Question 180
A regional service fails but some users keep reaching it until cached DNS answers expire despite Traffic Manager reporting a healthy alternate. A marketing site needs weighted distribution of new DNS lookups between regional hostnames for controlled rollout. Which response best addresses these needs?
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses; do not review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover; use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover; configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection; use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
Explanation
Correct Answer
B:DNS-based failover cannot immediately replace a connection that relies on an already cached address. Weighted DNS routing can steer new resolver answers without providing layer-7 application transformations. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover. The remaining action alone does not satisfy the situation.
C:Weighted DNS routing can steer new resolver answers without providing layer-7 application transformations.
D:DNS-based failover cannot immediately replace a connection that relies on an already cached address.
Question 181
During an Azure networking rollout, the team must resolve both of these conditions. A worldwide retail site needs Microsoft edge-based HTTP routing, TLS termination, caching, and automatic origin health failover. A CDN-enabled app serves outdated pricing pages for hours after prices change in the origin database. What is the most appropriate plan for this situation?
- Deploy an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes; configure Front Door origin groups and routes with appropriate priority and latency-based traffic distribution.
- Deploy an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes; adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses.
- Configure Front Door rules sets and route options to apply the approved redirects and URL rewrites; adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses.
- Adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses; do not deploy an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes.
Explanation
Correct Answer
B:Front Door provides global layer-7 ingress and origin routing rather than only regional private load balancing. Edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data. Both actions are needed.
Incorrect Answers
A:Edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data.
C:Front Door provides global layer-7 ingress and origin routing rather than only regional private load balancing.
D:This plan leaves out a required action: Deploy an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes. The remaining action alone does not satisfy the situation.
Question 182
An operations team treats a service tag as a permanent list of Azure public CIDRs and manually pins stale values in every NSG. A VNet is configured with an alternate DNS server address, but the team attributes unrelated IP exhaustion to DNS settings. A peered VNet retains a default address range that duplicates an on-premises production prefix, and routing fails after VPN connection. Which course of action addresses the stated issues?
- Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists; investigate subnet IP assignments and available CIDR capacity independently from DNS resolver configuration; and Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology.
- Check supported global or cross-region load-balancing constructs and separate regional address identities where required; investigate subnet IP assignments and available CIDR capacity independently from DNS resolver configuration; and Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology.
- Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists; check supported global or cross-region load-balancing constructs and separate regional address identities where required; and Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology.
- Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists; investigate subnet IP assignments and available CIDR capacity independently from DNS resolver configuration; and check supported global or cross-region load-balancing constructs and separate regional address identities where required.
Explanation
Correct Answer
A:Service tags abstract approved platform prefixes and reduce configuration drift from evolving Azure address ranges. Name resolution settings do not increase the number of assignable private addresses in a subnet. Overlapping advertised prefixes undermine deterministic routing regardless of gateway health. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: service tags abstract approved platform prefixes and reduce configuration drift from evolving Azure address ranges.
C:Two actions meet their requirements, but action 2 misses this need: name resolution settings do not increase the number of assignable private addresses in a subnet.
D:Two actions meet their requirements, but action 3 misses this need: overlapping advertised prefixes undermine deterministic routing regardless of gateway health.
Question 183
An organization orders high-capacity dedicated ExpressRoute connectivity that requires paired physical links and direct Microsoft edge port management. A company seeks lower latency by reducing gateway data-path processing for eligible ExpressRoute workloads. Which response best addresses these needs?
- Evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support; do not evaluate ExpressRoute Direct with supported locations, port capacity, and operational requirements.
- Evaluate ExpressRoute Direct with supported locations, port capacity, and operational requirements; evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support.
- Evaluate ExpressRoute Direct with supported locations, port capacity, and operational requirements; evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support.
- Add diverse eligible circuits and routing failover options across independent connectivity locations; evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support.
Explanation
Correct Answer
C:ExpressRoute Direct exposes dedicated port arrangements beyond a standard provider-managed circuit. FastPath can bypass parts of a supported gateway data path but is not automatically available for all circuit configurations. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Evaluate ExpressRoute Direct with supported locations, port capacity, and operational requirements. The remaining action alone does not satisfy the situation.
B:FastPath can bypass parts of a supported gateway data path but is not automatically available for all circuit configurations.
D:ExpressRoute Direct exposes dedicated port arrangements beyond a standard provider-managed circuit.
Question 184
An organization acquires a partner whose 10.20.0.0/16 network overlaps a planned Azure hub, making peering routes ambiguous. Which action best addresses this finding?
- Redesign the Azure address plan using nonoverlapping prefixes and coordinate any required network translation before connecting the environments.
- Expand or redesign the VNet address space and reserve appropriately sized nonoverlapping subnets before deploying new services.
- Configure the service's supported subnet delegation and check whether other intended resources can share that subnet.
- Provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet.
Explanation
Correct Answer
A:Peering and VPN routing cannot disambiguate overlapping private destinations without a deliberate addressing or translation plan.
Incorrect Answers
B:Here, peering and VPN routing cannot disambiguate overlapping private destinations without a deliberate addressing or translation plan.
C:For this question, peering and VPN routing cannot disambiguate overlapping private destinations without a deliberate addressing or translation plan.
D:For this finding, peering and VPN routing cannot disambiguate overlapping private destinations without a deliberate addressing or translation plan.
Question 185
A single Application Gateway must handle dozens of customer hostnames and choose the right TLS certificate for each one. Which action best addresses this finding?
- Validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths.
- Use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname.
- Verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration.
- Configure supported cookie-based affinity where suitable and redesign session state for failover resilience.
Explanation
Correct Answer
B:Hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate.
Incorrect Answers
A:For this question, hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate.
C:Here, hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate.
D:For this finding, hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate.
Question 186
A gateway must add an X-Forwarded custom header for upstream application diagnostics without changing application binaries. An engineer creates two path rules but one broad basic rule captures every request, making the intended /admin routing ineffective. Which response best addresses these needs?
- Configure a supported Application Gateway rewrite rule set and verify the forwarded request headers; review listener and rule priorities and verify path-match precedence before committing the correction.
- Review listener and rule priorities and verify path-match precedence before committing the correction; do not configure a supported Application Gateway rewrite rule set and verify the forwarded request headers.
- Correct backend hostname and trusted certificate settings and retest the Application Gateway health probe; review listener and rule priorities and verify path-match precedence before committing the correction.
- Configure a supported Application Gateway rewrite rule set and verify the forwarded request headers; configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation.
Explanation
Correct Answer
A:Gateway rewrite rules modify eligible HTTP metadata without requiring changes to every backend service. Request routing priority determines which rule is evaluated when multiple definitions could match. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Configure a supported Application Gateway rewrite rule set and verify the forwarded request headers. The remaining action alone does not satisfy the situation.
C:Gateway rewrite rules modify eligible HTTP metadata without requiring changes to every backend service.
D:Request routing priority determines which rule is evaluated when multiple definitions could match.
Question 187
An ExpressRoute circuit is provisioned but a spoke VNet still has no on-premises reachability because no gateway connection exists. An engineer configures Microsoft peering when the requirement is to reach VM private IPs in Azure VNets. A circuit's provider reports ready, but BGP sessions do not establish because the configured peer ASN and VLAN values disagree. What is the most appropriate plan for this situation?
- Design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration; configure Azure private peering and the applicable VNet gateway or direct connectivity model; and align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration.
- Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit; configure Azure private peering and the applicable VNet gateway or direct connectivity model; and align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration.
- Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit; design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration; and align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration.
- Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit; configure Azure private peering and the applicable VNet gateway or direct connectivity model; and design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration.
Explanation
Correct Answer
B:Provisioning the circuit itself does not automatically connect a VNet's routing domain to the private peering. Microsoft peering is not a substitute for Azure private peering to VNet private address space. ExpressRoute service provisioning and route exchange are separate milestones with strict peering parameters. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: provisioning the circuit itself does not automatically connect a VNet's routing domain to the private peering.
C:Two actions meet their requirements, but action 2 misses this need: microsoft peering is not a substitute for Azure private peering to VNet private address space.
D:Two actions meet their requirements, but action 3 misses this need: expressRoute service provisioning and route exchange are separate milestones with strict peering parameters.
Question 188
A team requires advanced threat protection, URL filtering and supported TLS inspection but selects Azure Firewall Basic for the production design. An organization creates a secured Virtual WAN hub but assumes adding an ordinary VNet firewall appliance automatically integrates with hub routing intent. Which course of action addresses the stated issues?
- Deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections; do not select an appropriate Azure Firewall Premium tier after validating required advanced security features.
- Select an appropriate Azure Firewall Premium tier after validating required advanced security features; use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities.
- Select an appropriate Azure Firewall Premium tier after validating required advanced security features; deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.
- Update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall; deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.
Explanation
Correct Answer
C:Azure Firewall SKUs differ in supported advanced inspection and security capabilities. A secured virtual hub has supported managed integration steps distinct from placing any VM in a peered subnet. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Select an appropriate Azure Firewall Premium tier after validating required advanced security features. The remaining action alone does not satisfy the situation.
B:A secured virtual hub has supported managed integration steps distinct from placing any VM in a peered subnet.
D:Azure Firewall SKUs differ in supported advanced inspection and security capabilities.
Question 189
During an Azure networking rollout, the team must resolve both of these conditions. A VM database subnet must accept TCP 1433 only from the approved application subnet, but an NSG rule allows every source prefix. An administrator creates a deny rule at priority 400 but a broader allow at priority 200 still admits the traffic. Which response best addresses these needs?
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation.
- Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation; do not create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority.
- Check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies; Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation.
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules.
Explanation
Correct Answer
A:NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted. Lower numerical priority values are processed first, so an earlier matching allow can shadow a later deny. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority. The remaining action alone does not satisfy the situation.
C:NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.
D:Lower numerical priority values are processed first, so an earlier matching allow can shadow a later deny.
Question 190
After a backend maintenance window, Application Gateway still sends new traffic to one stale instance because the pool membership was not updated. A backend API needs a nonstandard HTTP port and the gateway reports connection failures though client port 443 is healthy. What is the most appropriate plan for this situation?
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
- Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; do not update backend pool membership and probe configuration and verify traffic distribution from client requests.
- Configure probes with the intended host header and path and validate the origin's virtual host behavior; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
Explanation
Correct Answer
A:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state. Frontend and backend ports are independent settings in an application-layer proxy. Both actions are needed.
Incorrect Answers
B:Frontend and backend ports are independent settings in an application-layer proxy.
C:This plan leaves out a required action: Update backend pool membership and probe configuration and verify traffic distribution from client requests. The remaining action alone does not satisfy the situation.
D:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests