Question 600
A globally distributed web service wants endpoint failover by changing the DNS answer based on health, not by proxying every HTTP request. What should the Azure network engineer do?
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.
- Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
Explanation
Correct Answer
B:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
Incorrect Answers
A:For this finding, traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
C:For this question, traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
D:Here, traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
Question 601
A site requires an edge rule that redirects HTTP to HTTPS and rewrites selected URL prefixes without application code changes. A CDN-enabled app serves outdated pricing pages for hours after prices change in the origin database. What is the most appropriate plan for this situation?
- Configure Front Door rules sets and route options to apply the approved redirects and URL rewrites; deploy an appropriate Azure Front Door profile with routes, origin groups, endpoints, and health probes.
- Configure Front Door origin groups and routes with appropriate priority and latency-based traffic distribution; adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses.
- Adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses; do not configure Front Door rules sets and route options to apply the approved redirects and URL rewrites.
- Configure Front Door rules sets and route options to apply the approved redirects and URL rewrites; adjust Front Door caching behavior and implement a controlled purge or cache-bypass path for freshness-sensitive responses.
Explanation
Correct Answer
D:Front Door can apply supported request-routing transformations at the global entry point. Edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data. Both actions are needed.
Incorrect Answers
A:Edge caching improves latency but requires invalidation and cache-control policies to avoid serving stale dynamic data.
B:Front Door can apply supported request-routing transformations at the global entry point.
C:This plan leaves out a required action: Configure Front Door rules sets and route options to apply the approved redirects and URL rewrites. The remaining action alone does not satisfy the situation.
Question 602
An operations team treats a service tag as a permanent list of Azure public CIDRs and manually pins stale values in every NSG. A peered VNet retains a default address range that duplicates an on-premises production prefix, and routing fails after VPN connection. Which course of action addresses the stated issues?
- Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists; check supported global or cross-region load-balancing constructs and separate regional address identities where required.
- Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology; do not use supported service tags where appropriate and review service scope instead of freezing changing platform address lists.
- Investigate subnet IP assignments and available CIDR capacity independently from DNS resolver configuration; Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology.
- Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists; Resolve the address overlap before deploying peering and hybrid route advertisements into the same connectivity topology.
Explanation
Correct Answer
D:Service tags abstract approved platform prefixes and reduce configuration drift from evolving Azure address ranges. Overlapping advertised prefixes undermine deterministic routing regardless of gateway health. Both actions are needed.
Incorrect Answers
A:Overlapping advertised prefixes undermine deterministic routing regardless of gateway health.
B:This plan leaves out a required action: Use supported service tags where appropriate and review service scope instead of freezing changing platform address lists. The remaining action alone does not satisfy the situation.
C:Service tags abstract approved platform prefixes and reduce configuration drift from evolving Azure address ranges.
Question 603
Two enterprise datacenters need private connectivity to each other through Microsoft's backbone, not just reach Azure resources. What should the Azure network engineer do?
- Evaluate ExpressRoute FastPath prerequisites and verify which traffic paths the selected gateway and routes support.
- Add diverse eligible circuits and routing failover options across independent connectivity locations.
- Evaluate ExpressRoute Global Reach between eligible circuits and validate location and provider support.
- Evaluate ExpressRoute Direct with supported locations, port capacity, and operational requirements.
Explanation
Correct Answer
C:Global Reach joins supported on-premises sites through ExpressRoute circuits subject to geographic and SKU constraints.
Incorrect Answers
A:For this finding, global Reach joins supported on-premises sites through ExpressRoute circuits subject to geographic and SKU constraints.
B:For this question, global Reach joins supported on-premises sites through ExpressRoute circuits subject to geographic and SKU constraints.
D:Here, global Reach joins supported on-premises sites through ExpressRoute circuits subject to geographic and SKU constraints.
Question 604
During an Azure networking rollout, the team must resolve both of these conditions. An operator tries to place an Azure VPN gateway in an ordinary shared application subnet named AppServers. A containerized service requires a subnet dedicated to a specific Azure platform integration, but deployment reports that delegation is missing. What is the most appropriate plan for this situation?
- Provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet; Redesign the Azure address plan using nonoverlapping prefixes and coordinate any required network translation before connecting the environments.
- Configure the service's supported subnet delegation and check whether other intended resources can share that subnet; do not provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet.
- Expand or redesign the VNet address space and reserve appropriately sized nonoverlapping subnets before deploying new services; configure the service's supported subnet delegation and check whether other intended resources can share that subnet.
- Provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet; configure the service's supported subnet delegation and check whether other intended resources can share that subnet.
Explanation
Correct Answer
D:Azure virtual network gateways rely on the specially named GatewaySubnet, not an arbitrary application segment. A delegated subnet grants a compatible platform service authority over subnet operations and may limit colocated services. Both actions are needed.
Incorrect Answers
A:A delegated subnet grants a compatible platform service authority over subnet operations and may limit colocated services.
B:This plan leaves out a required action: Provision a dedicated GatewaySubnet with the required size and attach the virtual network gateway to that supported subnet. The remaining action alone does not satisfy the situation.
C:Azure virtual network gateways rely on the specially named GatewaySubnet, not an arbitrary application segment.
Question 605
During an Azure networking rollout, the team must resolve both of these conditions. A single Application Gateway must handle dozens of customer hostnames and choose the right TLS certificate for each one. A backend pool is configured for HTTP/2-only application traffic while the gateway's supported backend mode differs from the client-side protocol expectation. Which course of action addresses the stated issues?
- Use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname; configure supported cookie-based affinity where suitable and redesign session state for failover resilience.
- Use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname; verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration.
- Validate Application Gateway subnet and routing restrictions and repair the effective required control-plane and backend paths; verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration.
- Verify the supported Application Gateway frontend and backend protocol capabilities and match the origin application configuration; do not use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname.
Explanation
Correct Answer
B:Hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate. A gateway's client-facing protocol does not automatically imply identical protocol negotiation toward the backend. Both actions are needed.
Incorrect Answers
A:A gateway's client-facing protocol does not automatically imply identical protocol negotiation toward the backend.
C:Hostname-aware HTTPS binding permits multiple domains on shared frontend infrastructure without substituting one invalid certificate.
D:This plan leaves out a required action: Use supported multi-site HTTPS listeners and server name indication with valid certificates for each authorized hostname. The remaining action alone does not satisfy the situation.
Question 606
An engineer creates two path rules but one broad basic rule captures every request, making the intended /admin routing ineffective. Which response best addresses this Azure networking scenario?
- Configure a supported Application Gateway rewrite rule set and verify the forwarded request headers.
- Review listener and rule priorities and verify path-match precedence before committing the correction.
- Correct backend hostname and trusted certificate settings and retest the Application Gateway health probe.
- Configure HTTPS backend settings with appropriate certificate trust and end-to-end TLS validation.
Explanation
Correct Answer
B:Request routing priority determines which rule is evaluated when multiple definitions could match.
Incorrect Answers
A:For this finding, request routing priority determines which rule is evaluated when multiple definitions could match.
C:Here, request routing priority determines which rule is evaluated when multiple definitions could match.
D:For this question, request routing priority determines which rule is evaluated when multiple definitions could match.
Question 607
An ExpressRoute circuit is provisioned but a spoke VNet still has no on-premises reachability because no gateway connection exists. An engineer configures Microsoft peering when the requirement is to reach VM private IPs in Azure VNets. What is the most appropriate plan for this situation?
- Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit; design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration.
- Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit; configure Azure private peering and the applicable VNet gateway or direct connectivity model.
- Configure Azure private peering and the applicable VNet gateway or direct connectivity model; do not create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit.
- Align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration; configure Azure private peering and the applicable VNet gateway or direct connectivity model.
Explanation
Correct Answer
B:Provisioning the circuit itself does not automatically connect a VNet's routing domain to the private peering. Microsoft peering is not a substitute for Azure private peering to VNet private address space. Both actions are needed.
Incorrect Answers
A:Microsoft peering is not a substitute for Azure private peering to VNet private address space.
C:This plan leaves out a required action: Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit. The remaining action alone does not satisfy the situation.
D:Provisioning the circuit itself does not automatically connect a VNet's routing domain to the private peering.
Question 608
A team requires advanced threat protection, URL filtering and supported TLS inspection but selects Azure Firewall Basic for the production design. Which action best addresses this finding?
- Update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall.
- Deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.
- Select an appropriate Azure Firewall Premium tier after validating required advanced security features.
- Use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities.
Explanation
Correct Answer
C:Azure Firewall SKUs differ in supported advanced inspection and security capabilities.
Incorrect Answers
A:Updating and associate approved route tables or secured hub routing intent and confirming packets traverse the firewall would not meet the need for an appropriate Azure Firewall Premium tier after validating required advanced security features.
B:For this finding, azure Firewall SKUs differ in supported advanced inspection and security capabilities.
D:Using Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities would not meet the need for an appropriate Azure Firewall Premium tier after validating required advanced security features.
Question 609
A VM database subnet must accept TCP 1433 only from the approved application subnet, but an NSG rule allows every source prefix. A security engineer attaches a restrictive NSG to a VM NIC but forgets an additional subnet NSG is also applied and traffic remains blocked. Which response best addresses these needs?
- Check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies; do not create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority.
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation.
- Use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules; check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies.
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies.
Explanation
Correct Answer
D:NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted. Subnet and NIC security rules can both affect traffic; one permissive policy does not override a deny elsewhere. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority. The remaining action alone does not satisfy the situation.
B:Subnet and NIC security rules can both affect traffic; one permissive policy does not override a deny elsewhere.
C:NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.
Question 610
After a backend maintenance window, Application Gateway still sends new traffic to one stale instance because the pool membership was not updated. A backend API needs a nonstandard HTTP port and the gateway reports connection failures though client port 443 is healthy. An application routes by hostname but uses a generic probe that targets the wrong virtual host and marks every endpoint down. What is the most appropriate plan for this situation?
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
Explanation
Correct Answer
C:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state. Frontend and backend ports are independent settings in an application-layer proxy. HTTP virtual hosting can return different health responses depending on the Host header sent by the probe. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: frontend and backend ports are independent settings in an application-layer proxy.
B:Two actions meet their requirements, but action 1 misses this need: traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
D:Two actions meet their requirements, but action 3 misses this need: hTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests