Question 320
A web application must maintain one stable inbound IP through a VM restart, but it currently receives a dynamic public address. A team allocates an unused public IP prefix and expects an individual virtual machine to respond to the entire prefix automatically. Which course of action addresses the stated issues?
- Create a suitable static Standard public IP and associate it with the supported load balancer or network interface; Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
- Create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints; do not create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
- Create a suitable static Standard public IP and associate it with the supported load balancer or network interface; create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
Explanation
Correct Answer
D:A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address. Reserving a prefix does not itself configure listeners or give one VM every address in that prefix. Both actions are needed.
Incorrect Answers
A:Reserving a prefix does not itself configure listeners or give one VM every address in that prefix.
B:A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address.
C:This plan leaves out a required action: Create a suitable static Standard public IP and associate it with the supported load balancer or network interface. The remaining action alone does not satisfy the situation.
Question 321
A business uses an external RADIUS server for remote user authentication and wants Azure P2S to validate against it. A P2S client authenticates successfully but cannot reach an internal database because its source address pool overlaps the destination subnet. Which response best addresses these needs?
- Redesign the client address pool to avoid overlapping private networks and validate the return routes; do not choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability.
- Implement certificate revocation and replacement for affected P2S clients, then verify rejected connections; Redesign the client address pool to avoid overlapping private networks and validate the return routes.
- Choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability; use a supported Microsoft Entra ID authentication design with appropriate client and conditional access prerequisites.
- Choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability; Redesign the client address pool to avoid overlapping private networks and validate the return routes.
Explanation
Correct Answer
D:RADIUS requires a compatible VPN configuration and live authentication path beyond a portal checkbox. Authentication success does not resolve collisions between remote client addresses and private destination routes. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability. The remaining action alone does not satisfy the situation.
B:RADIUS requires a compatible VPN configuration and live authentication path beyond a portal checkbox.
C:Authentication success does not resolve collisions between remote client addresses and private destination routes.
Question 322
Remote administrators need encrypted access from individual laptops while no branch appliance will terminate an IPsec site-to-site tunnel. A remote-access deployment requires Windows native VPN connectivity but a third-party client feature is assumed to exist on every platform. What is the most appropriate plan for this situation?
- Regenerate and redistribute the current VPN client configuration and verify the client's installed route list; Match the selected tunnel protocol and authentication approach to actual supported client operating systems.
- Configure a supported Azure point-to-site VPN gateway and distribute approved client profiles; Match the selected tunnel protocol and authentication approach to actual supported client operating systems.
- Configure a supported Azure point-to-site VPN gateway and distribute approved client profiles; select an eligible OpenVPN-based point-to-site profile and validate the required Microsoft Entra authentication support.
- Match the selected tunnel protocol and authentication approach to actual supported client operating systems; do not configure a supported Azure point-to-site VPN gateway and distribute approved client profiles.
Explanation
Correct Answer
B:Point-to-site VPN serves individual remote devices; a site-to-site gateway connection is not the required client onboarding model. Point-to-site user experience differs by operating system, tunnel client, and credential method. Both actions are needed.
Incorrect Answers
A:Point-to-site VPN serves individual remote devices; a site-to-site gateway connection is not the required client onboarding model.
C:Point-to-site user experience differs by operating system, tunnel client, and credential method.
D:This plan leaves out a required action: Configure a supported Azure point-to-site VPN gateway and distribute approved client profiles. The remaining action alone does not satisfy the situation.
Question 323
During an Azure networking rollout, the team must resolve both of these conditions. An enterprise must preserve one backend VM for each client source across multiple TCP connections, and uniform load distribution breaks session behavior. An administrator creates a backend pool but forgets to attach VM network interfaces or addresses, leaving it empty. Which course of action addresses the stated issues?
- Evaluate supported Load Balancer session persistence settings and the application's actual state handling; Associate the intended instances with the backend pool and verify probe health and effective frontend rules.
- Associate the intended instances with the backend pool and verify probe health and effective frontend rules; do not evaluate supported Load Balancer session persistence settings and the application's actual state handling.
- Evaluate supported Load Balancer session persistence settings and the application's actual state handling; deploy a suitable Azure Load Balancer UDP rule and health-check strategy for the supported backend service.
- Create appropriately scoped load-balancing or inbound NAT rules with distinct ports and authorized access controls; Associate the intended instances with the backend pool and verify probe health and effective frontend rules.
Explanation
Correct Answer
A:Layer-4 distribution can use session-affinity modes, but application state still requires a compatible design. Creating a backend pool does not populate it or connect incoming traffic to real servers. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Evaluate supported Load Balancer session persistence settings and the application's actual state handling. The remaining action alone does not satisfy the situation.
C:Creating a backend pool does not populate it or connect incoming traffic to real servers.
D:Layer-4 distribution can use session-affinity modes, but application state still requires a compatible design.
Question 324
Two offices require simultaneous resilient site-to-site tunnels into Azure and want protection against one gateway instance failure. Which response best addresses this Azure networking scenario?
- Evaluate policy-based compatibility and supported VPN gateway connection settings before attempting to force a route-based design.
- Select a supported gateway SKU based on throughput, tunnel limits, feature support, and availability needs.
- Select an eligible active-active VPN gateway configuration and design both on-premises tunnels and BGP peers where supported.
- Deploy a supported route-based Azure VPN gateway and configure compatible IPsec peer settings and routes.
Explanation
Correct Answer
C:Gateway redundancy requires a compatible gateway mode and remote peers, not merely two local IPsec profiles.
Incorrect Answers
A:Here, gateway redundancy requires a compatible gateway mode and remote peers, not merely two local IPsec profiles.
B:Selecting a supported gateway SKU based on throughput, tunnel limits, feature support, and availability needs would not meet the need for an eligible active-active VPN gateway configuration and design both on-premises tunnels and BGP peers where supported.
D:Deploying a supported route-based Azure VPN gateway and configuring compatible IPsec peer settings and routes would not meet the need for an eligible active-active VPN gateway configuration and design both on-premises tunnels and BGP peers where supported.
Question 325
A public zone was created in Azure DNS, but users still query the prior provider because the domain registrar nameservers were not updated. Which response best addresses this Azure networking scenario?
- Plan record TTLs and allow cached responses to age out while validating the authoritative record and cutover window.
- Inspect endpoint-linked DNS zone groups and reconcile stale private A records to the current endpoint IP.
- Configure delegation in the appropriate public parent zone and verify authoritative NS records for the child zone.
- Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation.
Explanation
Correct Answer
D:Public zone creation must be paired with parent delegation before internet clients consistently use Azure records.
Incorrect Answers
A:Here, public zone creation must be paired with parent delegation before internet clients consistently use Azure records.
B:For this finding, public zone creation must be paired with parent delegation before internet clients consistently use Azure records.
C:For this question, public zone creation must be paired with parent delegation before internet clients consistently use Azure records.
Question 326
A retailer needs to limit aggressive automated checkout requests from a small set of source addresses without blocking all legitimate shopping. A security engineer creates one custom WAF allow rule ahead of managed rules and unintentionally lets selected traffic bypass later inspections. Which course of action addresses the stated issues?
- Review custom-rule priority and termination behavior before permitting exceptions to the managed rule set; do not evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry.
- Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry; run authorized representative request tests and correlate WAF logs with policy mode and expected decisions.
- Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry; review custom-rule priority and termination behavior before permitting exceptions to the managed rule set.
- Map supported managed rule sets and custom-rule options to the new WAF platform before migration; review custom-rule priority and termination behavior before permitting exceptions to the managed rule set.
Explanation
Correct Answer
C:Rate limiting can mitigate request floods while preserving legitimate client patterns when thresholds are tested. WAF custom rule evaluation can change whether subsequent protections are applied to a request. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry. The remaining action alone does not satisfy the situation.
B:WAF custom rule evaluation can change whether subsequent protections are applied to a request.
D:Rate limiting can mitigate request floods while preserving legitimate client patterns when thresholds are tested.
Question 327
During an Azure networking rollout, the team must resolve both of these conditions. An administrator must access the RDP port of individual VMs behind one shared public load balancer IP. Several backend VMs exhaust outbound ephemeral translation ports when a load balancer's implicit internet egress is heavily used. Which response best addresses these needs?
- Define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances; configure an appropriate health probe for the actual service protocol and port and validate backend readiness.
- Design explicit outbound SNAT rules or approved NAT Gateway capacity and verify connection reuse; do not define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances.
- Define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances; design explicit outbound SNAT rules or approved NAT Gateway capacity and verify connection reuse.
- Evaluate Azure Gateway Load Balancer chaining and the compatible NVA appliance integration; design explicit outbound SNAT rules or approved NAT Gateway capacity and verify connection reuse.
Explanation
Correct Answer
C:Inbound NAT maps targeted management connections; it is distinct from distributing application traffic across a pool. Outbound SNAT port supply is a separate capacity constraint from inbound balancing or health probe checks. Both actions are needed.
Incorrect Answers
A:Outbound SNAT port supply is a separate capacity constraint from inbound balancing or health probe checks.
B:This plan leaves out a required action: Define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances. The remaining action alone does not satisfy the situation.
D:Inbound NAT maps targeted management connections; it is distinct from distributing application traffic across a pool.
Question 328
A troubleshooting capture must inspect packets leaving a VM during a brief TLS failure, but the team collects only Azure Activity Logs. An engineer adds NSG rules and wants to determine which rule applies to a particular source/destination protocol combination. What is the most appropriate plan for this situation?
- Configure a bounded Network Watcher packet capture for the target VM with authorized storage and filters; use Network Watcher connection troubleshoot and appropriate IP flow verification to isolate the failed connection stage.
- Run IP flow verify with representative five-tuple details and inspect the resulting allow or deny rule; do not configure a bounded Network Watcher packet capture for the target VM with authorized storage and filters.
- Configure a bounded Network Watcher packet capture for the target VM with authorized storage and filters; run IP flow verify with representative five-tuple details and inspect the resulting allow or deny rule.
- Use Network Watcher next hop and effective-route diagnostics for the affected VM source and destination; run IP flow verify with representative five-tuple details and inspect the resulting allow or deny rule.
Explanation
Correct Answer
C:Packet capture provides traffic-level evidence that management-plane activity events do not contain. IP flow verification evaluates NSG policy for a specific network tuple rather than inferring from rule names. Both actions are needed.
Incorrect Answers
A:IP flow verification evaluates NSG policy for a specific network tuple rather than inferring from rule names.
B:This plan leaves out a required action: Configure a bounded Network Watcher packet capture for the target VM with authorized storage and filters. The remaining action alone does not satisfy the situation.
D:Packet capture provides traffic-level evidence that management-plane activity events do not contain.
Question 329
A route-based VPN advertises 0.0.0.0/0 from a branch and unexpectedly attracts Azure workloads that should use direct internet egress. What should the Azure network engineer do?
- Expand GatewaySubnet through a supported change plan before allocating the new gateway instances.
- Evaluate zone-redundant or active-active options and validate operational failover against branch peer capabilities.
- Correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles.
- Review BGP default-route acceptance and forced-tunneling intent before allowing the branch's advertised default.
Explanation
Correct Answer
D:An accepted default route can change all internet egress traffic paths, not just the intended private branch prefixes.
Incorrect Answers
A:Expanding GatewaySubnet through a supported change plan would not review BGP default-route acceptance and forced-tunneling intent.
B:Evaluating zone-redundant or active-active options and validating operational failover against branch peer capabilities would not review BGP default-route acceptance and forced-tunneling intent.
C:For this finding, an accepted default route can change all internet egress traffic paths, not just the intended private branch prefixes.
Question 330
A finance team needs storage account traffic from its Azure VNet to use a private address instead of the service's public endpoint. An administrator creates a private endpoint to Azure SQL but leaves public network access open and declares all public ingress eliminated. Which response best addresses these needs?
- Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution; review and restrict the SQL service's public network access independently from the private endpoint connection.
- Review and restrict the SQL service's public network access independently from the private endpoint connection; do not create an Azure private endpoint for the required storage subresource and configure private name resolution.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; review and restrict the SQL service's public network access independently from the private endpoint connection.
Explanation
Correct Answer
D:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network. Adding a private path does not automatically turn off the service's separately configured public endpoint. Both actions are needed.
Incorrect Answers
A:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network.
B:This plan leaves out a required action: Create an Azure private endpoint for the required storage subresource and configure private name resolution. The remaining action alone does not satisfy the situation.
C:Adding a private path does not automatically turn off the service's separately configured public endpoint.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests