Question 90
A storage private endpoint receives an approved connection but a web app still connects to the storage public IP. A team wants to allow multiple consumer VNets to use one SQL private endpoint without peering or routing between those VNets. Which response best addresses these needs?
- Review and restrict the SQL service's public network access independently from the private endpoint connection; Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address; Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address; create an Azure private endpoint for the required storage subresource and configure private name resolution.
- Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution; do not Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
Explanation
Correct Answer
B:Private endpoint routing depends on name resolution; successful resource provisioning alone does not redirect clients. Private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone. Both actions are needed.
Incorrect Answers
A:Private endpoint routing depends on name resolution; successful resource provisioning alone does not redirect clients.
C:Private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone.
D:This plan leaves out a required action: Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address. The remaining action alone does not satisfy the situation.
Question 91
Two IPsec peers agree on addresses but IKE negotiation fails because the encryption and integrity algorithms differ. Which response best addresses this Azure networking scenario?
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration.
- Evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists.
- Align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance.
Explanation
Correct Answer
D:A routed path alone cannot establish encryption when negotiated cryptographic proposals are incompatible.
Incorrect Answers
A:Updating the local network gateway public endpoint and confirming the advertised prefixes and IKE peer configuration would not align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance.
B:Evaluating Azure Extended Network support, compatibility, and a tested migration topology would not align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance.
C:For this finding, a routed path alone cannot establish encryption when negotiated cryptographic proposals are incompatible.
Question 92
An enterprise needs services in two geographically separated Azure regions but chooses a circuit tier that cannot deliver its intended global reachability. A connection is intermittently slow and engineers have no failure-detection mechanism beyond long BGP hold timers. Which course of action addresses the stated issues?
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths; do not select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach.
- Evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
Explanation
Correct Answer
B:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules. BFD can signal forwarding failures faster than waiting solely on ordinary BGP timers. Both actions are needed.
Incorrect Answers
A:BFD can signal forwarding failures faster than waiting solely on ordinary BGP timers.
C:This plan leaves out a required action: Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach. The remaining action alone does not satisfy the situation.
D:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules.
Question 93
Hybrid DNS forwarding works for a test VNet but a newly added VNet still cannot resolve names in the on-premises domain. Operations replaces an inbound endpoint's subnet and assumes on-premises conditional forwarders will continue working with the former inbound address. Which response best addresses these needs?
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries; Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
- Configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path; Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries; check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address.
- Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end; do not verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries.
Explanation
Correct Answer
A:DNS resolver forwarding policies do not automatically apply to newly connected VNets without the right ruleset link. The forwarding target must be reachable and current after endpoint changes; old private resolver IPs are not aliases. Both actions are needed.
Incorrect Answers
B:DNS resolver forwarding policies do not automatically apply to newly connected VNets without the right ruleset link.
C:The forwarding target must be reachable and current after endpoint changes; old private resolver IPs are not aliases.
D:This plan leaves out a required action: Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries. The remaining action alone does not satisfy the situation.
Question 94
A company wants an NVA in a virtual hub for specialized packet inspection but tries to insert an arbitrary VM into the managed hub subnet. A branch VPN connects into Virtual WAN but the security team assumes all traffic is encrypted and inspected by default, regardless of hub policy. What is the most appropriate plan for this situation?
- Use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites; review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
- Inspect Virtual WAN route-table associations and route propagation settings for each connection; review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
- Use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites; select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits.
- Review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows; do not use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites.
Explanation
Correct Answer
A:Managed virtual hub architectures restrict how third-party network security appliances are integrated. VPN tunnel encryption does not itself provide application-layer threat inspection across transit paths. Both actions are needed.
Incorrect Answers
B:Managed virtual hub architectures restrict how third-party network security appliances are integrated.
C:VPN tunnel encryption does not itself provide application-layer threat inspection across transit paths.
D:This plan leaves out a required action: Use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites. The remaining action alone does not satisfy the situation.
Question 95
A business wants to join two VNets in different Azure geographies through ExpressRoute but treats one circuit as globally valid without checking tier restrictions. A private peering setup works for one site but two sites advertise the same RFC1918 prefix and traffic selects the wrong return path. A customer enables ExpressRoute resiliency but never checks the provider circuit's secondary BGP session, leaving a single point of route failure. Which course of action addresses the stated issues?
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology; Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment; and run a staged routing cutover with application session tests and a documented rollback and convergence window.
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology; run a staged routing cutover with application session tests and a documented rollback and convergence window; and Monitor and validate both provider path BGP sessions and test a deliberate failover.
- Run a staged routing cutover with application session tests and a documented rollback and convergence window; Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment; and Monitor and validate both provider path BGP sessions and test a deliberate failover.
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology; Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment; and Monitor and validate both provider path BGP sessions and test a deliberate failover.
Explanation
Correct Answer
D:ExpressRoute geography and connectivity scale vary by SKU and peering locations. Private peering cannot reliably identify the intended location when separate sites publish the same prefix. Documented redundancy is ineffective if one BGP peer is already down before an incident. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: documented redundancy is ineffective if one BGP peer is already down before an incident.
B:Two actions meet their requirements, but action 2 misses this need: private peering cannot reliably identify the intended location when separate sites publish the same prefix.
C:Two actions meet their requirements, but action 1 misses this need: expressRoute geography and connectivity scale vary by SKU and peering locations.
Question 96
A security analyst must verify whether a particular SSH packet is permitted but has only a list of all NSG rules. An Azure VM needs emergency administration without any public IP or an always-open internet-facing RDP rule. A network team opens TCP 3389 to all addresses because engineers sometimes need VM access from home. Which response best addresses these needs?
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; and remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
- Use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; and remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy; and remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; and use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
Explanation
Correct Answer
A:The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection. Azure Bastion permits managed browser or client sessions to private VM addresses without exposing an RDP public listener. Wide-open management ports increase the attack surface independently of the VM's login credentials. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: the evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.
C:Two actions meet their requirements, but action 2 misses this need: azure Bastion permits managed browser or client sessions to private VM addresses without exposing an RDP public listener.
D:Two actions meet their requirements, but action 3 misses this need: wide-open management ports increase the attack surface independently of the VM's login credentials.
Question 97
During an Azure networking rollout, the team must resolve both of these conditions. Operations adds new sites without monitoring hub gateway health, and users report delayed recognition of a partial regional failure. A third-party firewall integration into Virtual WAN blocks half the sites because only a subset of connections use the secured route table. What is the most appropriate plan for this situation?
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration.
- Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point; do not configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts.
Explanation
Correct Answer
A:A managed WAN design still needs monitoring of ingress, hub routing and active connections. Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered. Both actions are needed.
Incorrect Answers
B:Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered.
C:A managed WAN design still needs monitoring of ingress, hub routing and active connections.
D:This plan leaves out a required action: Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts. The remaining action alone does not satisfy the situation.
Question 98
A network rule uses overly broad any-to-any settings, and monitoring cannot identify which service depends on it. What should the Azure network engineer do?
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution.
- Validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session.
- Verify rule collection group and collection priorities and the documented processing order before rollout.
- Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules.
Explanation
Correct Answer
D:Observed flow data supports restricting exposure while preserving the identified business traffic.
Incorrect Answers
A:Aligning the documented DNS proxy and resolver settings and validating consistent destination resolution would not analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules.
B:For this finding, observed flow data supports restricting exposure while preserving the identified business traffic.
C:Verifying rule collection group and collection priorities and the documented processing order would not analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules.
Question 99
A spoke-to-spoke path fails after deployment, and the administrator checks only its route table JSON rather than what each VM receives. A forced-tunneling design sends everything through an on-premises firewall, but Azure platform dependencies unexpectedly lose connectivity. Which response best addresses these needs?
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly.
- Validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; do not inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
- Enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly.
Explanation
Correct Answer
B:Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved. Forced tunneling must account for platform control paths and documented service exceptions, not just user traffic. Both actions are needed.
Incorrect Answers
A:Forced tunneling must account for platform control paths and documented service exceptions, not just user traffic.
C:This plan leaves out a required action: Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries. The remaining action alone does not satisfy the situation.
D:Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved.
Question 100
Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. What is the most appropriate plan for this situation?
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; do not use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
C:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity. Peering relationships are not automatically transitive across another VNet. Both actions are needed.
Incorrect Answers
A:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.
B:This plan leaves out a required action: Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement. The remaining action alone does not satisfy the situation.
D:Peering relationships are not automatically transitive across another VNet.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests