Question 680
A network team migrates a traditional hub-spoke deployment to Virtual WAN but copies all old user-defined route tables into connections unchanged. A new virtual hub in another region remains isolated despite being placed in the same resource group as the existing hub. A third-party firewall integration into Virtual WAN blocks half the sites because only a subset of connections use the secured route table. Which course of action addresses the stated issues?
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; and configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; verify supported inter-hub connectivity and Virtual WAN association rather than relying on shared resource-group membership; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
- Map effective routes to Virtual WAN hub tables, connection associations, and policy before performing a staged migration; configure relevant Virtual WAN hub and gateway metrics with actionable connectivity and route-health alerts; and validate routing intent or policy and connection associations so intended flows consistently traverse the supported inspection point.
Explanation
Correct Answer
B:Virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub. Azure resource-group placement is administrative and does not establish network transit. Inspection coverage depends on the effective transit path through the hub, not on the appliance being registered. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 3 misses this need: inspection coverage depends on the effective transit path through the hub, not on the appliance being registered.
C:Two actions meet their requirements, but action 1 misses this need: virtual WAN does not have the same per-spoke hub routing implementation as a custom VNet hub.
D:Two actions meet their requirements, but action 2 misses this need: azure resource-group placement is administrative and does not establish network transit.
Question 681
A firewall FQDN rule fails for internal service names because the firewall and clients resolve the same name through different DNS servers. A network rule uses overly broad any-to-any settings, and monitoring cannot identify which service depends on it. A network security team adds a firewall rule collection but assumes its descriptive name determines evaluation ahead of other collections. Which response best addresses these needs?
- Validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session; Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; and verify rule collection group and collection priorities and the documented processing order before rollout.
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session; and verify rule collection group and collection priorities and the documented processing order before rollout.
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; and validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session.
- Align the documented DNS proxy and resolver settings and validate consistent destination resolution; Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; and verify rule collection group and collection priorities and the documented processing order before rollout.
Explanation
Correct Answer
D:FQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients. Observed flow data supports restricting exposure while preserving the identified business traffic. Azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names. Each decision addresses a separate requirement.
Incorrect Answers
A:Two actions meet their requirements, but action 1 misses this need: fQDN filtering is unreliable when DNS answers differ between the enforcing firewall and clients.
B:Two actions meet their requirements, but action 2 misses this need: observed flow data supports restricting exposure while preserving the identified business traffic.
C:Two actions meet their requirements, but action 3 misses this need: azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.
Question 682
A spoke-to-spoke path fails after deployment, and the administrator checks only its route table JSON rather than what each VM receives. A UDR specifies next-hop VirtualAppliance but points to a VM that has IP forwarding disabled, causing blackholed traffic. What is the most appropriate plan for this situation?
- Enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions; do not inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; Associate an appropriate route table with a spoke subnet and direct the approved default route to the appliance's valid next hop.
- Validate required service-specific routing exceptions and forced-tunnel support before applying the default-route policy broadly; enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
- Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries; enable supported IP forwarding on the appliance network interface and within its operating system, then test both directions.
Explanation
Correct Answer
D:Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved. Sending packets to an NVA does not make it a router unless forwarding is configured and supported. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Inspect effective routes on the affected network interfaces and compare system, BGP, and user-defined entries. The remaining action alone does not satisfy the situation.
B:Sending packets to an NVA does not make it a router unless forwarding is configured and supported.
C:Effective routes reveal the selected forwarding behavior after route precedence and attachment are resolved.
Question 683
An administrator adds an inbound allow on an NSG but the application cannot reach a remote service because the effective outbound rule denies the reply's original initiation path. A storage service uses a dynamic set of provider addresses, and engineers plan to hardcode every observed IP in NSG egress rules. Which course of action addresses the stated issues?
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; review NSG stateful flow behavior and verify active session handling before claiming the rule instantly terminates all traffic.
- Validate supported security admin rule precedence, Allow or Always Allow semantics, and effective policy before rollout; use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
- Use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes; do not inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics.
- Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics; use supported Azure service tags and narrowly scoped protocols where applicable instead of manually pinning transient platform prefixes.
Explanation
Correct Answer
D:Connection direction and state tracking determine which policy is evaluated for new traffic. Service tags provide maintained address abstractions for specific service categories. Both actions are needed.
Incorrect Answers
A:Service tags provide maintained address abstractions for specific service categories.
B:Connection direction and state tracking determine which policy is evaluated for new traffic.
C:This plan leaves out a required action: Inspect both connection initiation direction and the relevant inbound/outbound NSG rules and stateful semantics. The remaining action alone does not satisfy the situation.
Question 684
A globally cached API returns private personalized responses to other users because its routes cache content with an overly broad policy. Which response most directly resolves the issue?
- Inspect Front Door diagnostics and WAF event logs separately from origin request logs to trace enforcement.
- Complete the supported custom-domain validation and certificate workflow and confirm public DNS records.
- Disable caching for personalized responses and correct origin cache headers before enabling edge delivery.
- Stage changes to Front Door origin routing and test failover and application session behavior under maintenance.
Explanation
Correct Answer
C:Shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe.
Incorrect Answers
A:For this finding, shared edge caching of user-specific content can cause cross-user disclosure unless cache keys and policies are safe.
B:DNS configuration would not address the need for disable caching for personalized responses and correct origin cache headers.
D:Stage changes to Front Door origin routing and test failover and application session behavior under maintenance would not address the need for disable caching for personalized responses and correct origin cache headers.
Question 685
During an Azure networking rollout, the team must resolve both of these conditions. An Application Gateway backend shows unhealthy because its probe requests / and receives 404 even though /health returns 200. A team deploys one manually sized Application Gateway instance for traffic that varies tenfold during seasonal campaigns. What is the most appropriate plan for this situation?
- Configure multi-site listener hostnames and appropriate routing rules with the required certificates; evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
- Evaluate autoscaling Application Gateway capacity with monitored minimums and service limits; do not create a custom health probe for the correct host and health path and review backend HTTP settings.
- Create a custom health probe for the correct host and health path and review backend HTTP settings; use Azure Application Gateway path-based routing with listeners, backend pools, and HTTP settings.
- Create a custom health probe for the correct host and health path and review backend HTTP settings; evaluate autoscaling Application Gateway capacity with monitored minimums and service limits.
Explanation
Correct Answer
D:A default probe can misclassify a functioning application when its expected hostname or path differs. Dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance. Both actions are needed.
Incorrect Answers
A:A default probe can misclassify a functioning application when its expected hostname or path differs.
B:This plan leaves out a required action: Create a custom health probe for the correct host and health path and review backend HTTP settings. The remaining action alone does not satisfy the situation.
C:Dynamic autoscaling can handle changing load more reliably than a permanently undersized fixed instance.
Question 686
During an Azure networking rollout, the team must resolve both of these conditions. A security team needs historical communication patterns for subnet-level troubleshooting and assumes the retired NSG flow log workflow is the only option. Defender for Cloud flags an exposed management port and an engineer ignores the attack-path context because the vulnerability scan is clean. Which course of action addresses the stated issues?
- Review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence; do not plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions.
- Evaluate Azure DDoS Network Protection for supported public endpoints and design network-level mitigation and monitoring; review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; review Secure Score recommendations and attack path analysis with the affected resource's reachability and exposure evidence.
- Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions; use Azure Monitor for Networks and resource-specific diagnostics to correlate network health and dependency symptoms.
Explanation
Correct Answer
C:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited. Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding. Both actions are needed.
Incorrect Answers
A:This plan leaves out a required action: Plan supported virtual network flow logs with appropriate storage, traffic analytics, retention, and privacy restrictions. The remaining action alone does not satisfy the situation.
B:VNet flow logs capture network flow metadata while legacy NSG flow-log guidance may be deprecated or limited.
D:Attack paths combine exploitable exposures and relationships that may not appear as a single software-vulnerability finding.
Question 687
A false-positive rule excludes all request bodies to fix one JSON property, creating a large inspection gap. A WAF rule has blocked requests in its logs, yet clients still reach the origin directly by an unprotected public hostname. Which response best addresses these needs?
- Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
- Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring; restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
- Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress; do not use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
Explanation
Correct Answer
C:Broad exemptions can silently remove inspection coverage for unrelated malicious payloads. WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint. Both actions are needed.
Incorrect Answers
A:Broad exemptions can silently remove inspection coverage for unrelated malicious payloads.
B:WAF policy cannot inspect a path that bypasses the gateway or Front Door endpoint.
D:This plan leaves out a required action: Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring. The remaining action alone does not satisfy the situation.
Question 688
A multinational firm operates hundreds of branch VPN sites and wants centrally managed cloud transit rather than dozens of individually peered hub VNets. An enterprise requires branch-to-branch transit through a new WAN service but selects a Basic Virtual WAN configuration without reviewing capabilities. What is the most appropriate plan for this situation?
- Select regionally appropriate Virtual WAN hubs with verified inter-hub connectivity and resilience design; choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities.
- Choose a Virtual WAN SKU that supports required branch and inter-hub transit capabilities; do not design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing.
- Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing; create a virtual hub and deploy the necessary supported gateway and VNet connections for the intended sites.
Explanation
Correct Answer
B:Virtual WAN centralizes supported branch and VNet transit in managed hubs rather than scaling manual peering meshes. Basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services. Both actions are needed.
Incorrect Answers
A:Virtual WAN centralizes supported branch and VNet transit in managed hubs rather than scaling manual peering meshes.
C:This plan leaves out a required action: Design an appropriate Azure Virtual WAN hub-and-spoke topology with site connections and managed virtual hub routing. The remaining action alone does not satisfy the situation.
D:Basic and Standard Virtual WAN capabilities differ, including advanced connectivity and transit services.
Question 689
A healthcare database requires consumers to resolve a private service address and disable the provider's public endpoint entirely. A team needs VNet-origin restrictions for a supported Azure service but does not need private IP allocation or per-endpoint approvals. Which course of action addresses the stated issues?
- Test actual FQDN answers and effective routes, then select the intended access method explicitly; use service endpoints and service-side virtual network rules after validating compatibility.
- Use service endpoints and service-side virtual network rules after validating compatibility; do not use a private endpoint with service-supported public network restrictions and the matching private DNS integration.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use a compatible private connectivity or hybrid network design rather than assuming on-premises traffic carries an Azure VNet service endpoint identity.
- Use a private endpoint with service-supported public network restrictions and the matching private DNS integration; use service endpoints and service-side virtual network rules after validating compatibility.
Explanation
Correct Answer
D:Private Link provides the private address required for a design that eliminates public service reachability. Service endpoints can be simpler when subnet identity is sufficient and the public service endpoint model is acceptable. Both actions are needed.
Incorrect Answers
A:Private Link provides the private address required for a design that eliminates public service reachability.
B:This plan leaves out a required action: Use a private endpoint with service-supported public network restrictions and the matching private DNS integration. The remaining action alone does not satisfy the situation.
C:Service endpoints can be simpler when subnet identity is sufficient and the public service endpoint model is acceptable.
Question 690
A VM communicates to a service through a private endpoint but a Network Watcher next-hop result points to an unexpected network virtual appliance. A DDoS investigation sees no L7 HTTP request details despite having network DDoS telemetry enabled. Which response best addresses these needs?
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns.
- Use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
- Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
- Use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; do not inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records.
Explanation
Correct Answer
C:A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions. Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures. Both actions are needed.
Incorrect Answers
A:Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures.
B:A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions.
D:This plan leaves out a required action: Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records. The remaining action alone does not satisfy the situation.
Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests