Microsoft Microsoft Certifications AZ-700 Questions & Answers

• Question 71:

  You need to ensure that requests for www.relecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Stage 1: Create an Azure private DNS zone using the Azure portal.

  Step 1: On the portal search bar, type private dns zones in the search text box and press Enter.

  Step 2: Select Private DNS zone.

  Step 3: Select Create private dns zone.

  On the Create Private DNS zone page, type or select appropriate values:

  Resource group: Select Create new, enter something X, and select OK. The resource group name must be unique within the Azure subscription.

  Name: Type private.relecloud.com.

  Resource group location:

  Step 4: Select Review + Create.

  Step 5: Select Create.

  Stage 2: Create a CNAME DNS record

  Step 6: Open the X resource group you created earlier and select the private.relecloud.com private zone.

  You can enter private.relecloud.com the Filter by name box to find it more easily.

  Step 7: At the top of the DNS zone page, select + Record set.

  Step 8: On the Add record set page, type or select the following values:

  Name: Type www.

  Type: CNAME

  Record set properties: frontdoor1.azurefd.net

  Step 9: Select Save at the top of the page to save your settings. Then close the page.

  Reference:

  https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal

  https://learn.microsoft.com/en-us/azure/dns/dns-operations-recordsets-portal

• Question 72:

  You need to ensure that connections to the storage12345678 storage account can be made by using an IP address in the 10.1.1.0/24 range and the name storage12345678.privatelink.blob.core.windows.net.

  To complete this task, sign in to the Azure portal.

  A. See explanation below.

  B. Placeholder

  C. Placeholder

  D. Placeholder

  Correct Answer: A

  Use private endpoints for Azure Storage

  You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each

  storage account service.

  Plan:

  Stage 1: Create a virtual network and subnet

  Stage 2: Create a private endpoint

  Stage 1: Create a virtual network and subnet

  Step 1: Sign in to the Azure portal.

  Step 2: In the search box at the top of the portal, enter Virtual network. In the search results, select Virtual networks.

  Step 3: Select + Create in Virtual networks.

  Step 4: In the Basics tab of Create virtual network, enter or select the following information.

  Subscription -Select your subscription.

  Resource group - Select Create new.

  Enter SomeName in Name and select OK.

  Instance details

  Name - Enter myVNet for example

  Region - Select West Europe.

  Step 5: Select Next: IP Addresses or the IP Addresses tab.

  Step 6: Select the IP Addresses tab or select Next: IP Addresses at the bottom of the page.

  Step 7: In the IP Addresses tab, enter the following information:

  * IPv4 address space - Enter 10.1.0.0/16

  Step 8: Select Add subnet. In Edit subnet, enter the following information:

  Subnet name - Enter mySubnet

  Subnet address range - Enter 10.1.1.0/24 (as specified in the question)

  Step 9: For the subnet: Select the Review + create tab or select the Review + create button.

  Step 10: For the Virtual network: Select the Review + create tab or select the Review + create button.

  Stage 2: Create a private endpoint

  Step 1: In the search box at the top of the portal, enter Private endpoint. Select Private endpoints.

  Step 2: Select + Create in Private endpoints.

  Step 3: In the Basics tab of Create a private endpoint, enter or select the following information.

  *

  Storage subresource - storage12345678.privatelink.blob.core.windows.net

  *

  Private DNS integration.

  Integrate with private DNS zone - Leave the default Yes.

  *

  Private DNS Zone

  Leave the default (New) privatelink.blob.core.windows.net.

  Step 4: Select Next: Resource.

  Step 5: In the Resource pane, leave the defaults.

  Step 6: Select Next: Virtual Network.

  Step 7: In Virtual Network, enter or select the following information.

  Virtual network - Select the virtual network you created in stage 1.

  Subnet - Select the subnet you created in stage 1.

  Step 8: Select Next: DNS.

  Step 9: Leave the defaults in DNS. Select Next: Tags, then Next: Review + create.

  Step 10: Select Create.

  Reference: https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints https://learn.microsoft.com/en-us/azure/private-link/create-private-endpoint-portal

• Question 73:

  You need to configure GW1 to meet the network security requirements for the P2S VPN users.

  Which Tunnel type should you select in the Point-to-site configuration settings of GW1?

  A. IKEv2 and OpenVPN (SSL)

  B. IKEv2

  C. IKEv2 and SSTP (SSL)

  D. OpenVPN (SSL)

  E. SSTP (SSL)

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 74:

  What should you implement to meet the virtual network requirements for the virtual machines that connect to Vnet4 and Vnet5?

