AZ-700: Designing and Implementing Microsoft Azure Networking Solutions Topic 3
Question #: 38
Topic #: 3
You have an Azure subscription that contains the resources shown in the following table.
Gateway1 provides access to App1 by using a URL of https://app1.contoso.com.
You create a new web app named App2.
You need to configure Gateway1 to enable access to App2 by using a URL of https://app2.contoso.com. The solution must minimize administrative effort.
What should you configure on Gateway1?
A. a backend pool and a routing rule
B. a listener and a routing rule
C. a listener, a backend pool, and a routing rule
D. a listener and a backend pool
Selected Answer: C
Question #: 38
Topic #: 4
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You modify the policy settings of WAF1.
Does this meet the goal?
A. Yes
B. No
Selected Answer: B
Question #: 39
Topic #: 4
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You configure a custom rule for WAF1.
Does this meet the goal?
A. Yes
B. No
Selected Answer: A
Question #: 40
Topic #: 4
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.
You need to configure a rate limit for incoming requests to AFD1.
Solution: You add a rule to the rule set of AFD1.
Does this meet the goal?
A. Yes
B. No
Selected Answer: B
Question #: 40
Topic #: 3
You have two Azure virtual networks in the East US Azure region as shown in the following table.
The virtual networks are peered to one another. Each virtual network contains four subnets.
You plan to deploy a virtual machine named VM1 that will inspect and route traffic between all the subnets on both the virtual networks.
What is the minimum number of IP addresses that you must assign to VM1?
A. 1
B. 2
C. 4
D. 8
Selected Answer: A
Question #: 41
Topic #: 3
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. On FW1, configure a DNAT rule for port 1688
B. Deploy a NAT gateway.
C. Add an internet route to RT1 for the Azure Key Management Service (KMS).
D. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
Selected Answer: C
Question #: 42
Topic #: 3
You have an on-premises network.
You have an Azure subscription that includes a virtual network named VNet1 and a private Azure Kubernetes Service (AKS) cluster named AKS1. VNet1 is connected to your on-premises environment via an Azure ExpressRoute circuit. AKS1 is connected to VNet1.
You need to implement an off-cluster ingress controller for AKS1. The solution must provide connectivity from the on-premises environment to containerized workloads hosted on AKS1.
Which Azure service should you use?
A. Azure Application Gateway
B. Azure Front Door
C. Azure Traffic Manager
D. Azure Load Balancer
Selected Answer: A
Question #: 45
Topic #: 3
You have an Azure subscription that contains the Azure App Service web apps shown in the following table.
You need to deploy Azure Traffic Manager. The solution must meet the following requirements:
• Traffic to https://www.fabrikam.com must be directed to App1eu.
• If App1eu becomes unresponsive, all the traffic to https://www.fabrikam.com must be directed to App1us.
You need to implement Traffic Manager to meet the requirements.
Which two resources should you create? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. a Traffic Manager profile that uses the priority routing method
B. a Traffic Manager profile that uses the geographic routing method
C. a CNAME record in a DNS domain named fabrikam.com
D. a TXT record in a DNS domain named fabricam.com
E. a real user measurements key in Traffic Manager
Selected Answer: AC
Question #: 46
Topic #: 4
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement an Azure Front Door profile.
Does this meet the requirement?
A. Yes
B. No
Selected Answer: B
Question #: 47
Topic #: 4
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure Firewall.
Does this meet the requirement?
A. Yes
B. No
Selected Answer: A
Question #: 47
Topic #: 3
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. On FW1, configure a DNAT rule for port 1688.
B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
C. Deploy an application security group that allows outbound traffic to 1688.
D. Deploy an Azure Standard Load Balancer that has an outbound NAT rule.
Selected Answer: B
Question #: 48
Topic #: 3
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1.
You deploy an instance of Azure Application Gateway v2 named AppGw1 to Subnet1. You create a network security group (NSG) named NSG1 and link NSG1 to Subnet1.
You need to ensure that AppGw1 will only load balance traffic that originates from VNet1. The solution must minimize the impact on the functionality of AppGw1.
What should you add to NSG1?
A. an outbound rule that has a priority of 4096 and blocks all internet traffic
B. an inbound rule that has a priority of 4096 and blocks all internet traffic
C. an inbound rule that has a priority of 100 and blocks all internet traffic
D. an outbound rule that has a priority 100 and blocks all internet traffic
Selected Answer: B
Question #: 48
Topic #: 4
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.
Hub1 has a security status of Unsecured.
You need to ensure that the security status of Hub1 is marked as Secured.
Solution: You implement Azure NAT Gateway.
Does this meet the requirement?
A. Yes
B. No
Selected Answer: B
Question #: 49
Topic #: 3
You plan to implement an Azure virtual network that will contain 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.
You need to recommend a load balancing solution for the virtual network. The solution must meet the following requirements:
• The virtual machines and the load balancer must be accessible only from the virtual network.
• Costs must be minimized.
What should you include in the recommendation?
A. Basic Azure Load Balancer
B. Azure Application Gateway v1
C. Azure Standard Load Balancer
D. Azure Application Gateway v2
Selected Answer: C
Question #: 50
Topic #: 3
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. On FW1, configure a DNAT rule for port 1688.
B. Deploy an application security group that allows outbound traffic to 1688.
C. Add an internet route to RT1 for the Azure Key Management Service (KMS).
D. Deploy an Azure Standard Load Balancer that has an outbound NAT rule.
Selected Answer: C
Question #: 53
Topic #: 3
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. On FW1, create an outbound service tag rule for AzureCloud.
B. Deploy an Azure Standard Load Balancer that has an outbound NAT rule.
C. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
D. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
Selected Answer: C
Question #: 54
Topic #: 3
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machine operating systems were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
C. Deploy a NAT gateway.
D. Deploy an application security group that allows outbound traffic to 1688.
Selected Answer: C
Question #: 55
Topic #: 2
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
A. storage account
B. internal load balancers
C. service endpoints
D. virtual network peering
Selected Answer: B
Question #: 56
Topic #: 2
You have the on-premises networks shown in the following table.
You have an Azure subscription that contains an Azure virtual WAN named VWAN1 and a virtual network named VNet1. VWAN is connected to the on-premises networks and VNet1 in a full mesh topology. The virtual hub routing preference for VWAN1 is AS Path.
You need to route traffic from VNet1 to 10.61.1.5.
Which path will be used?
A. the VPN connection to Branch1
B. the VPN connection to Branch2
C. the ExpressRoute connection to Branch2
D. the ExpressRoute connection to Branch3
Selected Answer: D
Question #: 57
Topic #: 3
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to Subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machine operating systems were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
A. On FW1, create an outbound service tag rule for AzureCloud.
B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
C. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.
D. Deploy an application security group that allows outbound traffic to 1688.
Selected Answer: B
Question #: 58
Topic #: 2
You have an Azure subscription that contains a virtual network named VNet1.
You deploy several web apps and configure the apps to use private endpoints on VNet1.
You need to identify which DNS records the web apps registered automatically.
Where will the records be created?
A. an Azure DNS zone named privatelink.azurewebsites.net
B. an Azure Private DNS zone named azurewebsites.net
C. an Azure Private DNS zone named privatelink.azurewebsites.net
D. an Azure DNS zone named azurewebsites.net
Selected Answer: C
Question #: 60
Topic #: 2
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
A. storage account
B. internal load balancers
C. service endpoints
D. service endpoint policies
Selected Answer: B
Question #: 61
Topic #: 2
You have the Azure virtual networks shown in the following table.
You deploy Azure Firewall to Vnet3.
You need to ensure that the traffic from Subnet1-1 to Subnet2-1 passes through the firewall.
What should you configure?
A. peering links between Vnet1 and Vnet2
B. a route table associated to Subnet1-1 and Subnet2-1
C. an Azure private DNS zone
D. a route table associated to AzureFirewallSubnet
Selected Answer: B
Question #: 62
Topic #: 2
You plan to implement an Azure virtual network that will contain 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.
You need to recommend which subnet mask size to use for the virtual subnets.
What should you recommend?
A. /64
B. /120
C. /48
D. /24
Selected Answer: A
Question #: 64
Topic #: 2
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
A. Azure Virtual Network NAT
B. service endpoint policies
C. internal load balancers
D. virtual network peering
Selected Answer: A
Question #: 66
Topic #: 2
You have an Azure subscription that contains a virtual network named VNet1. VNet1 has a subnet mask of/24.
You plan to implement an Azure application gateway that will have the following configurations:
• Public endpoints: 1
• Private endpoints: 1
• Minimum instances: 1
• Maximum instances: 10
You need to configure the address space for the subnet of the application gateway. The solution must minimize the number of IP addresses allocated to the application gateway subnet.
What is the minimum number of assignable IP addresses required?
A. 1
B. 2
C. 11
D. 12
E. 20
Selected Answer: C
Question #: 74
Topic #: 2
SIMULATION
–
Username and password
–
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password, place your cursor in the Enter password box and click on the password below.
Azure Username: User-12345678@cloudslice.onmicrosoft.com
Azure Password: xxxxxxxxxx
–
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 12345678
–
You plan to deploy two DNS servers to subnet2-1. Each server will host a DNS zone for fabrikam,com. The DNS zones will contain records from the on-premises network only. The IP address of the DNS servers will be 10.2.1.4 and 10.2.1.5.
You need to ensure that virtual machines on VNET2 can resolve the names of the on-premises servers in fabrikam.com.
To complete this task, sign in to the Azure portal.
A. 1
B. 2
C. 11
D. 12
E. 20
Selected Answer: B
Question #: 1
Topic #: 14
HOTSPOT –
You need to restrict traffic from VMScaleSet1 to VMScaleSet2. The solution must meet the virtual networking requirements.
What is the minimum number of custom NSG rules and NSG assignments required? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Box 2: One NSG –
Box 1: Two custom rules –
Question #: 1
Topic #: 12
HOTSPOT –
You are implementing the virtual network requirements for VM-Analyze.
What should you include in a custom route that is linked to Subnet2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
A C
Question #: 1
Topic #: 13
HOTSPOT –
You create NSG10 and NSG11 to meet the network security requirements.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Y Y N
Question #: 1
Topic #: 6
HOTSPOT –
You need to recommend a configuration for the ExpressRoute connection from the Boston datacenter. The solution must meet the hybrid networking requirements and business requirements.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
box1: Ultra Performance
box 2: connect vnet2 directly to the ER circuit
Question #: 1
Topic #: 15
HOTSPOT –
In which NSGs can you use ASG1 and to which virtual machine network interfaces can you associate ASG1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
NSG1,NSG2
VM2 only
Question #: 1
Topic #: 10
HOTSPOT –
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
N Y N
Question #: 1
Topic #: 9
DRAG DROP –
You need to prepare Vnet1 for the deployment of an ExpressRoute gateway. The solution must meet the hybrid connectivity requirements and the business requirements.
Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer.
Select and Place:
1. Delete VPN GW1.
2. Set the subnet mask of Gateway Subnet to /27.
3. Create a VPN gateway by using the VPN GW1 SKU.
Question #: 2
Topic #: 10
HOTSPOT –
Which virtual machines can VM1 and VM4 ping successfully? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Box 1: VM2, VM3 and VM4.
Box 2: VM1, VM2 and VM3.
Question #: 2
Topic #: 3
HOTSPOT –
You have an Azure subscription that contains the route tables and routes shown in the following table.
The subscription contains the subnets shown in the following table.
The subscription contains the virtual machines shown in the following table.
The subscription contains the local network gateways shown in the following table.
There is a Site-to-Site VPN connection to each local network gateway.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
N N Y
Question #: 2
Topic #: 5
HOTSPOT –
You have the Azure App Service app shown in the App Service exhibit.
The VNet Integration settings for as12 are configured as shown in the Vnet Integration exhibit.
The Private Endpoint connections settings for as12 are configured as shown in the Private Endpoint connections exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Y Y N
Question #: 5
Topic #: 4
HOTSPOT –
You have an Azure subscription that contains the virtual machines shown in the following table.
Subnet1 and Subnet2 are associated to a network security group (NSG) named NSG1 that has the following outbound rule:
✑ Priority: 100
✑ Port: Any
✑ Protocol: Any
✑ Source: Any
✑ Destination: Storage
✑ Action: Deny
You create a private endpoint that has the following settings:
✑ Name: Private1
✑ Resource type: Microsoft.Storage/storageAccounts
✑ Resource: storage1
✑ Target sub-resource: blob
✑ Virtual network: Vnet1
✑ Subnet: Subnet1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
N Y N
Question #: 5
Topic #: 2
HOTSPOT –
You have an Azure private DNS zone named contoso.com that is linked to the virtual networks shown in the following table.
The links have auto registration enabled.
You create the virtual machines shown in the following table.
You manually add the following entry to the contoso.com zone:
✑ Name: VM1
IP address: 10.1.10.9 –
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
N N N
Question #: 3
Topic #: 7
HOTSPOT –
You need to implement name resolution for the cloud.litwareinc.com. The solution must meet the networking requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
A C
Question #: 3
Topic #: 5
DRAG DROP –
You have an Azure virtual network named Vnet1 that connects to an on-premises network.
You have an Azure Storage account named storageaccount1 that contains blob storage.
You need to configure a private endpoint for the blob storage. The solution must meet the following requirements:
✑ Ensure that all on-premises users can access storageaccount1 through the private endpoint.
✑ Prevent access to storageaccount1 from being interrupted.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Order: 5 1 2 3
Question #: 3
Topic #: 2
HOTSPOT –
You have the Azure environment shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
C D
Question #: 3
Topic #: 9
HOTSPOT –
You need to implement a P2S VPN for the users in the branch office. The solution must meet the hybrid networking requirements.
What should you do? To answer, select the appropriate options in the answer area.
Hot Area:
B C
Question #: 2
Topic #: 11
DRAG DROP –
You need to implement outbound connectivity for VMScaleSet1. The solution must meet the virtual networking requirements and the business requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Create a public load balancer in the Standard SKU
Create a backend pool that contains VMScaleSet1
Create an outbound rule
Question #: 7
Topic #: 5
HOTSPOT –
You have the Azure environment shown in the Azure Environment exhibit.
The settings for each subnet are shown in the following table.
The Firewalls and virtual networks settings for storage1 are configured as shown in the Storage1 exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Y N N
Question #: 7
Topic #: 3
HOTSPOT –
You have an Azure Front Door instance that provides access to a web app. The web app uses a hostname of www.contoso.com.
You have the routing rules shown in the following table.
Which rule will apply to each incoming request? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point
Hot Area:
A C D