Question 460
During an Azure networking rollout, the team must resolve both of these conditions. Two Azure VNets in different subscriptions need low-latency private connectivity, but the design proposes a separate site-to-site VPN between them. A network team peers two VNets that use overlapping 10.0.0.0/16 prefixes and is surprised by the creation failure. What is the most appropriate plan for this situation?
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Renumber or redesign the conflicting address spaces before creating peering between the two VNets; do not use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Explanation
Correct Answer
A:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity. Overlapping address ranges are incompatible with reliable direct peering across the endpoints. Both actions are needed.
Incorrect Answers
B:VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.
C:This plan leaves out a required action: Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement. The remaining action alone does not satisfy the situation.
D:Overlapping address ranges are incompatible with reliable direct peering across the endpoints.
Question 461
A security policy change blocks new inbound sessions, but existing established connections continue transferring for a period. An administrator adds an inbound allow on an NSG but the application cannot reach a remote service because the effective outbound rule denies the reply's original initiation path. Which course of action addresses the stated issues?
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic; validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.
- Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic; inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; do not review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes; inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
Explanation
Correct Answer
B:Stateful security evaluation can allow established flows to persist independently of how new flows are classified. Connection direction and state tracking determine which policy is evaluated for new traffic. Both actions are needed.
Incorrect Answers
A:Connection direction and state tracking determine which policy is evaluated for new traffic.
C:This plan leaves out a required action: Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic. The remaining action alone does not satisfy the situation.
D:Stateful security evaluation can allow established flows to persist independently of how new flows are classified.
Question 462
A subnet contains a private endpoint and an architect assumes an NSG on the subnet always filters its traffic without checking network policy settings. A developer connects privately to a PaaS service but disables TLS certificate validation because the service now has a private IP. Which response best addresses these needs?
- Apply least-privilege service authorization and identity controls in addition to the private network connection; Continue using the service's valid hostname and certificate validation over the private endpoint connection.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; Continue using the service's valid hostname and certificate validation over the private endpoint connection.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
- Continue using the service's valid hostname and certificate validation over the private endpoint connection; do not check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.
Explanation
Correct Answer
B:Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation. A private IP does not make encrypted transport or endpoint identity verification unnecessary. Both actions are needed.
Incorrect Answers
A:Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.
C:A private IP does not make encrypted transport or endpoint identity verification unnecessary.
D:This plan leaves out a required action: Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement. The remaining action alone does not satisfy the situation.
Question 463
During an Azure networking rollout, the team must resolve both of these conditions. A new Azure Bastion host cannot deploy because the security team reused a general server subnet for the service. A team adds a private endpoint to a VNet but assumes it must reserve the entire gateway subnet for the endpoint. What is the most appropriate plan for this situation?
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; do not create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion.
- Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
- Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.
- Select a supported public ingress service or public IP association target instead of inventing direct attachment capability; Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
Explanation
Correct Answer
B:Azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites. Private endpoints consume private addresses; they do not use the virtual network gateway's special subnet. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion. The remaining action alone does not satisfy the situation.
C:Private endpoints consume private addresses; they do not use the virtual network gateway's special subnet.
D:Azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites.
Question 464
A globally cached API returns private personalized responses to other users because its routes cache content with an overly broad policy. A request passes an edge WAF policy, but the administrator mistakes its rate-limit action for evidence that the origin application performed the same inspection. A retailer plans to cut traffic from one region but simply disables its origin without validating what happens to long-lived client connections. Which course of action addresses the stated issues?
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; and Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; and Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; and Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; Complete the supported custom-domain validation and certificate workflow and confirm public DNS records; and Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
Explanation
Correct Answer
C:Shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe. Edge and origin components log different security decisions and require correlation to explain a request outcome. Origin routing health changes affect new or retried requests and must be tested with real application continuity needs. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe.
B:Two actions meet their requirements, but action 3 misses this need: origin routing health changes affect new or retried requests and must be tested with real application continuity needs.
D:Two actions meet their requirements, but action 2 misses this need: edge and origin components log different security decisions and require correlation to explain a request outcome.
Question 465
A shopping site must send /payments to a protected API pool and /catalog to a different pool under one HTTPS host. An Application Gateway backend shows unhealthy because its probe requests / and receives 404 even though /health returns 200. Which response best addresses these needs?
- Create a custom health probe for the correct host and health path and review backend HTTP settings; do not use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits; create a custom health probe for the correct host and health path and review backend HTTP settings.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; create a custom health probe for the correct host and health path and review backend HTTP settings.
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings; configure multi-site listener hostnames and appropriate routing rules with the required certificates.
Explanation
Correct Answer
C:Application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide. A default probe can misclassify a functioning application when its expected hostname or path differs. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings. The remaining action alone does not satisfy the situation.
B:Application Gateway supports layer-7 path decisions that a layer-4 load balancer cannot provide.
D:A default probe can misclassify a functioning application when its expected hostname or path differs.
Question 466
A security team needs historical communication patterns for subnet-level troubleshooting and assumes the retired NSG flow log workflow is the only option. An internet-facing app is targeted by a volumetric attack, and the team mistakes a simple NSG deny rule for a full DDoS mitigation plan. Defender for Cloud flags an exposed management port and an engineer ignores the attack-path context because the vulnerability scan is clean. What is the most appropriate plan for this situation?
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; and use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; and review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; and review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; and review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
Explanation
Correct Answer
C:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited. NSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services. Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
B:Two actions meet their requirements, but action 1 misses this need: vNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
D:Two actions meet their requirements, but action 2 misses this need: nSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services.
Question 467
A payroll API must be reachable only from private VNets and must not expose any public frontend address. Which action best addresses this finding?
- Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
- Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
Explanation
Correct Answer
C:Internal load balancing provides VNet-private service entry rather than an internet-facing public address.
Incorrect Answers
A:For this finding, internal load balancing provides VNet-private service entry rather than an internet-facing public address.
B:Using an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule would not deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
D:Using an application-layer gateway or reverse proxy when routing requires HTTP path inspection would not deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
Question 468
An Azure PaaS resource is used by both a production and test VNet, and a team wants isolated private connections and separate approval records. Which response most directly resolves the issue?
- Use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
- Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.
Explanation
Correct Answer
D:Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.
Incorrect Answers
A:For this question, separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.
B:Here, separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.
C:For this finding, separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.
Question 469
A WAF is left in Detection mode while executives expect it to block confirmed malicious payloads. A WAF rule has blocked requests in its logs, yet clients still reach the origin directly by an unprotected public hostname. An enterprise enables a WAF policy on one Front Door domain and assumes all domains on a separate profile inherit it automatically. What is the most appropriate plan for this situation?
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; and validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; and validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; and validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; and use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
Explanation
Correct Answer
A:Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode. WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint. WAF protection must be explicitly associated with the intended application ingress scope. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 2 misses this need: wAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint.
C:Two actions meet their requirements, but action 1 misses this need: detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.
D:Two actions meet their requirements, but action 3 misses this need: wAF protection must be explicitly associated with the intended application ingress scope.
Question 470
An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. Which action best addresses this finding?
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
Explanation
Correct Answer
A:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
Incorrect Answers
B:For this question, throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
C:For this finding, throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
D:Verifying the gateway SKU, VPN type, and BGP compatibility would not meet the need for measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests