Question 470
An Azure VPN hub fails only during peak hours and connection logs show gateway capacity limits, despite healthy on-premises circuits. Which action best addresses this finding?
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
Explanation
Correct Answer
A:Throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
Incorrect Answers
B:For this question, throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
C:For this finding, throughput exhaustion requires gateway sizing review rather than a blanket NSG policy change.
D:Verifying the gateway SKU, VPN type, and BGP compatibility would not meet the need for measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
Question 471
An enterprise requires branch-to-branch transit through a new WAN service but selects a Basic Virtual WAN configuration without reviewing capabilities. A team deploys a Virtual WAN resource but assumes it immediately provides gateways and virtual hub network paths. A global network needs geographically distributed WAN hubs, but the plan places all branches behind one distant hub irrespective of latency and availability. Which response best addresses these needs?
- Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites; and select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
- Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; and select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
- Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites; and design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites; and select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
Explanation
Correct Answer
A:Basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services. The Virtual WAN resource is a management container; traffic requires configured hub services and connections. Hub placement affects branch latency and region failure exposure even when a global WAN resource exists. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 2 misses this need: the Virtual WAN resource is a management container; traffic requires configured hub services and connections.
C:Two actions meet their requirements, but action 3 misses this need: hub placement affects branch latency and region failure exposure even when a global WAN resource exists.
D:Two actions meet their requirements, but action 1 misses this need: basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services.
Question 472
A team needs VNet-origin restrictions for a supported Azure service but does not need private IP allocation or per-endpoint approvals. A service endpoint configuration works within one VNet but a newly migrated workload on-premises cannot use the same policy-based source identity. An administrator mixes a private endpoint and a service endpoint on the same subnet and assumes DNS selection is irrelevant to which path a client uses. What is the most appropriate plan for this situation?
- Use service endpoints and service-side virtual network rules after validating compatibility; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; and test actual FQDN answers and effective routes, then select the intended access method explicitly.
- Use service endpoints and service-side virtual network rules after validating compatibility; use a private endpoint with service-supported public network restrictions and the matching private DNS integration; and test actual FQDN answers and effective routes, then select the intended access method explicitly.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; and test actual FQDN answers and effective routes, then select the intended access method explicitly.
- Use service endpoints and service-side virtual network rules after validating compatibility; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; and use a private endpoint with service-supported public network restrictions and the matching private DNS integration.
Explanation
Correct Answer
A:Service endpoints can be simpler when subnet identity is sufficient and the public service endpoint model is acceptable. On-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel. DNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 2 misses this need: on-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel.
C:Two actions meet their requirements, but action 1 misses this need: service endpoints can be simpler when subnet identity is sufficient and the public service endpoint model is acceptable.
D:Two actions meet their requirements, but action 3 misses this need: DNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference.
Question 473
A company wants subnets to access only a subset of approved storage accounts rather than every account that could accept service endpoint traffic. An administrator attaches a service endpoint policy for an unsupported Azure service type and assumes it will restrict all Azure platform egress. Which course of action addresses the stated issues?
- Review storage network rules and service endpoint source identity alongside application-layer credentials; check which Azure services support service endpoint policies and use alternative enforcement where unsupported.
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility; check which Azure services support service endpoint policies and use alternative enforcement where unsupported.
- Check which Azure services support service endpoint policies and use alternative enforcement where unsupported; do not apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility.
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility; retain appropriate NSG and routing controls because service endpoints do not replace general outbound network security.
Explanation
Correct Answer
B:Service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported. Service endpoint policies are not universal egress firewalls for every Azure service. Both actions are needed.
Incorrect Answers
A:Service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported.
C:This plan leaves out a required action: Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility. The remaining action alone does not satisfy the situation.
D:Service endpoint policies are not universal egress firewalls for every Azure service.
Question 474
A private endpoint is recreated with a new network interface, but a manually maintained private DNS A record still points to the deleted address. What should the Azure network engineer do?
- Update the zone group or private DNS record so the resource hostname resolves to the active endpoint IP.
- Use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP.
- Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links.
- Create separate private endpoints and matching private DNS records for each required supported storage subresource.
Explanation
Correct Answer
A:Stale private DNS records can keep clients on an invalid address after a private endpoint replacement.
Incorrect Answers
B:Stable service DNS names and TLS validation are safer than applications depending on one private interface address. Stale private DNS records can keep clients on an invalid address after a private endpoint replacement.
C:Private endpoint name resolution must reach the Azure private zone from the on-premises resolver path. Stale private DNS records can keep clients on an invalid address after a private endpoint replacement.
D:Private endpoint connections are often scoped to specific service subresources rather than all endpoints in the resource. Stale private DNS records can keep clients on an invalid address after a private endpoint replacement.
Question 475
Azure workloads must resolve a private corporate domain hosted on on-premises DNS without changing every VM's resolver configuration. Which response best addresses this Azure networking scenario?
- Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet.
- Link the DNS forwarding ruleset to the intended client VNet and verify suffix matching and target reachability.
- Create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules.
- Deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders.
Explanation
Correct Answer
A:Outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers.
Incorrect Answers
B:For this finding, outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers.
C:Creating appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules would not configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet.
D:For this question, outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers.
Question 476
During an Azure networking rollout, the team must resolve both of these conditions. A VM communicates to a service through a private endpoint but a Network Watcher next-hop result points to an unexpected network virtual appliance. A defender finds a network-exposed secret management endpoint and wants to prioritize remediation beyond raw Secure Score point totals. Which course of action addresses the stated issues?
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns.
- Use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
- Use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets; do not inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records.
Explanation
Correct Answer
C:A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions. Security scoring is a prioritization input but does not by itself show how an attacker could traverse a live exposure. Both actions are needed.
Incorrect Answers
A:Security scoring is a prioritization input but does not by itself show how an attacker could traverse a live exposure.
B:A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions.
D:This plan leaves out a required action: Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records. The remaining action alone does not satisfy the situation.
Question 477
A virtual subnet contains a /29 range and a design spreadsheet assumes all eight addresses are assignable to workloads. Which response best addresses this Azure networking scenario?
- Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs.
- Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
- Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix.
- Choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity.
Explanation
Correct Answer
A:Azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity.
Incorrect Answers
B:For this question, azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity.
C:Here, azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity.
D:For this finding, azure reserves addresses within each subnet, so raw CIDR address count overstates usable workload capacity.
Question 478
A multinational organization manually creates hundreds of peering relationships, causing inconsistent spoke connectivity across subscriptions. An engineer uses Virtual Network Manager to push an overly broad security admin rule that overrides carefully scoped workload NSG denies. What is the most appropriate plan for this situation?
- Apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope; evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design.
- Keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange; review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups.
- Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups; do not apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope.
- Apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope; review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups.
Explanation
Correct Answer
D:Central network grouping can standardize supported connectivity patterns instead of relying on separate manual peer edits. Central administrative security rules have distinct precedence behavior and broad scope that must be validated. Both actions are needed.
Incorrect Answers
A:Central administrative security rules have distinct precedence behavior and broad scope that must be validated.
B:Central network grouping can standardize supported connectivity patterns instead of relying on separate manual peer edits.
C:This plan leaves out a required action: Apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope. The remaining action alone does not satisfy the situation.
Question 479
An administrator creates an NSG but never associates it with the intended subnet or NIC and claims the workload is isolated. A VNet is migrated to a new hub but its flow log configuration still targets an obsolete storage account and monitoring shows no recent records. Which course of action addresses the stated issues?
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive.
- Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; do not Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces.
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; assign the appropriate VM network interface to the ASG and check effective security rules.
- Use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls; Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive.
Explanation
Correct Answer
A:Unassociated NSG resources cannot evaluate or filter the intended traffic. Flow logging depends on operational delivery and destination access, not solely on NSG rule existence. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces. The remaining action alone does not satisfy the situation.
C:Flow logging depends on operational delivery and destination access, not solely on NSG rule existence.
D:Unassociated NSG resources cannot evaluate or filter the intended traffic.
Question 480
During an Azure networking rollout, the team must resolve both of these conditions. A globally distributed web service wants endpoint failover by changing the DNS answer based on health, not by proxying every HTTP request. A network engineer demands TLS termination and WAF inspection directly on a Traffic Manager DNS profile. Which response best addresses these needs?
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses; use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection; do not configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
Explanation
Correct Answer
A:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy. A DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads. Both actions are needed.
Incorrect Answers
B:A DNS traffic manager does not terminate HTTP/TLS connections or inspect request payloads.
C:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
D:This plan leaves out a required action: Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring. The remaining action alone does not satisfy the situation.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests