Question 150
A finance team needs storage account traffic from its Azure VNet to use a private address instead of the service's public endpoint. An administrator creates a private endpoint to Azure SQL but leaves public network access open and declares all public ingress eliminated. A team wants to allow multiple consumer VNets to use one SQL private endpoint without peering or routing between those VNets. Which response best addresses these needs?
- Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address; review and restrict the SQL service's public network access independently from the private endpoint connection; and Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; review and restrict the SQL service's public network access independently from the private endpoint connection; and Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address; and Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; review and restrict the SQL service's public network access independently from the private endpoint connection; and Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
Explanation
Correct Answer
B:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network. Adding a private path does not automatically turn off the service's separately configured public endpoint. Private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: a private endpoint gives a supported PaaS resource a reachable private IP within the consumer network.
C:Two actions meet their requirements, but action 2 misses this need: adding a private path does not automatically turn off the service's separately configured public endpoint.
D:Two actions meet their requirements, but action 3 misses this need: private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone.
Question 151
An on-premises firewall public address changes after an ISP migration, but the Azure VPN still targets its previous peer endpoint. Two IPsec peers agree on addresses but IKE negotiation fails because the encryption and integrity algorithms differ. A hybrid migration needs to extend a supported on-premises network into Azure while preserving IP addressing across certain workloads. What is the most appropriate plan for this situation?
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration; align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance; and update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists.
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration; update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists; and evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists; align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance; and evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration; align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance; and evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
Explanation
Correct Answer
D:The local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation. A routed path alone cannot establish encryption when negotiated cryptographic proposals are incompatible. Extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity.
B:Two actions meet their requirements, but action 2 misses this need: a routed path alone cannot establish encryption when negotiated cryptographic proposals are incompatible.
C:Two actions meet their requirements, but action 1 misses this need: the local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation.
Question 152
An enterprise needs services in two geographically separated Azure regions but chooses a circuit tier that cannot deliver its intended global reachability. An engineer assumes ExpressRoute traffic is automatically end-to-end encrypted because the provider connection is private. Which course of action addresses the stated issues?
- Evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; do not select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters.
- Evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities.
Explanation
Correct Answer
B:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules. Private transport and cryptographic confidentiality are separate assurances. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach. The remaining action alone does not satisfy the situation.
C:Private transport and cryptographic confidentiality are separate assurances.
D:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules.
Question 153
An inbound DNS Private Resolver endpoint can be pinged from Azure, yet on-premises clients cannot send DNS queries over their VPN. Operations replaces an inbound endpoint's subnet and assumes on-premises conditional forwarders will continue working with the former inbound address. Which response best addresses these needs?
- Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end; do not check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address.
- Configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path; Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
- Check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address; verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries.
- Check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address; Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
Explanation
Correct Answer
D:ICMP reachability is not evidence that DNS packets and responses traverse the hybrid network path. The forwarding target must be reachable and current after endpoint changes; old private resolver IPs are not aliases. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address. The remaining action alone does not satisfy the situation.
B:ICMP reachability is not evidence that DNS packets and responses traverse the hybrid network path.
C:The forwarding target must be reachable and current after endpoint changes; old private resolver IPs are not aliases.
Question 154
During an Azure networking rollout, the team must resolve both of these conditions. A virtual hub receives many site-to-site VPN connections and the operator chooses its gateway capacity using only the number of VNets. A company wants an NVA in a virtual hub for specialized packet inspection but tries to insert an arbitrary VM into the managed hub subnet. What is the most appropriate plan for this situation?
- Review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows; use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites.
- Use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites; do not select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits.
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; inspect Virtual WAN route-table associations and route propagation settings for each connection.
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites.
Explanation
Correct Answer
D:Virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone. Managed virtual hub architectures restrict how third-party network security appliances are integrated. Both actions are needed.
Incorrect Answers
A:Virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone.
B:This plan leaves out a required action: Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits. The remaining action alone does not satisfy the situation.
C:Managed virtual hub architectures restrict how third-party network security appliances are integrated.
Question 155
A customer enables ExpressRoute resiliency but never checks the provider circuit's secondary BGP session, leaving a single point of route failure. What should the Azure network engineer do?
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology.
- Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment.
- Run a staged routing cutover with application session tests and a documented rollback and convergence window.
- Monitor and validate both provider path BGP sessions and test a deliberate failover.
Explanation
Correct Answer
D:Documented redundancy is ineffective if one BGP peer is already down before an incident.
Incorrect Answers
A:Verifying the circuit's reach and eligible VNet connection limits would not monitor and validate both provider path BGP sessions and test a deliberate failover.
B:Here, documented redundancy is ineffective if one BGP peer is already down before an incident.
C:Running a staged routing cutover with application session tests and a documented rollback and convergence window would not monitor and validate both provider path BGP sessions and test a deliberate failover.
Question 156
A security analyst must verify whether a particular SSH packet is permitted but has only a list of all NSG rules. After an address-space change, security staff cannot explain which NSG rule denied a particular traffic flow captured overnight. Which response best addresses these needs?
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service.
- Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
- Use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy; do not use Network Watcher IP flow verify with the precise source, destination, protocol, and ports.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
Explanation
Correct Answer
D:The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection. Historical flow records provide activity evidence that current configuration alone may not retain. Both actions are needed.
Incorrect Answers
A:Historical flow records provide activity evidence that current configuration alone may not retain.
B:The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.
C:This plan leaves out a required action: Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports. The remaining action alone does not satisfy the situation.
Question 157
A new virtual hub in another region remains isolated despite being placed in the same resource group as the existing hub. A third-party firewall integration into Virtual WAN blocks half the sites because only a subset of connections use the secured route table. What is the most appropriate plan for this situation?
- Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration.
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point; do not verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership.
Explanation
Correct Answer
A:Azure resource-group placement is administrative and does not establish network transit. Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered. Both actions are needed.
Incorrect Answers
B:Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered.
C:Azure resource-group placement is administrative and does not establish network transit.
D:This plan leaves out a required action: Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership. The remaining action alone does not satisfy the situation.
Question 158
A firewall FQDN rule fails for internal service names because the firewall and clients resolve the same name through different DNS servers. A network security team adds a firewall rule collection but assumes its descriptive name determines evaluation ahead of other collections. Which course of action addresses the stated issues?
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; verify rule collection group and collection priorities and the documented processing order before rollout.
- Validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session; verify rule collection group and collection priorities and the documented processing order before rollout.
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules.
- Verify rule collection group and collection priorities and the documented processing order before rollout; do not align the documented DNS proxy and resolver settings and validate consistent destination resolution.
Explanation
Correct Answer
A:FQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients. Azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names. Both actions are needed.
Incorrect Answers
B:FQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients.
C:Azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.
D:This plan leaves out a required action: Align the documented DNS proxy and resolver settings and validate consistent destination resolution. The remaining action alone does not satisfy the situation.
Question 159
A security architect wants all spoke internet traffic inspected by a hub network virtual appliance, but packets still follow the system internet route. A spoke-to-spoke path fails after deployment, and the administrator checks only its route table JSON rather than what each VM receives. Which response best addresses these needs?
- Enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions; inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; do not Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop.
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop; inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
Explanation
Correct Answer
D:User-defined routes override eligible system routing choices only when attached to the relevant source subnets. Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved. Both actions are needed.
Incorrect Answers
A:User-defined routes override eligible system routing choices only when attached to the relevant source subnets.
B:Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved.
C:This plan leaves out a required action: Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop. The remaining action alone does not satisfy the situation.
Question 160
A spoke peered to a hub needs to reach on-premises through the hub VPN gateway, but gateway transit options are not configured. Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. What is the most appropriate plan for this situation?
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; do not enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
A:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway. Peering relationships are not automatically transitive across another VNet. Both actions are needed.
Incorrect Answers
B:Peering relationships are not automatically transitive across another VNet.
C:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
D:This plan leaves out a required action: Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules. The remaining action alone does not satisfy the situation.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests