AZ-700 practice questions 141–150

1. Question 141 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You need to ensure that remote users can establish RDP connections to the virtual machines by using Bastion1. How should you configure the rules for NSG1 for traffic from the internet to AzureBastionSubnet and for traffic from AzureBastionSubnet to Subnet1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

2. Question 142 · 339 in bank

   DRAG DROP - You have the resources shown in the following table.

   

   From the Microsoft Entra admin center, you register the Azure VPN application as an enterprise application. You need to enable Microsoft Entra authentication for the P2S VPN connections. The solution must meet the following requirements: • Ensure that only the members of Group1 can establish VPN connections to VPNGW1. • Ensure that only the members of Group2 can establish VPN connections to VPNGW2. In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

3. Question 143 · 339 in bank

   DRAG DROP - You have an on-premises network. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway named Gateway1. You need to implement an ExpressRoute solution from a third-party provider named Fabrikam, Inc. The solution must ensure that devices on the on-premises network can connect to the Azure resources on VNet1. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

4. Question 144 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. Your on-premises network connects to VNet1 by using a Site-to-Site (S2S) VPN connection. You need to ensure that Azure Network Watcher generates an alert if the VPN connection fails. Which Network Watcher feature should you use to generate the alert, and which data source should the feature query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   It is VPN troubleshoot and Network Watcher Agent Enable Network Watcher: Ensure Network Watcher is enabled in the region where your resources are located. Configure VPN Troubleshoot: In the Azure portal, navigate to Network Watcher. Under Network diagnostic tools, select VPN troubleshoot. Select the virtual network gateway and connection you want to monitor. Choose a storage account to save the diagnostic logs. Create an Alert Rule: Go to Alerts in the Azure portal. Create a new alert rule. Set the condition to monitor the VPN connection status. Define the action group to notify you when the alert is triggered.

   Source: Adapted from community discussion — exam2301

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 145 · 339 in bank

   You have the Azure subscriptions shown in the following table.

   

   Each virtual network contains 20 internet-accessible resources that are assigned public IP addresses. You need to implement Azure DDoS Network Protection to protect the resources. The solution must minimize costs. What is the minimum number of DDoS Network Protection plans you should deploy?

   • A1
   • B2
   • C3
   • D6

   Show answer

   Answer: B

   Explanation

   One DDOS plan per 100 IP Addresses = 2 plans. Link 3 vNets to plan 1; Link the remaining 3 vNets to plan 2 https://azure.microsoft.com/en-us/pricing/details/ddos-protection/

   Source: Adapted from community discussion — alinuxguru70

   References

   • azure.microsoft.com documentation

   Next question

6. Question 146 · 339 in bank

   You have an Azure subscription that contains 100 network security groups (NSGs). You need to ensure that you log the application of specific NSG rules. Which type of log should you configure?

   • Aflow log
   • Bactivity log
   • CAzure resource log
   • Daudit log

   Show answer

   Answer: A

   Explanation

   Flow logs is correct. ----------------------- Identify unknown or undesired traffic. Monitor traffic levels and bandwidth consumption. Filter flow logs by IP and port to understand application behavior. Export flow logs to analytics and visualization tools of your choice to set up monitoring dashboards. https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview#common-use-cases ================== Azure resource logs are platform logs that provide insight into operations that are performed in an Azure resource. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/resource-logs

   Source: Adapted from community discussion — gaurav4101

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 147 · 339 in bank

   DRAG DROP - You have Azure virtual networks named Hub1 and Spoke1. Hub1 connects to an on-premises network by using a Site-to-Site VPN connection. You are implementing peering between Hub1 and Spoke1. You need to ensure that a virtual machine connected to Spoke1 can connect to the on-premises network through Hub1. How should you complete the PowerShell script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli#virtual-network-peering

   Source: Adapted from community discussion — walkwolf3

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 148 · 339 in bank

   Your company has a remote office that contains a macOS device named Device1. Device1 has an IKEv2 VPN client installed. You have an Azure subscription that contains the resources shown in the following table.

   

   You need to ensure that Device1 can access the resources on VNet1 by using the VPN connections of VPNGW1. The solution must minimize administrative effort. What should you do first?

   • ATo VNet1, deploy a virtual machine that contains a RADIUS server.
   • BOn Device1, install the OpenVPN client.
   • COn Device1, add an X.509 certificate.
   • DFrom Devices in the Microsoft Entra admin center, configure the Device settings.

   Show answer

   Answer: B

   Explanation

   The question is saying your P2S VPN (VPNGW1) is configured for Entra ID authentication. However, the Mac (Device1) is only has IKEv2 VPN client installed (use for cert auth) The question is asking to allow Device1 to be able to connect to VNET1 using VPNGW1 which mean the Mac has to be able to authenticate with Entra ID. --> The answer with least admin effort is to "Install the Open VPN client" on the Mac which is Azure VPN client https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-entra-vpn-client-mac

   Source: Adapted from community discussion — e6d6bf4

   References

   • Microsoft Learn

   Next question

9. Question 149 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You plan to deploy Azure virtual machines and Azure Bastion to VNet1. You need to recommend an IP subnetting configuration for VNet1. The solution must maximize the number of IP addresses that can be assigned to the virtual machines. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I believe the correct answer is: /25 and 182 Because the total address space is /24 which gives 265 IPs. This number should be used to address both of the VM subnets and the Bastion subnet. By default, Bastion subnets takes /26 which gives 64 IP address. So the remaining IP addresses from the total address space is: 256-64 = 192 available IP address to be used for VMs. But to use this IP range, needs to be divided into to VM Subnets: /25 (128 - 5 = 123) /26 (64 - 5 = 59) Based on the above the total number of the available IP address for VM subnets is: 182 In the question its asking for the "Bit mask for the LARGER virtual machine subnet" which is: /25

   Source: Adapted from community discussion — Knight_Of_Peace

   

   Next question

10. Question 150 · 339 in bank

    HOTSPOT - You have an on-premises network that includes the sites shown in the following table.

    

    Each site is connected to the Internet by a firewall. All sites are connected to an SD-WAN. Each site is configured to propagate routes by using BGP. You have an Azure subscription that includes a virtual network named Vnet1 that contains a Virtual Network Gateway named Gateway1. You create a local network gateway with the configuration shown in the gateway exhibit (Click the Gateway tab.)

    

    You create a Site-to-Site (S2S) connection with the configuration shown in connection exhibit. (Click the Connection tab.)

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    No to the question. The current Local Network Gateway configured to point to Public IP (131.107.50.60) of on-prem Firewall is correct. However the configured address space (172.16.0.0/16) is not correct. The address space of the target Firewall is (172.16.0.0/24). Therefore address space need to be updated for Paris user to connect...not the IP address.

    Source: Adapted from community discussion — e6d6bf4

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 141. 339 questions available.