Question 400
A spoke peered to a hub needs to reach on-premises through the hub VPN gateway, but gateway transit options are not configured. What should the Azure network engineer do?
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
D:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
Incorrect Answers
A:For this finding, ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
B:Renumber or redesign the conflicting address spaces would not enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
C:For this question, ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
Question 401
A storage service uses a dynamic set of provider addresses, and engineers plan to hardcode every observed IP in NSG egress rules. Which response best addresses this Azure networking scenario?
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.
Explanation
Correct Answer
B:Service tags provide maintained address abstractions for specific service categories.
Incorrect Answers
A:Here, service tags provide maintained address abstractions for specific service categories.
C:For this question, service tags provide maintained address abstractions for specific service categories.
D:For this finding, service tags provide maintained address abstractions for specific service categories.
Question 402
A security team plans UDR-based inspection for private endpoint traffic but does not verify whether the route policy actually applies to the endpoint path. A private endpoint connection is approved for production, but administrators forget that its data plane still uses an overprivileged service identity. Which response best addresses these needs?
- Apply least-privilege service authorization and identity controls in addition to the private network connection; do not validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
- Continue using the service's valid hostname and certificate validation over the private endpoint connection; apply least-privilege service authorization and identity controls in addition to the private network connection.
- Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance; apply least-privilege service authorization and identity controls in addition to the private network connection.
- Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance; check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.
Explanation
Correct Answer
C:Private endpoint routing and network policy requirements must be checked to avoid unintentionally bypassed inspection. Private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance. The remaining action alone does not satisfy the situation.
B:Private endpoint routing and network policy requirements must be checked to avoid unintentionally bypassed inspection.
D:Private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself.
Question 403
A team adds a private endpoint to a VNet but assumes it must reserve the entire gateway subnet for the endpoint. A network engineer associates a public IP directly with an unsupported private platform resource, hoping to make its internal endpoint public. What is the most appropriate plan for this situation?
- Select a supported public ingress service or public IP association target instead of inventing direct attachment capability; do not Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.
- Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
Explanation
Correct Answer
D:Private endpoints consume private addresses; they do not use the virtual network gateway's special subnet. Public IP associations are constrained by supported Azure resource types and network architectures. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility. The remaining action alone does not satisfy the situation.
B:Public IP associations are constrained by supported Azure resource types and network architectures.
C:Private endpoints consume private addresses; they do not use the virtual network gateway's special subnet.
Question 404
A request passes an edge WAF policy, but the administrator mistakes its rate-limit action for evidence that the origin application performed the same inspection. Which response best addresses this Azure networking scenario?
- Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
- Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
Explanation
Correct Answer
A:Edge and origin components log different security decisions and require correlation to explain a request outcome.
Incorrect Answers
B:DNS configuration would not inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
C:Stage changes to Front Door origin routing and test failover and application session behavior under maintenance would not inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
D:Here, edge and origin components log different security decisions and require correlation to explain a request outcome.
Question 405
A shopping site must send /payments to a protected API pool and /catalog to a different pool under one HTTPS host. Which response best addresses this Azure networking scenario?
- Create a custom health probe for the correct host and health path and review backend HTTP settings.
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Configure multi-site listener hostnames and appropriate routing rules with the required certificates.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.
Explanation
Correct Answer
D:Application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
Incorrect Answers
A:For this finding, application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
B:For this question, application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
C:Here, application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
Question 406
Defender for Cloud flags an exposed management port and an engineer ignores the attack-path context because the vulnerability scan is clean. Which action best addresses this finding?
- Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
Explanation
Correct Answer
A:Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
Incorrect Answers
B:For this finding, attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
C:For this question, attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
D:Here, attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
Question 407
During an Azure networking rollout, the team must resolve both of these conditions. A payroll API must be reachable only from private VNets and must not expose any public frontend address. A team configures a Load Balancer rule for HTTPS traffic but assumes it can inspect URL paths and select different backends for /api. Which course of action addresses the stated issues?
- Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements; use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
- Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing; use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection; do not deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
- Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing; use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
Explanation
Correct Answer
D:Internal load balancing provides VNet-private service entry rather than an internet-facing public address. Layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions. Both actions are needed.
Incorrect Answers
A:Internal load balancing provides VNet-private service entry rather than an internet-facing public address.
B:Layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions.
C:This plan leaves out a required action: Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing. The remaining action alone does not satisfy the situation.
Question 408
During an Azure networking rollout, the team must resolve both of these conditions. A private endpoint appears in the portal as Pending and clients cannot reach the provider service despite correct subnet DNS. An engineering design must provide private access to a partner-managed service without joining the partner's full VNet or exposing all its subnets. Which response best addresses these needs?
- Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state; use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration; use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state; create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.
- Use an approved Private Link service and consumer private endpoint rather than broad VNet peering; do not approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
Explanation
Correct Answer
A:A pending private connection cannot be treated as an established provider-approved data path. Private Link can expose a designated service across ownership boundaries without providing general network transit. Both actions are needed.
Incorrect Answers
B:A pending private connection cannot be treated as an established provider-approved data path.
C:Private Link can expose a designated service across ownership boundaries without providing general network transit.
D:This plan leaves out a required action: Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state. The remaining action alone does not satisfy the situation.
Question 409
A WAF is left in Detection mode while executives expect it to block confirmed malicious payloads. Which response most directly resolves the issue?
- Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
Explanation
Correct Answer
B:Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.
Incorrect Answers
A:For this question, detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.
C:Here, detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.
D:For this finding, detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.
Question 410
A VPN tunnel reports disconnected immediately after certificate or shared-key rotation, while route tables are unchanged. An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. A dual-tunnel deployment sends traffic to Azure but replies prefer one failed peer because on-premises routing did not converge. Which course of action addresses the stated issues?
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; and verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; and verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; and verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; and verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
Explanation
Correct Answer
A:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic. Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change. Resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 3 misses this need: resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure.
C:Two actions meet their requirements, but action 2 misses this need: throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
D:Two actions meet their requirements, but action 1 misses this need: authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests