Question 550
During an Azure networking rollout, the team must resolve both of these conditions. An administrator expects Application Gateway to provide raw RDP load balancing for remote administrators rather than web traffic. A backend API needs a nonstandard HTTP port and the gateway reports connection failures though client port 443 is healthy. What is the most appropriate plan for this situation?
- Configure probes with the intended host header and path and validate the origin's virtual host behavior; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; update backend pool membership and probe configuration and verify traffic distribution from client requests.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener.
- Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; do not use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
Explanation
Correct Answer
C:Application Gateway focuses on HTTP(S) services and does not expose generic TCP connections like an L4 balancer. Frontend and backend ports are independent settings in an application-layer proxy. Both actions are needed.
Incorrect Answers
A:Application Gateway focuses on HTTP(S) services and does not expose generic TCP connections like an L4 balancer.
B:Frontend and backend ports are independent settings in an application-layer proxy.
D:This plan leaves out a required action: Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol. The remaining action alone does not satisfy the situation.
Question 551
An on-premises route learned over BGP overlaps a narrow spoke UDR, and the team cannot explain the chosen next hop. A hub VPN gateway provides on-premises routes, but a spoke has its own gateway and is configured to use both its own and a remote gateway simultaneously. A network team deploys a virtual WAN hub and assumes ordinary VNet peering route tables govern all hub-to-branch connectivity. Which course of action addresses the stated issues?
- Add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA; review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; and review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions.
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination; review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; and add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination; add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA; and review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions.
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination; review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; and review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions.
Explanation
Correct Answer
D:Route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR. Spoke gateway ownership and remote-gateway consumption have documented compatibility rules. Virtual WAN has its own route-table and connection semantics that differ from manually peered hubs. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR.
B:Two actions meet their requirements, but action 3 misses this need: virtual WAN has its own route-table and connection semantics that differ from manually peered hubs.
C:Two actions meet their requirements, but action 2 misses this need: spoke gateway ownership and remote-gateway consumption have documented compatibility rules.
Question 552
During an Azure networking rollout, the team must resolve both of these conditions. An application sees outbound socket exhaustion during burst traffic and engineers increase only inbound load-balancer probes. An engineer expects NAT Gateway to translate private addresses for traffic between two private VNets without public internet egress. Which response best addresses these needs?
- Use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity; do not inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload.
- Review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments; use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity.
- Inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload; Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior.
- Inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload; use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity.
Explanation
Correct Answer
D:Outbound source translation ports limit concurrency independently of inbound application health probes. Subnet NAT Gateway is not a general private-to-private network address translation router. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload. The remaining action alone does not satisfy the situation.
B:Outbound source translation ports limit concurrency independently of inbound application health probes.
C:Subnet NAT Gateway is not a general private-to-private network address translation router.
Question 553
An e-commerce site faces SQL injection in HTTP form fields but the security team relies solely on an L4 NSG port restriction. What should the Azure network engineer do?
- Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention.
- Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
- Apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic.
- Deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling.
Explanation
Correct Answer
D:Web application attacks require application-layer inspection of HTTP payloads beyond port-level packet rules.
Incorrect Answers
A:Here, web application attacks require application-layer inspection of HTTP payloads beyond port-level packet rules.
B:For this question, web application attacks require application-layer inspection of HTTP payloads beyond port-level packet rules.
C:For this finding, web application attacks require application-layer inspection of HTTP payloads beyond port-level packet rules.
Question 554
During an Azure networking rollout, the team must resolve both of these conditions. A hub-and-spoke environment requires centralized stateful inspection of outbound traffic from many spokes and their on-premises extensions. A company needs FQDN-aware outbound web application controls from a hub to selected sanctioned destinations. Which course of action addresses the stated issues?
- Configure an Azure Firewall DNAT rule and corresponding backend routing and security controls; configure Azure Firewall application rules for supported web protocols and destination domains.
- Configure Azure Firewall application rules for supported web protocols and destination domains; do not deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address.
- Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address; use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities.
- Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address; configure Azure Firewall application rules for supported web protocols and destination domains.
Explanation
Correct Answer
D:Azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing. Application rules support eligible FQDN-based filtering distinct from IP-and-port network rule matching. Both actions are needed.
Incorrect Answers
A:Azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing.
B:This plan leaves out a required action: Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address. The remaining action alone does not satisfy the situation.
C:Application rules support eligible FQDN-based filtering distinct from IP-and-port network rule matching.
Question 555
An architect treats Azure VPN Gateway as a turnkey replacement for a complete on-premises Always On VPN infrastructure. Which response best addresses this Azure networking scenario?
- Check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path.
- Provide supported custom DNS server or private resolution configuration through the client and gateway architecture.
- Inspect certificate trust chains and authentication logs on both client and gateway before altering network routes.
- Review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles.
Explanation
Correct Answer
D:Always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence.
Incorrect Answers
A:For this question, always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence.
B:Here, always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence.
C:For this finding, always On VPN has client and infrastructure dependencies that must be validated separately from Azure gateway existence.
Question 556
A global application wants its backend reachable only through Front Door rather than directly over a public origin hostname. A team configures Front Door WAF but the origin still accepts direct internet traffic from arbitrary clients. A Front Door profile has healthy origins but sends users to an unexpected region because origin priorities and weights are inconsistent. What is the most appropriate plan for this situation?
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs; and inspect origin group routing, priority, weight, and health settings and test representative client regions.
- Select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs; Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door; and inspect origin group routing, priority, weight, and health settings and test representative client regions.
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door; and select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door; and inspect origin group routing, priority, weight, and health settings and test representative client regions.
Explanation
Correct Answer
D:Private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them. Edge WAF cannot inspect or block requests that bypass the edge and reach an unprotected origin directly. Origin selection is determined by configured routing and health criteria rather than geographic proximity alone. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: edge WAF cannot inspect or block requests that bypass the edge and reach an unprotected origin directly.
B:Two actions meet their requirements, but action 1 misses this need: private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them.
C:Two actions meet their requirements, but action 3 misses this need: origin selection is determined by configured routing and health criteria rather than geographic proximity alone.
Question 557
Two VM workloads must resolve internal app.contoso.internal consistently across multiple Azure VNets without publishing the record on the internet. A business needs a public website record resolvable worldwide and mistakenly stores its authoritative A record only in Azure Private DNS. Which course of action addresses the stated issues?
- Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior; Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings; Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider; do not create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings; enable supported auto-registration on the designated VNet link and verify which resource types produce records.
Explanation
Correct Answer
B:Private DNS zone links enable scoped VNet resolution without relying on publicly advertised DNS records. Private DNS zones are not internet authoritative and cannot substitute for public DNS delegation. Both actions are needed.
Incorrect Answers
A:Private DNS zone links enable scoped VNet resolution without relying on publicly advertised DNS records.
C:This plan leaves out a required action: Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings. The remaining action alone does not satisfy the situation.
D:Private DNS zones are not internet authoritative and cannot substitute for public DNS delegation.
Question 558
A subnet reaches a supported service endpoint, but the service firewall denies requests because the VNet subnet was never allowed. What should the Azure network engineer do?
- Choose a private endpoint when the requirement is a private IP on the consumer VNet.
- Add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules.
Explanation
Correct Answer
B:Subnet endpoint activation alone does not grant the service permission to accept the subnet's requests.
Incorrect Answers
A:Here, subnet endpoint activation alone does not grant the service permission to accept the subnet's requests.
C:Using a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP would not add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
D:Enabling the supported service endpoint on those subnets and configuring matching storage firewall VNet rules would not add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
Question 559
A provider wants to control which partner subscriptions may create private endpoints to its internal service. A private-link provider changes its backend pool, then assumes all client endpoint connections must be recreated. What is the most appropriate plan for this situation?
- Configure Private Link service visibility and connection approval permissions before accepting consumer requests; Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Publish the service through an eligible Private Link service or supported Azure service target first; Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Maintain the supported Private Link service frontend while updating backend health and routing as needed; do not configure Private Link service visibility and connection approval permissions before accepting consumer requests.
- Configure Private Link service visibility and connection approval permissions before accepting consumer requests; create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals.
Explanation
Correct Answer
A:Private Link service admission governs permitted consumers separately from network reachability to its load balancer. Consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract. Both actions are needed.
Incorrect Answers
B:Private Link service admission governs permitted consumers separately from network reachability to its load balancer.
C:This plan leaves out a required action: Configure Private Link service visibility and connection approval permissions before accepting consumer requests. The remaining action alone does not satisfy the situation.
D:Consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract.
Question 560
A company deploys dozens of public ingress endpoints and wants contiguous provider-owned addresses that simplify upstream firewall allowlists. A web application must maintain one stable inbound IP through a VM restart, but it currently receives a dynamic public address. A team allocates an unused public IP prefix and expects an individual virtual machine to respond to the entire prefix automatically. Which course of action addresses the stated issues?
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; create a suitable static Standard public IP and associate it with the supported load balancer or network interface; and create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; create a suitable static Standard public IP and associate it with the supported load balancer or network interface; and evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; create a suitable static Standard public IP and associate it with the supported load balancer or network interface; and create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; and create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints.
Explanation
Correct Answer
A:An Azure public IP prefix provides a predictable block for related public addresses without requiring independent random allocations. A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address. Reserving a prefix does not itself configure listeners or give one VM every address in that prefix. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 3 misses this need: reserving a prefix does not itself configure listeners or give one VM every address in that prefix.
C:Two actions meet their requirements, but action 1 misses this need: an Azure public IP prefix provides a predictable block for related public addresses without requiring independent random allocations.
D:Two actions meet their requirements, but action 2 misses this need: a static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests