Question 410
A VPN tunnel reports disconnected immediately after certificate or shared-key rotation, while route tables are unchanged. An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. A dual-tunnel deployment sends traffic to Azure but replies prefer one failed peer because on-premises routing did not converge. Which course of action addresses the stated issues?
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; and verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; and verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; and verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier; and verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
Explanation
Correct Answer
A:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic. Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change. Resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 3 misses this need: resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure.
C:Two actions meet their requirements, but action 2 misses this need: throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
D:Two actions meet their requirements, but action 1 misses this need: authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
Question 411
A multinational firm operates hundreds of branch VPN sites and wants centrally managed cloud transit rather than dozens of individually peered hub VNets. An enterprise requires branch-to-branch transit through a new WAN service but selects a Basic Virtual WAN configuration without reviewing capabilities. A team deploys a Virtual WAN resource but assumes it immediately provides gateways and virtual hub network paths. Which response best addresses these needs?
- Select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design; choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; and create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design; and create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; and create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; and select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
Explanation
Correct Answer
C:Virtual WAN centralizes supported branch and VNet transit in managed hubs rather than scaling manual peering meshes. Basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services. The Virtual WAN resource is a management container; traffic requires configured hub services and connections. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: virtual WAN centralizes supported branch and VNet transit in managed hubs rather than scaling manual peering meshes.
B:Two actions meet their requirements, but action 2 misses this need: basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services.
D:Two actions meet their requirements, but action 3 misses this need: the Virtual WAN resource is a management container; traffic requires configured hub services and connections.
Question 412
A healthcare database requires consumers to resolve a private service address and disable the provider's public endpoint entirely. A service endpoint configuration works within one VNet but a newly migrated workload on-premises cannot use the same policy-based source identity. An administrator mixes a private endpoint and a service endpoint on the same subnet and assumes DNS selection is irrelevant to which path a client uses. What is the most appropriate plan for this situation?
- Use service endpoints and service-side virtual network rules after validating compatibility; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; and test actual FQDN answers and effective routes, then select the intended access method explicitly.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; and use service endpoints and service-side virtual network rules after validating compatibility.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use service endpoints and service-side virtual network rules after validating compatibility; and test actual FQDN answers and effective routes, then select the intended access method explicitly.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; and test actual FQDN answers and effective routes, then select the intended access method explicitly.
Explanation
Correct Answer
D:Private Link provides the private address required for a design that eliminates public service reachability. On-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel. DNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: private Link provides the private address required for a design that eliminates public service reachability.
B:Two actions meet their requirements, but action 3 misses this need: DNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference.
C:Two actions meet their requirements, but action 2 misses this need: on-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel.
Question 413
A company wants subnets to access only a subset of approved storage accounts rather than every account that could accept service endpoint traffic. A team activates a service endpoint for a production subnet and assumes its VMs lose all other internet access automatically. Which course of action addresses the stated issues?
- Review storage network rules and service endpoint source identity alongside application-layer credentials; retain appropriate NSG and routing controls because service endpoints do not replace general outbound network security.
- Retain appropriate NSG and routing controls because service endpoints do not replace general outbound network security; do not apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility.
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility; retain appropriate NSG and routing controls because service endpoints do not replace general outbound network security.
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility; check which Azure services support service endpoint policies and use alternative enforcement where unsupported.
Explanation
Correct Answer
C:Service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported. Service endpoints optimize access to supported services; they do not inherently block unrelated destinations. Both actions are needed.
Incorrect Answers
A:Service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported.
B:This plan leaves out a required action: Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility. The remaining action alone does not satisfy the situation.
D:Service endpoints optimize access to supported services; they do not inherently block unrelated destinations.
Question 414
A web app on-premises receives a public address for vault.privatelink.vaultcore.azure.net even though Azure workloads resolve it privately. A storage account has both Blob and File services, and the administrator assumes a Blob private endpoint also covers the file share endpoint. A private endpoint is recreated with a new network interface, but a manually maintained private DNS A record still points to the deleted address. Which response best addresses these needs?
- Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links; create separate private endpoints and matching private DNS records for each required supported storage subresource; and use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP.
- Use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP; create separate private endpoints and matching private DNS records for each required supported storage subresource; and update the zone group or private DNS record so the resource hostname resolves to the active endpoint IP.
- Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links; create separate private endpoints and matching private DNS records for each required supported storage subresource; and update the zone group or private DNS record so the resource hostname resolves to the active endpoint IP.
- Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links; use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP; and update the zone group or private DNS record so the resource hostname resolves to the active endpoint IP.
Explanation
Correct Answer
C:Private endpoint name resolution must reach the Azure private zone from the on-premises resolver path. Private endpoint connections are often scoped to specific service subresources rather than all endpoints in the resource. Stale private DNS records can keep clients on an invalid address after a private endpoint replacement. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: stale private DNS records can keep clients on an invalid address after a private endpoint replacement.
B:Two actions meet their requirements, but action 1 misses this need: private endpoint name resolution must reach the Azure private zone from the on-premises resolver path.
D:Two actions meet their requirements, but action 2 misses this need: private endpoint connections are often scoped to specific service subresources rather than all endpoints in the resource.
Question 415
During an Azure networking rollout, the team must resolve both of these conditions. Azure workloads must resolve a private corporate domain hosted on on-premises DNS without changing every VM's resolver configuration. A DNS Private Resolver deployment places inbound and outbound endpoint roles in one subnet and receives an unsupported-configuration error. What is the most appropriate plan for this situation?
- Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet; deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders.
- Link the DNS forwarding ruleset to the intended client VNet and verify suffix matching and target reachability; create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules.
- Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet; create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules.
- Create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules; do not configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet.
Explanation
Correct Answer
C:Outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers. Resolver endpoint types have distinct subnet requirements and cannot be combined arbitrarily. Both actions are needed.
Incorrect Answers
A:Resolver endpoint types have distinct subnet requirements and cannot be combined arbitrarily.
B:Outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers.
D:This plan leaves out a required action: Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet. The remaining action alone does not satisfy the situation.
Question 416
A VM communicates to a service through a private endpoint but a Network Watcher next-hop result points to an unexpected network virtual appliance. A DDoS investigation sees no L7 HTTP request details despite having network DDoS telemetry enabled. A defender finds a network-exposed secret management endpoint and wants to prioritize remediation beyond raw Secure Score point totals. Which course of action addresses the stated issues?
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; and examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns.
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; and use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns; and use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
- Examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; and use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
Explanation
Correct Answer
B:A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions. Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures. Security scoring is a prioritization input but does not by itself show how an attacker could traverse a live exposure. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: security scoring is a prioritization input but does not by itself show how an attacker could traverse a live exposure.
C:Two actions meet their requirements, but action 2 misses this need: network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures.
D:Two actions meet their requirements, but action 1 misses this need: a next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions.
Question 417
A virtual subnet contains a /29 range and a design spreadsheet assumes all eight addresses are assignable to workloads. A team wants to shrink an active VNet subnet while network interfaces and endpoints still occupy addresses outside the proposed range. A future private endpoint deployment needs addresses kept available, but the last free subnet is being filled with ephemeral test VMs. Which response best addresses these needs?
- Choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity; Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; and Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
- Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs; Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; and choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity.
- Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs; choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity; and Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
- Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs; Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; and Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
Explanation
Correct Answer
D:Azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity. Subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints. Shared capacity without reservation can block security-sensitive service connectivity when the subnet becomes exhausted. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity.
B:Two actions meet their requirements, but action 3 misses this need: shared capacity without reservation can block security-sensitive service connectivity when the subnet becomes exhausted.
C:Two actions meet their requirements, but action 2 misses this need: subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints.
Question 418
An engineer uses Virtual Network Manager to push an overly broad security admin rule that overrides carefully scoped workload NSG denies. A hub NVA exchanges BGP routes with a VPN environment, but static routes become stale every time on-premises prefixes change. What is the most appropriate plan for this situation?
- Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups; evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design.
- Evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design; do not review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups.
- Keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange; evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design.
- Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups; apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope.
Explanation
Correct Answer
A:Central administrative security rules have distinct precedence behavior and broad scope that must be validated. Route Server can exchange dynamic routes with eligible NVAs and gateways instead of maintaining each learned prefix manually. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups. The remaining action alone does not satisfy the situation.
C:Central administrative security rules have distinct precedence behavior and broad scope that must be validated.
D:Route Server can exchange dynamic routes with eligible NVAs and gateways instead of maintaining each learned prefix manually.
Question 419
An administrator creates an NSG but never associates it with the intended subnet or NIC and claims the workload is isolated. A VNet is migrated to a new hub but its flow log configuration still targets an obsolete storage account and monitoring shows no recent records. An ASG rule fails to apply to a target VM because its network interface was never made a member of the designated group. Which course of action addresses the stated issues?
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls; and assign the appropriate VM network interface to the ASG and check effective security rules.
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; and assign the appropriate VM network interface to the ASG and check effective security rules.
- Use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls; Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; and assign the appropriate VM network interface to the ASG and check effective security rules.
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; and use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
Explanation
Correct Answer
B:Unassociated NSG resources cannot evaluate or filter the intended traffic. Flow logging depends on operational delivery and destination access, not solely on NSG rule existence. An ASG reference matches configured membership and cannot infer application tier from resource names. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: flow logging depends on operational delivery and destination access, not solely on NSG rule existence.
C:Two actions meet their requirements, but action 1 misses this need: unassociated NSG resources cannot evaluate or filter the intended traffic.
D:Two actions meet their requirements, but action 3 misses this need: an ASG reference matches configured membership and cannot infer application tier from resource names.
Question 420
A regional service fails but some users keep reaching it until cached DNS answers expire despite Traffic Manager reporting a healthy alternate. A network engineer demands TLS termination and WAF inspection directly on a Traffic Manager DNS profile. Which response best addresses these needs?
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection; do not review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover; configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover; use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses; use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.
Explanation
Correct Answer
C:DNS-based failover cannot immediately replace a connection that relies on an already cached address. A DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover. The remaining action alone does not satisfy the situation.
B:A DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads.
D:DNS-based failover cannot immediately replace a connection that relies on an already cached address.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests