Question 340
A network team peers two VNets that use overlapping 10.0.0.0/16 prefixes and is surprised by the creation failure. Which response best addresses this Azure networking scenario?
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
Explanation
Correct Answer
C:Overlapping address ranges are incompatible with reliable direct peering across the endpoints.
Incorrect Answers
A:For this question, overlapping address ranges are incompatible with reliable direct peering across the endpoints.
B:Here, overlapping address ranges are incompatible with reliable direct peering across the endpoints.
D:For this finding, overlapping address ranges are incompatible with reliable direct peering across the endpoints.
Question 341
An administrator adds an inbound allow on an NSG but the application cannot reach a remote service because the effective outbound rule denies the reply's original initiation path. A project uses Virtual Network Manager security admin rules and local NSGs but assumes their precedence is a simple concatenated NSG list. A storage service uses a dynamic set of provider addresses, and engineers plan to hardcode every observed IP in NSG egress rules. Which course of action addresses the stated issues?
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; and review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic; validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; and use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; and use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic; and use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
Explanation
Correct Answer
C:Connection direction and state tracking determine which policy is evaluated for new traffic. Central security administration rules are evaluated differently from standard workload NSG rules. Service tags provide maintained address abstractions for specific service categories. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: service tags provide maintained address abstractions for specific service categories.
B:Two actions meet their requirements, but action 1 misses this need: connection direction and state tracking determine which policy is evaluated for new traffic.
D:Two actions meet their requirements, but action 2 misses this need: central security administration rules are evaluated differently from standard workload NSG rules.
Question 342
A security team plans UDR-based inspection for private endpoint traffic but does not verify whether the route policy actually applies to the endpoint path. Which response most directly resolves the issue?
- Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.
- Apply least-privilege service authorization and identity controls in addition to the private network connection.
- Continue using the service's valid hostname and certificate validation over the private endpoint connection.
Explanation
Correct Answer
A:Private endpoint routing and network policy requirements must be checked to avoid unintentionally bypassed inspection.
Incorrect Answers
B:Checking private endpoint network policies and supported NSG behavior for the target subnet would not validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
C:For this finding, private endpoint routing and network policy requirements must be checked to avoid unintentionally bypassed inspection.
D:Continuing using the service's valid hostname and certificate validation over the private endpoint connection would not validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
Question 343
An application gateway deployment fails because the team put backend VMs and its gateway instances in the same subnet. A network engineer associates a public IP directly with an unsupported private platform resource, hoping to make its internal endpoint public. What is the most appropriate plan for this situation?
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets; create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets; select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Select a supported public ingress service or public IP association target instead of inventing direct attachment capability; do not Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.
Explanation
Correct Answer
B:Application Gateway has subnet placement requirements that are distinct from the workloads it proxies. Public IP associations are constrained by supported Azure resource types and network architectures. Both actions are needed.
Incorrect Answers
A:Public IP associations are constrained by supported Azure resource types and network architectures.
C:Application Gateway has subnet placement requirements that are distinct from the workloads it proxies.
D:This plan leaves out a required action: Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets. The remaining action alone does not satisfy the situation.
Question 344
A Front Door endpoint uses a custom apex domain but DNS validation has not completed and HTTPS certificates cannot be activated. A request passes an edge WAF policy, but the administrator mistakes its rate-limit action for evidence that the origin application performed the same inspection. Which course of action addresses the stated issues?
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
- Stage changes to Front Door origin routing and test failover and application session behavior under maintenance; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
- Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; do not Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
Explanation
Correct Answer
C:Custom hostname registration and TLS activation depend on authoritative DNS ownership verification. Edge and origin components log different security decisions and require correlation to explain a request outcome. Both actions are needed.
Incorrect Answers
A:Edge and origin components log different security decisions and require correlation to explain a request outcome.
B:Custom hostname registration and TLS activation depend on authoritative DNS ownership verification.
D:This plan leaves out a required action: Complete the supported custom-domain validation and certificate workflow and confirm public DNS records. The remaining action alone does not satisfy the situation.
Question 345
During an Azure networking rollout, the team must resolve both of these conditions. A shopping site must send /payments to a protected API pool and /catalog to a different pool under one HTTPS host. A reverse proxy answers for store.example.com but rejects requests for support.example.com despite both sites sharing the gateway. Which response best addresses these needs?
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; configure multi-site listener hostnames and appropriate routing rules with the required certificates.
- Configure multi-site listener hostnames and appropriate routing rules with the required certificates; do not use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; create a custom health probe for the correct host and health path and review backend HTTP settings.
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits; configure multi-site listener hostnames and appropriate routing rules with the required certificates.
Explanation
Correct Answer
A:Application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide. Host-based listener matching controls which site a shared gateway accepts and routes. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings. The remaining action alone does not satisfy the situation.
C:Host-based listener matching controls which site a shared gateway accepts and routes.
D:Application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
Question 346
A security team needs historical communication patterns for subnet-level troubleshooting and assumes the retired NSG flow log workflow is the only option. What should the Azure network engineer do?
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
- Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
Explanation
Correct Answer
D:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
Incorrect Answers
A:Here, vNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
B:For this question, vNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
C:For this finding, vNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
Question 347
A backend service uses a custom TCP protocol and requires distribution across healthy VMs within one Azure region. A payroll API must be reachable only from private VNets and must not expose any public frontend address. An internet-facing application needs region-independent failover across two regional backend deployments using transport-level balancing. Which course of action addresses the stated issues?
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection; deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing; and evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing; and evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; use an application-layer gateway or reverse proxy when routing requires HTTP path inspection; and evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule; deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing; and use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
Explanation
Correct Answer
B:Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy. Internal load balancing provides VNet-private service entry rather than an internet-facing public address. Cross-region load balancing uses a global entry point across eligible regional deployments rather than a private regional listener. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.
C:Two actions meet their requirements, but action 2 misses this need: internal load balancing provides VNet-private service entry rather than an internet-facing public address.
D:Two actions meet their requirements, but action 3 misses this need: cross-region load balancing uses a global entry point across eligible regional deployments rather than a private regional listener.
Question 348
An engineering design must provide private access to a partner-managed service without joining the partner's full VNet or exposing all its subnets. What should the Azure network engineer do?
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.
- Use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
Explanation
Correct Answer
C:Private Link can expose a designated service across ownership boundaries without providing general network transit.
Incorrect Answers
A:For this finding, private Link can expose a designated service across ownership boundaries without providing general network transit.
B:For this question, private Link can expose a designated service across ownership boundaries without providing general network transit.
D:Here, private Link can expose a designated service across ownership boundaries without providing general network transit.
Question 349
A WAF is left in Detection mode while executives expect it to block confirmed malicious payloads. A WAF rule has blocked requests in its logs, yet clients still reach the origin directly by an unprotected public hostname. What is the most appropriate plan for this situation?
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
- Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; do not After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
Explanation
Correct Answer
B:Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode. WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint. Both actions are needed.
Incorrect Answers
A:WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint.
C:Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.
D:This plan leaves out a required action: After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes. The remaining action alone does not satisfy the situation.
Question 350
A VPN tunnel reports disconnected immediately after certificate or shared-key rotation, while route tables are unchanged. Which response best addresses this Azure networking scenario?
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
Explanation
Correct Answer
C:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
Incorrect Answers
A:For this question, authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
B:Here, authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
D:For this finding, authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests