Microsoft AZ-700 Practice Test 70

Question 690

A VM communicates to a service through a private endpoint but a Network Watcher next-hop result points to an unexpected network virtual appliance. A DDoS investigation sees no L7 HTTP request details despite having network DDoS telemetry enabled. Which response best addresses these needs?

Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; examine virtual network flow logs and appropriate filtering or analytics to identify observed denied communication patterns.
Use Defender for Cloud attack path evidence and exposure context to sequence mitigations for reachable critical assets; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records; use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence.
Use application-layer WAF and application access logs for HTTP-specific analysis alongside network DDoS evidence; do not inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records.

Explanation

Correct Answer

A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions. Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures. Both actions are needed.

Incorrect Answers

Network volumetric mitigation metrics do not replace inspection of web request paths, headers, and attack signatures.

A next-hop anomaly identifies a routing choice; renaming the target does not override subnet route decisions.

This plan leaves out a required action: Inspect the effective routes and any forced-tunnel UDR association before changing the endpoint's DNS records. The remaining action alone does not satisfy the situation.

Question 691

A team wants to shrink an active VNet subnet while network interfaces and endpoints still occupy addresses outside the proposed range. A hub already uses a large address prefix and an architect adds an overlapping prefix to the same VNet for a new department. What is the most appropriate plan for this situation?

Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity.
Choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity; do not Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix.
Reserve a dedicated address segment or enforce capacity limits for planned private endpoints before the test fleet expands; choose distinct address ranges and validate existing VNet address-space and peering constraints before adding capacity.
Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix; Account for Azure-reserved subnet addresses and resize the subnet to provide enough usable IPs.

Explanation

Correct Answer

Subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints. Address ranges within the network design must avoid overlap so that effective routes remain unambiguous. Both actions are needed.

Incorrect Answers

This plan leaves out a required action: Move or deallocate affected resources and validate subnet resize constraints before applying a smaller prefix. The remaining action alone does not satisfy the situation.

Subnet modifications must preserve assigned addresses and satisfy Azure allocation and service constraints.

Address ranges within the network design must avoid overlap so that effective routes remain unambiguous.

Question 692

A multinational organization manually creates hundreds of peering relationships, causing inconsistent spoke connectivity across subscriptions. Which response best addresses this Azure networking scenario?

Keep packet forwarding on supported gateways or NVAs and use Route Server only for appropriate routing control-plane exchange.
Evaluate Azure Route Server with supported BGP peers and effective route propagation through the hub design.
Apply Azure Virtual Network Manager connectivity configurations with well-defined network groups and rollout scope.
Review the security admin configuration's action and priority semantics and pilot the deployment against intended network groups.

Explanation

Correct Answer

Central network grouping can standardize supported connectivity patterns instead of relying on separate manual peer edits.

Incorrect Answers

For this question, central network grouping can standardize supported connectivity patterns instead of relying on separate manual peer edits.

For this finding, central network grouping can standardize supported connectivity patterns instead of relying on separate manual peer edits.

Here, central network grouping can standardize supported connectivity patterns instead of relying on separate manual peer edits.

Question 693

An ASG rule fails to apply to a target VM because its network interface was never made a member of the designated group. A security team must protect subnet traffic while retaining an approved central segmentation policy distributed to many VNets. Which response best addresses these needs?

Use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls; do not assign the appropriate VM network interface to the ASG and check effective security rules.
Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
Assign the appropriate VM network interface to the ASG and check effective security rules; Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces.
Assign the appropriate VM network interface to the ASG and check effective security rules; use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.

Explanation

Correct Answer

An ASG reference matches configured membership and cannot infer application tier from resource names. Central policy can standardize segmentation, but group scope and precedence must be deliberately tested. Both actions are needed.

Incorrect Answers

This plan leaves out a required action: Assign the appropriate VM network interface to the ASG and check effective security rules. The remaining action alone does not satisfy the situation.

An ASG reference matches configured membership and cannot infer application tier from resource names.

Central policy can standardize segmentation, but group scope and precedence must be deliberately tested.

Question 694

A marketing site needs weighted distribution of new DNS lookups between regional hostnames for controlled rollout. Which response best addresses this Azure networking scenario?

Review DNS caching and TTL behavior and design client retry expectations for Traffic Manager failover.
Use Traffic Manager weighted routing with monitored endpoints and validate the resulting DNS responses.
Configure Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring.
Use a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection.

Explanation

Correct Answer

Weighted DNS routing can steer new resolver answers without providing layer-7 application transformations.

Incorrect Answers

Here, weighted DNS routing can steer new resolver answers without providing layer-7 application transformations.

Configuring Azure Traffic Manager with an appropriate traffic-routing method and endpoint monitoring would not meet the need for DNS configuration.

Using a supported web delivery layer such as Front Door or Application Gateway for TLS and WAF inspection would not meet the need for DNS configuration.

Question 695

A hub-and-spoke environment requires centralized stateful inspection of outbound traffic from many spokes and their on-premises extensions. An operations team configures an Azure Firewall network rule for web traffic but expects it to filter by individual HTTP URL path. A service hosted behind a firewall must be published to the internet through one approved public IP and translated to a private host. Which course of action addresses the stated issues?

Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address; use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities; and configure Azure Firewall application rules for supported web protocols and destination domains.
Configure Azure Firewall application rules for supported web protocols and destination domains; use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities; and configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address; configure Azure Firewall application rules for supported web protocols and destination domains; and configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.
Deploy Azure Firewall in a supported dedicated AzureFirewallSubnet and route approved flows through its private address; use appropriate application-layer controls and select firewall rules based on supported L3–L7 matching capabilities; and configure an Azure Firewall DNAT rule and corresponding backend routing and security controls.

Explanation

Correct Answer

Azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing. Firewall network rules are based on network tuples; they do not act as full HTTP path-based web application proxies. Destination network address translation publishes an approved private target rather than creating generalized inbound permission. Each decision addresses a separate requirement.

Incorrect Answers

Two actions meet their requirements, but action 3 misses this need: destination network address translation publishes an approved private target rather than creating generalized inbound permission.

Two actions meet their requirements, but action 1 misses this need: azure Firewall provides managed network inspection when deployed with its mandatory subnet and appropriate routing.

Two actions meet their requirements, but action 2 misses this need: firewall network rules are based on network tuples; they do not act as full HTTP path-based web application proxies.

Question 696

A security engineer creates one custom WAF allow rule ahead of managed rules and unintentionally lets selected traffic bypass later inspections. A team deploys a new Front Door WAF policy and checks only that HTTP status is 200 instead of validating known harmless attack-test fixtures. Which response best addresses these needs?

Review custom-rule priority and termination behavior before permitting exceptions to the managed rule set; evaluate supported WAF rate-limiting rules with appropriate thresholds, exceptions, and telemetry.
Review custom-rule priority and termination behavior before permitting exceptions to the managed rule set; run authorized representative request tests and correlate WAF logs with policy mode and expected decisions.
Map supported managed rule sets and custom-rule options to the new WAF platform before migration; run authorized representative request tests and correlate WAF logs with policy mode and expected decisions.
Run authorized representative request tests and correlate WAF logs with policy mode and expected decisions; do not review custom-rule priority and termination behavior before permitting exceptions to the managed rule set.

Explanation

Correct Answer

WAF custom rule evaluation can change whether subsequent protections are applied to a request. Functional and security behavior should be confirmed through actual matched requests, not service readiness alone. Both actions are needed.

Incorrect Answers

Functional and security behavior should be confirmed through actual matched requests, not service readiness alone.

WAF custom rule evaluation can change whether subsequent protections are applied to a request.

This plan leaves out a required action: Review custom-rule priority and termination behavior before permitting exceptions to the managed rule set. The remaining action alone does not satisfy the situation.

Question 697

A security analyst must verify whether a particular SSH packet is permitted but has only a list of all NSG rules. Which response best addresses this Azure networking scenario?

Remove broad inbound management exposure and use Bastion or a tightly controlled trusted administrative path.
Use Network Watcher IP flow verify with the precise source, destination, protocol, and ports.
Deploy Azure Bastion using its required subnet and authorize administrative access through that supported service.
Use supported virtual network flow logs and targeted query or analysis to correlate observed denied flows with effective policy.

Explanation

Correct Answer

The evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.

Incorrect Answers

For this finding, the evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.

Here, the evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.

For this question, the evaluated connection tuple reveals the effective NSG allow or deny rather than relying on visual rule inspection.

Question 698

A network rule uses overly broad any-to-any settings, and monitoring cannot identify which service depends on it. A public application behind Azure Firewall unexpectedly fails after IP translation because a team configures only a DNAT mapping and ignores the effective return route. A network security team adds a firewall rule collection but assumes its descriptive name determines evaluation ahead of other collections. Which course of action addresses the stated issues?

Align the documented DNS proxy and resolver settings and validate consistent destination resolution; validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session; and verify rule collection group and collection priorities and the documented processing order before rollout.
Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session; and verify rule collection group and collection priorities and the documented processing order before rollout.
Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; validate DNAT rule translation and bidirectional routing or SNAT expectations for the complete session; and align the documented DNS proxy and resolver settings and validate consistent destination resolution.
Analyze Azure Firewall flow logs and replace the broad rule with approved narrower application or network rules; align the documented DNS proxy and resolver settings and validate consistent destination resolution; and verify rule collection group and collection priorities and the documented processing order before rollout.

Explanation

Correct Answer

Observed flow data supports restricting exposure while preserving the identified business traffic. Address translation alone does not ensure symmetric reachability to and from a backend application. Azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names. Each decision addresses a separate requirement.

Incorrect Answers

Two actions meet their requirements, but action 1 misses this need: observed flow data supports restricting exposure while preserving the identified business traffic.

Two actions meet their requirements, but action 3 misses this need: azure Firewall policy evaluation depends on configured rule priorities and types, not on friendly names.

Two actions meet their requirements, but action 2 misses this need: address translation alone does not ensure symmetric reachability to and from a backend application.

Question 699

An enterprise enables a WAF policy on one Front Door domain and assumes all domains on a separate profile inherit it automatically. What should the Azure network engineer do?

Restrict the origin's network access so protected traffic must traverse the WAF-enabled ingress.
Use the narrowest supported WAF match-variable exclusion with controlled testing and monitoring.
After testing exclusions and rule behavior, enable Prevention mode on the appropriate policy and verify blocked outcomes.
Validate policy associations and the exact domains or endpoints protected in each relevant Front Door profile.

Explanation

Correct Answer

WAF protection must be explicitly associated with the intended application ingress scope.

Incorrect Answers

For this finding, wAF protection must be explicitly associated with the intended application ingress scope.

Here, wAF protection must be explicitly associated with the intended application ingress scope.

For this question, wAF protection must be explicitly associated with the intended application ingress scope.

Question 700

A VNet is migrated to a new hub but its flow log configuration still targets an obsolete storage account and monitoring shows no recent records. An ASG rule fails to apply to a target VM because its network interface was never made a member of the designated group. A security team must protect subnet traffic while retaining an approved central segmentation policy distributed to many VNets. What is the most appropriate plan for this situation?

Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; assign the appropriate VM network interface to the ASG and check effective security rules; and use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; assign the appropriate VM network interface to the ASG and check effective security rules; and Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces.
Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; Associate the NSG at the proper network scope and verify effective rules on representative workload interfaces; and use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.
Repair the supported VNet flow-log destination, permissions, and retention settings, then verify new records arrive; assign the appropriate VM network interface to the ASG and check effective security rules; and use Virtual Network Manager security admin configurations with carefully tested network group targeting and local NSG controls.

Explanation

Correct Answer

Flow logging depends on operational delivery and destination access, not solely on NSG rule existence. An ASG reference matches configured membership and cannot infer application tier from resource names. Central policy can standardize segmentation, but group scope and precedence must be deliberately tested. Each decision addresses a separate requirement.

Incorrect Answers

Two actions meet their requirements, but action 1 misses this need: flow logging depends on operational delivery and destination access, not solely on NSG rule existence.

Two actions meet their requirements, but action 3 misses this need: central policy can standardize segmentation, but group scope and precedence must be deliberately tested.

Two actions meet their requirements, but action 2 misses this need: an ASG reference matches configured membership and cannot infer application tier from resource names.

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests

Microsoft AZ-700 Practice Test 68 - 10 Questions (Last Reviewed 30-Oct-2026)
Microsoft AZ-700 Practice Test 69 - 10 Questions (Last Reviewed 29-Oct-2026)
Microsoft AZ-700 Practice Test 70 - 10 Questions (Last Reviewed 28-Oct-2026)

Pass Your Microsoft AZ-700 Exam Easy!

Question 690

Explanation

Correct Answer

Incorrect Answers

Question 691

Explanation

Correct Answer

Incorrect Answers

Question 692

Explanation

Correct Answer

Incorrect Answers

Question 693

Explanation

Correct Answer

Incorrect Answers

Question 694

Explanation

Correct Answer

Incorrect Answers

Question 695

Explanation

Correct Answer

Incorrect Answers

Question 696

Explanation

Correct Answer

Incorrect Answers

Question 697

Explanation

Correct Answer

Incorrect Answers

Question 698

Explanation

Correct Answer

Incorrect Answers

Question 699

Explanation

Correct Answer

Incorrect Answers

Question 700

Explanation

Correct Answer

Incorrect Answers

Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) Practice Tests