Question 330
A finance team needs storage account traffic from its Azure VNet to use a private address instead of the service's public endpoint. An administrator creates a private endpoint to Azure SQL but leaves public network access open and declares all public ingress eliminated. Which response best addresses these needs?
- Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution; review and restrict the SQL service's public network access independently from the private endpoint connection.
- Review and restrict the SQL service's public network access independently from the private endpoint connection; do not create an Azure private endpoint for the required storage subresource and configure private name resolution.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; review and restrict the SQL service's public network access independently from the private endpoint connection.
Explanation
Correct Answer
D:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network. Adding a private path does not automatically turn off the service's separately configured public endpoint. Both actions are needed.
Incorrect Answers
A:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network.
B:This plan leaves out a required action: Create an Azure private endpoint for the required storage subresource and configure private name resolution. The remaining action alone does not satisfy the situation.
C:Adding a private path does not automatically turn off the service's separately configured public endpoint.
Question 331
A hybrid migration needs to extend a supported on-premises network into Azure while preserving IP addressing across certain workloads. What should the Azure network engineer do?
- Align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance.
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration.
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists.
- Evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
Explanation
Correct Answer
D:Extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity.
Incorrect Answers
A:Here, extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity.
B:For this question, extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity.
C:For this finding, extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity.
Question 332
An enterprise needs services in two geographically separated Azure regions but chooses a circuit tier that cannot deliver its intended global reachability. An on-premises router advertises a broad default route through ExpressRoute and Azure internet-bound traffic now follows an unexpected private path. Which course of action addresses the stated issues?
- Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; do not select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach.
- Evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities.
Explanation
Correct Answer
C:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules. Advertised routes influence actual Azure egress choices when the gateway accepts those prefixes. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach. The remaining action alone does not satisfy the situation.
B:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules.
D:Advertised routes influence actual Azure egress choices when the gateway accepts those prefixes.
Question 333
During an Azure networking rollout, the team must resolve both of these conditions. Hybrid DNS forwarding works for a test VNet but a newly added VNet still cannot resolve names in the on-premises domain. A private DNS zone record resolves from one region but fails after clients switch to an alternate custom DNS server with no forwarding rule. Which response best addresses these needs?
- Configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path; do not verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries.
- Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end; configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries; check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address.
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries; configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
Explanation
Correct Answer
D:DNS resolver forwarding policies do not automatically apply to newly connected VNets without the right ruleset link. Custom DNS server selection can bypass Azure private-zone resolution unless the namespace is explicitly forwarded. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries. The remaining action alone does not satisfy the situation.
B:DNS resolver forwarding policies do not automatically apply to newly connected VNets without the right ruleset link.
C:Custom DNS server selection can bypass Azure private-zone resolution unless the namespace is explicitly forwarded.
Question 334
A branch VPN connects into Virtual WAN but the security team assumes all traffic is encrypted and inspected by default, regardless of hub policy. Which action best addresses this finding?
- Use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites.
- Review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
- Inspect Virtual WAN route-table associations and route propagation settings for each connection.
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits.
Explanation
Correct Answer
B:VPN tunnel encryption does not itself provide application-layer threat inspection across transit paths.
Incorrect Answers
A:For this finding, vPN tunnel encryption does not itself provide application-layer threat inspection across transit paths.
C:Here, vPN tunnel encryption does not itself provide application-layer threat inspection across transit paths.
D:For this question, vPN tunnel encryption does not itself provide application-layer threat inspection across transit paths.
Question 335
A business wants to join two VNets in different Azure geographies through ExpressRoute but treats one circuit as globally valid without checking tier restrictions. A team demands zero-downtime ExpressRoute deployment and ignores propagation delays and routing convergence in its cutover plan. Which course of action addresses the stated issues?
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology; Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment.
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology; run a staged routing cutover with application session tests and a documented rollback and convergence window.
- Run a staged routing cutover with application session tests and a documented rollback and convergence window; do not verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology.
- Monitor and validate both provider path BGP sessions and test a deliberate failover; run a staged routing cutover with application session tests and a documented rollback and convergence window.
Explanation
Correct Answer
B:ExpressRoute geography and connectivity scale vary by SKU and peering locations. Routing transitions can briefly affect active flows even when the destination circuit is provisioned correctly. Both actions are needed.
Incorrect Answers
A:Routing transitions can briefly affect active flows even when the destination circuit is provisioned correctly.
C:This plan leaves out a required action: Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology. The remaining action alone does not satisfy the situation.
D:ExpressRoute geography and connectivity scale vary by SKU and peering locations.
Question 336
A network team opens TCP 3389 to all addresses because engineers sometimes need VM access from home. After an address-space change, security staff cannot explain which NSG rule denied a particular traffic flow captured overnight. Which response best addresses these needs?
- Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; use Network Watcher IP flow verify with the precise source, destination, protocol, and ports.
- Use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy; do not remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
- Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
- Deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
Explanation
Correct Answer
C:Wide-open management ports increase the attack surface independently of the VM's login credentials. Historical flow records provide activity evidence that current configuration alone may not retain. Both actions are needed.
Incorrect Answers
A:Historical flow records provide activity evidence that current configuration alone may not retain.
B:This plan leaves out a required action: Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path. The remaining action alone does not satisfy the situation.
D:Wide-open management ports increase the attack surface independently of the VM's login credentials.
Question 337
A network team migrates a traditional hub-spoke deployment to Virtual WAN but copies all old user-defined route tables into connections unchanged. Operations adds new sites without monitoring hub gateway health, and users report delayed recognition of a partial regional failure. What is the most appropriate plan for this situation?
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; do not map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership.
- Validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts.
Explanation
Correct Answer
D:Virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub. A managed WAN design still needs monitoring of ingress, hub routing and active connections. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration. The remaining action alone does not satisfy the situation.
B:A managed WAN design still needs monitoring of ingress, hub routing and active connections.
C:Virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub.
Question 338
A firewall FQDN rule fails for internal service names because the firewall and clients resolve the same name through different DNS servers. Which action best addresses this finding?
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution.
- Verify rule collection group and collection priorities and the documented processing order before rollout.
- Validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session.
- Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules.
Explanation
Correct Answer
A:FQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients.
Incorrect Answers
B:For this question, fQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients.
C:For this finding, fQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients.
D:Here, fQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients.
Question 339
A security architect wants all spoke internet traffic inspected by a hub network virtual appliance, but packets still follow the system internet route. A forced-tunneling design sends everything through an on-premises firewall, but Azure platform dependencies unexpectedly lose connectivity. A UDR specifies next-hop VirtualAppliance but points to a VM that has IP forwarding disabled, causing blackholed traffic. Which response best addresses these needs?
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; and enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop; inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; and enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; and inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; and enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
Explanation
Correct Answer
D:User-defined routes override eligible system routing choices only when attached to the relevant source subnets. Forced tunneling must account for platform control paths and documented service exceptions, not just user traffic. Sending packets to an NVA does not make it a router unless forwarding is configured and supported. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: user-defined routes override eligible system routing choices only when attached to the relevant source subnets.
B:Two actions meet their requirements, but action 2 misses this need: forced tunneling must account for platform control paths and documented service exceptions, not just user traffic.
C:Two actions meet their requirements, but action 3 misses this need: sending packets to an NVA does not make it a router unless forwarding is configured and supported.
Question 340
A network team peers two VNets that use overlapping 10.0.0.0/16 prefixes and is surprised by the creation failure. Which response best addresses this Azure networking scenario?
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
Explanation
Correct Answer
C:Overlapping address ranges are incompatible with reliable direct peering across the endpoints.
Incorrect Answers
A:For this question, overlapping address ranges are incompatible with reliable direct peering across the endpoints.
B:Here, overlapping address ranges are incompatible with reliable direct peering across the endpoints.
D:For this finding, overlapping address ranges are incompatible with reliable direct peering across the endpoints.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests