Question 120
A network engineer demands TLS termination and WAF inspection directly on a Traffic Manager DNS profile. Which action best addresses this finding?
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
Explanation
Correct Answer
B:A DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads.
Incorrect Answers
A:Here, a DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads.
C:For this finding, a DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads.
D:For this question, a DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads.
Question 121
An international website must route European and Asian requests across geographically dispersed origins while accelerating HTTPS delivery. A CDN-enabled app serves outdated pricing pages for hours after prices change in the origin database. What is the most appropriate plan for this situation?
- Configure Front Door rules sets and route options to apply the approved redirects and URL rewrites; adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses.
- Configure Front Door origin groups and routes with appropriate priority and latency-based traffic distribution; adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses.
- Adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses; do not configure Front Door origin groups and routes with appropriate priority and latency-based traffic distribution.
- Configure Front Door origin groups and routes with appropriate priority and latency-based traffic distribution; deploy an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes.
Explanation
Correct Answer
B:Front Door's global edge and origin selection differ from Azure's regional Application Gateway footprint. Edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data. Both actions are needed.
Incorrect Answers
A:Front Door's global edge and origin selection differ from Azure's regional Application Gateway footprint.
C:This plan leaves out a required action: Configure Front Door origin groups and routes with appropriate priority and latency-based traffic distribution. The remaining action alone does not satisfy the situation.
D:Edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data.
Question 122
An operations team treats a service tag as a permanent list of Azure public CIDRs and manually pins stale values in every NSG. Which course of action addresses the stated issues?
- Check supported global or cross-region load-balancing constructs and separate regional address identities where required; use supported service tags where appropriate and review service scope instead of freezing changing platform address lists.
- Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists; do not check supported global or cross-region load-balancing constructs and separate regional address identities where required.
- Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology; use supported service tags where appropriate and review service scope instead of freezing changing platform address lists.
- Check supported global or cross-region load-balancing constructs and separate regional address identities where required; investigate subnet IP assignments and available CIDR capacity independently from DNS resolver configuration.
Explanation
Correct Answer
A:A regional public IP does not automatically span independent regions or become a global frontend address. Service tags abstract approved platform prefixes and reduce configuration drift from evolving Azure address ranges. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Check supported global or cross-region load-balancing constructs and separate regional address identities where required. The remaining action alone does not satisfy the situation.
C:A regional public IP does not automatically span independent regions or become a global frontend address.
D:Service tags abstract approved platform prefixes and reduce configuration drift from evolving Azure address ranges.
Question 123
Two enterprise datacenters need private connectivity to each other through Microsoft's backbone, not just reach Azure resources. A company seeks lower latency by reducing gateway data-path processing for eligible ExpressRoute workloads. Which response best addresses these needs?
- Evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support; evaluate ExpressRoute Direct with supported locations, port capacity, and operational requirements.
- Evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support; evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support.
- Add diverse eligible circuits and routing failover options across independent connectivity locations; evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support.
- Evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support; do not evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support.
Explanation
Correct Answer
B:Global Reach joins supported on-premises sites through ExpressRoute circuits subject to geographic and SKU constraints. FastPath can bypass parts of a supported gateway data path but is not automatically available for all circuit configurations. Both actions are needed.
Incorrect Answers
A:FastPath can bypass parts of a supported gateway data path but is not automatically available for all circuit configurations.
C:Global Reach joins supported on-premises sites through ExpressRoute circuits subject to geographic and SKU constraints.
D:This plan leaves out a required action: Evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support. The remaining action alone does not satisfy the situation.
Question 124
A containerized service requires a subnet dedicated to a specific Azure platform integration, but deployment reports that delegation is missing. Which response best addresses this Azure networking scenario?
- Expand or redesign the VNet address space and reserve appropriately sized nonoverlapping subnets before deploying new services.
- Provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet.
- Redesign the Azure address plan using nonoverlapping prefixes and coordinate any required network translation before connecting the environments.
- Configure the service's supported subnet delegation and check whether other intended resources can share that subnet.
Explanation
Correct Answer
D:A delegated subnet grants a compatible platform service authority over subnet operations and may limit colocated services.
Incorrect Answers
A:Here, a delegated subnet grants a compatible platform service authority over subnet operations and may limit colocated services.
B:For this finding, a delegated subnet grants a compatible platform service authority over subnet operations and may limit colocated services.
C:For this question, a delegated subnet grants a compatible platform service authority over subnet operations and may limit colocated services.
Question 125
A single Application Gateway must handle dozens of customer hostnames and choose the right TLS certificate for each one. A regional Application Gateway deployment includes several separate backends but fails requests after a subnet routing change inserts an unsupported forced tunnel. Which course of action addresses the stated issues?
- Validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths; do not use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname.
- Use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname; validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths.
- Configure supported cookie-based affinity where suitable and redesign session state for failover resilience; validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths.
- Use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname; verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration.
Explanation
Correct Answer
B:Hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate. An Application Gateway still depends on documented networking prerequisites, including compatible routing through its subnet. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname. The remaining action alone does not satisfy the situation.
C:Hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate.
D:An Application Gateway still depends on documented networking prerequisites, including compatible routing through its subnet.
Question 126
During an Azure networking rollout, the team must resolve both of these conditions. An application migrates from a legacy backend host name and now receives 502 responses because its certificate does not match the host selected by the gateway. An engineer creates two path rules but one broad basic rule captures every request, making the intended /admin routing ineffective. Which response best addresses these needs?
- Review listener and rule priorities and verify path-match precedence before committing the correction; do not correct backend hostname and trusted certificate settings and retest the Application Gateway health probe.
- Correct backend hostname and trusted certificate settings and retest the Application Gateway health probe; review listener and rule priorities and verify path-match precedence before committing the correction.
- Configure a supported Application Gateway rewrite rule set and verify the forwarded request headers; review listener and rule priorities and verify path-match precedence before committing the correction.
- Correct backend hostname and trusted certificate settings and retest the Application Gateway health probe; configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation.
Explanation
Correct Answer
B:Backend TLS validation depends on the expected name and chain, not just a responding TCP port. Request routing priority determines which rule is evaluated when multiple definitions could match. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Correct backend hostname and trusted certificate settings and retest the Application Gateway health probe. The remaining action alone does not satisfy the situation.
C:Backend TLS validation depends on the expected name and chain, not just a responding TCP port.
D:Request routing priority determines which rule is evaluated when multiple definitions could match.
Question 127
A circuit's provider reports ready, but BGP sessions do not establish because the configured peer ASN and VLAN values disagree. Which response best addresses this Azure networking scenario?
- Design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration.
- Align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration.
- Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit.
- Configure Azure private peering and the applicable VNet gateway or direct connectivity model.
Explanation
Correct Answer
B:ExpressRoute service provisioning and route exchange are separate milestones with strict peering parameters.
Incorrect Answers
A:For this question, expressRoute service provisioning and route exchange are separate milestones with strict peering parameters.
C:Here, expressRoute service provisioning and route exchange are separate milestones with strict peering parameters.
D:For this finding, expressRoute service provisioning and route exchange are separate milestones with strict peering parameters.
Question 128
During an Azure networking rollout, the team must resolve both of these conditions. Multiple Azure Firewalls should share a baseline threat and network rule policy while allowing one region's justified exceptions. A team requires advanced threat protection, URL filtering and supported TLS inspection but selects Azure Firewall Basic for the production design. Which course of action addresses the stated issues?
- Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities; select an appropriate Azure Firewall Premium tier after validating required advanced security features.
- Update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall; select an appropriate Azure Firewall Premium tier after validating required advanced security features.
- Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities; deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.
- Select an appropriate Azure Firewall Premium tier after validating required advanced security features; do not use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities.
Explanation
Correct Answer
A:Central policy inheritance can standardize controls without copying every rule by hand into each firewall. Azure Firewall SKUs differ in supported advanced inspection and security capabilities. Both actions are needed.
Incorrect Answers
B:Central policy inheritance can standardize controls without copying every rule by hand into each firewall.
C:Azure Firewall SKUs differ in supported advanced inspection and security capabilities.
D:This plan leaves out a required action: Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities. The remaining action alone does not satisfy the situation.
Question 129
A VM database subnet must accept TCP 1433 only from the approved application subnet, but an NSG rule allows every source prefix. An administrator creates a deny rule at priority 400 but a broader allow at priority 200 still admits the traffic. A security engineer attaches a restrictive NSG to a VM NIC but forgets an additional subnet NSG is also applied and traffic remains blocked. Which response best addresses these needs?
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules; and check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies.
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation; and use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules.
- Use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules; Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation; and check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies.
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation; and check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies.
Explanation
Correct Answer
D:NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted. Lower numerical priority values are processed first, so an earlier matching allow can shadow a later deny. Subnet and NIC security rules can both affect traffic; one permissive policy does not override a deny elsewhere. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: lower numerical priority values are processed first, so an earlier matching allow can shadow a later deny.
B:Two actions meet their requirements, but action 3 misses this need: subnet and NIC security rules can both affect traffic; one permissive policy does not override a deny elsewhere.
C:Two actions meet their requirements, but action 1 misses this need: nSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.
Question 130
After a backend maintenance window, Application Gateway still sends new traffic to one stale instance because the pool membership was not updated. What should the Azure network engineer do?
- Update backend pool membership and probe configuration and verify traffic distribution from client requests.
- Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
- Configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
Explanation
Correct Answer
A:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
Incorrect Answers
B:For this finding, traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
C:For this question, traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
D:Here, traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests