Question 590
A VPN tunnel reports disconnected immediately after certificate or shared-key rotation, while route tables are unchanged. An architect tries to configure BGP settings on a gateway deployment that does not support the intended protocol combination. Which course of action addresses the stated issues?
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange; do not check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs; verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
Explanation
Correct Answer
D:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic. Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone. Both actions are needed.
Incorrect Answers
A:Dynamic route capability is tied to supported gateway configurations and cannot be assumed from connectivity alone.
B:Authentication and cryptographic negotiation occur before any protected application routes can carry traffic.
C:This plan leaves out a required action: Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs. The remaining action alone does not satisfy the situation.
Question 591
An enterprise requires branch-to-branch transit through a new WAN service but selects a Basic Virtual WAN configuration without reviewing capabilities. A global network needs geographically distributed WAN hubs, but the plan places all branches behind one distant hub irrespective of latency and availability. Which response best addresses these needs?
- Select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design; do not choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities.
- Create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites; select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
- Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
- Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing.
Explanation
Correct Answer
C:Basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services. Hub placement affects branch latency and region failure exposure even when a global WAN resource exists. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities. The remaining action alone does not satisfy the situation.
B:Basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services.
D:Hub placement affects branch latency and region failure exposure even when a global WAN resource exists.
Question 592
A team needs VNet-origin restrictions for a supported Azure service but does not need private IP allocation or per-endpoint approvals. A service endpoint configuration works within one VNet but a newly migrated workload on-premises cannot use the same policy-based source identity. What is the most appropriate plan for this situation?
- Use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity; do not use service endpoints and service-side virtual network rules after validating compatibility.
- Test actual FQDN answers and effective routes, then select the intended access method explicitly; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity.
- Use service endpoints and service-side virtual network rules after validating compatibility; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity.
- Use service endpoints and service-side virtual network rules after validating compatibility; use a private endpoint with service-supported public network restrictions and the matching private DNS integration.
Explanation
Correct Answer
C:Service endpoints can be simpler when subnet identity is sufficient and the public service endpoint model is acceptable. On-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Use service endpoints and service-side virtual network rules after validating compatibility. The remaining action alone does not satisfy the situation.
B:Service endpoints can be simpler when subnet identity is sufficient and the public service endpoint model is acceptable.
D:On-premises packets do not automatically inherit service endpoint subnet identity through a VPN tunnel.
Question 593
During an Azure networking rollout, the team must resolve both of these conditions. A company wants subnets to access only a subset of approved storage accounts rather than every account that could accept service endpoint traffic. A security auditor asks whether a storage request originated in an approved subnet, but the team validates only the caller's account key. Which course of action addresses the stated issues?
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility; check which Azure services support service endpoint policies and use alternative enforcement where unsupported.
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility; review storage network rules and service endpoint source identity alongside application-layer credentials.
- Review storage network rules and service endpoint source identity alongside application-layer credentials; do not apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility.
- Retain appropriate NSG and routing controls because service endpoints do not replace general outbound network security; review storage network rules and service endpoint source identity alongside application-layer credentials.
Explanation
Correct Answer
B:Service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported. Authorization to storage data and network-origin restrictions are independent access-control layers. Both actions are needed.
Incorrect Answers
A:Authorization to storage data and network-origin restrictions are independent access-control layers.
C:This plan leaves out a required action: Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility. The remaining action alone does not satisfy the situation.
D:Service endpoint policies can further constrain eligible service destinations beyond subnet identity where supported.
Question 594
A web app on-premises receives a public address for vault.privatelink.vaultcore.azure.net even though Azure workloads resolve it privately. Which response best addresses this Azure networking scenario?
- Create separate private endpoints and matching private DNS records for each required supported storage subresource.
- Update the zone group or private DNS record so the resource hostname resolves to the active endpoint IP.
- Use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP.
- Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links.
Explanation
Correct Answer
D:Private endpoint name resolution must reach the Azure private zone from the on-premises resolver path.
Incorrect Answers
A:Here, private endpoint name resolution must reach the Azure private zone from the on-premises resolver path.
B:For this finding, private endpoint name resolution must reach the Azure private zone from the on-premises resolver path.
C:For this question, private endpoint name resolution must reach the Azure private zone from the on-premises resolver path.
Question 595
Azure workloads must resolve a private corporate domain hosted on on-premises DNS without changing every VM's resolver configuration. A resolver forwarding ruleset exists, but queries from an application VNet still go to default public resolution for the corporate domain. What is the most appropriate plan for this situation?
- Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet; deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders.
- Link the DNS forwarding ruleset to the intended client VNet and verify suffix matching and target reachability; do not configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet.
- Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet; Link the DNS forwarding ruleset to the intended client VNet and verify suffix matching and target reachability.
- Create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules; Link the DNS forwarding ruleset to the intended client VNet and verify suffix matching and target reachability.
Explanation
Correct Answer
C:Outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers. Forwarding behavior depends on ruleset links and matching rules, not merely creation of an outbound endpoint. Both actions are needed.
Incorrect Answers
A:Forwarding behavior depends on ruleset links and matching rules, not merely creation of an outbound endpoint.
B:This plan leaves out a required action: Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet. The remaining action alone does not satisfy the situation.
D:Outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers.
Question 596
A network administrator sees a connection-timeout alert but wants to know which traffic actually matched an NSG deny in the preceding hour. A VM communicates to a service through a private endpoint but a Network Watcher next-hop result points to an unexpected network virtual appliance. A DDoS investigation sees no L7 HTTP request details despite having network DDoS telemetry enabled. Which course of action addresses the stated issues?
- Examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns; use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets; and use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
- Use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets; inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; and use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
- Examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns; inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; and use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
- Examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns; inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; and use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets.
Explanation
Correct Answer
C:Historical flow evidence can reveal repeated blocked traffic, while a one-time configuration check is not a time-series record. A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions. Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: a next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions.
B:Two actions meet their requirements, but action 1 misses this need: historical flow evidence can reveal repeated blocked traffic, while a one-time configuration check is not a time-series record.
D:Two actions meet their requirements, but action 3 misses this need: network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures.
Question 597
A hub already uses a large address prefix and an architect adds an overlapping prefix to the same VNet for a new department. A future private endpoint deployment needs addresses kept available, but the last free subnet is being filled with ephemeral test VMs. Which response best addresses these needs?
- Choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity; Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs.
- Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
- Choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity; Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
- Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands; do not choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity.
Explanation
Correct Answer
C:Address ranges within the network design must avoid overlap so that effective routes remain unambiguous. Shared capacity without reservation can block security-sensitive service connectivity when the subnet becomes exhausted. Both actions are needed.
Incorrect Answers
A:Shared capacity without reservation can block security-sensitive service connectivity when the subnet becomes exhausted.
B:Address ranges within the network design must avoid overlap so that effective routes remain unambiguous.
D:This plan leaves out a required action: Choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity. The remaining action alone does not satisfy the situation.
Question 598
An engineer uses Virtual Network Manager to push an overly broad security admin rule that overrides carefully scoped workload NSG denies. Which action best addresses this finding?
- Keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange.
- Evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design.
- Apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope.
- Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups.
Explanation
Correct Answer
D:Central administrative security rules have distinct precedence behavior and broad scope that must be validated.
Incorrect Answers
A:Azure Route Server exchanges route information; it is not itself a traffic-inspection appliance. Central administrative security rules have distinct precedence behavior and broad scope that must be validated.
B:Route Server can exchange dynamic routes with eligible NVAs and gateways instead of maintaining each learned prefix manually. Central administrative security rules have distinct precedence behavior and broad scope that must be validated.
C:Central network grouping can standardize supported connectivity patterns instead of relying on separate manual peer edits. Central administrative security rules have distinct precedence behavior and broad scope that must be validated.
Question 599
An administrator creates an NSG but never associates it with the intended subnet or NIC and claims the workload is isolated. An ASG rule fails to apply to a target VM because its network interface was never made a member of the designated group. A security team must protect subnet traffic while retaining an approved central segmentation policy distributed to many VNets. Which course of action addresses the stated issues?
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; assign the appropriate VM network interface to the ASG and check effective security rules; and use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; assign the appropriate VM network interface to the ASG and check effective security rules; and Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive.
- Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; assign the appropriate VM network interface to the ASG and check effective security rules; and use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; and use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
Explanation
Correct Answer
A:Unassociated NSG resources cannot evaluate or filter the intended traffic. An ASG reference matches configured membership and cannot infer application tier from resource names. Central policy can standardize segmentation, but group scope and precedence must be deliberately tested. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 3 misses this need: central policy can standardize segmentation, but group scope and precedence must be deliberately tested.
C:Two actions meet their requirements, but action 1 misses this need: unassociated NSG resources cannot evaluate or filter the intended traffic.
D:Two actions meet their requirements, but action 2 misses this need: an ASG reference matches configured membership and cannot infer application tier from resource names.
Question 600
A globally distributed web service wants endpoint failover by changing the DNS answer based on health, not by proxying every HTTP request. What should the Azure network engineer do?
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
Explanation
Correct Answer
B:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
Incorrect Answers
A:For this finding, traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
C:For this question, traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
D:Here, traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests