AZ-700 practice questions 101–110

1. Question 101 · 339 in bank

   SIMULATION -

   

   Username and password - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Azure Username: User-12345678@cloudslice.onmicrosoft.com Azure Password: xxxxxxxxxx - If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 12345678 - You plan to deploy 100 virtual machines to subnet-1. The virtual machines will NOT be assigned a public IP address. The virtual machines will call the same API which is hosted by a third party. The virtual machines will make more than 10,000 calls per minute to the API. You need to minimize the risk of SNAT port exhaustion. The solution must minimize administrative effort. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Key here as mentioned is the Public IP Prefix, since no mention of the Ports to be used I would go for Max i.e. /28 here is more from MS doco A single NAT gateway can scale up to 16 IP addresses. Each NAT gateway public IP address provides 64,512 SNAT ports to make outbound connections. NAT gateway can scale up to over 1 million SNAT ports. NAT gateway can use up to 16 public IP addresses. NAT gateway can use any combination of public IP addresses and public IP prefixes totaling to 16 addresses. NAT gateway can support the following prefix sizes: /28 (16 addresses), /29 (8 addresses), /30 (4 addresses), and /31 (2 addresses). More here https://learn.microsoft.com/en-us/azure/nat-gateway/nat-gateway-snat#nat-gateway-snat-port-selection-and-reuse https://learn.microsoft.com/en-us/azure/nat-gateway/faq

   Source: Adapted from community discussion — Lazylinux

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 102 · 339 in bank

   You have an Azure subscription that contains a virtual machine named VM1, a virtual network interface card (NIC) named NIC1, and a Basic SKU public IP address named IP1. NIC1 is attached to VM1. IP1 is associated to NIC1. You need to upgrade IP1 to the Standard SKU. What should you do first?

   • ACreate a new NIC for VMI.
   • BDisassociate IP1 from NIC1.
   • CDetach NIC1 from VM1.
   • DStop vM1.

   Show answer

   Answer: B

   Next question

3. Question 103 · 339 in bank

   SIMULATION -

   

   Username and password - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Azure Username: User-12345678@cloudslice.onmicrosoft.com Azure Password: xxxxxxxxxx - If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 12345678 - You plan to deploy an appliance to subnet3-2. The appliance will perform packet inspection and will have an IP address of 10.3.2.100. You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You need to create route table as per below – Called InternetAccess Destination type – IP Address Destination IP address/CIDR ranges – 0.0.0.0/0 Next Hop type – Virtual Appliance Next Hop Address - 10.3.2.100 Save and now associate the InternetAccess route table with subnet - subnet3-1 All done

   Source: Adapted from community discussion — Lazylinux

   

   Next question

4. Question 104 · 339 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You test DDoSplan1 by running a simulation that targets IP1. You need to review the DDoS Protection mitigation reports. What should you use?

   • ADDos protection plan in the Azure portal
   • BLog Analytics
   • CMicrosoft Defender for Cloud
   • DAzure Monitor Network Insights

   Show answer

   Answer: B

   Next question

5. Question 105 · 339 in bank

   SIMULATION -

   

   Username and password - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Azure Username: User-12345678@cloudslice.onmicrosoft.com Azure Password: xxxxxxxxxx - If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 12345678 - You plan to use VNET4 for an Azure API Management implementation. You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canada. You do NOT need to create the application gateway to complete this task. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Rule Priority Example Allow Canada IPs Rule: Priority: 100 (this rule will be evaluated first) Action: Allow requests from Canadian IP addresses. Block All Other Traffic Rule: Priority: 200 (this rule will be evaluated after the allow rule) Action: Block all other requests. Azure Portal View While I can’t provide a direct screenshot, here’s a textual representation of how it might look in the Azure portal: +-----------------------------------------------------+ | WAF Policy Rules | +---------------------+-------------------------------+ | Rule Name | Priority | +---------------------+-------------------------------+ | AllowCanadaIPs | 100 | | BlockAllOtherTraffic | 200 | +---------------------+-------------------------------+

   Source: Adapted from community discussion — thekhijir

   

   Next question

6. Question 106 · 339 in bank

   SIMULATION -

   

   Username and password - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Azure Username: User-12345678@cloudslice.onmicrosoft.com Azure Password: xxxxxxxxxx - If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 12345678 - You plan to deploy several virtual machines to subnet1-2. You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2. The solution must minimize administrative effort. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The lab is about creating NSG only, The NSG needs to deny traffic on port 5585 to the Subnet1-2. The image is not correct. Create an NSG with deny inbound traffic on port 5585 and associate the NSG with Subnet1-2. Step 1: Create NSG Upper left side of the portal Search for Network Security Group Put > Subscription > Resource Group > Name > Region Tags Review+Create Step 2: Add Inbound Security Source > Any Port Range > * Destination > IP address Destination IP address/CIDR Range > Range of Subnet1-2 Service > Custom Destination Port Range > 5585 Protocol > Any Action > Deny Priority > 100 Name > DenyAnyCustom8080Inbound Add Step 3: Associate the NSG with the subnet Go to Virtual Network Select the Subnet1-2 On NSG section > select the proper name of the NSG that you create earlier Save

   Source: Adapted from community discussion — ABIYGK

   References

   • Microsoft Learn

   

   Next question

7. Question 107 · 339 in bank

   SIMULATION -

   

   Username and password - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Azure Username: User-12345678@cloudslice.onmicrosoft.com Azure Password: xxxxxxxxxx - If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 12345678 - You need to ensure that only hosts on VNET1 can access the storage123456789 storage account. The solution must ensure that access occurs over the Azure backbone network. To complete this task, sign in to the Azure portal.

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Totally INCORRECT - please read before you write so u can understanding what you writing!! Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

   Source: Adapted from community discussion — Lazylinux

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 108 · 339 in bank

   HOTSPOT - You have an Azure virtual network named Vnet1 that contains two subnets named Subnet1 and Subnet2. Both subnets contain virtual machines. You create a NAT gateway named NATgateway1 as shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NAT Gateway can be associated to multiple subnets as long as they are in the same VNET. The (28) indicates that the public IP prefix is a /28, which allows 16 IP addresses. Correct answer

   Source: Adapted from community discussion — MrBlueSky

   References

   • Microsoft Learn

   

   Next question

9. Question 109 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains the resources shown in the following table.

   

   You need to publish App1 by using AG1 and a URL of https://app1.contoso.com. The solution must meet the following requirements: • TLS connections must terminate on AG1. • Minimize the number of targets in the backend pool of AG1. • Minimize the number of deployed copies of the SSL certificate of App1. How many locations should you import to the certificate, and how many targets should you add to the backend pool of AG1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   why not 1 and 1? VMSS itself can be a backend target and not the 4 VM's making the VMSS. Certificate can come from Key Vault.

   Source: Adapted from community discussion — seth_saurabh84

   References

   • Microsoft Learn

   

   Next question

10. Question 110 · 339 in bank

    HOTSPOT - You have an Azure private DNS zone named contoso.com that is linked to the virtual networks shown in the following table.

    

    The links have auto registration enabled. You create the virtual machines shown in the following table.

    

    You manually add the following entry to the contoso.com zone: ✑ Name: VM1 IP address: 10.1.10.9 -

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: No - The manual DNS record will overwrite the auto-registered DNS record so VM1 will resolve to 10.1.10.9. Box 2: No - The DNS record for VM1 is now a manually created record rather than an auto-registered record. Only auto-registered DNS records are deleted when a VM is deleted. Box 3: No - This answer depends on how the IP address is changed. To change the IP address of a VM manually, you would need to select 'Static' as the IP address assignment. In this case, the DNS record will not be updated because only DHCP assigned IP addresses are auto-registered. Reference: https://docs.microsoft.com/en-us/azure/dns/dns-faq-private

    Source: Adapted from community discussion — rakesh333

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 101. 339 questions available.