Question 390
A storage private endpoint receives an approved connection but a web app still connects to the storage public IP. Which action best addresses this finding?
- Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
- Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Review and restrict the SQL service's public network access independently from the private endpoint connection.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution.
Explanation
Correct Answer
A:Private endpoint routing depends on name resolution; successful resource provisioning alone does not redirect clients.
Incorrect Answers
B:For this question, private endpoint routing depends on name resolution; successful resource provisioning alone does not redirect clients.
C:Here, private endpoint routing depends on name resolution; successful resource provisioning alone does not redirect clients.
D:Creating an Azure private endpoint for the required storage subresource and configuring private name resolution would not fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address.
Question 391
An on-premises firewall public address changes after an ISP migration, but the Azure VPN still targets its previous peer endpoint. Which response most directly resolves the issue?
- Align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance.
- Update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration.
- Evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists.
Explanation
Correct Answer
B:The local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation.
Incorrect Answers
A:Here, the local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation.
C:For this question, the local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation.
D:For this finding, the local network gateway records the remote site's connection identity; an obsolete endpoint blocks tunnel negotiation.
Question 392
An enterprise needs services in two geographically separated Azure regions but chooses a circuit tier that cannot deliver its intended global reachability. An engineer assumes ExpressRoute traffic is automatically end-to-end encrypted because the provider connection is private. A connection is intermittently slow and engineers have no failure-detection mechanism beyond long BGP hold timers. Which course of action addresses the stated issues?
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; and evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; and evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; and evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths.
- Select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; and review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters.
Explanation
Correct Answer
A:Circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules. Private transport and cryptographic confidentiality are separate assurances. BFD can signal forwarding failures faster than waiting solely on ordinary BGP timers. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: circuit tiers govern supported geographic reach and cannot be expanded by changing VNet NSG rules.
C:Two actions meet their requirements, but action 2 misses this need: private transport and cryptographic confidentiality are separate assurances.
D:Two actions meet their requirements, but action 3 misses this need: bFD can signal forwarding failures faster than waiting solely on ordinary BGP timers.
Question 393
Hybrid DNS forwarding works for a test VNet but a newly added VNet still cannot resolve names in the on-premises domain. An inbound DNS Private Resolver endpoint can be pinged from Azure, yet on-premises clients cannot send DNS queries over their VPN. Operations replaces an inbound endpoint's subnet and assumes on-premises conditional forwarders will continue working with the former inbound address. Which response best addresses these needs?
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries; check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address; and Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries; check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address; and configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path.
- Verify that the forwarding ruleset is linked to the new VNet and that its suffix matches the intended DNS queries; configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path; and Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
- Configure the custom resolver to forward the relevant private namespace through a supported Azure resolution path; check private routing, UDP and TCP port 53 access, and the conditional forwarder target for the resolver inbound address; and Reconcile the deployed inbound endpoint address with the DNS forwarder targets and test queries end to end.
Explanation
Correct Answer
A:DNS resolver forwarding policies do not automatically apply to newly connected VNets without the right ruleset link. ICMP reachability is not evidence that DNS packets and responses traverse the hybrid network path. The forwarding target must be reachable and current after endpoint changes; old private resolver IPs are not aliases. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 3 misses this need: the forwarding target must be reachable and current after endpoint changes; old private resolver IPs are not aliases.
C:Two actions meet their requirements, but action 2 misses this need: iCMP reachability is not evidence that DNS packets and responses traverse the hybrid network path.
D:Two actions meet their requirements, but action 1 misses this need: DNS resolver forwarding policies do not automatically apply to newly connected VNets without the right ruleset link.
Question 394
A virtual hub receives many site-to-site VPN connections and the operator chooses its gateway capacity using only the number of VNets. A private branch can reach one VNet connection but not another because hub routing associations and propagations differ. What is the most appropriate plan for this situation?
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; use a supported Virtual WAN hub NVA integration model and validate partner appliance prerequisites.
- Inspect Virtual WAN route-table associations and route propagation settings for each connection; do not select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits.
- Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits; inspect Virtual WAN route-table associations and route propagation settings for each connection.
- Review available secured virtual hub, firewall and routing-intent configurations for the target traffic flows; inspect Virtual WAN route-table associations and route propagation settings for each connection.
Explanation
Correct Answer
C:Virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone. Virtual hub routing is governed by hub-specific tables and propagation, not implicit transitivity in every design. Both actions are needed.
Incorrect Answers
A:Virtual hub routing is governed by hub-specific tables and propagation, not implicit transitivity in every design.
B:This plan leaves out a required action: Select suitable VPN gateway scale units using aggregate bandwidth and supported connection limits. The remaining action alone does not satisfy the situation.
D:Virtual hub gateway scaling is based on capacity and connectivity rather than the VNet count alone.
Question 395
A team demands zero-downtime ExpressRoute deployment and ignores propagation delays and routing convergence in its cutover plan. Which response most directly resolves the issue?
- Monitor and validate both provider path BGP sessions and test a deliberate failover.
- Resolve duplicate advertisements or redesign site IP space before connecting both sites to the ExpressRoute environment.
- Run a staged routing cutover with application session tests and a documented rollback and convergence window.
- Verify the circuit's reach and eligible VNet connection limits before choosing a multi-region topology.
Explanation
Correct Answer
C:Routing transitions can briefly affect active flows even when the destination circuit is provisioned correctly.
Incorrect Answers
A:For this finding, routing transitions can briefly affect active flows even when the destination circuit is provisioned correctly.
B:Here, routing transitions can briefly affect active flows even when the destination circuit is provisioned correctly.
D:For this question, routing transitions can briefly affect active flows even when the destination circuit is provisioned correctly.
Question 396
A security analyst must verify whether a particular SSH packet is permitted but has only a list of all NSG rules. A network team opens TCP 3389 to all addresses because engineers sometimes need VM access from home. Which response best addresses these needs?
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; deploy Azure Bastion using its required subnet and authorize administrative access through that supported service.
- Use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
- Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; do not use Network Watcher IP flow verify with the precise source, destination, protocol, and ports.
- Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
Explanation
Correct Answer
D:The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection. Wide-open management ports increase the attack surface independently of the VM's login credentials. Both actions are needed.
Incorrect Answers
A:Wide-open management ports increase the attack surface independently of the VM's login credentials.
B:The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.
C:This plan leaves out a required action: Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports. The remaining action alone does not satisfy the situation.
Question 397
A new virtual hub in another region remains isolated despite being placed in the same resource group as the existing hub. Operations adds new sites without monitoring hub gateway health, and users report delayed recognition of a partial regional failure. What is the most appropriate plan for this situation?
- Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration.
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; do not verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership.
- Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts.
- Validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts.
Explanation
Correct Answer
C:Azure resource-group placement is administrative and does not establish network transit. A managed WAN design still needs monitoring of ingress, hub routing and active connections. Both actions are needed.
Incorrect Answers
A:A managed WAN design still needs monitoring of ingress, hub routing and active connections.
B:This plan leaves out a required action: Verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership. The remaining action alone does not satisfy the situation.
D:Azure resource-group placement is administrative and does not establish network transit.
Question 398
During an Azure networking rollout, the team must resolve both of these conditions. A network rule uses overly broad any-to-any settings, and monitoring cannot identify which service depends on it. A network security team adds a firewall rule collection but assumes its descriptive name determines evaluation ahead of other collections. Which course of action addresses the stated issues?
- Verify rule collection group and collection priorities and the documented processing order before rollout; do not Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules.
- Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; verify rule collection group and collection priorities and the documented processing order before rollout.
- Validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session; verify rule collection group and collection priorities and the documented processing order before rollout.
- Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; align the documented DNS proxy and resolver settings and validate consistent destination resolution.
Explanation
Correct Answer
B:Observed flow data supports restricting exposure while preserving the identified business traffic. Azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules. The remaining action alone does not satisfy the situation.
C:Observed flow data supports restricting exposure while preserving the identified business traffic.
D:Azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.
Question 399
A spoke-to-spoke path fails after deployment, and the administrator checks only its route table JSON rather than what each VM receives. A forced-tunneling design sends everything through an on-premises firewall, but Azure platform dependencies unexpectedly lose connectivity. A UDR specifies next-hop VirtualAppliance but points to a VM that has IP forwarding disabled, causing blackholed traffic. Which response best addresses these needs?
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; and Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; and enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop; and enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
- Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop; validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; and enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
Explanation
Correct Answer
B:Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved. Forced tunneling must account for platform control paths and documented service exceptions, not just user traffic. Sending packets to an NVA does not make it a router unless forwarding is configured and supported. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: sending packets to an NVA does not make it a router unless forwarding is configured and supported.
C:Two actions meet their requirements, but action 2 misses this need: forced tunneling must account for platform control paths and documented service exceptions, not just user traffic.
D:Two actions meet their requirements, but action 1 misses this need: effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved.
Question 400
A spoke peered to a hub needs to reach on-premises through the hub VPN gateway, but gateway transit options are not configured. What should the Azure network engineer do?
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
D:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
Incorrect Answers
A:For this finding, ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
B:Renumber or redesign the conflicting address spaces would not enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
C:For this question, ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests