Question 580
A spoke peered to a hub needs to reach on-premises through the hub VPN gateway, but gateway transit options are not configured. Three VNets form A-to-B and B-to-C peerings, and the architect assumes A can reach C through automatic transitive peering. A network team peers two VNets that use overlapping 10.0.0.0/16 prefixes and is surprised by the creation failure. What is the most appropriate plan for this situation?
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; and use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; and Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Enable gateway transit on the hub peering and use remote gateways on eligible spokes subject to gateway design rules; use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; and Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
- Use VNet peering with verified permissions and nonoverlapping ranges when private Microsoft backbone connectivity meets the requirement; design explicit connectivity or approved transit routing because VNet peering does not inherently provide A-to-C transitivity; and Renumber or redesign the conflicting address spaces before creating peering between the two VNets.
Explanation
Correct Answer
B:Ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway. Peering relationships are not automatically transitive across another VNet. Overlapping address ranges are incompatible with reliable direct peering across the endpoints. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: overlapping address ranges are incompatible with reliable direct peering across the endpoints.
C:Two actions meet their requirements, but action 2 misses this need: peering relationships are not automatically transitive across another VNet.
D:Two actions meet their requirements, but action 1 misses this need: ordinary peering does not automatically permit a spoke to consume a hub's virtual network gateway.
Question 581
A project uses Virtual Network Manager security admin rules and local NSGs but assumes their precedence is a simple concatenated NSG list. A storage service uses a dynamic set of provider addresses, and engineers plan to hardcode every observed IP in NSG egress rules. Which course of action addresses the stated issues?
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes; do not validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout.
Explanation
Correct Answer
A:Central security administration rules are evaluated differently from standard workload NSG rules. Service tags provide maintained address abstractions for specific service categories. Both actions are needed.
Incorrect Answers
B:Service tags provide maintained address abstractions for specific service categories.
C:Central security administration rules are evaluated differently from standard workload NSG rules.
D:This plan leaves out a required action: Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout. The remaining action alone does not satisfy the situation.
Question 582
A subnet contains a private endpoint and an architect assumes an NSG on the subnet always filters its traffic without checking network policy settings. A private endpoint connection is approved for production, but administrators forget that its data plane still uses an overprivileged service identity. A developer connects privately to a PaaS service but disables TLS certificate validation because the service now has a private IP. Which response best addresses these needs?
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; apply least-privilege service authorization and identity controls in addition to the private network connection; and Continue using the service's valid hostname and certificate validation over the private endpoint connection.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; apply least-privilege service authorization and identity controls in addition to the private network connection; and validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance.
- Check private endpoint network policies and supported NSG behavior for the target subnet before asserting enforcement; validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance; and Continue using the service's valid hostname and certificate validation over the private endpoint connection.
- Validate the supported private endpoint routing policy, prefix specificity, and effective path through the intended appliance; apply least-privilege service authorization and identity controls in addition to the private network connection; and Continue using the service's valid hostname and certificate validation over the private endpoint connection.
Explanation
Correct Answer
A:Private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation. Private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself. A private IP does not make encrypted transport or endpoint identity verification unnecessary. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 3 misses this need: a private IP does not make encrypted transport or endpoint identity verification unnecessary.
C:Two actions meet their requirements, but action 2 misses this need: private connectivity protects the transport path but does not grant or restrict data-plane permissions by itself.
D:Two actions meet their requirements, but action 1 misses this need: private endpoint subnet policy behavior can differ from ordinary VM NIC behavior and needs explicit validation.
Question 583
An application gateway deployment fails because the team put backend VMs and its gateway instances in the same subnet. A new Azure Bastion host cannot deploy because the security team reused a general server subnet for the service. A network engineer associates a public IP directly with an unsupported private platform resource, hoping to make its internal endpoint public. What is the most appropriate plan for this situation?
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets; Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; and select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets; create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; and Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility.
- Allocate a suitable private endpoint address within an appropriate VNet subnet and check network policy compatibility; create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; and select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
- Place Application Gateway in a supported dedicated subnet and keep application backend resources in their own subnets; create the required AzureBastionSubnet with a supported address size before deploying Azure Bastion; and select a supported public ingress service or public IP association target instead of inventing direct attachment capability.
Explanation
Correct Answer
D:Application Gateway has subnet placement requirements that are distinct from the workloads it proxies. Azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites. Public IP associations are constrained by supported Azure resource types and network architectures. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: azure Bastion requires its designated subnet; a network security rule alone cannot replace service prerequisites.
B:Two actions meet their requirements, but action 3 misses this need: public IP associations are constrained by supported Azure resource types and network architectures.
C:Two actions meet their requirements, but action 1 misses this need: application Gateway has subnet placement requirements that are distinct from the workloads it proxies.
Question 584
A Front Door endpoint uses a custom apex domain but DNS validation has not completed and HTTPS certificates cannot be activated. What should the Azure network engineer do?
- Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
- Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
Explanation
Correct Answer
B:Custom hostname registration and TLS activation depend on authoritative DNS ownership verification.
Incorrect Answers
A:For this question, custom hostname registration and TLS activation depend on authoritative DNS ownership verification.
C:Here, custom hostname registration and TLS activation depend on authoritative DNS ownership verification.
D:For this finding, custom hostname registration and TLS activation depend on authoritative DNS ownership verification.
Question 585
An Application Gateway backend shows unhealthy because its probe requests / and receives 404 even though /health returns 200. What should the Azure network engineer do?
- Use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Configure multi-site listener hostnames and appropriate routing rules with the required certificates.
- Create a custom health probe for the correct host and health path and review backend HTTP settings.
Explanation
Correct Answer
D:A default probe can misclassify a functioning application when its expected hostname or path differs.
Incorrect Answers
A:Using Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings would not create a custom health probe for the correct host and health path and review backend HTTP settings.
B:Evaluating autoscaling Application Gateway capacity with monitored minimums and service limits would not create a custom health probe for the correct host and health path and review backend HTTP settings.
C:Here, a default probe can misclassify a functioning application when its expected hostname or path differs.
Question 586
A regional outage affects multiple network resources, but monitoring checks only one VM's CPU graph. An internet-facing app is targeted by a volumetric attack, and the team mistakes a simple NSG deny rule for a full DDoS mitigation plan. Defender for Cloud flags an exposed management port and an engineer ignores the attack-path context because the vulnerability scan is clean. What is the most appropriate plan for this situation?
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; and review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; and plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
- Use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; and review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; and review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
Explanation
Correct Answer
C:Network observability requires path and service signals beyond guest VM compute utilization. NSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services. Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: nSG packet filtering alone does not provide the adaptive volumetric attack protections of DDoS services.
B:Two actions meet their requirements, but action 3 misses this need: attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
D:Two actions meet their requirements, but action 1 misses this need: network observability requires path and service signals beyond guest VM compute utilization.
Question 587
A team configures a Load Balancer rule for HTTPS traffic but assumes it can inspect URL paths and select different backends for /api. Which course of action addresses the stated issues?
- Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements; use an appropriate Azure Load Balancer frontend, backend pool, health probe, and transport-level rule.
- Deploy an internal Azure Load Balancer with a private frontend IP and approved backend subnet routing; use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
- Use an application-layer gateway or reverse proxy when routing requires HTTP path inspection; do not evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements.
- Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements; use an application-layer gateway or reverse proxy when routing requires HTTP path inspection.
Explanation
Correct Answer
D:Cross-region load balancing uses a global entry point across eligible regional deployments rather than a private regional listener. Layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions. Both actions are needed.
Incorrect Answers
A:Layer-4 load balancing does not interpret HTTP routes or headers to make application-specific decisions.
B:Cross-region load balancing uses a global entry point across eligible regional deployments rather than a private regional listener.
C:This plan leaves out a required action: Evaluate cross-region Azure Load Balancer with supported regional load balancers and global frontend requirements. The remaining action alone does not satisfy the situation.
Question 588
A resource team deletes a storage private endpoint but assumes all linked private DNS records and stale application caches disappear immediately. An engineering design must provide private access to a partner-managed service without joining the partner's full VNet or exposing all its subnets. Which response best addresses these needs?
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration; use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Approve the endpoint request through the service provider's supported connection workflow and confirm the connection state; use an approved Private Link service and consumer private endpoint rather than broad VNet peering.
- Use an approved Private Link service and consumer private endpoint rather than broad VNet peering; do not review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration.
- Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration; create and manage private endpoints for the intended consumers with corresponding DNS zone links and approvals.
Explanation
Correct Answer
A:Resource deletion and DNS/cache cleanup are distinct lifecycle steps that can affect clients after teardown. Private Link can expose a designated service across ownership boundaries without providing general network transit. Both actions are needed.
Incorrect Answers
B:Resource deletion and DNS/cache cleanup are distinct lifecycle steps that can affect clients after teardown.
C:This plan leaves out a required action: Review zone group lifecycle, remove stale records if needed, and validate resolver cache expiration. The remaining action alone does not satisfy the situation.
D:Private Link can expose a designated service across ownership boundaries without providing general network transit.
Question 589
A false-positive rule excludes all request bodies to fix one JSON property, creating a large inspection gap. Which response best addresses this Azure networking scenario?
- After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
- Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
Explanation
Correct Answer
D:Broad exemptions can silently remove inspection coverage for unrelated malicious payloads.
Incorrect Answers
A:For this question, broad exemptions can silently remove inspection coverage for unrelated malicious payloads.
B:For this finding, broad exemptions can silently remove inspection coverage for unrelated malicious payloads.
C:Validating policy associations and the exact domains or endpoints protected in each relevant Front Door profile would not meet the need for the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
Question 590
A VPN tunnel reports disconnected immediately after certificate or shared-key rotation, while route tables are unchanged. An architect tries to configure BGP settings on a gateway deployment that does not support the intended protocol combination. Which course of action addresses the stated issues?
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; do not check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
Explanation
Correct Answer
D:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic. Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone. Both actions are needed.
Incorrect Answers
A:Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.
B:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
C:This plan leaves out a required action: Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs. The remaining action alone does not satisfy the situation.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests