 11: Finish the creation of the policy. Click Review+Create

  Reference: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs https://wedoazure.ie/2021/08/09/how-to-enable-web-application-firewall-geomatch-custom-rules/ https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

• Question 57:

  You plan to deploy an appliance to subnet3-2. The appliance will perform packet inspection and will have an IP address of 10.3.2.100. You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Plan:

  Stage 1: Create a route table

  Stage 2: Create a route

  Stage 3: Associate a route table to a subnet

  Stage 1: Create a route table

  Step 1: On the Azure portal menu or from the Home page, select Create a resource.

  Step 2: In the search box, enter Route table. When Route table appears in the search results, select it.

  Step 3: In the Route table page, select Create.

  Step 4: In the Create route table dialog box:

  * Details omitted*

  Step 5: Select Review + create and then Create to create your new route table.

  Stage 2: Create a route

  Step 6: Make sure the route table you created is selected.

  Step 7: From the route table menu bar, choose Routes and then select + Add.

  Step 8: Enter a unique Route name for the route within the route table.

  

  Step 9: Enter the Address prefix, in Classless Inter-Domain Routing (CIDR) notation, that you want to route traffic to. The prefix can't be duplicated in more than one route within the route table, though the prefix can be within another prefix. For example, if you defined 10.0.0.0/16 as a prefix in one route, you can still define another route with the 10.0.0.0/22 address prefix. Azure selects a route for traffic based on longest prefix match.

  Enter the following: Address prefixes: 0.0.0.0/0 Next hop type: Internet Next hop address: 10.3.2.100

  Step 10: Click Add.

  Stage 3: Associate a route table to a subnet

  Step 11: In the virtual network list, choose the virtual network that contains the subnet you want to associate a route table to.

  Step 13: Select the subnet you want to associate the route table to. In our case select subnet3-1,

  (You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.)

  Step 14: In Route table, choose the route table you want to associate to the subnet. Select the one you created earlier.

  

  Step 12: In the virtual network menu bar, choose Subnets.

  Step 15: Select Save.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a-route

• Question 58:

  You plan to deploy 100 virtual machines to subnet-1. The virtual machines will NOT be assigned a public IP address. The virtual machines will call the same API which is hosted by a third party. The virtual machines will make more than 10,000 calls per minute to the API.

  You need to minimize the risk of SNAT port exhaustion. The solution must minimize administrative effort.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  SNAT exhaustion occurs when a backend instance runs out of given SNAT Ports. A load balancer can still have unused SNAT ports. If a backend instance's used SNAT ports exceed its given SNAT ports, it will be unable to establish new

  outbound connections.

  Use a NAT gateway for outbound connectivity to the Internet

  Virtual network NAT gateway is a highly resilient and scalable Azure service that provides outbound connectivity to the internet from your virtual network. A NAT gateway's unique method of consuming SNAT ports helps resolve common

  SNAT exhaustion and connection issues.

  (Basic load balancers and basic public IP addresses aren't compatible with NAT.)

  Create a NAT gateway

  Step 1: Sign in to the Azure portal.

  Step 2: In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  Step 3: Select + Create.

  Step 4: In Create network address translation (NAT) gateway, enter or select this information in the Basics tab.

  * Details omitted *

  Step 5: Select the Outbound IP tab, or select the Next: Outbound IP button at the bottom of the page.

  Step 6: In the Outbound IP tab, enter or select the following information:

  * Public IP addresses

  Select Create a new public IP address.

  In Name, enter myPublicIP.

  Select OK.

  Step 7: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 8: Select Create.

  Reference: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections https://learn.microsoft.com/en-us/azure/load-balancer/troubleshoot-outbound-connection

• Question 59:

  You need to archive all the metrics of VNET1 to an existing storage account.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Monitoring Azure virtual network

  Azure virtual network uses Azure Monitor.

  Data platform

  Azure Monitor stores data in data stores for each of the pillars of observability: metrics, logs, distributed traces, and changes. Each store is optimized for specific types of data and monitoring scenarios.

  Retention of metrics

  You can send platform metrics for Azure Monitor resources to a Log Analytics workspace for long-term trending.

  Send to Azure Storage

  Send resource logs to Azure Storage to retain them for archiving. After you've created the diagnostic setting, a storage container is created in the storage account as soon as an event occurs in one of the enabled log categories.

  Create a diagnostic setting to send resource logs to a Log Analytics workspace or to a Storage Account.

  Archiving logs and metrics to a Storage account is useful for audit, static analysis, or backup. Compared to using Azure Monitor Logs or a Log Analytics workspace, Storage is less expensive, and logs can be kept there indefinitely.

  Create diagnostic settings

  You can configure diagnostic settings in the Azure portal either from the Azure Monitor menu or from the menu for the resource.

  Step 1: Select the Virtual Network VNET1.

  Step 2: Select Diagnostic settings under Monitoring on the resource's menu.

  

  Step 3: If no settings exist on the resource you've selected, you're prompted to create a setting. Select Add diagnostic setting.

  

  If there are existing settings on the resource, you see a list of settings already configured. Select Add diagnostic setting to add a new setting. Or select Edit setting to edit an existing one. Each setting can have no more than one of each of the destination types.

  

  Step 4: Give your setting a name if it doesn't already have one.

  Step 5: Logs and metrics to route: Select AllMetrics if you want to store metrics in Azure Monitor Logs too.

  

  Step 6: Destination details. Select Archive to a storage account

  

  Step 7: Storage: Select the Subscription, Storage account, and Retention policy.

  Step 8: Select Save.

  Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-platform-metrics

• Question 60:

  You need to ensure that the owner of VNET3 receives an alert if an administrative operation is performed in the virtual network.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Monitoring Azure virtual network Alerts Azure Monitor alerts proactively notify you when important conditions are found in your monitoring data. They allow you to identify and address issues in your system before your customers notice them. You can set alerts on metrics, logs, and the activity log.

  Create a new alert rule in the Azure portal

  Step 1: In the portal, select Monitor > Alerts.

  Step 2: Open the + Create menu and select Alert rule.

  

  Step 3: On the Select a resource pane, set the scope for your alert rule. You can filter by subscription, resource type, or resource location. We select Virtual Network.

  The Available signal types for your selected resources are at the bottom right of the pane.

  Step 4: Select Include all future resources to include any future resources added to the selected scope.

  Step 5: Select Done.

  Step 6: Select Next: Condition at the bottom of the page.

  Step 7: On the Select a signal pane, filter the list of signals by using the signal type and monitor service:

  *

  Signal type: The type of alert rule you're creating. We select Activity log

  *

  Monitor service: The service sending the signal. This list is pre-populated based on the type of alert rule you selected. We select Activity log – Administrative (The service that provides the Administrative activity log events)

  Step 8: On the Actions tab, select to create the required action group.

  

  Step 9: Configure basic action group settings

  

  Step 10: Configure notifications. To open the Notifications tab, select Next: Notifications. Alternately, at the top of the page, select the Notifications tab.

  Step 11: Define a list of notifications to send when an alert is triggered. Notification: Email Azure Resource Manager Role Name: Notify Owner

  

  Step 12: Select OK.

  Step 13: Finish the remaining steps in the wizard.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/monitor-virtual-network https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-new-alert-rule?tabs=metric#create-a-new-alert-rule-in-the-azure-portal