  A. a private endpoint

  B. a routing table

  C. a service endpoint

  D. a private link service

  E. a virtual network peering

  Correct Answer: E

  There is no virtual network peering between VM4's VNet (VNet3) and VM5's VNet (VNet4). To enable the VMs to communicate over the Microsoft backbone network a VNet peering is required between VNet3 and VNet4.

• Question 75:

  You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements. Which two actions should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. On the peering from Vnet1, select Allow for Traffic forwarded from remote virtual network.

  B. On the peerings from Vnet2 and Vnet3, select Allow for Traffic forwarded from remote virtual network.

  C. On the peering from Vnet1, select Use the remote virtual network's gateway or Route Server.

  D. On the peering from Vnet1, select Allow for Traffic to remote virtual network.

  E. On the peerings from Vnet2 and Vnet3, select Use the remote virtual network's gateway or Route Server.

  Correct Answer: BE

  Correct answer is: BE.

  The justification is as follows:

  -

  E IS obviously an answer because without it the requirements cannot be met.

  -

  D is NOT an answer, because: The case study says that "There is bidirectional peering between Vnet1 and Vnet2. There is bidirectional peering between Vnet1 and Vnet3." This means that "Traffic to remote virtual network" is already allowed for Vnet1<...>Vnet2 and Vnet1<...>.

  -C is a total nonsense.

  -

  B IS an answer, because Vnet1 contains the VPN gateway that forwards the traffic between Vnet2 and Vnet3.

  -

  A is NOT an answer, because Vnet2 and Vnet3 don't have VPN gateways so they cannot forward traffic to Vnet1. Documentation: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering?tabs=peering-portal#create-a-peering https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

• Question 76:

  You need to provide access to storage1. The solution must meet the PaaS networking requirements and the business requirements. What should you include in the solution?

  A. a private endpoint

  B. Azure Traffic Manager

  C. Azure Front Door

  D. a service endpoint

  Correct Answer: A

  service endpoint limitation Endpoints are enabled on subnets configured in Azure virtual networks. Endpoints can't be used for traffic from your premises to Azure services

• Question 77:

  You need to configure the default route in Vnet2 and Vnet3. The solution must meet the virtual networking requirements. What should you use to configure the default route?

  A. a user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3

  B. a user-defined route assigned to GatewaySubnet in Vnet1

  C. BGP route exchange

  D. route filters

  Correct Answer: C

  You must use BGP to advertise on-premises routes to the Microsoft Edge router. You cannot create user-defined routes to force traffic to the ExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type: ExpressRoute

  Source: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#border-gateway-protocol

• Question 78:

  You need to configure the default route on Vnet2 and Vnet3. The solution must meet the virtual networking requirements. What should you use to configure the default route?

  A. route filters

  B. BGP route exchange

  C. a user-defined route assigned to GatewaySubnet in Vnet1

  D. a user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3

  Correct Answer: B

  You cannot specify a virtual network gateway created as type ExpressRoute in a user-defined route because with ExpressRoute, you must use BGP for custom routes https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

• Question 79:

  You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements.

  Which two actions should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. On the peering from Vnet1, select Allow gateway transit.

  B. On the peerings from Vnet2 and Vnet3, select Use remote gateways.

  C. On the peerings from Vnet2 and Vnet3, select Allow gateway transit.

  D. On the peering from Vnet1, select Use remote gateways.

  E. On the peering from Vnet1, select Allow forwarded traffic.

  Correct Answer: AB

  Virtual network peering seamlessly connects two Azure virtual networks, merging the two virtual networks into one for connectivity purposes. Gateway transit is a peering property that lets one virtual network use the VPN gateway in the peered virtual network for cross-premises or VNet-to-VNet connectivity. The following diagram shows how gateway transit works with virtual network peering.

  

  In the diagram, gateway transit allows the peered virtual networks to use the Azure VPN gateway in Hub-RM. Connectivity available on the VPN gateway, including S2S, P2S, and VNet-to-VNet connections,

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

• Question 80:

  You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements. Which connectivity method should you use?

  A. a private endpoint

  B. Azure Firewall

  C. Azure Front Door

  D. a service endpoint

  Correct Answer: A

  wsrudmen Highly Voted 1 year ago Selected Answer: A Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network. Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP

  Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK