Question 30
An administrator creates a private endpoint to Azure SQL but leaves public network access open and declares all public ingress eliminated. A team wants to allow multiple consumer VNets to use one SQL private endpoint without peering or routing between those VNets. Which response best addresses these needs?
- Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address; Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Review and restrict the SQL service's public network access independently from the private endpoint connection; Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Review and restrict the SQL service's public network access independently from the private endpoint connection; create an Azure private endpoint for the required storage subresource and configure private name resolution.
- Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution; do not review and restrict the SQL service's public network access independently from the private endpoint connection.
Explanation
Correct Answer
B:Adding a private path does not automatically turn off the service's separately configured public endpoint. Private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone. Both actions are needed.
Incorrect Answers
A:Adding a private path does not automatically turn off the service's separately configured public endpoint.
C:Private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone.
D:This plan leaves out a required action: Review and restrict the SQL service's public network access independently from the private endpoint connection. The remaining action alone does not satisfy the situation.
Question 31
An on-premises firewall public address changes after an ISP migration, but the Azure VPN still targets its previous peer endpoint. The VPN tunnel shows connected but Azure cannot return packets to a newly added branch subnet absent from the local network gateway. What is the most appropriate plan for this situation?
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration; update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists.
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists; do not update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration.
- Evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics; update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists.
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration; align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance.
Explanation
Correct Answer
A:The local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation. Established tunnels do not automatically carry reachability for prefixes that were never configured or advertised. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration. The remaining action alone does not satisfy the situation.
C:The local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation.
D:Established tunnels do not automatically carry reachability for prefixes that were never configured or advertised.
Question 32
During an Azure networking rollout, the team must resolve both of these conditions. An on-premises router advertises a broad default route through ExpressRoute and Azure internet-bound traffic now follows an unexpected private path. A connection is intermittently slow and engineers have no failure-detection mechanism beyond long BGP hold timers. Which course of action addresses the stated issues?
- Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach.
- Evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths; do not review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters.
Explanation
Correct Answer
A:Advertised routes influence actual Azure egress choices when the gateway accepts those prefixes. BFD can signal forwarding failures faster than waiting solely on ordinary BGP timers. Both actions are needed.
Incorrect Answers
B:Advertised routes influence actual Azure egress choices when the gateway accepts those prefixes.
C:BFD can signal forwarding failures faster than waiting solely on ordinary BGP timers.
D:This plan leaves out a required action: Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters. The remaining action alone does not satisfy the situation.
Question 33
An inbound DNS Private Resolver endpoint can be pinged from Azure, yet on-premises clients cannot send DNS queries over their VPN. A private DNS zone record resolves from one region but fails after clients switch to an alternate custom DNS server with no forwarding rule. Which response best addresses these needs?
- Check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address; configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
- Check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address; verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries.
- Configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path; do not check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address.
- Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end; configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
Explanation
Correct Answer
A:ICMP reachability is not evidence that DNS packets and responses traverse the hybrid network path. Custom DNS server selection can bypass Azure private-zone resolution unless the namespace is explicitly forwarded. Both actions are needed.
Incorrect Answers
B:Custom DNS server selection can bypass Azure private-zone resolution unless the namespace is explicitly forwarded.
C:This plan leaves out a required action: Check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address. The remaining action alone does not satisfy the situation.
D:ICMP reachability is not evidence that DNS packets and responses traverse the hybrid network path.
Question 34
A virtual hub receives many site-to-site VPN connections and the operator chooses its gateway capacity using only the number of VNets. A branch VPN connects into Virtual WAN but the security team assumes all traffic is encrypted and inspected by default, regardless of hub policy. What is the most appropriate plan for this situation?
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; inspect Virtual WAN route-table associations and route propagation settings for each connection.
- Use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites; review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows.
- Review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows; do not select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits.
Explanation
Correct Answer
A:Virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone. VPN tunnel encryption does not itself provide application-layer threat inspection across transit paths. Both actions are needed.
Incorrect Answers
B:VPN tunnel encryption does not itself provide application-layer threat inspection across transit paths.
C:Virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone.
D:This plan leaves out a required action: Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits. The remaining action alone does not satisfy the situation.
Question 35
A business wants to join two VNets in different Azure geographies through ExpressRoute but treats one circuit as globally valid without checking tier restrictions. Which response best addresses this Azure networking scenario?
- Run a staged routing cutover with application session tests and a documented rollback and convergence window.
- Monitor and validate both provider path BGP sessions and test a deliberate failover.
- Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment.
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology.
Explanation
Correct Answer
D:ExpressRoute geography and connectivity scale vary by SKU and peering locations.
Incorrect Answers
A:For this question, expressRoute geography and connectivity scale vary by SKU and peering locations.
B:For this finding, expressRoute geography and connectivity scale vary by SKU and peering locations.
C:Here, expressRoute geography and connectivity scale vary by SKU and peering locations.
Question 36
A security analyst must verify whether a particular SSH packet is permitted but has only a list of all NSG rules. An Azure VM needs emergency administration without any public IP or an always-open internet-facing RDP rule. After an address-space change, security staff cannot explain which NSG rule denied a particular traffic flow captured overnight. Which response best addresses these needs?
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; and remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; and use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
- Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; and use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; and use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.
Explanation
Correct Answer
D:The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection. Azure Bastion permits managed browser or client sessions to private VM addresses without exposing an RDP public listener. Historical flow records provide activity evidence that current configuration alone may not retain. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: historical flow records provide activity evidence that current configuration alone may not retain.
B:Two actions meet their requirements, but action 2 misses this need: azure Bastion permits managed browser or client sessions to private VM addresses without exposing an RDP public listener.
C:Two actions meet their requirements, but action 1 misses this need: the evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.
Question 37
A network team migrates a traditional hub-spoke deployment to Virtual WAN but copies all old user-defined route tables into connections unchanged. Operations adds new sites without monitoring hub gateway health, and users report delayed recognition of a partial regional failure. A third-party firewall integration into Virtual WAN blocks half the sites because only a subset of connections use the secured route table. What is the most appropriate plan for this situation?
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; and verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership.
- Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
Explanation
Correct Answer
D:Virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub. A managed WAN design still needs monitoring of ingress, hub routing and active connections. Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: a managed WAN design still needs monitoring of ingress, hub routing and active connections.
B:Two actions meet their requirements, but action 3 misses this need: inspection coverage depends on the effective transit path through the hub, not on the appliance being registered.
C:Two actions meet their requirements, but action 1 misses this need: virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub.
Question 38
A firewall FQDN rule fails for internal service names because the firewall and clients resolve the same name through different DNS servers. A network rule uses overly broad any-to-any settings, and monitoring cannot identify which service depends on it. A public application behind Azure Firewall unexpectedly fails after IP translation because a team configures only a DNAT mapping and ignores the effective return route. Which course of action addresses the stated issues?
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; verify rule collection group and collection priorities and the documented processing order before rollout; and validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session.
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; and validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session.
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; and verify rule collection group and collection priorities and the documented processing order before rollout.
- Verify rule collection group and collection priorities and the documented processing order before rollout; Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; and validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session.
Explanation
Correct Answer
B:FQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients. Observed flow data supports restricting exposure while preserving the identified business traffic. Address translation alone does not ensure symmetric reachability to and from a backend application. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: observed flow data supports restricting exposure while preserving the identified business traffic.
C:Two actions meet their requirements, but action 3 misses this need: address translation alone does not ensure symmetric reachability to and from a backend application.
D:Two actions meet their requirements, but action 1 misses this need: fQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients.
Question 39
A spoke-to-spoke path fails after deployment, and the administrator checks only its route table JSON rather than what each VM receives. Which response most directly resolves the issue?
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop.
- Validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
- Enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
Explanation
Correct Answer
C:Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved.
Incorrect Answers
A:Associate an appropriate route table with a spoke subnet would not inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
B:For this finding, effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved.
D:Enabling supported IP forwarding on the appliance network interface and within its operating system, then test both directions would not inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
Question 40
Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. Which response most directly resolves the issue?
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
C:Peering relationships are not automatically transitive across another VNet.
Incorrect Answers
A:For this question, peering relationships are not automatically transitive across another VNet.
B:Renumber or redesign the conflicting address spaces would not design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
D:Here, peering relationships are not automatically transitive across another VNet.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests