Question 440
A team allocates an unused public IP prefix and expects an individual virtual machine to respond to the entire prefix automatically. Which action best addresses this finding?
- Create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix.
- Create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
Explanation
Correct Answer
A:Reserving a prefix does not itself configure listeners or give one VM every address in that prefix.
Incorrect Answers
B:Here, reserving a prefix does not itself configure listeners or give one VM every address in that prefix.
C:For this question, reserving a prefix does not itself configure listeners or give one VM every address in that prefix.
D:For this finding, reserving a prefix does not itself configure listeners or give one VM every address in that prefix.
Question 441
A P2S client authenticates successfully but cannot reach an internal database because its source address pool overlaps the destination subnet. What should the Azure network engineer do?
- Use a supported Microsoft Entra ID authentication design with appropriate client and conditional access prerequisites.
- Redesign the client address pool to avoid overlapping private networks and validate the return routes.
- Choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability.
- Implement certificate revocation and replacement for affected P2S clients, then verify rejected connections.
Explanation
Correct Answer
B:Authentication success does not resolve collisions between remote client addresses and private destination routes.
Incorrect Answers
A:For this question, authentication success does not resolve collisions between remote client addresses and private destination routes.
C:Here, authentication success does not resolve collisions between remote client addresses and private destination routes.
D:For this finding, authentication success does not resolve collisions between remote client addresses and private destination routes.
Question 442
Remote administrators need encrypted access from individual laptops while no branch appliance will terminate an IPsec site-to-site tunnel. An employee installs a VPN client profile from an old gateway and cannot reach newly added private routes after the gateway configuration changes. What is the most appropriate plan for this situation?
- Configure a supported Azure point-to-site VPN gateway and distribute approved client profiles; select an eligible OpenVPN-based point-to-site profile and validate the required Microsoft Entra authentication support.
- Match the selected tunnel protocol and authentication approach to actual supported client operating systems; Regenerate and redistribute the current VPN client configuration and verify the client's installed route list.
- Configure a supported Azure point-to-site VPN gateway and distribute approved client profiles; Regenerate and redistribute the current VPN client configuration and verify the client's installed route list.
- Regenerate and redistribute the current VPN client configuration and verify the client's installed route list; do not configure a supported Azure point-to-site VPN gateway and distribute approved client profiles.
Explanation
Correct Answer
C:Point-to-site VPN serves individual remote devices; a site-to-site gateway connection is not the required client onboarding model. Client packages may contain stale connection and routing settings that must match the updated gateway. Both actions are needed.
Incorrect Answers
A:Client packages may contain stale connection and routing settings that must match the updated gateway.
B:Point-to-site VPN serves individual remote devices; a site-to-site gateway connection is not the required client onboarding model.
D:This plan leaves out a required action: Configure a supported Azure point-to-site VPN gateway and distribute approved client profiles. The remaining action alone does not satisfy the situation.
Question 443
An enterprise must preserve one backend VM for each client source across multiple TCP connections, and uniform load distribution breaks session behavior. A service using UDP streaming must balance traffic across Azure instances, yet its architect selects an HTTP-only application gateway. Which course of action addresses the stated issues?
- Evaluate supported Load Balancer session persistence settings and the application's actual state handling; Associate the intended instances with the backend pool and verify probe health and effective frontend rules.
- Deploy a suitable Azure Load Balancer UDP rule and health-check strategy for the supported backend service; do not evaluate supported Load Balancer session persistence settings and the application's actual state handling.
- Create appropriately scoped load-balancing or inbound NAT rules with distinct ports and authorized access controls; deploy a suitable Azure Load Balancer UDP rule and health-check strategy for the supported backend service.
- Evaluate supported Load Balancer session persistence settings and the application's actual state handling; deploy a suitable Azure Load Balancer UDP rule and health-check strategy for the supported backend service.
Explanation
Correct Answer
D:Layer-4 distribution can use session-affinity modes, but application state still requires a compatible design. Transport-level load balancing supports UDP scenarios that an HTTP reverse proxy does not handle directly. Both actions are needed.
Incorrect Answers
A:Transport-level load balancing supports UDP scenarios that an HTTP reverse proxy does not handle directly.
B:This plan leaves out a required action: Evaluate supported Load Balancer session persistence settings and the application's actual state handling. The remaining action alone does not satisfy the situation.
C:Layer-4 distribution can use session-affinity modes, but application state still requires a compatible design.
Question 444
A branch needs an encrypted connection to an Azure VNet over the public internet with dynamic routing and multiple prefixes. A legacy network appliance supports only fixed traffic selectors and no route-based tunnel configuration. Which response best addresses these needs?
- Deploy a supported route-based Azure VPN gateway and configure compatible IPsec peer settings and routes; evaluate policy-based compatibility and supported VPN gateway connection settings before attempting to force a route-based design.
- Evaluate policy-based compatibility and supported VPN gateway connection settings before attempting to force a route-based design; do not deploy a supported route-based Azure VPN gateway and configure compatible IPsec peer settings and routes.
- Deploy a supported route-based Azure VPN gateway and configure compatible IPsec peer settings and routes; select an eligible active-active VPN gateway configuration and design both on-premises tunnels and BGP peers where supported.
- Select a supported gateway SKU based on throughput, tunnel limits, feature support, and availability needs; evaluate policy-based compatibility and supported VPN gateway connection settings before attempting to force a route-based design.
Explanation
Correct Answer
A:Route-based VPN supports flexible prefix exchange and dynamic connectivity that an inflexible policy-based design may not satisfy. Tunnel types and selector capabilities must match both peers, not only the Azure side. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Deploy a supported route-based Azure VPN gateway and configure compatible IPsec peer settings and routes. The remaining action alone does not satisfy the situation.
C:Tunnel types and selector capabilities must match both peers, not only the Azure side.
D:Route-based VPN supports flexible prefix exchange and dynamic connectivity that an inflexible policy-based design may not satisfy.
Question 445
A public zone was created in Azure DNS, but users still query the prior provider because the domain registrar nameservers were not updated. A deployment adds a public subdomain but places its NS delegation inside an unrelated private zone and expects public resolvers to discover it. What is the most appropriate plan for this situation?
- Configure delegation in the appropriate public parent zone and verify authoritative NS records for the child zone; do not Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation.
- Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation; plan record TTLs and allow cached responses to age out while validating the authoritative record and cutover window.
- Inspect endpoint-linked DNS zone groups and reconcile stale private A records to the current endpoint IP; configure delegation in the appropriate public parent zone and verify authoritative NS records for the child zone.
- Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation; configure delegation in the appropriate public parent zone and verify authoritative NS records for the child zone.
Explanation
Correct Answer
D:Public zone creation must be paired with parent delegation before internet clients consistently use Azure records. Public DNS delegation must be discoverable from the public namespace hierarchy, not from an isolated private zone. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation. The remaining action alone does not satisfy the situation.
B:Public DNS delegation must be discoverable from the public namespace hierarchy, not from an isolated private zone.
C:Public zone creation must be paired with parent delegation before internet clients consistently use Azure records.
Question 446
During an Azure networking rollout, the team must resolve both of these conditions. A retailer needs to limit aggressive automated checkout requests from a small set of source addresses without blocking all legitimate shopping. A team deploys a new Front Door WAF policy and checks only that HTTP status is 200 instead of validating known harmless attack-test fixtures. Which course of action addresses the stated issues?
- Run authorized representative request tests and correlate WAF logs with policy mode and expected decisions; do not evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry.
- Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry; review custom-rule priority and termination behavior before permitting exceptions to the managed rule set.
- Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry; run authorized representative request tests and correlate WAF logs with policy mode and expected decisions.
- Map supported managed rule sets and custom-rule options to the new WAF platform before migration; run authorized representative request tests and correlate WAF logs with policy mode and expected decisions.
Explanation
Correct Answer
C:Rate limiting can mitigate request floods while preserving legitimate client patterns when thresholds are tested. Functional and security behavior should be confirmed through actual matched requests, not service readiness alone. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry. The remaining action alone does not satisfy the situation.
B:Functional and security behavior should be confirmed through actual matched requests, not service readiness alone.
D:Rate limiting can mitigate request floods while preserving legitimate client patterns when thresholds are tested.
Question 447
An administrator must access the RDP port of individual VMs behind one shared public load balancer IP. A firewall appliance service must be inserted transparently ahead of a workload and preserve the relevant traffic path. Which response best addresses these needs?
- Define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances; evaluate Azure Gateway Load Balancer chaining and the compatible NVA appliance integration.
- Design explicit outbound SNAT rules or approved NAT Gateway capacity and verify connection reuse; evaluate Azure Gateway Load Balancer chaining and the compatible NVA appliance integration.
- Evaluate Azure Gateway Load Balancer chaining and the compatible NVA appliance integration; do not define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances.
- Define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances; configure an appropriate health probe for the actual service protocol and port and validate backend readiness.
Explanation
Correct Answer
A:Inbound NAT maps targeted management connections; it is distinct from distributing application traffic across a pool. Gateway Load Balancer enables supported transparent third-party appliance insertion rather than HTTP-path routing. Both actions are needed.
Incorrect Answers
B:Inbound NAT maps targeted management connections; it is distinct from distributing application traffic across a pool.
C:This plan leaves out a required action: Define approved inbound NAT rules with distinct frontend port mappings to the intended backend instances. The remaining action alone does not satisfy the situation.
D:Gateway Load Balancer enables supported transparent third-party appliance insertion rather than HTTP-path routing.
Question 448
A VM cannot connect to a database on TCP 1433, and an operator wants to identify whether a policy or hop blocks the request. A troubleshooting capture must inspect packets leaving a VM during a brief TLS failure, but the team collects only Azure Activity Logs. What is the most appropriate plan for this situation?
- Use Network Watcher connection troubleshoot and appropriate IP flow verification to isolate the failed connection stage; use Network Watcher next hop and effective-route diagnostics for the affected VM source and destination.
- Run IP flow verify with representative five-tuple details and inspect the resulting allow or deny rule; configure a bounded Network Watcher packet capture for the target VM with authorized storage and filters.
- Use Network Watcher connection troubleshoot and appropriate IP flow verification to isolate the failed connection stage; configure a bounded Network Watcher packet capture for the target VM with authorized storage and filters.
- Configure a bounded Network Watcher packet capture for the target VM with authorized storage and filters; do not use Network Watcher connection troubleshoot and appropriate IP flow verification to isolate the failed connection stage.
Explanation
Correct Answer
C:Connection diagnostics can distinguish reachable transport paths from NSG decisions without guessing at firewall rules. Packet capture provides traffic-level evidence that management-plane activity events do not contain. Both actions are needed.
Incorrect Answers
A:Packet capture provides traffic-level evidence that management-plane activity events do not contain.
B:Connection diagnostics can distinguish reachable transport paths from NSG decisions without guessing at firewall rules.
D:This plan leaves out a required action: Use Network Watcher connection troubleshoot and appropriate IP flow verification to isolate the failed connection stage. The remaining action alone does not satisfy the situation.
Question 449
An operations team schedules an Azure virtual network gateway maintenance operation without planning how branch traffic will survive an instance loss. A hub gateway returns traffic to the branch over an unexpected virtual tunnel after a second office is onboarded with duplicate CIDRs. Which course of action addresses the stated issues?
- Expand GatewaySubnet through a supported change plan before allocating the new gateway instances; correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles.
- Evaluate zone-redundant or active-active options and validate operational failover against branch peer capabilities; review BGP default-route acceptance and forced-tunneling intent before allowing the branch's advertised default.
- Correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles; do not evaluate zone-redundant or active-active options and validate operational failover against branch peer capabilities.
- Evaluate zone-redundant or active-active options and validate operational failover against branch peer capabilities; correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles.
Explanation
Correct Answer
D:Gateway high availability and on-premises configuration together determine whether encrypted sessions can recover. VPN encryption can be healthy while ambiguous destination prefixes cause asymmetric or incorrect routing. Both actions are needed.
Incorrect Answers
A:Gateway high availability and on-premises configuration together determine whether encrypted sessions can recover.
B:VPN encryption can be healthy while ambiguous destination prefixes cause asymmetric or incorrect routing.
C:This plan leaves out a required action: Evaluate zone-redundant or active-active options and validate operational failover against branch peer capabilities. The remaining action alone does not satisfy the situation.
Question 450
A finance team needs storage account traffic from its Azure VNet to use a private address instead of the service's public endpoint. A team wants to allow multiple consumer VNets to use one SQL private endpoint without peering or routing between those VNets. Which response best addresses these needs?
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; review and restrict the SQL service's public network access independently from the private endpoint connection.
- Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution; do not create an Azure private endpoint for the required storage subresource and configure private name resolution.
- Fix the application's DNS resolution path so the service hostname resolves to the correct private endpoint address; Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
- Create an Azure private endpoint for the required storage subresource and configure private name resolution; Provide private endpoint instances or supported network connectivity for each consumer VNet, with matching DNS resolution.
Explanation
Correct Answer
D:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network. Private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone. Both actions are needed.
Incorrect Answers
A:Private endpoint reachability is a private networking concern; another VNet cannot use an unreachable endpoint by permission alone.
B:This plan leaves out a required action: Create an Azure private endpoint for the required storage subresource and configure private name resolution. The remaining action alone does not satisfy the situation.
C:A private endpoint gives a supported PaaS resource a reachable private IP within the consumer network.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests