Question 280
Two Azure VNets in different subscriptions need low-latency private connectivity, but the design proposes a separate site-to-site VPN between them. A spoke peered to a hub needs to reach on-premises through the hub VPN gateway, but gateway transit options are not configured. What is the most appropriate plan for this situation?
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; do not use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
Explanation
Correct Answer
A:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity. Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway. Both actions are needed.
Incorrect Answers
B:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
C:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.
D:This plan leaves out a required action: Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement. The remaining action alone does not satisfy the situation.
Question 281
During an Azure networking rollout, the team must resolve both of these conditions. An administrator adds an inbound allow on an NSG but the application cannot reach a remote service because the effective outbound rule denies the reply's original initiation path. A project uses Virtual Network Manager security admin rules and local NSGs but assumes their precedence is a simple concatenated NSG list. Which course of action addresses the stated issues?
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes; validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; do not inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
Explanation
Correct Answer
C:Connection direction and state tracking determine which policy is evaluated for new traffic. Central security administration rules are evaluated differently from standard workload NSG rules. Both actions are needed.
Incorrect Answers
A:Connection direction and state tracking determine which policy is evaluated for new traffic.
B:This plan leaves out a required action: Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics. The remaining action alone does not satisfy the situation.
D:Central security administration rules are evaluated differently from standard workload NSG rules.
Question 282
During an Azure networking rollout, the team must resolve both of these conditions. A subnet contains a private endpoint and an architect assumes an NSG on the subnet always filters its traffic without checking network policy settings. A security team plans UDR-based inspection for private endpoint traffic but does not verify whether the route policy actually applies to the endpoint path. Which response best addresses these needs?
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
- Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance; do not check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; apply least-privilege service authorization and identity controls in addition to the private network connection.
- Continue using the service's valid hostname and certificate validation over the private endpoint connection; validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
Explanation
Correct Answer
A:Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation. Private endpoint routing and network policy requirements must be checked to avoid unintentionally bypassed inspection. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement. The remaining action alone does not satisfy the situation.
C:Private endpoint routing and network policy requirements must be checked to avoid unintentionally bypassed inspection.
D:Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.
Question 283
A new Azure Bastion host cannot deploy because the security team reused a general server subnet for the service. Which response best addresses this Azure networking scenario?
- Select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.
- Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion.
Explanation
Correct Answer
D:Azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites.
Incorrect Answers
A:Selecting a supported public ingress service or public IP association target would not create the required AzureBastionSubnet with a supported address size.
B:For this finding, azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites.
C:Placing Application Gateway in a supported dedicated subnet and keeping application backend resources in their own subnets would not create the required AzureBastionSubnet with a supported address size.
Question 284
A globally cached API returns private personalized responses to other users because its routes cache content with an overly broad policy. A request passes an edge WAF policy, but the administrator mistakes its rate-limit action for evidence that the origin application performed the same inspection. Which course of action addresses the stated issues?
- Stage changes to Front Door origin routing and test failover and application session behavior under maintenance; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
- Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; do not Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
Explanation
Correct Answer
D:Shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe. Edge and origin components log different security decisions and require correlation to explain a request outcome. Both actions are needed.
Incorrect Answers
A:Shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe.
B:Edge and origin components log different security decisions and require correlation to explain a request outcome.
C:This plan leaves out a required action: Disable caching for personalized responses and correct origin cache headers before enabling edge delivery. The remaining action alone does not satisfy the situation.
Question 285
A team deploys one manually sized Application Gateway instance for traffic that varies tenfold during seasonal campaigns. Which response most directly resolves the issue?
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Configure multi-site listener hostnames and appropriate routing rules with the required certificates.
- Create a custom health probe for the correct host and health path and review backend HTTP settings.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.
Explanation
Correct Answer
A:Dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance.
Incorrect Answers
B:Here, dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance.
C:For this finding, dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance.
D:For this question, dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance.
Question 286
A regional outage affects multiple network resources, but monitoring checks only one VM's CPU graph. Defender for Cloud flags an exposed management port and an engineer ignores the attack-path context because the vulnerability scan is clean. What is the most appropriate plan for this situation?
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence; do not use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
- Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
Explanation
Correct Answer
B:Network observability requires path and service signals beyond guest VM compute utilization. Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding. Both actions are needed.
Incorrect Answers
A:Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
C:This plan leaves out a required action: Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms. The remaining action alone does not satisfy the situation.
D:Network observability requires path and service signals beyond guest VM compute utilization.
Question 287
A backend service uses a custom TCP protocol and requires distribution across healthy VMs within one Azure region. An internet-facing application needs region-independent failover across two regional backend deployments using transport-level balancing. Which course of action addresses the stated issues?
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements; do not use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection; evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
Explanation
Correct Answer
A:Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy. Cross-region load balancing uses a global entry point across eligible regional deployments rather than a private regional listener. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule. The remaining action alone does not satisfy the situation.
C:Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.
D:Cross-region load balancing uses a global entry point across eligible regional deployments rather than a private regional listener.
Question 288
A private endpoint appears in the portal as Pending and clients cannot reach the provider service despite correct subnet DNS. Which response best addresses this Azure networking scenario?
- Use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.
Explanation
Correct Answer
B:A pending private connection cannot be treated as an established provider-approved data path.
Incorrect Answers
A:Using an approved Private Link service and consumer private endpoint rather than broad VNet peering would not approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
C:For this finding, a pending private connection cannot be treated as an established provider-approved data path.
D:Creating and managing private endpoints for the intended consumers with corresponding DNS zone links and approvals would not approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
Question 289
A false-positive rule excludes all request bodies to fix one JSON property, creating a large inspection gap. An enterprise enables a WAF policy on one Front Door domain and assumes all domains on a separate profile inherit it automatically. What is the most appropriate plan for this situation?
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile; do not use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
Explanation
Correct Answer
A:Broad exemptions can silently remove inspection coverage for unrelated malicious payloads. WAF protection must be explicitly associated with the intended application ingress scope. Both actions are needed.
Incorrect Answers
B:Broad exemptions can silently remove inspection coverage for unrelated malicious payloads.
C:This plan leaves out a required action: Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring. The remaining action alone does not satisfy the situation.
D:WAF protection must be explicitly associated with the intended application ingress scope.
Question 290
A VPN tunnel reports disconnected immediately after certificate or shared-key rotation, while route tables are unchanged. An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. Which course of action addresses the stated issues?
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; do not check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
Explanation
Correct Answer
D:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic. Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs. The remaining action alone does not satisfy the situation.
B:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
C:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests