Question 100
Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. What is the most appropriate plan for this situation?
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; do not use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
C:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity. Peering relationships are not automatically transitive across another VNet. Both actions are needed.
Incorrect Answers
A:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.
B:This plan leaves out a required action: Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement. The remaining action alone does not satisfy the situation.
D:Peering relationships are not automatically transitive across another VNet.
Question 101
A project uses Virtual Network Manager security admin rules and local NSGs but assumes their precedence is a simple concatenated NSG list. Which response most directly resolves the issue?
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
Explanation
Correct Answer
C:Central security administration rules are evaluated differently from standard workload NSG rules.
Incorrect Answers
A:Using supported Azure service tags and narrowly scoped protocols where applicable would not validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy.
B:Here, central security administration rules are evaluated differently from standard workload NSG rules.
D:Reviewing NSG stateful flow behavior and verifying active session handling would not validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy.
Question 102
During an Azure networking rollout, the team must resolve both of these conditions. A private endpoint connection is approved for production, but administrators forget that its data plane still uses an overprivileged service identity. A developer connects privately to a PaaS service but disables TLS certificate validation because the service now has a private IP. Which response best addresses these needs?
- Continue using the service's valid hostname and certificate validation over the private endpoint connection; do not apply least-privilege service authorization and identity controls in addition to the private network connection.
- Apply least-privilege service authorization and identity controls in addition to the private network connection; Continue using the service's valid hostname and certificate validation over the private endpoint connection.
- Apply least-privilege service authorization and identity controls in addition to the private network connection; check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.
- Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance; Continue using the service's valid hostname and certificate validation over the private endpoint connection.
Explanation
Correct Answer
B:Private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself. A private IP does not make encrypted transport or endpoint identity verification unnecessary. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Apply least-privilege service authorization and identity controls in addition to the private network connection. The remaining action alone does not satisfy the situation.
C:A private IP does not make encrypted transport or endpoint identity verification unnecessary.
D:Private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself.
Question 103
An application gateway deployment fails because the team put backend VMs and its gateway instances in the same subnet. A team adds a private endpoint to a VNet but assumes it must reserve the entire gateway subnet for the endpoint. What is the most appropriate plan for this situation?
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; do not Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets; create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion.
- Select a supported public ingress service or public IP association target instead of inventing direct attachment capability; Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets; Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
Explanation
Correct Answer
D:Application Gateway has subnet placement requirements that are distinct from the workloads it proxies. Private endpoints consume private addresses; they do not use the virtual network gateway's special subnet. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets. The remaining action alone does not satisfy the situation.
B:Private endpoints consume private addresses; they do not use the virtual network gateway's special subnet.
C:Application Gateway has subnet placement requirements that are distinct from the workloads it proxies.
Question 104
A Front Door endpoint uses a custom apex domain but DNS validation has not completed and HTTPS certificates cannot be activated. A request passes an edge WAF policy, but the administrator mistakes its rate-limit action for evidence that the origin application performed the same inspection. A retailer plans to cut traffic from one region but simply disables its origin without validating what happens to long-lived client connections. Which course of action addresses the stated issues?
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; and Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; and Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; and Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; and Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
Explanation
Correct Answer
A:Custom hostname registration and TLS activation depend on authoritative DNS ownership verification. Edge and origin components log different security decisions and require correlation to explain a request outcome. Origin routing health changes affect new or retried requests and must be tested with real application continuity needs. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: custom hostname registration and TLS activation depend on authoritative DNS ownership verification.
C:Two actions meet their requirements, but action 2 misses this need: edge and origin components log different security decisions and require correlation to explain a request outcome.
D:Two actions meet their requirements, but action 3 misses this need: origin routing health changes affect new or retried requests and must be tested with real application continuity needs.
Question 105
A reverse proxy answers for store.example.com but rejects requests for support.example.com despite both sites sharing the gateway. A team deploys one manually sized Application Gateway instance for traffic that varies tenfold during seasonal campaigns. Which response best addresses these needs?
- Configure multi-site listener hostnames and appropriate routing rules with the required certificates; evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Configure multi-site listener hostnames and appropriate routing rules with the required certificates; use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits; do not configure multi-site listener hostnames and appropriate routing rules with the required certificates.
- Create a custom health probe for the correct host and health path and review backend HTTP settings; evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
Explanation
Correct Answer
A:Host-based listener matching controls which site a shared gateway accepts and routes. Dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance. Both actions are needed.
Incorrect Answers
B:Dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance.
C:This plan leaves out a required action: Configure multi-site listener hostnames and appropriate routing rules with the required certificates. The remaining action alone does not satisfy the situation.
D:Host-based listener matching controls which site a shared gateway accepts and routes.
Question 106
A regional outage affects multiple network resources, but monitoring checks only one VM's CPU graph. Which response most directly resolves the issue?
- Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
- Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring.
Explanation
Correct Answer
B:Network observability requires path and service signals beyond guest VM compute utilization.
Incorrect Answers
A:Reviewing Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence would not meet the need for Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
C:Planning supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions would not meet the need for Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
D:For this finding, network observability requires path and service signals beyond guest VM compute utilization.
Question 107
A backend service uses a custom TCP protocol and requires distribution across healthy VMs within one Azure region. A payroll API must be reachable only from private VNets and must not expose any public frontend address. Which course of action addresses the stated issues?
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection; deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
- Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing; do not use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
Explanation
Correct Answer
C:Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy. Internal load balancing provides VNet-private service entry rather than an internet-facing public address. Both actions are needed.
Incorrect Answers
A:Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.
B:Internal load balancing provides VNet-private service entry rather than an internet-facing public address.
D:This plan leaves out a required action: Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule. The remaining action alone does not satisfy the situation.
Question 108
An Azure PaaS resource is used by both a production and test VNet, and a team wants isolated private connections and separate approval records. An engineering design must provide private access to a partner-managed service without joining the partner's full VNet or exposing all its subnets. Which response best addresses these needs?
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration; use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
- Use an approved Private Link service and consumer private endpoint rather than broad VNet peering; do not create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.
Explanation
Correct Answer
A:Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path. Private Link can expose a designated service across ownership boundaries without providing general network transit. Both actions are needed.
Incorrect Answers
B:Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.
C:Private Link can expose a designated service across ownership boundaries without providing general network transit.
D:This plan leaves out a required action: Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals. The remaining action alone does not satisfy the situation.
Question 109
A WAF rule has blocked requests in its logs, yet clients still reach the origin directly by an unprotected public hostname. An enterprise enables a WAF policy on one Front Door domain and assumes all domains on a separate profile inherit it automatically. What is the most appropriate plan for this situation?
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile; do not restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
Explanation
Correct Answer
A:WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint. WAF protection must be explicitly associated with the intended application ingress scope. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress. The remaining action alone does not satisfy the situation.
C:WAF protection must be explicitly associated with the intended application ingress scope.
D:WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint.
Question 110
An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. A dual-tunnel deployment sends traffic to Azure but replies prefer one failed peer because on-premises routing did not converge. Which course of action addresses the stated issues?
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers; do not compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
Explanation
Correct Answer
A:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change. Resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure. Both actions are needed.
Incorrect Answers
B:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
C:This plan leaves out a required action: Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier. The remaining action alone does not satisfy the situation.
D:Resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests