Question 610
After a backend maintenance window, Application Gateway still sends new traffic to one stale instance because the pool membership was not updated. A backend API needs a nonstandard HTTP port and the gateway reports connection failures though client port 443 is healthy. An application routes by hostname but uses a generic probe that targets the wrong virtual host and marks every endpoint down. What is the most appropriate plan for this situation?
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; and use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
Explanation
Correct Answer
C:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state. Frontend and backend ports are independent settings in an application-layer proxy. HTTP virtual hosting can return different health responses depending on the Host header sent by the probe. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 2 misses this need: frontend and backend ports are independent settings in an application-layer proxy.
B:Two actions meet their requirements, but action 1 misses this need: traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
D:Two actions meet their requirements, but action 3 misses this need: hTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
Question 611
An on-premises route learned over BGP overlaps a narrow spoke UDR, and the team cannot explain the chosen next hop. Which response best addresses this Azure networking scenario?
- Add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
- Review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions.
- Compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination.
- Review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently.
Explanation
Correct Answer
C:Route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR.
Incorrect Answers
A:For this question, route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR.
B:For this finding, route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR.
D:Here, route decisions depend on both prefix specificity and precedence; a default BGP path need not win against a more specific UDR.
Question 612
During an Azure networking rollout, the team must resolve both of these conditions. A VM scale set needs predictable outbound source addresses without accepting internet-initiated inbound connections. A team associates NAT Gateway with a subnet but continues to use an explicitly configured public load balancer outbound rule for the same VMs without checking precedence. Which response best addresses these needs?
- Review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments; do not Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior.
- Use appropriate private routing or an NVA translation design because NAT Gateway is intended for outbound internet connectivity; review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments.
- Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior; review the documented outbound connectivity precedence and effective SNAT path for the actual subnet attachments.
- Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior; inspect SNAT port consumption and design appropriate NAT Gateway capacity and connection reuse for the outbound workload.
Explanation
Correct Answer
C:NAT Gateway supplies scalable subnet outbound connectivity without serving as an inbound application listener. Multiple outbound mechanisms require precedence validation rather than assuming traffic always selects the newest configuration. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Attach Azure NAT Gateway with approved public IP resources to the workload subnet and validate outbound SNAT behavior. The remaining action alone does not satisfy the situation.
B:NAT Gateway supplies scalable subnet outbound connectivity without serving as an inbound application listener.
D:Multiple outbound mechanisms require precedence validation rather than assuming traffic always selects the newest configuration.
Question 613
During an Azure networking rollout, the team must resolve both of these conditions. A new WAF policy produces false positives against legitimate JSON API requests and the team wants to disable all managed protections. A web application needs global edge enforcement for geographically distributed users, but the team builds a WAF policy only on one regional internal Application Gateway. What is the most appropriate plan for this situation?
- Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs; apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic.
- Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention; deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling.
- Apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic; do not Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention.
- Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention; apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic.
Explanation
Correct Answer
D:Measured exclusions protect legitimate requests while retaining broad application threat inspection. Front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service. Both actions are needed.
Incorrect Answers
A:Measured exclusions protect legitimate requests while retaining broad application threat inspection.
B:Front Door WAF inspects eligible requests at global ingress, while Application Gateway is a regional web delivery service.
C:This plan leaves out a required action: Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention. The remaining action alone does not satisfy the situation.
Question 614
A company needs FQDN-aware outbound web application controls from a hub to selected sanctioned destinations. A service hosted behind a firewall must be published to the internet through one approved public IP and translated to a private host. Which course of action addresses the stated issues?
- Use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities; configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
- Configure Azure Firewall application rules for supported web protocols and destination domains; configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
- Configure an Azure Firewall DNAT rule and corresponding backend routing and security controls; do not configure Azure Firewall application rules for supported web protocols and destination domains.
- Configure Azure Firewall application rules for supported web protocols and destination domains; deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address.
Explanation
Correct Answer
B:Application rules support eligible FQDN-based filtering distinct from IP-and-port network rule matching. Destination network address translation publishes an approved private target rather than creating generalized inbound permission. Both actions are needed.
Incorrect Answers
A:Application rules support eligible FQDN-based filtering distinct from IP-and-port network rule matching.
C:This plan leaves out a required action: Configure Azure Firewall application rules for supported web protocols and destination domains. The remaining action alone does not satisfy the situation.
D:Destination network address translation publishes an approved private target rather than creating generalized inbound permission.
Question 615
A VPN client reports intermittent authentication errors during a certificate authority migration but subnet routes are valid. A support engineer uses Azure Network Adapter as an assumed universally supported feature on every legacy Windows Server build. Which response best addresses these needs?
- Inspect certificate trust chains and authentication logs on both client and gateway before altering network routes; review Always On VPN client, authentication, and gateway prerequisites and map only supported Azure roles.
- Check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path; do not inspect certificate trust chains and authentication logs on both client and gateway before altering network routes.
- Provide supported custom DNS server or private resolution configuration through the client and gateway architecture; check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path.
- Inspect certificate trust chains and authentication logs on both client and gateway before altering network routes; check supported Azure Network Adapter OS and management prerequisites before recommending that onboarding path.
Explanation
Correct Answer
D:Identity trust problems manifest before application traffic and cannot be fixed by a broader allow rule. Convenience management features have specific host and Azure prerequisites rather than universal availability. Both actions are needed.
Incorrect Answers
A:Convenience management features have specific host and Azure prerequisites rather than universal availability.
B:This plan leaves out a required action: Inspect certificate trust chains and authentication logs on both client and gateway before altering network routes. The remaining action alone does not satisfy the situation.
C:Identity trust problems manifest before application traffic and cannot be fixed by a broader allow rule.
Question 616
A Front Door profile has healthy origins but sends users to an unexpected region because origin priorities and weights are inconsistent. A subscription owner assumes every Front Door tier includes Private Link origins and WAF features at identical price and functionality. What is the most appropriate plan for this situation?
- Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door; select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
- Inspect origin group routing, priority, weight, and health settings and test representative client regions; select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
- Inspect origin group routing, priority, weight, and health settings and test representative client regions; evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing.
- Select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs; do not inspect origin group routing, priority, weight, and health settings and test representative client regions.
Explanation
Correct Answer
B:Origin selection is determined by configured routing and health criteria rather than geographic proximity alone. Front Door feature availability and origin security options vary by tier and must be checked explicitly. Both actions are needed.
Incorrect Answers
A:Origin selection is determined by configured routing and health criteria rather than geographic proximity alone.
C:Front Door feature availability and origin security options vary by tier and must be checked explicitly.
D:This plan leaves out a required action: Inspect origin group routing, priority, weight, and health settings and test representative client regions. The remaining action alone does not satisfy the situation.
Question 617
During an Azure networking rollout, the team must resolve both of these conditions. Two VM workloads must resolve internal app.contoso.internal consistently across multiple Azure VNets without publishing the record on the internet. A development VNet needs automatic registration of VM hostnames in a private DNS zone, not merely read-only lookup. Which course of action addresses the stated issues?
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings; Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings; enable supported auto-registration on the designated VNet link and verify which resource types produce records.
- Enable supported auto-registration on the designated VNet link and verify which resource types produce records; do not create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings.
- Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider; enable supported auto-registration on the designated VNet link and verify which resource types produce records.
Explanation
Correct Answer
B:Private DNS zone links enable scoped VNet resolution without relying on publicly advertised DNS records. Resolution-only private zone links do not automatically register VM records; registration has link and resource limitations. Both actions are needed.
Incorrect Answers
A:Resolution-only private zone links do not automatically register VM records; registration has link and resource limitations.
C:This plan leaves out a required action: Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings. The remaining action alone does not satisfy the situation.
D:Private DNS zone links enable scoped VNet resolution without relying on publicly advertised DNS records.
Question 618
A storage account should accept requests from two authorized Azure subnets while continuing to use its normal public service name. An architect adds a service endpoint and expects it to create a private NIC inside the subnet with an RFC1918 IP. A subnet reaches a supported service endpoint, but the service firewall denies requests because the VNet subnet was never allowed. Which response best addresses these needs?
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules; choose a private endpoint when the requirement is a private IP on the consumer VNet; and add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules; choose a private endpoint when the requirement is a private IP on the consumer VNet; and use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules; use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP; and add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP; choose a private endpoint when the requirement is a private IP on the consumer VNet; and add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
Explanation
Correct Answer
A:Service endpoints secure supported service access by source subnet while the service retains its public endpoint model. Service endpoints do not allocate a private endpoint interface; the service endpoint and Private Link models differ. Subnet endpoint activation alone does not grant the service permission to accept the subnet's requests. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 3 misses this need: subnet endpoint activation alone does not grant the service permission to accept the subnet's requests.
C:Two actions meet their requirements, but action 2 misses this need: service endpoints do not allocate a private endpoint interface; the service endpoint and Private Link models differ.
D:Two actions meet their requirements, but action 1 misses this need: service endpoints secure supported service access by source subnet while the service retains its public endpoint model.
Question 619
An architect tries to expose a self-hosted application through Azure Private Endpoint without creating any supported Private Link target service. A provider wants to control which partner subscriptions may create private endpoints to its internal service. A private-link provider changes its backend pool, then assumes all client endpoint connections must be recreated. What is the most appropriate plan for this situation?
- Publish the service through an eligible Private Link service or supported Azure service target first; configure Private Link service visibility and connection approval permissions before accepting consumer requests; and create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals.
- Publish the service through an eligible Private Link service or supported Azure service target first; configure Private Link service visibility and connection approval permissions before accepting consumer requests; and Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals; configure Private Link service visibility and connection approval permissions before accepting consumer requests; and Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Publish the service through an eligible Private Link service or supported Azure service target first; create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals; and Maintain the supported Private Link service frontend while updating backend health and routing as needed.
Explanation
Correct Answer
B:Private endpoints consume a published private connection; they do not automatically publish arbitrary VM ports. Private Link service admission governs permitted consumers separately from network reachability to its load balancer. Consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: consumer private endpoint connections target the published service, allowing controlled backend changes behind its stable contract.
C:Two actions meet their requirements, but action 1 misses this need: private endpoints consume a published private connection; they do not automatically publish arbitrary VM ports.
D:Two actions meet their requirements, but action 2 misses this need: private Link service admission governs permitted consumers separately from network reachability to its load balancer.
Question 620
A company deploys dozens of public ingress endpoints and wants contiguous provider-owned addresses that simplify upstream firewall allowlists. A web application must maintain one stable inbound IP through a VM restart, but it currently receives a dynamic public address. Which course of action addresses the stated issues?
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
- Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix; evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
- Create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints; create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
- Create a suitable static Standard public IP and associate it with the supported load balancer or network interface; do not Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix.
Explanation
Correct Answer
A:An Azure public IP prefix provides a predictable block for related public addresses without requiring independent random allocations. A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address. Both actions are needed.
Incorrect Answers
B:A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address.
C:An Azure public IP prefix provides a predictable block for related public addresses without requiring independent random allocations.
D:This plan leaves out a required action: Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix. The remaining action alone does not satisfy the situation.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests