Question 210
A finance team needs storage account traffic from its Azure VNet to use a private address instead of the service's public endpoint. A storage private endpoint receives an approved connection but a web app still connects to the storage public IP. Which response best addresses these needs?
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; review and restrict the SQL service's public network access independently from the private endpoint connection.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
- Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address; do not create an Azure private endpoint for the required storage subresource and configure private name resolution.
- Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution; Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
Explanation
Correct Answer
B:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network. Private endpoint routing depends on name resolution; successful resource provisioning alone does not redirect clients. Both actions are needed.
Incorrect Answers
A:Private endpoint routing depends on name resolution; successful resource provisioning alone does not redirect clients.
C:This plan leaves out a required action: Create an Azure private endpoint for the required storage subresource and configure private name resolution. The remaining action alone does not satisfy the situation.
D:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network.
Question 211
Two IPsec peers agree on addresses but IKE negotiation fails because the encryption and integrity algorithms differ. A hybrid migration needs to extend a supported on-premises network into Azure while preserving IP addressing across certain workloads. What is the most appropriate plan for this situation?
- Align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance; evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists; evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics; do not align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance.
- Align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance; update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration.
Explanation
Correct Answer
A:A routed path alone cannot establish encryption when negotiated cryptographic proposals are incompatible. Extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity. Both actions are needed.
Incorrect Answers
B:A routed path alone cannot establish encryption when negotiated cryptographic proposals are incompatible.
C:This plan leaves out a required action: Align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance. The remaining action alone does not satisfy the situation.
D:Extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity.
Question 212
An enterprise needs services in two geographically separated Azure regions but chooses a circuit tier that cannot deliver its intended global reachability. An on-premises router advertises a broad default route through ExpressRoute and Azure internet-bound traffic now follows an unexpected private path. A connection is intermittently slow and engineers have no failure-detection mechanism beyond long BGP hold timers. Which course of action addresses the stated issues?
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; and evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; and evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; and evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; and evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities.
Explanation
Correct Answer
A:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules. Advertised routes influence actual Azure egress choices when the gateway accepts those prefixes. BFD can signal forwarding failures faster than waiting solely on ordinary BGP timers. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules.
C:Two actions meet their requirements, but action 2 misses this need: advertised routes influence actual Azure egress choices when the gateway accepts those prefixes.
D:Two actions meet their requirements, but action 3 misses this need: bFD can signal forwarding failures faster than waiting solely on ordinary BGP timers.
Question 213
A private DNS zone record resolves from one region but fails after clients switch to an alternate custom DNS server with no forwarding rule. Which action best addresses this finding?
- Check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address.
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries.
- Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
- Configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
Explanation
Correct Answer
D:Custom DNS server selection can bypass Azure private-zone resolution unless the namespace is explicitly forwarded.
Incorrect Answers
A:Here, custom DNS server selection can bypass Azure private-zone resolution unless the namespace is explicitly forwarded.
B:Verifying that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries would not configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
C:Reconciling the deployed inbound endpoint address with the DNS forwarder targets and testing queries end to end would not configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
Question 214
A virtual hub receives many site-to-site VPN connections and the operator chooses its gateway capacity using only the number of VNets. A company wants an NVA in a virtual hub for specialized packet inspection but tries to insert an arbitrary VM into the managed hub subnet. A branch VPN connects into Virtual WAN but the security team assumes all traffic is encrypted and inspected by default, regardless of hub policy. What is the most appropriate plan for this situation?
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites; and inspect Virtual WAN route-table associations and route propagation settings for each connection.
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; inspect Virtual WAN route-table associations and route propagation settings for each connection; and review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
- Inspect Virtual WAN route-table associations and route propagation settings for each connection; use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites; and review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites; and review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
Explanation
Correct Answer
D:Virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone. Managed virtual hub architectures restrict how third-party network security appliances are integrated. VPN tunnel encryption does not itself provide application-layer threat inspection across transit paths. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: vPN tunnel encryption does not itself provide application-layer threat inspection across transit paths.
B:Two actions meet their requirements, but action 2 misses this need: managed virtual hub architectures restrict how third-party network security appliances are integrated.
C:Two actions meet their requirements, but action 1 misses this need: virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone.
Question 215
A business wants to join two VNets in different Azure geographies through ExpressRoute but treats one circuit as globally valid without checking tier restrictions. A customer enables ExpressRoute resiliency but never checks the provider circuit's secondary BGP session, leaving a single point of route failure. Which course of action addresses the stated issues?
- Run a staged routing cutover with application session tests and a documented rollback and convergence window; Monitor and validate both provider path BGP sessions and test a deliberate failover.
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology; Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment.
- Monitor and validate both provider path BGP sessions and test a deliberate failover; do not verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology.
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology; Monitor and validate both provider path BGP sessions and test a deliberate failover.
Explanation
Correct Answer
D:ExpressRoute geography and connectivity scale vary by SKU and peering locations. Documented redundancy is ineffective if one BGP peer is already down before an incident. Both actions are needed.
Incorrect Answers
A:ExpressRoute geography and connectivity scale vary by SKU and peering locations.
B:Documented redundancy is ineffective if one BGP peer is already down before an incident.
C:This plan leaves out a required action: Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology. The remaining action alone does not satisfy the situation.
Question 216
A security analyst must verify whether a particular SSH packet is permitted but has only a list of all NSG rules. A network team opens TCP 3389 to all addresses because engineers sometimes need VM access from home. After an address-space change, security staff cannot explain which NSG rule denied a particular traffic flow captured overnight. Which response best addresses these needs?
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; and use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; and use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
- Deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; and use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; and deploy Azure Bastion using its required subnet and authorize administrative access through that supported service.
Explanation
Correct Answer
B:The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection. Wide-open management ports increase the attack surface independently of the VM's login credentials. Historical flow records provide activity evidence that current configuration alone may not retain. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: wide-open management ports increase the attack surface independently of the VM's login credentials.
C:Two actions meet their requirements, but action 1 misses this need: the evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.
D:Two actions meet their requirements, but action 3 misses this need: historical flow records provide activity evidence that current configuration alone may not retain.
Question 217
A network team migrates a traditional hub-spoke deployment to Virtual WAN but copies all old user-defined route tables into connections unchanged. A third-party firewall integration into Virtual WAN blocks half the sites because only a subset of connections use the secured route table. What is the most appropriate plan for this situation?
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point; do not map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration.
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
Explanation
Correct Answer
B:Virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub. Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered. Both actions are needed.
Incorrect Answers
A:Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered.
C:This plan leaves out a required action: Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration. The remaining action alone does not satisfy the situation.
D:Virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub.
Question 218
A network security team adds a firewall rule collection but assumes its descriptive name determines evaluation ahead of other collections. Which response best addresses this Azure networking scenario?
- Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules.
- Verify rule collection group and collection priorities and the documented processing order before rollout.
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution.
- Validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session.
Explanation
Correct Answer
B:Azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.
Incorrect Answers
A:Here, azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.
C:For this question, azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.
D:For this finding, azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.
Question 219
A security architect wants all spoke internet traffic inspected by a hub network virtual appliance, but packets still follow the system internet route. What should the Azure network engineer do?
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
- Enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
- Validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly.
Explanation
Correct Answer
A:User-defined routes override eligible system routing choices only when attached to the relevant source subnets.
Incorrect Answers
B:Here, user-defined routes override eligible system routing choices only when attached to the relevant source subnets.
C:For this question, user-defined routes override eligible system routing choices only when attached to the relevant source subnets.
D:For this finding, user-defined routes override eligible system routing choices only when attached to the relevant source subnets.
Question 220
Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. A network team peers two VNets that use overlapping 10.0.0.0/16 prefixes and is surprised by the creation failure. What is the most appropriate plan for this situation?
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; do not design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
Explanation
Correct Answer
C:Peering relationships are not automatically transitive across another VNet. Overlapping address ranges are incompatible with reliable direct peering across the endpoints. Both actions are needed.
Incorrect Answers
A:Peering relationships are not automatically transitive across another VNet.
B:This plan leaves out a required action: Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity. The remaining action alone does not satisfy the situation.
D:Overlapping address ranges are incompatible with reliable direct peering across the endpoints.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests