Question 130
After a backend maintenance window, Application Gateway still sends new traffic to one stale instance because the pool membership was not updated. What should the Azure network engineer do?
- Update backend pool membership and probe configuration and verify traffic distribution from client requests.
- Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
- Configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
Explanation
Correct Answer
A:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
Incorrect Answers
B:For this finding, traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
C:For this question, traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
D:Here, traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
Question 131
During an Azure networking rollout, the team must resolve both of these conditions. A network team deploys a virtual WAN hub and assumes ordinary VNet peering route tables govern all hub-to-branch connectivity. An NVA is advertised as a transit point for interspoke traffic, but the spoke UDR only covers internet prefixes. Which course of action addresses the stated issues?
- Add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA; do not review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions.
- Review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions; compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination.
- Review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions; add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
- Review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
Explanation
Correct Answer
C:Virtual WAN has its own route-table and connection semantics that differ from manually peered hubs. Forcing only 0.0.0.0/0 does not guarantee every more-specific private route traverses the intended inspection path. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions. The remaining action alone does not satisfy the situation.
B:Forcing only 0.0.0.0/0 does not guarantee every more-specific private route traverses the intended inspection path.
D:Virtual WAN has its own route-table and connection semantics that differ from manually peered hubs.
Question 132
A team associates NAT Gateway with a subnet but continues to use an explicitly configured public load balancer outbound rule for the same VMs without checking precedence. An engineer expects NAT Gateway to translate private addresses for traffic between two private VNets without public internet egress. Which response best addresses these needs?
- Review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments; Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior.
- Use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity; do not review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments.
- Review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments; use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity.
- Inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload; use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity.
Explanation
Correct Answer
C:Multiple outbound mechanisms require precedence validation rather than assuming traffic always selects the newest configuration. Subnet NAT Gateway is not a general private-to-private network address translation router. Both actions are needed.
Incorrect Answers
A:Subnet NAT Gateway is not a general private-to-private network address translation router.
B:This plan leaves out a required action: Review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments. The remaining action alone does not satisfy the situation.
D:Multiple outbound mechanisms require precedence validation rather than assuming traffic always selects the newest configuration.
Question 133
A web application needs global edge enforcement for geographically distributed users, but the team builds a WAF policy only on one regional internal Application Gateway. Which response best addresses this Azure networking scenario?
- Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
- Apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic.
- Deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling.
- Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention.
Explanation
Correct Answer
B:Front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service.
Incorrect Answers
A:For this question, front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service.
C:Deploying WAF with supported managed rule sets on Application Gateway or Front Door and testing malicious request handling would not apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic.
D:Here, front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service.
Question 134
An operations team configures an Azure Firewall network rule for web traffic but expects it to filter by individual HTTP URL path. A company needs FQDN-aware outbound web application controls from a hub to selected sanctioned destinations. Which course of action addresses the stated issues?
- Use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities; deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address.
- Use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities; configure Azure Firewall application rules for supported web protocols and destination domains.
- Configure an Azure Firewall DNAT rule and corresponding backend routing and security controls; configure Azure Firewall application rules for supported web protocols and destination domains.
- Configure Azure Firewall application rules for supported web protocols and destination domains; do not use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities.
Explanation
Correct Answer
B:Firewall network rules are based on network tuples; they do not act as full HTTP path-based web application proxies. Application rules support eligible FQDN-based filtering distinct from IP-and-port network rule matching. Both actions are needed.
Incorrect Answers
A:Application rules support eligible FQDN-based filtering distinct from IP-and-port network rule matching.
C:Firewall network rules are based on network tuples; they do not act as full HTTP path-based web application proxies.
D:This plan leaves out a required action: Use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities. The remaining action alone does not satisfy the situation.
Question 135
During an Azure networking rollout, the team must resolve both of these conditions. An architect treats Azure VPN Gateway as a turnkey replacement for a complete on-premises Always On VPN infrastructure. A support engineer uses Azure Network Adapter as an assumed universally supported feature on every legacy Windows Server build. Which response best addresses these needs?
- Inspect certificate trust chains and authentication logs on both client and gateway before altering network routes; check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path.
- Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles; Provide supported custom DNS server or private resolution configuration through the client and gateway architecture.
- Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles; check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path.
- Check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path; do not review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles.
Explanation
Correct Answer
C:Always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence. Convenience management features have specific host and Azure prerequisites rather than universal availability. Both actions are needed.
Incorrect Answers
A:Always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence.
B:Convenience management features have specific host and Azure prerequisites rather than universal availability.
D:This plan leaves out a required action: Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles. The remaining action alone does not satisfy the situation.
Question 136
A global application wants its backend reachable only through Front Door rather than directly over a public origin hostname. Which response best addresses this Azure networking scenario?
- Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door.
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing.
- Inspect origin group routing, priority, weight, and health settings and test representative client regions.
- Select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
Explanation
Correct Answer
B:Private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them.
Incorrect Answers
A:Here, private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them.
C:For this finding, private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them.
D:For this question, private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them.
Question 137
Two VM workloads must resolve internal app.contoso.internal consistently across multiple Azure VNets without publishing the record on the internet. An engineer creates a private DNS zone but never links it to the application VNet; clients resolve the name as nonexistent. A business needs a public website record resolvable worldwide and mistakenly stores its authoritative A record only in Azure Private DNS. Which course of action addresses the stated issues?
- Enable supported auto-registration on the designated VNet link and verify which resource types produce records; Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior; and Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings; Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior; and Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings; enable supported auto-registration on the designated VNet link and verify which resource types produce records; and Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings; Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior; and enable supported auto-registration on the designated VNet link and verify which resource types produce records.
Explanation
Correct Answer
B:Private DNS zone links enable scoped VNet resolution without relying on publicly advertised DNS records. Creating a zone alone does not give a VNet permission or a route to resolve its records. Private DNS zones are not internet authoritative and cannot substitute for public DNS delegation. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: private DNS zone links enable scoped VNet resolution without relying on publicly advertised DNS records.
C:Two actions meet their requirements, but action 2 misses this need: creating a zone alone does not give a VNet permission or a route to resolve its records.
D:Two actions meet their requirements, but action 3 misses this need: private DNS zones are not internet authoritative and cannot substitute for public DNS delegation.
Question 138
A storage account should accept requests from two authorized Azure subnets while continuing to use its normal public service name. A subnet reaches a supported service endpoint, but the service firewall denies requests because the VNet subnet was never allowed. Which response best addresses these needs?
- Use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP; add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules; add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Add the intended subnet to the service's supported network access rules and confirm the service endpoint state; do not enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules; choose a private endpoint when the requirement is a private IP on the consumer VNet.
Explanation
Correct Answer
B:Service endpoints secure supported service access by source subnet while the service retains its public endpoint model. Subnet endpoint activation alone does not grant the service permission to accept the subnet's requests. Both actions are needed.
Incorrect Answers
A:Service endpoints secure supported service access by source subnet while the service retains its public endpoint model.
C:This plan leaves out a required action: Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules. The remaining action alone does not satisfy the situation.
D:Subnet endpoint activation alone does not grant the service permission to accept the subnet's requests.
Question 139
A software provider hosts a custom TCP service behind an internal Standard Load Balancer and wants customers to connect without public exposure. An architect tries to expose a self-hosted application through Azure Private Endpoint without creating any supported Private Link target service. A provider wants to control which partner subscriptions may create private endpoints to its internal service. What is the most appropriate plan for this situation?
- Maintain the supported Private Link service frontend while updating backend health and routing as needed; publish the service through an eligible Private Link service or supported Azure service target first; and configure Private Link service visibility and connection approval permissions before accepting consumer requests.
- Create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals; Maintain the supported Private Link service frontend while updating backend health and routing as needed; and configure Private Link service visibility and connection approval permissions before accepting consumer requests.
- Create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals; publish the service through an eligible Private Link service or supported Azure service target first; and Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals; publish the service through an eligible Private Link service or supported Azure service target first; and configure Private Link service visibility and connection approval permissions before accepting consumer requests.
Explanation
Correct Answer
D:Private Link service publishes an eligible customer-hosted private service to consumers via their private endpoints. Private endpoints consume a published private connection; they do not automatically publish arbitrary VM ports. Private Link service admission governs permitted consumers separately from network reachability to its load balancer. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: private Link service publishes an eligible customer-hosted private service to consumers via their private endpoints.
B:Two actions meet their requirements, but action 2 misses this need: private endpoints consume a published private connection; they do not automatically publish arbitrary VM ports.
C:Two actions meet their requirements, but action 3 misses this need: private Link service admission governs permitted consumers separately from network reachability to its load balancer.
Question 140
A regulated enterprise owns a registered public IPv4 block and wants to advertise it from Azure rather than use Azure-owned public space. Which response most directly resolves the issue?
- Create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix.
- Create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
Explanation
Correct Answer
B:Custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges.
Incorrect Answers
A:For this finding, custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges.
C:For this question, custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges.
D:Creating and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints would not meet the need for Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests