Microsoft AZ-700 Practice Test 53

Question 520

Two Azure VNets in different subscriptions need low-latency private connectivity, but the design proposes a separate site-to-site VPN between them. Which action best addresses this finding?

Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
Design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity.
Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules.
Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.

Explanation

Correct Answer

VNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.

Incorrect Answers

For this question, vNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.

For this finding, vNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.

Here, vNet peering can directly connect eligible VNets without adding a VPN tunnel and its operational complexity.

Question 521

A security policy change blocks new inbound sessions, but existing established connections continue transferring for a period. Which action best addresses this finding?

Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
Review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.

Explanation

Correct Answer

Stateful security evaluation can allow established flows to persist independently of how new flows are classified.

Incorrect Answers

Here, stateful security evaluation can allow established flows to persist independently of how new flows are classified.

For this question, stateful security evaluation can allow established flows to persist independently of how new flows are classified.

For this finding, stateful security evaluation can allow established flows to persist independently of how new flows are classified.

Question 522

A subnet contains a private endpoint and an architect assumes an NSG on the subnet always filters its traffic without checking network policy settings. What should the Azure network engineer do?

Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
Continue using the service's valid hostname and certificate validation over the private endpoint connection.
Apply least-privilege service authorization and identity controls in addition to the private network connection.
Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement.

Explanation

Correct Answer

Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.

Incorrect Answers

Here, private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.

For this question, private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.

For this finding, private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.

Question 523

A new Azure Bastion host cannot deploy because the security team reused a general server subnet for the service. A network engineer associates a public IP directly with an unsupported private platform resource, hoping to make its internal endpoint public. What is the most appropriate plan for this situation?

Select a supported public ingress service or public IP association target instead of inventing direct attachment capability; do not create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion.
Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets.

Explanation

Correct Answer

Azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites. Public IP associations are constrained by supported Azure resource types and network architectures. Both actions are needed.

Incorrect Answers

This plan leaves out a required action: Create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion. The remaining action alone does not satisfy the situation.

Azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites.

Public IP associations are constrained by supported Azure resource types and network architectures.

Question 524

A request passes an edge WAF policy, but the administrator mistakes its rate-limit action for evidence that the origin application performed the same inspection. A retailer plans to cut traffic from one region but simply disables its origin without validating what happens to long-lived client connections. Which course of action addresses the stated issues?

Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
Disable caching for personalized responses and correct origin cache headers before enabling edge delivery; Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement; Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
Stage changes to Front Door origin routing and test failover and application session behavior under maintenance; do not inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.

Explanation

Correct Answer

Edge and origin components log different security decisions and require correlation to explain a request outcome. Origin routing health changes affect new or retried requests and must be tested with real application continuity needs. Both actions are needed.

Incorrect Answers

Origin routing health changes affect new or retried requests and must be tested with real application continuity needs.

Edge and origin components log different security decisions and require correlation to explain a request outcome.

This plan leaves out a required action: Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement. The remaining action alone does not satisfy the situation.

Question 525

A reverse proxy answers for store.example.com but rejects requests for support.example.com despite both sites sharing the gateway. Which action best addresses this finding?

Configure multi-site listener hostnames and appropriate routing rules with the required certificates.
Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
Create a custom health probe for the correct host and health path and review backend HTTP settings.
Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.

Explanation

Correct Answer

Host-based listener matching controls which site a shared gateway accepts and routes.

Incorrect Answers

Evaluating autoscaling Application Gateway capacity with monitored minimums and service limits would not configure multi-site listener hostnames and appropriate routing rules with the required certificates.

For this finding, host-based listener matching controls which site a shared gateway accepts and routes.

Using Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings would not configure multi-site listener hostnames and appropriate routing rules with the required certificates.

Question 526

An internet-facing app is targeted by a volumetric attack, and the team mistakes a simple NSG deny rule for a full DDoS mitigation plan. Defender for Cloud flags an exposed management port and an engineer ignores the attack-path context because the vulnerability scan is clean. What is the most appropriate plan for this situation?

Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence; do not evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring.

Explanation

Correct Answer

NSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services. Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding. Both actions are needed.

Incorrect Answers

Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.

NSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services.

This plan leaves out a required action: Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring. The remaining action alone does not satisfy the situation.

Question 527

A backend service uses a custom TCP protocol and requires distribution across healthy VMs within one Azure region. Which response best addresses this Azure networking scenario?

Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing.
Use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.

Explanation

Correct Answer

Azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.

Incorrect Answers

For this question, azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.

Here, azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.

For this finding, azure Load Balancer distributes layer-4 connections without requiring an HTTP-aware reverse proxy.

Question 528

An Azure PaaS resource is used by both a production and test VNet, and a team wants isolated private connections and separate approval records. A private endpoint appears in the portal as Pending and clients cannot reach the provider service despite correct subnet DNS. Which response best addresses these needs?

Use an approved Private Link service and consumer private endpoint rather than broad VNet peering; approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; approve the endpoint request through the service provider's supported connection workflow and confirm the connection state.
Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals; review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state; do not create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.

Explanation

Correct Answer

Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path. A pending private connection cannot be treated as an established provider-approved data path. Both actions are needed.

Incorrect Answers

Separately scoped consumer endpoints allow isolation and auditing instead of sharing an uncontrolled network path.

A pending private connection cannot be treated as an established provider-approved data path.

This plan leaves out a required action: Create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals. The remaining action alone does not satisfy the situation.

Question 529

A WAF is left in Detection mode while executives expect it to block confirmed malicious payloads. A false-positive rule excludes all request bodies to fix one JSON property, creating a large inspection gap. What is the most appropriate plan for this situation?

After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile; use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes; use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; do not After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.

Explanation

Correct Answer

Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode. Broad exemptions can silently remove inspection coverage for unrelated malicious payloads. Both actions are needed.

Incorrect Answers

Broad exemptions can silently remove inspection coverage for unrelated malicious payloads.

Detection mode records matching requests but does not enforce the same blocking actions as Prevention mode.

This plan leaves out a required action: After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes. The remaining action alone does not satisfy the situation.

Question 530

An architect tries to configure BGP settings on a gateway deployment that does not support the intended protocol combination. Which response most directly resolves the issue?

Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
Verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.

Explanation

Correct Answer

Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.

Incorrect Answers

For this question, dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.

For this finding, dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.

Here, dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests

Microsoft AZ-700 Practice Test 51 - 10 Questions (Last Reviewed 20-Sep-2026)
Microsoft AZ-700 Practice Test 52 - 10 Questions (Last Reviewed 19-Sep-2026)
Microsoft AZ-700 Practice Test 53 - 10 Questions (Last Reviewed 18-Sep-2026)
Microsoft AZ-700 Practice Test 54 - 10 Questions (Last Reviewed 17-Sep-2026)
Microsoft AZ-700 Practice Test 55 - 10 Questions (Last Reviewed 16-Sep-2026)

Pass Your Microsoft AZ-700 Exam Easy!

Question 520

Explanation

Correct Answer

Incorrect Answers

Question 521

Explanation

Correct Answer

Incorrect Answers

Question 522

Explanation

Correct Answer

Incorrect Answers

Question 523

Explanation

Correct Answer

Incorrect Answers

Question 524

Explanation

Correct Answer

Incorrect Answers

Question 525

Explanation

Correct Answer

Incorrect Answers

Question 526

Explanation

Correct Answer

Incorrect Answers

Question 527

Explanation

Correct Answer

Incorrect Answers

Question 528

Explanation

Correct Answer

Incorrect Answers

Question 529

Explanation

Correct Answer

Incorrect Answers

Question 530

Explanation

Correct Answer

Incorrect Answers

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests