Question 670
An app on-premises must reach a storage account exclusively over a private IP but the architect suggests using only a VNet service endpoint. Which response most directly resolves the issue?
- Add the intended subnet to the service's supported network access rules and confirm the service endpoint state.
- Use a Private Endpoint with hybrid DNS/routing, since service endpoints do not give an on-premises client a private consumer IP.
- Choose a private endpoint when the requirement is a private IP on the consumer VNet.
- Enable the supported service endpoint on those subnets and configure matching storage firewall VNet rules.
Explanation
Correct Answer
B:Service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
Incorrect Answers
A:For this finding, service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
C:Here, service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
D:For this question, service endpoints primarily identify Azure VNet subnets to supported Azure services and do not create on-premises private endpoints.
Question 671
A software provider hosts a custom TCP service behind an internal Standard Load Balancer and wants customers to connect without public exposure. Which action best addresses this finding?
- Configure Private Link service visibility and connection approval permissions before accepting consumer requests.
- Create a supported Azure Private Link service backed by the load balancer and manage consumer endpoint approvals.
- Maintain the supported Private Link service frontend while updating backend health and routing as needed.
- Publish the service through an eligible Private Link service or supported Azure service target first.
Explanation
Correct Answer
B:Private Link service publishes an eligible customer-hosted private service to consumers via their private endpoints.
Incorrect Answers
A:For this finding, private Link service publishes an eligible customer-hosted private service to consumers via their private endpoints.
C:For this question, private Link service publishes an eligible customer-hosted private service to consumers via their private endpoints.
D:Here, private Link service publishes an eligible customer-hosted private service to consumers via their private endpoints.
Question 672
A regulated enterprise owns a registered public IPv4 block and wants to advertise it from Azure rather than use Azure-owned public space. A web application must maintain one stable inbound IP through a VM restart, but it currently receives a dynamic public address. Which response best addresses these needs?
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; Reserve a Standard public IP prefix of appropriate size and allocate individual public IP resources from that prefix.
- Create and explicitly assign appropriate public IP resources from the prefix to the intended frontend endpoints; create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
- Create a suitable static Standard public IP and associate it with the supported load balancer or network interface; do not evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements.
- Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements; create a suitable static Standard public IP and associate it with the supported load balancer or network interface.
Explanation
Correct Answer
D:Custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges. A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address. Both actions are needed.
Incorrect Answers
A:A static public IP resource maintains a known endpoint instead of relying on a temporary automatically assigned address.
B:Custom IP prefixes involve ownership proof and announcement steps distinct from allocating provider-owned public IP ranges.
C:This plan leaves out a required action: Evaluate Azure custom IP prefix bring-your-own-IP onboarding, validation, and supported regional advertisement requirements. The remaining action alone does not satisfy the situation.
Question 673
A point-to-site deployment needs centralized employee identities with MFA, but engineers choose shared self-signed client certificates for everyone. A business uses an external RADIUS server for remote user authentication and wants Azure P2S to validate against it. A P2S client authenticates successfully but cannot reach an internal database because its source address pool overlaps the destination subnet. What is the most appropriate plan for this situation?
- Use a supported Microsoft Entra ID authentication design with appropriate client and conditional access prerequisites; choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability; and implement certificate revocation and replacement for affected P2S clients, then verify rejected connections.
- Use a supported Microsoft Entra ID authentication design with appropriate client and conditional access prerequisites; choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability; and Redesign the client address pool to avoid overlapping private networks and validate the return routes.
- Use a supported Microsoft Entra ID authentication design with appropriate client and conditional access prerequisites; implement certificate revocation and replacement for affected P2S clients, then verify rejected connections; and Redesign the client address pool to avoid overlapping private networks and validate the return routes.
- Implement certificate revocation and replacement for affected P2S clients, then verify rejected connections; choose a supported P2S gateway and tunnel combination with RADIUS authentication and test server reachability; and Redesign the client address pool to avoid overlapping private networks and validate the return routes.
Explanation
Correct Answer
B:Individual identity-based authentication supports governance that a shared client certificate cannot provide. RADIUS requires a compatible VPN configuration and live authentication path beyond a portal checkbox. Authentication success does not resolve collisions between remote client addresses and private destination routes. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: authentication success does not resolve collisions between remote client addresses and private destination routes.
C:Two actions meet their requirements, but action 2 misses this need: rADIUS requires a compatible VPN configuration and live authentication path beyond a portal checkbox.
D:Two actions meet their requirements, but action 1 misses this need: individual identity-based authentication supports governance that a shared client certificate cannot provide.
Question 674
A public zone was created in Azure DNS, but users still query the prior provider because the domain registrar nameservers were not updated. A private DNS zone contains an A record for an endpoint that was deleted and recreated with a different address; clients hit the obsolete IP. Which course of action addresses the stated issues?
- Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation; inspect endpoint-linked DNS zone groups and reconcile stale private A records to the current endpoint IP.
- Inspect endpoint-linked DNS zone groups and reconcile stale private A records to the current endpoint IP; do not Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation.
- Configure delegation in the appropriate public parent zone and verify authoritative NS records for the child zone; inspect endpoint-linked DNS zone groups and reconcile stale private A records to the current endpoint IP.
- Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation; plan record TTLs and allow cached responses to age out while validating the authoritative record and cutover window.
Explanation
Correct Answer
A:Public zone creation must be paired with parent delegation before internet clients consistently use Azure records. Private endpoint resolution must track endpoint lifecycle; an old A record can break an otherwise healthy service. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Delegate the public domain to the Azure DNS authoritative nameservers at the registrar and verify propagation. The remaining action alone does not satisfy the situation.
C:Public zone creation must be paired with parent delegation before internet clients consistently use Azure records.
D:Private endpoint resolution must track endpoint lifecycle; an old A record can break an otherwise healthy service.
Question 675
A retailer needs to limit aggressive automated checkout requests from a small set of source addresses without blocking all legitimate shopping. A security engineer creates one custom WAF allow rule ahead of managed rules and unintentionally lets selected traffic bypass later inspections. An app moves from regional Application Gateway to global Front Door and reuses old WAF exclusion syntax without reviewing supported policy differences. Which response best addresses these needs?
- Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry; review custom-rule priority and termination behavior before permitting exceptions to the managed rule set; and map supported managed rule sets and custom-rule options to the new WAF platform before migration.
- Run authorized representative request tests and correlate WAF logs with policy mode and expected decisions; review custom-rule priority and termination behavior before permitting exceptions to the managed rule set; and map supported managed rule sets and custom-rule options to the new WAF platform before migration.
- Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry; run authorized representative request tests and correlate WAF logs with policy mode and expected decisions; and map supported managed rule sets and custom-rule options to the new WAF platform before migration.
- Evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry; review custom-rule priority and termination behavior before permitting exceptions to the managed rule set; and run authorized representative request tests and correlate WAF logs with policy mode and expected decisions.
Explanation
Correct Answer
A:Rate limiting can mitigate request floods while preserving legitimate client patterns when thresholds are tested. WAF custom rule evaluation can change whether subsequent protections are applied to a request. WAF implementations can differ in rule-set versions, policy associations and exclusions even with common security goals. Each decision addresses a separate requirement.
Incorrect Answers
B:Two actions meet their requirements, but action 1 misses this need: rate limiting can mitigate request floods while preserving legitimate client patterns when thresholds are tested.
C:Two actions meet their requirements, but action 2 misses this need: wAF custom rule evaluation can change whether subsequent protections are applied to a request.
D:Two actions meet their requirements, but action 3 misses this need: wAF implementations can differ in rule-set versions, policy associations and exclusions even with common security goals.
Question 676
During an Azure networking rollout, the team must resolve both of these conditions. A hub gateway returns traffic to the branch over an unexpected virtual tunnel after a second office is onboarded with duplicate CIDRs. A new VPN gateway deployment is blocked because the existing GatewaySubnet is too small for the target feature or resiliency mode. What is the most appropriate plan for this situation?
- Expand GatewaySubnet through a supported change plan before allocating the new gateway instances; do not correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles.
- Correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles; evaluate zone-redundant or active-active options and validate operational failover against branch peer capabilities.
- Correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles; Expand GatewaySubnet through a supported change plan before allocating the new gateway instances.
- Review BGP default-route acceptance and forced-tunneling intent before allowing the branch's advertised default; Expand GatewaySubnet through a supported change plan before allocating the new gateway instances.
Explanation
Correct Answer
C:VPN encryption can be healthy while ambiguous destination prefixes cause asymmetric or incorrect routing. Gateway topology and scaling options can require address space beyond a minimal legacy subnet. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Correct overlapping on-premises address ranges and verify learned prefixes before adjusting tunnel encryption profiles. The remaining action alone does not satisfy the situation.
B:Gateway topology and scaling options can require address space beyond a minimal legacy subnet.
D:VPN encryption can be healthy while ambiguous destination prefixes cause asymmetric or incorrect routing.
Question 677
The VPN tunnel shows connected but Azure cannot return packets to a newly added branch subnet absent from the local network gateway. A hybrid migration needs to extend a supported on-premises network into Azure while preserving IP addressing across certain workloads. Which course of action addresses the stated issues?
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists; evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics; do not update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists.
- Align the supported IPsec/IKE policy parameters and key exchange settings across Azure and the remote appliance; evaluate Azure Extended Network support, compatibility, and a tested migration topology before extending layer-2 semantics.
- Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists; update the local network gateway public endpoint and confirm the advertised prefixes and IKE peer configuration.
Explanation
Correct Answer
A:Established tunnels do not automatically carry reachability for prefixes that were never configured or advertised. Extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity. Both actions are needed.
Incorrect Answers
B:This plan leaves out a required action: Update and verify the on-premises prefix advertisement or static address ranges and ensure the return route exists. The remaining action alone does not satisfy the situation.
C:Established tunnels do not automatically carry reachability for prefixes that were never configured or advertised.
D:Extended network migration has platform and operational constraints distinct from conventional routed VPN connectivity.
Question 678
An on-premises router advertises a broad default route through ExpressRoute and Azure internet-bound traffic now follows an unexpected private path. An engineer assumes ExpressRoute traffic is automatically end-to-end encrypted because the provider connection is private. Which response best addresses these needs?
- Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; select the correct ExpressRoute circuit SKU or add supported regional circuits based on the target geopolitical reach.
- Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities.
- Evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities; do not review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters.
- Evaluate Bidirectional Forwarding Detection where supported to accelerate detection of affected ExpressRoute routing paths; evaluate supported encryption overlays or MACsec options according to the threat model and physical circuit capabilities.
Explanation
Correct Answer
B:Advertised routes influence actual Azure egress choices when the gateway accepts those prefixes. Private transport and cryptographic confidentiality are separate assurances. Both actions are needed.
Incorrect Answers
A:Private transport and cryptographic confidentiality are separate assurances.
C:This plan leaves out a required action: Review the BGP advertisements and forced-tunnel policy for the circuit and use intended prefix filters. The remaining action alone does not satisfy the situation.
D:Advertised routes influence actual Azure egress choices when the gateway accepts those prefixes.
Question 679
An Azure VM needs emergency administration without any public IP or an always-open internet-facing RDP rule. A network team opens TCP 3389 to all addresses because engineers sometimes need VM access from home. What is the most appropriate plan for this situation?
- Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path; do not deploy Azure Bastion using its required subnet and authorize administrative access through that supported service.
- Deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; use Network Watcher IP flow verify with the precise source, destination, protocol, and ports.
- Deploy Azure Bastion using its required subnet and authorize administrative access through that supported service; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
- Use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy; remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
Explanation
Correct Answer
C:Azure Bastion permits managed browser or client sessions to private VM addresses without exposing an RDP public listener. Wide-open management ports increase the attack surface independently of the VM's login credentials. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Deploy Azure Bastion using its required subnet and authorize administrative access through that supported service. The remaining action alone does not satisfy the situation.
B:Wide-open management ports increase the attack surface independently of the VM's login credentials.
D:Azure Bastion permits managed browser or client sessions to private VM addresses without exposing an RDP public listener.
Question 680
A network team migrates a traditional hub-spoke deployment to Virtual WAN but copies all old user-defined route tables into connections unchanged. A new virtual hub in another region remains isolated despite being placed in the same resource group as the existing hub. A third-party firewall integration into Virtual WAN blocks half the sites because only a subset of connections use the secured route table. Which course of action addresses the stated issues?
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; and configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
Explanation
Correct Answer
B:Virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub. Azure resource-group placement is administrative and does not establish network transit. Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: inspection coverage depends on the effective transit path through the hub, not on the appliance being registered.
C:Two actions meet their requirements, but action 1 misses this need: virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub.
D:Two actions meet their requirements, but action 2 misses this need: azure resource-group placement is administrative and does not establish network transit.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests