Question 490
An administrator expects Application Gateway to provide raw RDP load balancing for remote administrators rather than web traffic. A backend API needs a nonstandard HTTP port and the gateway reports connection failures though client port 443 is healthy. An application routes by hostname but uses a generic probe that targets the wrong virtual host and marks every endpoint down. What is the most appropriate plan for this situation?
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; update backend pool membership and probe configuration and verify traffic distribution from client requests; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and update backend pool membership and probe configuration and verify traffic distribution from client requests.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
Explanation
Correct Answer
D:Application Gateway focuses on HTTP(S) services and does not expose generic TCP connections like an L4 balancer. Frontend and backend ports are independent settings in an application-layer proxy. HTTP virtual hosting can return different health responses depending on the Host header sent by the probe. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: frontend and backend ports are independent settings in an application-layer proxy.
B:Two actions meet their requirements, but action 3 misses this need: hTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
C:Two actions meet their requirements, but action 1 misses this need: application Gateway focuses on HTTP(S) services and does not expose generic TCP connections like an L4 balancer.
Question 491
A hub VPN gateway provides on-premises routes, but a spoke has its own gateway and is configured to use both its own and a remote gateway simultaneously. Which action best addresses this finding?
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination.
- Review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions.
- Review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently.
- Add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
Explanation
Correct Answer
C:Spoke gateway ownership and remote-gateway consumption have documented compatibility rules.
Incorrect Answers
A:Comparing effective routes and applying longest-prefix matching and routing-source precedence to the specific destination would not review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently.
B:For this finding, spoke gateway ownership and remote-gateway consumption have documented compatibility rules.
D:For this question, spoke gateway ownership and remote-gateway consumption have documented compatibility rules.
Question 492
A VM scale set needs predictable outbound source addresses without accepting internet-initiated inbound connections. A team associates NAT Gateway with a subnet but continues to use an explicitly configured public load balancer outbound rule for the same VMs without checking precedence. An engineer expects NAT Gateway to translate private addresses for traffic between two private VNets without public internet egress. Which response best addresses these needs?
- Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior; review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments; and use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity.
- Inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload; review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments; and use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity.
- Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior; review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments; and inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload.
- Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior; inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload; and use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity.
Explanation
Correct Answer
A:NAT Gateway supplies scalable subnet outbound connectivity without serving as an inbound application listener. Multiple outbound mechanisms require precedence validation rather than assuming traffic always selects the newest configuration. Subnet NAT Gateway is not a general private-to-private network address translation router. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: nAT Gateway supplies scalable subnet outbound connectivity without serving as an inbound application listener.
C:Two actions meet their requirements, but action 3 misses this need: subnet NAT Gateway is not a general private-to-private network address translation router.
D:Two actions meet their requirements, but action 2 misses this need: multiple outbound mechanisms require precedence validation rather than assuming traffic always selects the newest configuration.
Question 493
A web application needs global edge enforcement for geographically distributed users, but the team builds a WAF policy only on one regional internal Application Gateway. An application uses Application Gateway WAF but the policy is never associated with the intended listener, so suspected attacks still reach the app. What is the most appropriate plan for this situation?
- Apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic; deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling.
- Apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic; Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
- Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention; Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
- Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs; do not apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic.
Explanation
Correct Answer
B:Front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service. An unattached policy cannot protect the traffic path regardless of how many managed rules it defines. Both actions are needed.
Incorrect Answers
A:An unattached policy cannot protect the traffic path regardless of how many managed rules it defines.
C:Front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service.
D:This plan leaves out a required action: Apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic. The remaining action alone does not satisfy the situation.
Question 494
A hub-and-spoke environment requires centralized stateful inspection of outbound traffic from many spokes and their on-premises extensions. A service hosted behind a firewall must be published to the internet through one approved public IP and translated to a private host. Which course of action addresses the stated issues?
- Configure an Azure Firewall DNAT rule and corresponding backend routing and security controls; do not deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address.
- Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address; use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities.
- Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address; configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
- Configure Azure Firewall application rules for supported web protocols and destination domains; configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
Explanation
Correct Answer
C:Azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing. Destination network address translation publishes an approved private target rather than creating generalized inbound permission. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address. The remaining action alone does not satisfy the situation.
B:Destination network address translation publishes an approved private target rather than creating generalized inbound permission.
D:Azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing.
Question 495
An architect treats Azure VPN Gateway as a turnkey replacement for a complete on-premises Always On VPN infrastructure. A Windows user sees a successful P2S tunnel but no DNS resolution for private service names despite correct IP connectivity. Which response best addresses these needs?
- Provide supported custom DNS server or private resolution configuration through the client and gateway architecture; do not review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles.
- Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles; inspect certificate trust chains and authentication logs on both client and gateway before altering network routes.
- Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles; Provide supported custom DNS server or private resolution configuration through the client and gateway architecture.
- Check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path; Provide supported custom DNS server or private resolution configuration through the client and gateway architecture.
Explanation
Correct Answer
C:Always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence. Remote VPN transport does not automatically supply access to the correct internal DNS namespace. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles. The remaining action alone does not satisfy the situation.
B:Remote VPN transport does not automatically supply access to the correct internal DNS namespace.
D:Always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence.
Question 496
A global application wants its backend reachable only through Front Door rather than directly over a public origin hostname. A team configures Front Door WAF but the origin still accepts direct internet traffic from arbitrary clients. A subscription owner assumes every Front Door tier includes Private Link origins and WAF features at identical price and functionality. What is the most appropriate plan for this situation?
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; inspect origin group routing, priority, weight, and health settings and test representative client regions; and select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door; and select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door; and inspect origin group routing, priority, weight, and health settings and test representative client regions.
- Inspect origin group routing, priority, weight, and health settings and test representative client regions; Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door; and select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
Explanation
Correct Answer
B:Private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them. Edge WAF cannot inspect or block requests that bypass the edge and reach an unprotected origin directly. Front Door feature availability and origin security options vary by tier and must be checked explicitly. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: edge WAF cannot inspect or block requests that bypass the edge and reach an unprotected origin directly.
C:Two actions meet their requirements, but action 3 misses this need: front Door feature availability and origin security options vary by tier and must be checked explicitly.
D:Two actions meet their requirements, but action 1 misses this need: private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them.
Question 497
During an Azure networking rollout, the team must resolve both of these conditions. An engineer creates a private DNS zone but never links it to the application VNet; clients resolve the name as nonexistent. A business needs a public website record resolvable worldwide and mistakenly stores its authoritative A record only in Azure Private DNS. Which course of action addresses the stated issues?
- Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior; Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider; do not Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior.
- Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior; create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings.
- Enable supported auto-registration on the designated VNet link and verify which resource types produce records; Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
Explanation
Correct Answer
A:Creating a zone alone does not give a VNet permission or a route to resolve its records. Private DNS zones are not internet authoritative and cannot substitute for public DNS delegation. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior. The remaining action alone does not satisfy the situation.
C:Private DNS zones are not internet authoritative and cannot substitute for public DNS delegation.
D:Creating a zone alone does not give a VNet permission or a route to resolve its records.
Question 498
During an Azure networking rollout, the team must resolve both of these conditions. An architect adds a service endpoint and expects it to create a private NIC inside the subnet with an RFC1918 IP. A subnet reaches a supported service endpoint, but the service firewall denies requests because the VNet subnet was never allowed. Which response best addresses these needs?
- Choose a private endpoint when the requirement is a private IP on the consumer VNet; add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Choose a private endpoint when the requirement is a private IP on the consumer VNet; enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules.
- Use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP; add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Add the intended subnet to the service's supported network access rules and confirm the service endpoint state; do not choose a private endpoint when the requirement is a private IP on the consumer VNet.
Explanation
Correct Answer
A:Service endpoints do not allocate a private endpoint interface; the service endpoint and Private Link models differ. Subnet endpoint activation alone does not grant the service permission to accept the subnet's requests. Both actions are needed.
Incorrect Answers
B:Subnet endpoint activation alone does not grant the service permission to accept the subnet's requests.
C:Service endpoints do not allocate a private endpoint interface; the service endpoint and Private Link models differ.
D:This plan leaves out a required action: Choose a private endpoint when the requirement is a private IP on the consumer VNet. The remaining action alone does not satisfy the situation.
Question 499
A private-link provider changes its backend pool, then assumes all client endpoint connections must be recreated. Which response best addresses this Azure networking scenario?
- Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Publish the service through an eligible Private Link service or supported Azure service target first.
- Configure Private Link service visibility and connection approval permissions before accepting consumer requests.
- Create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals.
Explanation
Correct Answer
A:Consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract.
Incorrect Answers
B:Here, consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract.
C:For this finding, consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract.
D:For this question, consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract.
Question 500
A company deploys dozens of public ingress endpoints and wants contiguous provider-owned addresses that simplify upstream firewall allowlists. A regulated enterprise owns a registered public IPv4 block and wants to advertise it from Azure rather than use Azure-owned public space. Which course of action addresses the stated issues?
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; do not Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix.
- Create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints; evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
Explanation
Correct Answer
A:An Azure public IP prefix provides a predictable block for related public addresses without requiring independent random allocations. Custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges. Both actions are needed.
Incorrect Answers
B:Custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges.
C:This plan leaves out a required action: Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix. The remaining action alone does not satisfy the situation.
D:An Azure public IP prefix provides a predictable block for related public addresses without requiring independent random allocations.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests