Question 660
A globally distributed web service wants endpoint failover by changing the DNS answer based on health, not by proxying every HTTP request. A marketing site needs weighted distribution of new DNS lookups between regional hostnames for controlled rollout. Which response best addresses these needs?
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection; use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
- Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses; do not configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
- Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring; review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
Explanation
Correct Answer
A:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy. Weighted DNS routing can steer new resolver answers without providing layer-7 application transformations. Both actions are needed.
Incorrect Answers
B:Traffic Manager makes DNS-level routing decisions and is not an inline application proxy.
C:This plan leaves out a required action: Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring. The remaining action alone does not satisfy the situation.
D:Weighted DNS routing can steer new resolver answers without providing layer-7 application transformations.
Question 661
An engineer configures Microsoft peering when the requirement is to reach VM private IPs in Azure VNets. Which response most directly resolves the issue?
- Create a supported ExpressRoute virtual network gateway and link the VNet to the provisioned circuit.
- Configure Azure private peering and the applicable VNet gateway or direct connectivity model.
- Align the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration.
- Design an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration.
Explanation
Correct Answer
B:Microsoft peering is not a substitute for Azure private peering to VNet private address space.
Incorrect Answers
A:Here, microsoft peering is not a substitute for Azure private peering to VNet private address space.
C:Aligning the provider handoff, BGP peer IPs, ASN, VLAN ID, and Microsoft peering configuration would not configure Azure private peering and the applicable VNet gateway or direct connectivity model.
D:Designing an ExpressRoute circuit with an eligible connectivity provider and appropriate peering and gateway configuration would not configure Azure private peering and the applicable VNet gateway or direct connectivity model.
Question 662
During an Azure networking rollout, the team must resolve both of these conditions. An organization creates a secured Virtual WAN hub but assumes adding an ordinary VNet firewall appliance automatically integrates with hub routing intent. An Azure Firewall deployment has apparently correct allow rules, but spokes bypass its IP because their UDRs still point to the internet. Which course of action addresses the stated issues?
- Update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall; do not deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections.
- Deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections; update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall.
- Select an appropriate Azure Firewall Premium tier after validating required advanced security features; update and associate approved route tables or secured hub routing intent and confirm packets traverse the firewall.
- Deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections; use Azure Firewall Policy hierarchy and appropriately scoped child policies with validation of rule collection priorities.
Explanation
Correct Answer
B:A secured virtual hub has supported managed integration steps distinct from placing any VM in a peered subnet. A correctly configured firewall cannot inspect traffic that never traverses its private data-path endpoint. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Deploy a supported Azure Firewall secured virtual hub configuration and verify Virtual WAN routing intent and connections. The remaining action alone does not satisfy the situation.
C:A secured virtual hub has supported managed integration steps distinct from placing any VM in a peered subnet.
D:A correctly configured firewall cannot inspect traffic that never traverses its private data-path endpoint.
Question 663
A VM database subnet must accept TCP 1433 only from the approved application subnet, but an NSG rule allows every source prefix. A fleet of VM network interfaces changes IP addresses frequently, and application-tier NSG rules depend on hardcoded individual addresses. Which response best addresses these needs?
- Use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules; do not create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority.
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; Reorder or narrow the higher-priority matching NSG rule and validate the effective security evaluation.
- Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority; use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules.
- Check effective NSG rules across subnet and NIC scopes before changing unrelated Azure Firewall policies; use supported Application Security Groups for member NICs and reference those groups in appropriate NSG rules.
Explanation
Correct Answer
C:NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted. ASGs allow logically grouped network interfaces to be controlled without manually tracking each private address. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Create a narrowly scoped inbound NSG rule with the specific source, destination, protocol, port, and appropriate priority. The remaining action alone does not satisfy the situation.
B:ASGs allow logically grouped network interfaces to be controlled without manually tracking each private address.
D:NSG least privilege is evaluated against concrete traffic tuples rather than whether a subnet is named trusted.
Question 664
After a backend maintenance window, Application Gateway still sends new traffic to one stale instance because the pool membership was not updated. An application routes by hostname but uses a generic probe that targets the wrong virtual host and marks every endpoint down. What is the most appropriate plan for this situation?
- Set the backend HTTP port and probe destination correctly rather than changing the public HTTPS listener; configure probes with the intended host header and path and validate the origin's virtual host behavior.
- Configure probes with the intended host header and path and validate the origin's virtual host behavior; do not update backend pool membership and probe configuration and verify traffic distribution from client requests.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; use a supported layer-4 load balancer, Azure Bastion, or access method matched to the management protocol.
- Update backend pool membership and probe configuration and verify traffic distribution from client requests; configure probes with the intended host header and path and validate the origin's virtual host behavior.
Explanation
Correct Answer
D:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state. HTTP virtual hosting can return different health responses depending on the Host header sent by the probe. Both actions are needed.
Incorrect Answers
A:Traffic destinations are determined by actual backend membership and health, not intended infrastructure state.
B:This plan leaves out a required action: Update backend pool membership and probe configuration and verify traffic distribution from client requests. The remaining action alone does not satisfy the situation.
C:HTTP virtual hosting can return different health responses depending on the Host header sent by the probe.
Question 665
A hub VPN gateway provides on-premises routes, but a spoke has its own gateway and is configured to use both its own and a remote gateway simultaneously. An NVA is advertised as a transit point for interspoke traffic, but the spoke UDR only covers internet prefixes. Which course of action addresses the stated issues?
- Review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; compare effective routes and apply longest-prefix matching and route-source precedence to the specific destination.
- Review Virtual WAN hub routing, connection associations, and propagations instead of applying standard VNet hub assumptions; add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
- Review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently; add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA.
- Add validated private-destination routes and appropriate return routing to direct authorized interspoke sessions through the NVA; do not review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently.
Explanation
Correct Answer
C:Spoke gateway ownership and remote-gateway consumption have documented compatibility rules. Forcing only 0.0.0.0/0 does not guarantee every more-specific private route traverses the intended inspection path. Both actions are needed.
Incorrect Answers
A:Forcing only 0.0.0.0/0 does not guarantee every more-specific private route traverses the intended inspection path.
B:Spoke gateway ownership and remote-gateway consumption have documented compatibility rules.
D:This plan leaves out a required action: Review the supported gateway-transit constraints and select a topology that uses an eligible gateway path consistently. The remaining action alone does not satisfy the situation.
Question 666
A new WAF policy produces false positives against legitimate JSON API requests and the team wants to disable all managed protections. Which response most directly resolves the issue?
- Associate the WAF policy at the supported gateway or listener scope and verify effective enforcement through logs.
- Start with detection-mode investigation and tune narrow rules or exclusions before moving to prevention.
- Deploy WAF with supported managed rule sets on Application Gateway or Front Door and test malicious request handling.
- Apply a supported Azure Front Door WAF policy to the global edge endpoint for eligible web traffic.
Explanation
Correct Answer
B:Measured exclusions protect legitimate requests while retaining broad application threat inspection.
Incorrect Answers
A:For this question, measured exclusions protect legitimate requests while retaining broad application threat inspection.
C:Deploying WAF with supported managed rule sets on Application Gateway or Front Door and testing malicious request handling would not address the need for start with detection-mode investigation and tune narrow rules or exclusions.
D:For this finding, measured exclusions protect legitimate requests while retaining broad application threat inspection.
Question 667
A service hosted behind a firewall must be published to the internet through one approved public IP and translated to a private host. What should the Azure network engineer do?
- Use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities.
- Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address.
- Configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
- Configure Azure Firewall application rules for supported web protocols and destination domains.
Explanation
Correct Answer
C:Destination network address translation publishes an approved private target rather than creating generalized inbound permission.
Incorrect Answers
A:Here, destination network address translation publishes an approved private target rather than creating generalized inbound permission.
B:For this question, destination network address translation publishes an approved private target rather than creating generalized inbound permission.
D:For this finding, destination network address translation publishes an approved private target rather than creating generalized inbound permission.
Question 668
A global application wants its backend reachable only through Front Door rather than directly over a public origin hostname. A subscription owner assumes every Front Door tier includes Private Link origins and WAF features at identical price and functionality. Which course of action addresses the stated issues?
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; Harden the origin with suitable network access restrictions and verify that permitted ingress follows Front Door.
- Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing; select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
- Select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs; do not evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing.
- Inspect origin group routing, priority, weight, and health settings and test representative client regions; select an appropriate Standard or Premium Front Door tier after mapping required features, limitations, and costs.
Explanation
Correct Answer
B:Private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them. Front Door feature availability and origin security options vary by tier and must be checked explicitly. Both actions are needed.
Incorrect Answers
A:Front Door feature availability and origin security options vary by tier and must be checked explicitly.
C:This plan leaves out a required action: Evaluate supported Front Door Premium origin Private Link integration and validate the origin approval and routing. The remaining action alone does not satisfy the situation.
D:Private Link-enabled origins can reduce direct public origin exposure when the selected Front Door tier supports them.
Question 669
A development VNet needs automatic registration of VM hostnames in a private DNS zone, not merely read-only lookup. Which response most directly resolves the issue?
- Link the relevant private zone to the querying VNet and test Azure-provided resolver behavior.
- Enable supported auto-registration on the designated VNet link and verify which resource types produce records.
- Host the external record in a publicly delegated Azure DNS zone or another authoritative public DNS provider.
- Create an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings.
Explanation
Correct Answer
B:Resolution-only private zone links do not automatically register VM records; registration has link and resource limitations.
Incorrect Answers
A:For this finding, resolution-only private zone links do not automatically register VM records; registration has link and resource limitations.
C:DNS configuration would not enable supported auto-registration on the designated VNet link and verify which resource types produce records.
D:Creating an Azure Private DNS zone and link each participating VNet with the appropriate resolution settings would not enable supported auto-registration on the designated VNet link and verify which resource types produce records.
Question 670
An app on-premises must reach a storage account exclusively over a private IP but the architect suggests using only a VNet service endpoint. Which response most directly resolves the issue?
- Add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP.
- Choose a private endpoint when the requirement is a private IP on the consumer VNet.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules.
Explanation
Correct Answer
B:Service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
Incorrect Answers
A:For this finding, service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
C:Here, service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
D:For this question, service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests