Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 61:

  You need to ensure that hosts on VNET1 and VNET2 can communicate. The solution must minimize latency between the virtual networks.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Peer virtual networks

  Step 1: In the search box at the top of the Azure portal, look for VNet1. When VNET1 appears in the search results, select it.

  

  Step 2: Under Settings, select Peerings, and then select + Add, as shown in the following picture:

  

  Step 3: Enter or select the following information, accept the defaults for the remaining settings, and then select Add.

  *

  ..

  *

  Virtual network

  Select VNET2 for the name of the remote virtual network. The remote virtual network can be in the same region of VNET1 or in a different region.

  

  Step 4: Click Add

  In the Peerings page, the Peering status is Connected, as shown in the following picture:

  

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal

• Question 62:

  You need to ensure that you can deploy Azure virtual machines to the France Central Azure region. The solution must ensure that virtual machines in the France Centralregion are in a network segment that has an IP address range of 10.5.1.0/24.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  You can create a virtual network before you create a virtual machine or you can create the virtual network as you create a virtual machine.

  You create these resources to support communication with a virtual machine:

  Network interfaces

  IP addresses

  Virtual network and subnets

  Create a virtual network

  Step 1: Select Create a resource in the upper left-hand corner of the portal.

  Step 2: In the search box, enter Virtual Network. Select Virtual Network in the search results.

  Step 3: In the Virtual Network page, select Create.

  Step 4: In Create virtual network, enter or select this information in the Basics tab:

  

  Step 5: Enter Region: France Central

  

  Step 6: Select the IP Addresses tab, or select the Next: IP Addresses button at the bottom of the page and enter in the following information then select Add:

  Step 7: For IPv4 address space enter: 10.5.1.0/16

  Step 8: Click Add subnet

  Step 9: For Subnet address range Enter 10.5.1.0/24.

  Step 10: Finish the wizard.

  Reference: https://learn.microsoft.com/en-us/azure/virtual-network/quick-create-portal

• Question 63:

  You need to ensure that subnet 4-3 can accommodate 507 hosts.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Change subnet settings

  Step 1: Go to the Azure portal to view your virtual networks. Search for and select Virtual networks.

  Step 2: Select the name of the virtual network containing the subnet you want to change.

  Step 3: From Settings, select Subnets.

  Step 4: In the list of subnets, select the subnet you want to change settings for. We select subnet 4-3.

  Step 5: In the subnet page, change the Subnet address range setting:

  For 507 hosts we need a 9-bit address range or larger, that is /23.

  Change to address to /23. For example: 10.0.0.0/23 will work fine.

  Note: For example, in a virtual network with address space 10.0.0.0/16, you might define a subnet address space of 10.0.0.0/22. The smallest range you can specify is /29, which provides eight IP addresses for the subnet. Azure reserves the

  first and last address in each subnet for protocol conformance. Three more addresses are reserved for Azure service usage. As a result, defining a subnet with a /29 address range results in three usable IP addresses in the subnet.

  Step 6: Select Save.

  Reference:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-subnet

• Question 64:

  You need to ensure that virtual machines on VNET1 and VNET2 are included automatically in a DNS zone named contosoazure. The solution must ensure that the virtual machines on VNET1 and VNET2 can resolve the names of the virtual machines on either virtual network.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  What is the auto registration feature in Azure DNS private zones?

  The Azure DNS private zones auto registration feature manages DNS records for virtual machines deployed in a virtual network. When you link a virtual network with a private DNS zone with this setting enabled, a DNS record gets created for

  each virtual machine deployed in the virtual network.

  For each virtual machine, an A record and a PTR record are created. DNS records for newly deployed virtual machines are also automatically created in the linked private DNS zone. When a virtual machine gets deleted, any associated DNS

  records also get deleted from the private DNS zone.

  Step 1: Locate the DNS zone contosoazure

  Step 2: On the left pane, select Virtual network links.

  Step 3: Select Add.

  

  Step 4: Type myLink for the Link name.

  Step 5: For Virtual network, select VNET1.

  Step 6: Select the Enable auto registration check box.

  To enable auto registration, select the checkbox for "Enable auto registration" when you create the virtual network link.

  Step 7: Select OK.

  Step 8: Repeat procedure for VNET2.

  Reference:

  https://learn.microsoft.com/en-us/azure/dns/private-dns-autoregistration https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal#link-the-virtual-network

• Question 65:

  You need to ensure that all hosts deployed to subnet3-2 connect to the internet by using the same static public IP address. The solution must minimize administrative effort when adding hosts to the subnet.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  NAT gateway provides outbound internet connectivity for one or more subnets of a virtual network. Once NAT gateway is associated to a subnet, NAT provides source network address translation (SNAT) for that subnet. NAT gateway

  specifies which static IP addresses virtual machines use when creating outbound flows.

  Plan:

  Stage 1: Create a NAT gateway

  Stage 2: Edit subnet subnet3-2 and link it to the NAT gateway

  Stage 1: Create a NAT gateway

  Step 1: Sign in to the Azure portal.

  Step 2: In the search box at the top of the portal, enter NAT gateway. Select NAT gateways in the search results.

  Step 3: Select + Create.

  Step 4: In Create network address translation (NAT) gateway, enter or select this information in the Basics tab:

  * NAT gateway name: Enter myNATgateway

  Step 5: Select the Outbound IP tab, or select the Next: Outbound IP button at the bottom of the page.

  Step 6: In the Outbound IP tab, enter or select the following information:

  Public IP addresses - Select Create a new public IP address.

  In Name, enter myPublicIP.

  Select OK.

  Step 7: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Step 8: Select Create.

  Stage 2: Edit subnet subnet3-2 and link it to the NAT gateway

  Change subnet settings

  Step 1: Go to the Azure portal to view your virtual networks. Search for and select Virtual networks.

  Step 2: Select the name of the virtual network containing the subnet you want to change.

  Step 3: From Settings, select Subnets.

  Step 4: In the list of subnets, select the subnet you want to change settings for. Here choose subnet3-2 connect.

  Step 5: In the subnet page, change the NAT Gateway to myNATgateway (the one we created in Stage 1).

  Step 6: Select Save.

  Reference:

  https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/quickstart-create-nat-gateway-portal

• Question 66:

  You plan to deploy a firewall to subnet1-2. The firewall will have an IP address of 10.1.2.4.

  You need to ensure that traffic from subnet1-1 to the IP address range of 192.168.10.0/24 is routed through the firewall that will be deployed to subnet 1-2. The solution must be achieved without using dynamic routing protocol.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Custom routes, User-defined

  You can create custom, or user-defined(static), routes in Azure to override Azure's default system routes, or to add more routes to a subnet's route table. In Azure, you create a route table, then associate the route table to zero or more virtual

  network subnets. Each subnet can have zero or one route table associated to it.

  Create a route table (Skip Step 1 to Step 4 if route table already present=

  Step 1: From the Azure portal menu, select + Create a resource > Networking > Route table, or search for Route table in the portal search box.

  Step 2: Select Create.

  Step 3: On the Basics tab of Create route table, enter or select information:

  

  Step 4: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

  Create a route

  In this section, you'll create a route in the route table that you created in the previous steps.

  Step 5: Select Go to resource or Search for myRouteTablePublic (The route table you created earlier) in the portal search box.

  Step 6: In the myRouteTablePublic page, select Routes from the Settings section.

  Step 7: In the Routes page, select the + Add button.

  Step 8: In Add route, enter or select this information:

  Route name: SomeName

  Address prefix destination: Select IP Addresses.

  Destination IP addresses/CIDR ranges: Enter 192.168.10.0/24 - The address range of to be routed from.

  Next hop type: Select Virtual appliance.

  Next hop address: Enter 10.1.2.4 (The address of the firewall in the sbunet1-2 subnet).

  Reference:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

  https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

• Question 67:

  You need to configure VNET1 to log all events and metrics. The solution must ensure that you can query the events and metrics directly from the Azure portal by using KQL.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Plan

  Stage 1: Determine the resource group of VNET1

  Stage 2: In Azure Monitor set up monitoring with the VNET's Resource Group as source, and Log Analytics workspace as destination

  Stage 1: Determine the resource group of VNET1

  Step 1: In Azure portal locate VNET1 and detect which resource group it is in (here we use XGroup).

  Stage 2: In Azure Monitor set up monitoring with the VNET's Resource Group as source, and Log Analytics workspace as destination

  Create diagnostic settings

  Step 2: You can configure diagnostic settings in the Azure portal either from the Azure Monitor menu or from the menu for the resource (XGroup in our case).

  Where you configure diagnostic settings in the Azure portal depends on the resource:

  For a single resource, select Diagnostic settings under Monitoring on the resource's menu.

  

  Step 3: If no settings exist on the resource you've selected, you're prompted to create a setting. Select Add diagnostic setting.

  

  Step 4: Give your setting a name if it doesn't already have one.

  

  Step 5: Logs and metrics to route: For logs, either choose a category group or select the individual checkboxes for each category of data you want to send to the destinations specified later. The list of categories varies for each Azure service.

  Select AllMetrics if you want to store metrics in Azure Monitor Logs too.

  We do the following:

  Categories: Select AuditEvent

  Metrics: Select AllMetrics

  (to log all events and metrics)

  Destination details: Select Send to Log Analytics workspace

  (To be able to query using KQL)

  

  Step 6: Destination details -skip

  Step 7: Select Save.

  Note: Azure virtual network collects the same kinds of monitoring data as other Azure resources.

  Azure virtual network uses Azure Monitor.

  Collection and routing

  Platform metrics and the Activity log are collected and stored automatically, but can be routed to other locations by using a diagnostic setting.

  Each Azure resource requires its own diagnostic setting, which defines the following criteria:

  Sources: The type of metric and log data to send to the destinations defined in the setting. The available types vary by resource type.

  Destinations: One or more destinations to send to.

  Destinations

  Platform logs and metrics can be sent to the destinations listed in the following table.

  *

  Log Analytics workspace Metrics are converted to log form. This option might not be available for all resource types. Sending them to the Azure Monitor Logs store (which is searchable via Log Analytics) helps you to integrate them into queries, alerts, and visualizations with existing log data.

  *

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings https://learn.microsoft.com/en-us/azure/virtual-network/monitor-virtual-network

• Question 68:

  You plan to implement an Azure application gateway in the East US Azure region. The application gateway will have Web Application Firewall (WAF) enabled.

  You need to create a policy that can be linked to the planned application gateway. The policy must block connections from IP addresses in the 131.107.150.0/24 range. You do NOT need to provision the application gateway to complete this task.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Web Application Firewall Policies contain all the WAF settings and configurations. This includes exclusions, custom rules, managed rules, and so on. These policies are then associated to an application gateway (global), a listener (per-site),

  or a path-based rule (per-URI) for them to take effect.

  Part 1: Create a WAF policy

  Create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal.

  Step 1: On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create.

  Step 2: On Create a WAF policy page, Basics tab, enter or select the following information and accept the defaults for the remaining settings:

  Policy for - Regional WAF (Application Gateway)

  Subscription - Select your subscription name

  Resource group - Select your resource group

  Policy name - Type a unique name for your WAF policy.

  Location: East US

  Step 3: On the Association tab, select Add association, then select one of the following settings:

  Setting - Value

  Application Gateway- Select the application gateway, and then select Add.

  HTTP Listener - Select the application gateway, select the listeners, then select Add.

  Route Path - Select the application gateway, select the listener, select the routing rule, and then select Add.

  Step 4: Select Review + create, then select Create.

  

  Part 2: Configure WAF rule

  When you create a WAF policy, by default it is in Detection mode. In Detection mode, WAF doesn't block any requests. Instead, the matching WAF rules are logged in the WAF logs. To see WAF in action, you can change the mode settings to

  Prevention. In Prevention mode, matching rules defined in the CRS Ruleset you selected are blocked and/or logged in the WAF logs.

  Custom rules

  Step 5: To create a custom rule, select Add custom rule under the Custom rules tab.

  This opens the custom rule configuration page.

  Step 6: On the Add custom rule page, use the following test values to create a custom rule:

  Setting - Value

  Custom rule name - AnyName

  Status - Enabled

  Rule type- Match

  Priority - 100

  Match type- IP address Match variable - SocketAddr (for example) Operation - Does contain IP address or range - 131.107.150.0/24 Then Deny traffic

  

  Step 7: Select Add.

  Step 8: Select Next: Association.

  Step 9: Select Associate a WAF policy.

  Step 10: For WAF policy, select your WAF policy.

  Step 11: For Domain, select the domain.

  Step 12. Select Add.

  Step 13: Select Review + create.

  Step 14: After your policy validation passes, select Create.

  Reference:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag

  https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-configure-ip-restriction#configure-a-waf-policy-with-the-azure-portal

• Question 69:

  You need to create an Azure Firewall instance named FW1 that meets the following requirements:

  1.

  Has an IP address from the address range of 10.1.255.0/24

  2.

  Uses a new Premium firewall policy named FW-policy1

  3.

  Routes traffic directly to the internet To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Step 1: On the Azure portal menu or from the Home page, select Create a resource.

  Step 2: Type firewall in the search box and press Enter.

  Step 3: Select Firewall and then select Create.

  Step 4: On the Create a Firewall page, use the following table to configure the firewall:

  *

  Name - Enter FW1

  *

  Firewall management - Select Use a Firewall Policy to manage this firewall.

  *

  Firewall policy - Select Add new, and enter FW-policy1.

  *

  Choose a virtual network - Select Create new

  Step 4.1: Enter or select the appropriate values:

  Subscription - Select your Azure subscription.

  Resource group -

  Name -

  Region -

  Step 4.2 Select Next: IP addresses.

  Step 4.3 For IPv4 Address space, accept the default 10.0.0.0/16.

  Step 4.4 Under Subnet, select default.

  Subnet name -

  For Address range, type 10.1.255.0/24

  Step 4.5 Select Save.

  Step 4.6 Select Review + create.

  Step 4.7: Select Create.

  Step 5: Back to the Create a Firewall page:

  * Public IP address - Add new

  Step 6: Accept the other default values, then select Review + create.

  Step 7: Review the summary, and then select Create to create the firewall.

  Reference: https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal-policy https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

• Question 70:

  You need to ensure that the storage12345678 storage account will only accept connections from the hosts on VNET1.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Azure storage account accepts connections from Virtual network. Use private endpoints for Azure Storage

  You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet. Link the private endpoint to the existing storage account

  Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

  Step 2: Select or Searchandfind storage account storage12345678

  Step 3: Select the Networking tab or select Next: Advanced then Next: Networking.

  Step 4: In the Networking tab, under Network connectivity select Disable public access and use private access.

  Step 5: In Private endpoint, select + Add private endpoint.

  Step 6: In the Basics tab of Create a private endpoint, enter or select basic information for the endpoint.

  Step 7: Select Next: Resource.

  Step 8: In the Resource pane, enter or select basic information for the resource.

  Step 9: Select Next: Virtual Network.

  Step 10: In Virtual Network, enter or select:

  * Virtual network: VNET1.

  Step 11: Select Next: DNS.

  Step 12: Leave the defaults in DNS. Select Next: Tags, then Next: Review + create.

  Step 13: Select Create.

  Back in the setting of settings of the Storage Account.

  Step 14: Save.

  Reference:

  https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal