Question 160
A spoke peered to a hub needs to reach on-premises through the hub VPN gateway, but gateway transit options are not configured. Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. What is the most appropriate plan for this situation?
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; do not enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
A:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway. Peering relationships are not automatically transitive across another VNet. Both actions are needed.
Incorrect Answers
B:Peering relationships are not automatically transitive across another VNet.
C:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
D:This plan leaves out a required action: Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules. The remaining action alone does not satisfy the situation.
Question 161
A security policy change blocks new inbound sessions, but existing established connections continue transferring for a period. A storage service uses a dynamic set of provider addresses, and engineers plan to hardcode every observed IP in NSG egress rules. Which course of action addresses the stated issues?
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic; inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes; do not review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic; use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
Explanation
Correct Answer
D:Stateful security evaluation can allow established flows to persist independently of how new flows are classified. Service tags provide maintained address abstractions for specific service categories. Both actions are needed.
Incorrect Answers
A:Stateful security evaluation can allow established flows to persist independently of how new flows are classified.
B:Service tags provide maintained address abstractions for specific service categories.
C:This plan leaves out a required action: Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic. The remaining action alone does not satisfy the situation.
Question 162
A subnet contains a private endpoint and an architect assumes an NSG on the subnet always filters its traffic without checking network policy settings. A private endpoint connection is approved for production, but administrators forget that its data plane still uses an overprivileged service identity. Which response best addresses these needs?
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; apply least-privilege service authorization and identity controls in addition to the private network connection.
- Continue using the service's valid hostname and certificate validation over the private endpoint connection; apply least-privilege service authorization and identity controls in addition to the private network connection.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
- Apply least-privilege service authorization and identity controls in addition to the private network connection; do not check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.
Explanation
Correct Answer
A:Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation. Private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself. Both actions are needed.
Incorrect Answers
B:Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.
C:Private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself.
D:This plan leaves out a required action: Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement. The remaining action alone does not satisfy the situation.
Question 163
A team adds a private endpoint to a VNet but assumes it must reserve the entire gateway subnet for the endpoint. Which action best addresses this finding?
- Select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
Explanation
Correct Answer
D:Private endpoints consume private addresses; they do not use the virtual network gateway's special subnet.
Incorrect Answers
A:Selecting a supported public ingress service or public IP association target would not address the need for allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
B:Here, private endpoints consume private addresses; they do not use the virtual network gateway's special subnet.
C:Placing Application Gateway in a supported dedicated subnet and keeping application backend resources in their own subnets would not address the need for allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
Question 164
A Front Door endpoint uses a custom apex domain but DNS validation has not completed and HTTPS certificates cannot be activated. A globally cached API returns private personalized responses to other users because its routes cache content with an overly broad policy. Which course of action addresses the stated issues?
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; do not Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
- Stage changes to Front Door origin routing and test failover and application session behavior under maintenance; Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
Explanation
Correct Answer
A:Custom hostname registration and TLS activation depend on authoritative DNS ownership verification. Shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Complete the supported custom-domain validation and certificate workflow and confirm public DNS records. The remaining action alone does not satisfy the situation.
C:Shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe.
D:Custom hostname registration and TLS activation depend on authoritative DNS ownership verification.
Question 165
A shopping site must send /payments to a protected API pool and /catalog to a different pool under one HTTPS host. A reverse proxy answers for store.example.com but rejects requests for support.example.com despite both sites sharing the gateway. A team deploys one manually sized Application Gateway instance for traffic that varies tenfold during seasonal campaigns. Which response best addresses these needs?
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; create a custom health probe for the correct host and health path and review backend HTTP settings; and evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; configure multi-site listener hostnames and appropriate routing rules with the required certificates; and create a custom health probe for the correct host and health path and review backend HTTP settings.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; configure multi-site listener hostnames and appropriate routing rules with the required certificates; and evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Create a custom health probe for the correct host and health path and review backend HTTP settings; configure multi-site listener hostnames and appropriate routing rules with the required certificates; and evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
Explanation
Correct Answer
C:Application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide. Host-based listener matching controls which site a shared gateway accepts and routes. Dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: host-based listener matching controls which site a shared gateway accepts and routes.
B:Two actions meet their requirements, but action 3 misses this need: dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance.
D:Two actions meet their requirements, but action 1 misses this need: application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
Question 166
A security team needs historical communication patterns for subnet-level troubleshooting and assumes the retired NSG flow log workflow is the only option. A regional outage affects multiple network resources, but monitoring checks only one VM's CPU graph. What is the most appropriate plan for this situation?
- Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence; use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; do not plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring.
Explanation
Correct Answer
C:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited. Network observability requires path and service signals beyond guest VM compute utilization. Both actions are needed.
Incorrect Answers
A:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
B:This plan leaves out a required action: Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions. The remaining action alone does not satisfy the situation.
D:Network observability requires path and service signals beyond guest VM compute utilization.
Question 167
A team configures a Load Balancer rule for HTTPS traffic but assumes it can inspect URL paths and select different backends for /api. Which response most directly resolves the issue?
- Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
- Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
Explanation
Correct Answer
C:Layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions.
Incorrect Answers
A:Here, layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions.
B:For this finding, layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions.
D:For this question, layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions.
Question 168
An Azure PaaS resource is used by both a production and test VNet, and a team wants isolated private connections and separate approval records. A resource team deletes a storage private endpoint but assumes all linked private DNS records and stale application caches disappear immediately. Which response best addresses these needs?
- Use an approved Private Link service and consumer private endpoint rather than broad VNet peering; review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration; do not create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
Explanation
Correct Answer
B:Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path. Resource deletion and DNS/cache cleanup are distinct lifecycle steps that can affect clients after teardown. Both actions are needed.
Incorrect Answers
A:Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.
C:This plan leaves out a required action: Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals. The remaining action alone does not satisfy the situation.
D:Resource deletion and DNS/cache cleanup are distinct lifecycle steps that can affect clients after teardown.
Question 169
A false-positive rule excludes all request bodies to fix one JSON property, creating a large inspection gap. A WAF rule has blocked requests in its logs, yet clients still reach the origin directly by an unprotected public hostname. An enterprise enables a WAF policy on one Front Door domain and assumes all domains on a separate profile inherit it automatically. What is the most appropriate plan for this situation?
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; and validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; and validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; and validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; and After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
Explanation
Correct Answer
C:Broad exemptions can silently remove inspection coverage for unrelated malicious payloads. WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint. WAF protection must be explicitly associated with the intended application ingress scope. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: broad exemptions can silently remove inspection coverage for unrelated malicious payloads.
B:Two actions meet their requirements, but action 2 misses this need: wAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint.
D:Two actions meet their requirements, but action 3 misses this need: wAF protection must be explicitly associated with the intended application ingress scope.
Question 170
An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. An architect tries to configure BGP settings on a gateway deployment that does not support the intended protocol combination. Which course of action addresses the stated issues?
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; do not compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
Explanation
Correct Answer
A:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change. Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier. The remaining action alone does not satisfy the situation.
C:Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.
D:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests