AZ-700 Online Practice Questions and Answers

Correct Answer:

Step 1: Deploy an Azure Load Balancer in front of the application server

Configure your application to run behind a standard load balancer in your virtual network.

Step 2: In Subscription 1, create a private link service and attach the service to the frontend IP configuration of the load balancer.

Create a Private Link Service referencing the load balancer above.

Step 3: In Subscription 2, create a private endpoint by using the private link service.

Private Link service can be accessed from approved private endpoints in any public region. The private endpoint can be reached from the same virtual network, regionally peered VNets, globally peered VNets and on premises using private

VPN or ExpressRoute connections.

Step 4: In Subscription1, accept the private endpoint connection request.

Network connections can be initiated only by clients that are connecting to the private endpoint.

Not:

Incorrect: Enable virtual network peering between Vnet1 and Vnet2.

Reference:

https://docs.microsoft.com/en-us/azure/private-link/private-link-service-overview

https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview

Correct Answer:

Box 1: Yes

Resources in Subnet1 will use the Route2 and its Next hop ID address to the Firewall to reach the Internet.

Box 2: Yes

Yes, with network network peering.

Box 3: No

Resources in Subnet2 can only reach resources in Subnet1, as gateway transit for virtual network peering has not been configured.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit

Correct Answer:

Correct Answer: D

Reference: https://docs.microsoft.com/en-us/azure/application-gateway/end-to-end-ssl-portal https://docs.microsoft.com/en-us/azure/application-gateway/create-ssl-portal#configuration-tab

Correct Answer: B

Correct Answer: A

Azure Load Balancer Floating IP configuration Floating IP Some application scenarios prefer or require the same port to be used by multiple application instances on a single VM in the backend pool. Common examples of port reuse include:

clustering for high availability network virtual appliances exposing multiple TLS endpoints without re-encryption.

If you want to reuse the backend port across multiple rules, you must enable Floating IP in the rule definition.

In the diagrams below, you see how IP address mapping works before and after enabling Floating IP: Note: Azure Load Balancer supports rules to configure traffic to the backend pool. There are four types of rules:

*

Load-balancing rules - A load balancer rule is used to define how incoming traffic is distributed to the all the instances within the backend pool. A load-balancing rule maps a given frontend IP configuration and port to multiple backend IP addresses and ports.

*

High availability ports

*

Inbound NAT rule

*

Outbound NAT rule Reference:

https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-floating-ip https://learn.microsoft.com/en-us/azure/load-balancer/manage-rules-how-to

Correct Answer: B

The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

Correct Answer: A

One SKU Premium required.

Azure ExpressRoute offers three different circuit SKUs, known as Local, Standard, and Premium, which provide varying degrees of connectivity scope.

Standard: a Standard SKU ExpressRoute circuit provides connectivity to resources in all Azure regions in a geopolitical area. Under this scenario, the on-premises network in London can connect to resources and access Azure's cloud

services hosted in regions such as West Europe (Amsterdam, Netherlands) and France Central (Paris, France) through ExpressRoute

Premium: a Premium SKU ExpressRoute circuit facilitates connectivity to resources and cloud services globally across all Azure regions. Specifically, this global connectivity is delivered over the Microsoft core network. In this case, the on-

premises network in London can link a virtual network created in West Europe (Amsterdam, Netherlands) to an Azure ExpressRoute circuit created in Japan East (Tokyo, Japan)

Reference: https://dgtlinfra.com/azure-expressroute-benefits-pricing-providers-locations/

Correct Answer: B

RemoteAddr specifies the IP Address/Range of the remote computer connection. So, you should use RemoteAddr instead of request headers. https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/custom-waf-rules-overview#match-variable- required

Correct Answer: A

Correct Answer(s):

Connection Troubleshoot - The connection troubleshoot capability enables you to test a connection between a VM and another VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned when using the

connection monitor capability, but tests the connection at a point in time, rather than monitoring it over time, as connection monitor does

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

Wrong Answers:

Next hop -- Next hop helps you determine if traffic is being directed to the intended destination, or whether the traffic is being sent nowhere.

NSG flow logs -- NSG flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG.

Traffic Analytics It provides visibility into user and application activity in cloud networks.

Correct Answer: A

You need to configure the VM NICs with an IPv6 address. https://docs.microsoft.com/en-us/azure/load-balancer/ipv6-add-to-existing-vnet-cli

Correct Answer: C

Application Gateway uses one private IP address per instance, plus another private IP address if a private frontend IP is configured. https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#size-of-the-subnet

Correct Answer: D

ErGw3Az and Ultra Performance SKU supports FastPath. ErGw3Az is Zone-redundant, but not Ultra Performance SKU.

Correct Answer: A

You can use a network security group to filter inbound and outbound network traffic to and from Azure resources in an Azure virtual network. Plan Stage 1: Create a network security group

Stage 2: Associate network security group to subnet Stage 3: Create security rule Stage 1: Create a network security group

A network security group (NSG) secures network traffic in your virtual network.

Step 1: From the Azure portal menu, select + Create a resource > Networking > Network security group, or search for Network security group in the portal search box.

Step 2: Select Create.

Step 3: On the Basics tab of Create network security group, enter or select this information:

*Details omitted*

Step 4: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

Step 5: Select Create.

Stage 2: Associate network security group to subnet

In this section, you'll associate the network security group with the subnet of the virtual network you created earlier.

Step 6: Search for myNsg (the name you give in stage 1) in the portal search box.

Step 7: Select Subnets from the Settings section of myNSG.

Step 8: In the Subnets page, select + Associate:

Step 9: Under Associate subnet, select myVNet (the virtual network that is available) for Virtual network.

Step 10: Select subnet1-2 for Subnet, and then select OK.

Stage 3: Create security rule

Step 11: Select Inbound security rules from the Settings section of myNSG.

Step 12: In Inbound security rules page, select + Add:

Step 13: Create a security rule that blocks TCP port 5585 to the network security group you created earlier. In Add inbound security rule page, enter or select this information:

(You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2.)

Source: Leave the default of Any.

Source port ranges: Leave the default of (*).

Destination: Select Network security group.

Destination Network security groups: Select the network security group you created earlier.

Service: Leave the default of Custom.

Destination port ranges: Enter 5585

Protocol: Select TCP.

Action: Deny

Priority Leave the default of 100.

Name: Enter something

Step 14: Select Add.

Reference: https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic

Correct Answer: A

Use private endpoints for Azure Storage You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

Connect to a storage account using an Azure Private Endpoint

Create a private endpoint

Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

Step 2: Locate and select the Storage Account storage123456789

Step 3: Select the Networking tab or select Next: Advanced then Next: Networking.

Step 4: In the Networking tab, under Network connectivity select Disable public access and use private access.

Step 5: In Private endpoint, select + Add private endpoint.

Step 6: In Create private endpoint enter or select the following information:

*Details omitted*

* Virtual network: Select VNET1.

Step 7: Select OK.

Step 8: Select Review.

Step 9: Select Create.

Reference:

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal