Question 650
A dual-tunnel deployment sends traffic to Azure but replies prefer one failed peer because on-premises routing did not converge. What should the Azure network engineer do?
- Check peer credentials and IKE negotiation diagnostics before modifying unrelated subnet UDRs.
- Verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
- Verify the gateway SKU, VPN type, and BGP compatibility before enabling route exchange.
- Compare measured throughput and tunnel use with gateway SKU limits and scale to a supported capacity tier.
Explanation
Correct Answer
B:Resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure.
Incorrect Answers
A:For this question, resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure.
C:Verifying the gateway SKU, VPN type, and BGP compatibility would not verify BGP advertisements, health, and route selection for both active paths across the VPN peers.
D:Here, resilient tunnel provisioning also requires correctly converging bidirectional routes after a failure.
Question 651
During an Azure networking rollout, the team must resolve both of these conditions. A multinational firm operates hundreds of branch VPN sites and wants centrally managed cloud transit rather than dozens of individually peered hub VNets. A global network needs geographically distributed WAN hubs, but the plan places all branches behind one distant hub irrespective of latency and availability. Which response best addresses these needs?
- Create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites; select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design.
- Select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design; do not design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing.
Explanation
Correct Answer
C:Virtual WAN centralizes supported branch and VNet transit in managed hubs rather than scaling manual peering meshes. Hub placement affects branch latency and region failure exposure even when a global WAN resource exists. Both actions are needed.
Incorrect Answers
A:Virtual WAN centralizes supported branch and VNet transit in managed hubs rather than scaling manual peering meshes.
B:Hub placement affects branch latency and region failure exposure even when a global WAN resource exists.
D:This plan leaves out a required action: Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing. The remaining action alone does not satisfy the situation.
Question 652
An administrator mixes a private endpoint and a service endpoint on the same subnet and assumes DNS selection is irrelevant to which path a client uses. Which action best addresses this finding?
- Use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity.
- Test actual FQDN answers and effective routes, then select the intended access method explicitly.
- Use service endpoints and service-side virtual network rules after validating compatibility.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration.
Explanation
Correct Answer
B:DNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference.
Incorrect Answers
A:For this finding, dNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference.
C:Here, DNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference.
D:For this question, DNS and routing determine the practical connection path; merely enabling both endpoint models does not enforce preference.
Question 653
An administrator attaches a service endpoint policy for an unsupported Azure service type and assumes it will restrict all Azure platform egress. What should the Azure network engineer do?
- Review storage network rules and service endpoint source identity alongside application-layer credentials.
- Check which Azure services support service endpoint policies and use alternative enforcement where unsupported.
- Apply supported service endpoint policies with the required resource restrictions and verify the service's compatibility.
- Retain appropriate NSG and routing controls because service endpoints do not replace general outbound network security.
Explanation
Correct Answer
B:Service endpoint policies are not universal egress firewalls for every Azure service.
Incorrect Answers
A:For this question, service endpoint policies are not universal egress firewalls for every Azure service.
C:Applying supported service endpoint policies with the required resource restrictions and verifying the service's compatibility would not check which Azure services support service endpoint policies and use alternative enforcement where unsupported.
D:For this finding, service endpoint policies are not universal egress firewalls for every Azure service.
Question 654
A web app on-premises receives a public address for vault.privatelink.vaultcore.azure.net even though Azure workloads resolve it privately. A storage account has both Blob and File services, and the administrator assumes a Blob private endpoint also covers the file share endpoint. Which response best addresses these needs?
- Use the service's supported hostname and validated private DNS resolution rather than binding to an ephemeral endpoint IP; create separate private endpoints and matching private DNS records for each required supported storage subresource.
- Create separate private endpoints and matching private DNS records for each required supported storage subresource; do not configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links.
- Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links; create separate private endpoints and matching private DNS records for each required supported storage subresource.
- Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links; update the zone group or private DNS record so the resource hostname resolves to the active endpoint IP.
Explanation
Correct Answer
C:Private endpoint name resolution must reach the Azure private zone from the on-premises resolver path. Private endpoint connections are often scoped to specific service subresources rather than all endpoints in the resource. Both actions are needed.
Incorrect Answers
A:Private endpoint name resolution must reach the Azure private zone from the on-premises resolver path.
B:This plan leaves out a required action: Configure hybrid private DNS conditional forwarding through supported Azure resolver endpoints and private zone links. The remaining action alone does not satisfy the situation.
D:Private endpoint connections are often scoped to specific service subresources rather than all endpoints in the resource.
Question 655
On-premises clients must resolve private endpoint names in Azure, but their DNS servers have no conditional path into Azure's private zones. Azure workloads must resolve a private corporate domain hosted on on-premises DNS without changing every VM's resolver configuration. What is the most appropriate plan for this situation?
- Configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet; do not deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders.
- Deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders; Link the DNS forwarding ruleset to the intended client VNet and verify suffix matching and target reachability.
- Deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders; configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet.
- Create appropriately dedicated delegated subnets for the inbound and outbound endpoints according to supported design rules; configure DNS Private Resolver outbound endpoints and forwarding rules for the corporate suffix, linked to the appropriate VNet.
Explanation
Correct Answer
C:Hybrid DNS needs a reachable inbound resolver path; simply linking the private zone to a VNet does not serve on-premises queries. Outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Deploy an Azure DNS Private Resolver inbound endpoint and configure appropriate on-premises conditional forwarders. The remaining action alone does not satisfy the situation.
B:Outbound DNS forwarding centralizes conditional resolution from Azure to designated external DNS servers.
D:Hybrid DNS needs a reachable inbound resolver path; simply linking the private zone to a VNet does not serve on-premises queries.
Question 656
A network administrator sees a connection-timeout alert but wants to know which traffic actually matched an NSG deny in the preceding hour. A VM communicates to a service through a private endpoint but a Network Watcher next-hop result points to an unexpected network virtual appliance. Which course of action addresses the stated issues?
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; do not examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns.
- Examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
- Examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns; inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records.
- Use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets; inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records.
Explanation
Correct Answer
C:Historical flow evidence can reveal repeated blocked traffic, while a one-time configuration check is not a time-series record. A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns. The remaining action alone does not satisfy the situation.
B:A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions.
D:Historical flow evidence can reveal repeated blocked traffic, while a one-time configuration check is not a time-series record.
Question 657
A team wants to shrink an active VNet subnet while network interfaces and endpoints still occupy addresses outside the proposed range. A future private endpoint deployment needs addresses kept available, but the last free subnet is being filled with ephemeral test VMs. Which response best addresses these needs?
- Choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity; Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
- Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands.
- Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands; do not Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix.
- Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs.
Explanation
Correct Answer
B:Subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints. Shared capacity without reservation can block security-sensitive service connectivity when the subnet becomes exhausted. Both actions are needed.
Incorrect Answers
A:Subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints.
C:This plan leaves out a required action: Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix. The remaining action alone does not satisfy the situation.
D:Shared capacity without reservation can block security-sensitive service connectivity when the subnet becomes exhausted.
Question 658
During an Azure networking rollout, the team must resolve both of these conditions. An engineer uses Virtual Network Manager to push an overly broad security admin rule that overrides carefully scoped workload NSG denies. An administrator creates a Route Server and assumes it intercepts packets as a firewall or data-plane proxy. What is the most appropriate plan for this situation?
- Keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange; do not review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups.
- Evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design; keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange.
- Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups; keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange.
- Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups; apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope.
Explanation
Correct Answer
C:Central administrative security rules have distinct precedence behavior and broad scope that must be validated. Azure Route Server exchanges route information; it is not itself a traffic-inspection appliance. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups. The remaining action alone does not satisfy the situation.
B:Central administrative security rules have distinct precedence behavior and broad scope that must be validated.
D:Azure Route Server exchanges route information; it is not itself a traffic-inspection appliance.
Question 659
An administrator creates an NSG but never associates it with the intended subnet or NIC and claims the workload is isolated. What should the Azure network engineer do?
- Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive.
- Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces.
- Use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
- Assign the appropriate VM network interface to the ASG and check effective security rules.
Explanation
Correct Answer
B:Unassociated NSG resources cannot evaluate or filter the intended traffic.
Incorrect Answers
A:Here, unassociated NSG resources cannot evaluate or filter the intended traffic.
C:For this question, unassociated NSG resources cannot evaluate or filter the intended traffic.
D:For this finding, unassociated NSG resources cannot evaluate or filter the intended traffic.
Question 660
A globally distributed web service wants endpoint failover by changing the DNS answer based on health, not by proxying every HTTP request. A marketing site needs weighted distribution of new DNS lookups between regional hostnames for controlled rollout. Which response best addresses these needs?
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection; use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses; do not configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
Explanation
Correct Answer
A:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy. Weighted DNS routing can steer new resolver answers without providing layer-7 application transformations. Both actions are needed.
Incorrect Answers
B:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
C:This plan leaves out a required action: Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring. The remaining action alone does not satisfy the situation.
D:Weighted DNS routing can steer new resolver answers without providing layer-7 application transformations.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests