Question 290
A VPN tunnel reports disconnected immediately after certificate or shared-key rotation, while route tables are unchanged. An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. Which course of action addresses the stated issues?
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; do not check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
Explanation
Correct Answer
D:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic. Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs. The remaining action alone does not satisfy the situation.
B:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
C:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
Question 291
A global network needs geographically distributed WAN hubs, but the plan places all branches behind one distant hub irrespective of latency and availability. Which response best addresses this Azure networking scenario?
- Create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites.
- Select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
- Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing.
Explanation
Correct Answer
B:Hub placement affects branch latency and region failure exposure even when a global WAN resource exists.
Incorrect Answers
A:For this finding, hub placement affects branch latency and region failure exposure even when a global WAN resource exists.
C:Here, hub placement affects branch latency and region failure exposure even when a global WAN resource exists.
D:For this question, hub placement affects branch latency and region failure exposure even when a global WAN resource exists.
Question 292
During an Azure networking rollout, the team must resolve both of these conditions. A healthcare database requires consumers to resolve a private service address and disable the provider's public endpoint entirely. A service endpoint configuration works within one VNet but a newly migrated workload on-premises cannot use the same policy-based source identity. What is the most appropriate plan for this situation?
- Use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; do not use a private endpoint with service-supported public network restrictions and the matching private DNS integration.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use service endpoints and service-side virtual network rules after validating compatibility.
- Test actual FQDN answers and effective routes, then select the intended access method explicitly; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity.
Explanation
Correct Answer
D:Private Link provides the private address required for a design that eliminates public service reachability. On-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Use a private endpoint with service-supported public network restrictions and the matching private DNS integration. The remaining action alone does not satisfy the situation.
B:On-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel.
C:Private Link provides the private address required for a design that eliminates public service reachability.
Question 293
A company wants subnets to access only a subset of approved storage accounts rather than every account that could accept service endpoint traffic. Which action best addresses this finding?
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility.
- Review storage network rules and service endpoint source identity alongside application-layer credentials.
- Retain appropriate NSG and routing controls because service endpoints do not replace general outbound network security.
- Check which Azure services support service endpoint policies and use alternative enforcement where unsupported.
Explanation
Correct Answer
A:Service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported.
Incorrect Answers
B:For this question, service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported.
C:For this finding, service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported.
D:Here, service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported.
Question 294
A storage account has both Blob and File services, and the administrator assumes a Blob private endpoint also covers the file share endpoint. An enterprise manually hardcodes the storage private endpoint IP in application configuration rather than using its normal service FQDN. Which response best addresses these needs?
- Use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP; do not create separate private endpoints and matching private DNS records for each required supported storage subresource.
- Create separate private endpoints and matching private DNS records for each required supported storage subresource; use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP.
- Create separate private endpoints and matching private DNS records for each required supported storage subresource; configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links.
- Update the zone group or private DNS record so the resource hostname resolves to the active endpoint IP; use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP.
Explanation
Correct Answer
B:Private endpoint connections are often scoped to specific service subresources rather than all endpoints in the resource. Stable service DNS names and TLS validation are safer than applications depending on one private interface address. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Create separate private endpoints and matching private DNS records for each required supported storage subresource. The remaining action alone does not satisfy the situation.
C:Stable service DNS names and TLS validation are safer than applications depending on one private interface address.
D:Private endpoint connections are often scoped to specific service subresources rather than all endpoints in the resource.
Question 295
On-premises clients must resolve private endpoint names in Azure, but their DNS servers have no conditional path into Azure's private zones. A DNS Private Resolver deployment places inbound and outbound endpoint roles in one subnet and receives an unsupported-configuration error. What is the most appropriate plan for this situation?
- Deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders; create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules.
- Deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders; configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet.
- Create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules; do not deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders.
- Link the DNS forwarding ruleset to the intended client VNet and verify suffix matching and target reachability; create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules.
Explanation
Correct Answer
A:Hybrid DNS needs a reachable inbound resolver path; simply linking the private zone to a VNet does not serve on-premises queries. Resolver endpoint types have distinct subnet requirements and cannot be combined arbitrarily. Both actions are needed.
Incorrect Answers
B:Resolver endpoint types have distinct subnet requirements and cannot be combined arbitrarily.
C:This plan leaves out a required action: Deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders. The remaining action alone does not satisfy the situation.
D:Hybrid DNS needs a reachable inbound resolver path; simply linking the private zone to a VNet does not serve on-premises queries.
Question 296
A DDoS investigation sees no L7 HTTP request details despite having network DDoS telemetry enabled. A defender finds a network-exposed secret management endpoint and wants to prioritize remediation beyond raw Secure Score point totals. Which course of action addresses the stated issues?
- Use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
- Use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns.
- Use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets; do not use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
Explanation
Correct Answer
A:Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures. Security scoring is a prioritization input but does not by itself show how an attacker could traverse a live exposure. Both actions are needed.
Incorrect Answers
B:Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures.
C:Security scoring is a prioritization input but does not by itself show how an attacker could traverse a live exposure.
D:This plan leaves out a required action: Use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence. The remaining action alone does not satisfy the situation.
Question 297
A virtual subnet contains a /29 range and a design spreadsheet assumes all eight addresses are assignable to workloads. A team wants to shrink an active VNet subnet while network interfaces and endpoints still occupy addresses outside the proposed range. Which response best addresses these needs?
- Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs; choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity.
- Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs; Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix.
- Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands; Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix.
- Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; do not Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs.
Explanation
Correct Answer
B:Azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity. Subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints. Both actions are needed.
Incorrect Answers
A:Subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints.
C:Azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity.
D:This plan leaves out a required action: Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs. The remaining action alone does not satisfy the situation.
Question 298
A hub NVA exchanges BGP routes with a VPN environment, but static routes become stale every time on-premises prefixes change. What should the Azure network engineer do?
- Evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design.
- Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups.
- Apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope.
- Keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange.
Explanation
Correct Answer
A:Route Server can exchange dynamic routes with eligible NVAs and gateways instead of maintaining each learned prefix manually.
Incorrect Answers
B:Here, route Server can exchange dynamic routes with eligible NVAs and gateways instead of maintaining each learned prefix manually.
C:Applying Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope would not meet the need for Azure Route Server with supported BGP peers and effective route propagation through the hub design.
D:Keeping packet forwarding on supported gateways or NVAs and using Route Server only for appropriate routing control-plane exchange would not meet the need for Azure Route Server with supported BGP peers and effective route propagation through the hub design.
Question 299
An administrator creates an NSG but never associates it with the intended subnet or NIC and claims the workload is isolated. An ASG rule fails to apply to a target VM because its network interface was never made a member of the designated group. Which course of action addresses the stated issues?
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive.
- Use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls; assign the appropriate VM network interface to the ASG and check effective security rules.
- Assign the appropriate VM network interface to the ASG and check effective security rules; do not Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces.
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; assign the appropriate VM network interface to the ASG and check effective security rules.
Explanation
Correct Answer
D:Unassociated NSG resources cannot evaluate or filter the intended traffic. An ASG reference matches configured membership and cannot infer application tier from resource names. Both actions are needed.
Incorrect Answers
A:An ASG reference matches configured membership and cannot infer application tier from resource names.
B:Unassociated NSG resources cannot evaluate or filter the intended traffic.
C:This plan leaves out a required action: Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces. The remaining action alone does not satisfy the situation.
Question 300
A globally distributed web service wants endpoint failover by changing the DNS answer based on health, not by proxying every HTTP request. A regional service fails but some users keep reaching it until cached DNS answers expire despite Traffic Manager reporting a healthy alternate. Which response best addresses these needs?
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection; review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover; do not configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
Explanation
Correct Answer
B:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy. DNS-based failover cannot immediately replace a connection that relies on an already cached address. Both actions are needed.
Incorrect Answers
A:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
C:This plan leaves out a required action: Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring. The remaining action alone does not satisfy the situation.
D:DNS-based failover cannot immediately replace a connection that relies on an already cached address.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests