Question 220
Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. A network team peers two VNets that use overlapping 10.0.0.0/16 prefixes and is surprised by the creation failure. What is the most appropriate plan for this situation?
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; do not design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
Explanation
Correct Answer
C:Peering relationships are not automatically transitive across another VNet. Overlapping address ranges are incompatible with reliable direct peering across the endpoints. Both actions are needed.
Incorrect Answers
A:Peering relationships are not automatically transitive across another VNet.
B:This plan leaves out a required action: Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity. The remaining action alone does not satisfy the situation.
D:Overlapping address ranges are incompatible with reliable direct peering across the endpoints.
Question 221
An administrator adds an inbound allow on an NSG but the application cannot reach a remote service because the effective outbound rule denies the reply's original initiation path. What should the Azure network engineer do?
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
Explanation
Correct Answer
B:Connection direction and state tracking determine which policy is evaluated for new traffic.
Incorrect Answers
A:Using supported Azure service tags and narrowly scoped protocols where applicable would not inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
C:For this finding, connection direction and state tracking determine which policy is evaluated for new traffic.
D:Reviewing NSG stateful flow behavior and verifying active session handling would not inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
Question 222
A developer connects privately to a PaaS service but disables TLS certificate validation because the service now has a private IP. Which action best addresses this finding?
- Continue using the service's valid hostname and certificate validation over the private endpoint connection.
- Apply least-privilege service authorization and identity controls in addition to the private network connection.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.
- Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
Explanation
Correct Answer
A:A private IP does not make encrypted transport or endpoint identity verification unnecessary.
Incorrect Answers
B:For this finding, a private IP does not make encrypted transport or endpoint identity verification unnecessary.
C:For this question, a private IP does not make encrypted transport or endpoint identity verification unnecessary.
D:Here, a private IP does not make encrypted transport or endpoint identity verification unnecessary.
Question 223
A network engineer associates a public IP directly with an unsupported private platform resource, hoping to make its internal endpoint public. What should the Azure network engineer do?
- Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion.
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
- Select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.
Explanation
Correct Answer
C:Public IP associations are constrained by supported Azure resource types and network architectures.
Incorrect Answers
A:Here, public IP associations are constrained by supported Azure resource types and network architectures.
B:For this finding, public IP associations are constrained by supported Azure resource types and network architectures.
D:For this question, public IP associations are constrained by supported Azure resource types and network architectures.
Question 224
A retailer plans to cut traffic from one region but simply disables its origin without validating what happens to long-lived client connections. Which action best addresses this finding?
- Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
- Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
Explanation
Correct Answer
C:Origin routing health changes affect new or retried requests and must be tested with real application continuity needs.
Incorrect Answers
A:For this finding, origin routing health changes affect new or retried requests and must be tested with real application continuity needs.
B:For this question, origin routing health changes affect new or retried requests and must be tested with real application continuity needs.
D:Here, origin routing health changes affect new or retried requests and must be tested with real application continuity needs.
Question 225
A shopping site must send /payments to a protected API pool and /catalog to a different pool under one HTTPS host. A reverse proxy answers for store.example.com but rejects requests for support.example.com despite both sites sharing the gateway. An Application Gateway backend shows unhealthy because its probe requests / and receives 404 even though /health returns 200. Which response best addresses these needs?
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; configure multi-site listener hostnames and appropriate routing rules with the required certificates; and evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits; configure multi-site listener hostnames and appropriate routing rules with the required certificates; and create a custom health probe for the correct host and health path and review backend HTTP settings.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; evaluate autoscaling Application Gateway capacity with monitored minimums and service limits; and create a custom health probe for the correct host and health path and review backend HTTP settings.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; configure multi-site listener hostnames and appropriate routing rules with the required certificates; and create a custom health probe for the correct host and health path and review backend HTTP settings.
Explanation
Correct Answer
D:Application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide. Host-based listener matching controls which site a shared gateway accepts and routes. A default probe can misclassify a functioning application when its expected hostname or path differs. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: a default probe can misclassify a functioning application when its expected hostname or path differs.
B:Two actions meet their requirements, but action 1 misses this need: application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
C:Two actions meet their requirements, but action 2 misses this need: host-based listener matching controls which site a shared gateway accepts and routes.
Question 226
A security team needs historical communication patterns for subnet-level troubleshooting and assumes the retired NSG flow log workflow is the only option. An internet-facing app is targeted by a volumetric attack, and the team mistakes a simple NSG deny rule for a full DDoS mitigation plan. What is the most appropriate plan for this situation?
- Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; do not plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
- Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring.
Explanation
Correct Answer
D:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited. NSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions. The remaining action alone does not satisfy the situation.
B:NSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services.
C:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
Question 227
A backend service uses a custom TCP protocol and requires distribution across healthy VMs within one Azure region. A team configures a Load Balancer rule for HTTPS traffic but assumes it can inspect URL paths and select different backends for /api. Which course of action addresses the stated issues?
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
- Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements; use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection; do not use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
Explanation
Correct Answer
A:Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy. Layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions. Both actions are needed.
Incorrect Answers
B:Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.
C:Layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions.
D:This plan leaves out a required action: Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule. The remaining action alone does not satisfy the situation.
Question 228
An Azure PaaS resource is used by both a production and test VNet, and a team wants isolated private connections and separate approval records. A private endpoint appears in the portal as Pending and clients cannot reach the provider service despite correct subnet DNS. An engineering design must provide private access to a partner-managed service without joining the partner's full VNet or exposing all its subnets. Which response best addresses these needs?
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; approve the endpoint request through the service provider's supported connection workflow and confirm the connection state; and review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration; and use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration; approve the endpoint request through the service provider's supported connection workflow and confirm the connection state; and use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; approve the endpoint request through the service provider's supported connection workflow and confirm the connection state; and use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
Explanation
Correct Answer
D:Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path. A pending private connection cannot be treated as an established provider-approved data path. Private Link can expose a designated service across ownership boundaries without providing general network transit. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: private Link can expose a designated service across ownership boundaries without providing general network transit.
B:Two actions meet their requirements, but action 2 misses this need: a pending private connection cannot be treated as an established provider-approved data path.
C:Two actions meet their requirements, but action 1 misses this need: separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.
Question 229
During an Azure networking rollout, the team must resolve both of these conditions. A WAF is left in Detection mode while executives expect it to block confirmed malicious payloads. An enterprise enables a WAF policy on one Front Door domain and assumes all domains on a separate profile inherit it automatically. What is the most appropriate plan for this situation?
- Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile; do not After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
Explanation
Correct Answer
C:Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode. WAF protection must be explicitly associated with the intended application ingress scope. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes. The remaining action alone does not satisfy the situation.
B:Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.
D:WAF protection must be explicitly associated with the intended application ingress scope.
Question 230
A dual-tunnel deployment sends traffic to Azure but replies prefer one failed peer because on-premises routing did not converge. An architect tries to configure BGP settings on a gateway deployment that does not support the intended protocol combination. Which course of action addresses the stated issues?
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers; check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; do not verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
Explanation
Correct Answer
A:Resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure. Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone. Both actions are needed.
Incorrect Answers
B:Resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure.
C:Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.
D:This plan leaves out a required action: Verify BGP advertisements, health, and route selection for both active paths across the VPN peers. The remaining action alone does not satisfy the situation.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests