AZ-700 practice questions 171–180

1. Question 171 · 339 in bank

   You have an Azure subscription that contains the following resources: ✑ A virtual network named Vnet1 ✑ Two subnets named subnet1 and AzureFirewallSubnet ✑ A public Azure Firewall named FW1 ✑ A route table named RT1 that is associated to Subnet 1 ✑ A rule routing of 0.0.0.0/0 to FW1 in RT1 After deploying 10 servers that run Windows Server to Subnet 1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?

   • AOn FW1, configure a DNAT rule for port 1688.
   • BDeploy an application security group that allows outbound traffic to 1688.
   • COn FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
   • DOn FW1, create an outbound service tag rule for Azure Cloud.

   Show answer

   Answer: C

   Explanation

   I C the answer Azure uses different endpoints for KMS (Key Management Services) activation depending on the cloud region where the VM resides. When using this troubleshooting guide, use the appropriate KMS endpoint that applies to your region. Azure public cloud regions: kms.core.windows.net:1688 or azkms.core.windows.net:1688 Azure China 21Vianet national cloud regions: kms.core.chinacloudapi.cn:1688 or azkms.core.chinacloudapi.cn:1688 Azure Germany national cloud regions: kms.core.cloudapi.de:1688 Azure US Gov national cloud regions: kms.core.usgovcloudapi.net:1688

   Source: Adapted from community discussion — Lazylinux

   References

   • Microsoft Learn

   Next question

2. Question 172 · 339 in bank

   Select 3

   You have an Azure Front Door instance that has a single frontend named Frontend1 and an Azure Web Application Firewall (WAF) policy named Policy1. Policy1 redirects requests that have a header containing "string1" to https://www.contoso.com/redirect1. Policy1 is associated to Frontend1. You need to configure additional redirection settings. Requests to Frontend1 that have a header containing "string2" must be redirected to https:// www.contoso.com/redirect2. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate a custom rule.
   • BCreate a policy.
   • CCreate a frontend host.
   • DConfigure a managed rule.
   • EAdd a custom rule to Policy1.
   • FCreate an association.

   Show answer

   Answer: AEF

   Explanation

   At this link: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview#waf-policy-and-rules It states: A web application delivered by Front Door can have only one WAF policy associated with it at a time. Since the question states "Policy1 is associated to Frontend1.", this eliminates option B. The question also states: "Requests to Frontend1 that have a header containing "string2" must be redirected to https:// www.contoso.com/redirect2.", which tells us that we don't need a new frontend. So option C is eliminated. At the above link, it also states: "managed rule sets that are a collection of Azure-managed pre-configured set of rules." Since we are targeting a specific value of "string2", this option would be eliminated. That leaves us with only AEF as possible answers.

   Source: Adapted from community discussion — wooyourdaddy

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 173 · 339 in bank

   You have 10 Azure App Service instances. Each instance hosts the same web app. Each instance is in a different Azure region. You need to configure Azure Traffic Manager to direct users to the instance that has the lowest latency. Which routing method should you use?

   • Ageographic
   • Bweighted
   • Cpriority
   • Dperformance

   Show answer

   Answer: D

   Explanation

   Select Performance routing when you have endpoints in different geographic locations and you want end users to use the "closest" endpoint for the lowest network latency. elect Geographic routing to direct users to specific endpoints (Azure, External, or Nested) based on where their DNS queries originate from geographically. With this routing method, it enables you to be in compliance with scenarios such as data sovereignty mandates, localization of content & user experience and measuring traffic from different regions.

   Source: Adapted from community discussion — A_A_AB

   References

   • Microsoft Learn

   Next question

4. Question 174 · 339 in bank

   Your company has offices in London, Tokyo, and New York. The company has a web app named App1 that has the Azure Traffic Manager profile shown in the following table.

   

   In Asia, you plan to deploy an additional endpoint that will host an updated version of App1. You need to route 10 percent of the traffic from the Tokyo office to the new endpoint during testing. What should you configure in Traffic Manager?

   • Atwo profiles and five endpoints
   • Btwo profiles and four endpoints
   • Cthree profiles and four endpoints
   • Done profile and five endpoints

   Show answer

   Answer: B

   Explanation

   You cannot combine both 'Weighted' and 'Geographic' traffic-routing in a single profile. The parent profile still uses the Geographic traffic-routing method and child profile uses the Weighted traffic-routing method. This 'child' profile act as an endpoint to the 'parent' profile.

   Source: Adapted from community discussion — sapien45

   References

   • Microsoft Learn

   Next question

5. Question 175 · 339 in bank

   HOTSPOT - You configure a route table named RT1 that has the routes shown in the following table.

   

   You have an Azure virtual network named Vnet1 that has the subnets shown in the following table.

   

   You have the resources shown in the following table.

   

   Vnet1 connects to an ExpressRoute circuit. The on-premises router advertises the following routes: ✑ 0.0.0.0/0 ✑ 10.0.0.0/16 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - NVA1 with IP (NVA-network virtual appliance) 192.168.0.4 is on the DMZ subnet. It will use route 10.0.0.0/16 to the on-premises network. Box 2: No - VM2 has IP address 192.168.2.4 and is on the BackEnd subnet. VM2 will not use the RT1 route table, and will not reach the on-premises network through NVA1. Box 3: Yes - VM1 with IP address 192.168.1.4 is on the FrontEnd subnet, and will use the RT1 routing table. It will use Route2 and Next Hop IP address 192.168.0.4, IP address of NVA1, to reach VM2.

   Source: Adapted from community discussion — Cristoicach91

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 176 · 339 in bank

   HOTSPOT - You have an Azure subscription. The subscription contains virtual machines that host websites as shown in the following table.

   

   You have the Azure Traffic Manager profiles shown in the following table.

   

   You have the endpoints shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - VM1, which is hosting site1.contoso.com, is located in East US. The VM1 endpoint status is degraded. Endpoint monitoring health checks are failing. The endpoint isn't included in DNS responses and doesn't receive traffic. When an endpoint has a Degraded status, it's no longer returned in response to DNS queries. Instead, an alternative endpoint is chosen and returned. The traffic- routing method configured in the profile determines how the alternative endpoint is chosen. Priority. Endpoints form a prioritized list. The first available endpoint on the list is always returned. If an endpoint status is Degraded, then the next available endpoint is returned. The user will connect to site2.us.contoso.com instead. Box 2: No - VM3, which is hosting site2.contoso.com, is located in in East US. The VM3 endpoint status is CheckingEndpoint. The endpoint is monitored, but the results of the first probe haven't been received yet. CheckingEndpoint is a temporary state that usually occurs immediately after adding or enabling an endpoint in the profile. An endpoint in this state is included in DNS responses and can receive traffic. User will connect to site2.contoso.com, not to site2.uk.contoso.com Box 3: No - VM3, which is hosting site2.contoso.com, is located in in East US. The VM1 endpoint status is CheckingEndpoint, which is OK (see above). User will connect to site2.contoso.com, not to site2.japan.contoso.com Reference: https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoring

   Source: Adapted from community discussion — jellybiscuit

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 177 · 339 in bank

   You have an Azure subscription that contains the public IP addresses shown in the following table.

   

   You plan to deploy a NAT gateway named NAT1. Which public IP addresses can be used as the public IP address for NAT1?

   • AIP3 only
   • BIP5 only
   • CIP2 and IP4 only
   • DIP1, IP3 and IP5 only
   • EIP3 and IP5 only

   Show answer

   Answer: A

   Explanation

   Answer is correct. Per the link, NAT cannot be associated to an IPv6 Public IP address or IPv6 Public IP Prefix. However, it can be associated to a dual stack subnet.

   Source: Adapted from community discussion — crawfish

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 178 · 339 in bank

   You have an Azure application gateway configured for a single website that is available at https://www.contoso.com. The application gateway contains one backend pool and one rule. The backend pool contains two backend servers. Each backend server has an additional website that is available on port 8080. You need to ensure that if port 8080 is unavailable on a backend server, all the traffic for https://www.contoso.com is redirected to the other backend server. What should you do?

   • ACreate a health probe
   • BAdd a new rule
   • CChange the port on the listener
   • DAdd a new listener

   Show answer

   Answer: A

   Explanation

   Option A appears correct. By default, the health probe checks port 80 for HTTP traffic. However, you can configure the health probe to check other ports, such as port 8080 in this case. If the application gateway determines that a backend server is unavailable, it can automatically redirect traffic to the other available backend server.

   Source: Adapted from community discussion — omgMerrick

   Next question

9. Question 179 · 339 in bank

   You have an Azure subscription that contains the following resources: • A virtual network named Vnet1 • Two subnets named subnet1 and AzureFirewallSubnet • A public Azure Firewall named FW1 • A route table named RT1 that is associated to Subnet1 • A rule routing of 0.0.0.0/0 to FW1 in RT1 After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?

   • AOn FW1, create an outbound service tag rule for AzureCloud.
   • BAdd an internet route to RT1 for the Azure Key Management Service (KMS).
   • COn FW1, configure a DNAT rule for port 1688.
   • DDeploy an Azure Standard Load Balancer that has an outbound NAT rule.

   Show answer

   Answer: B

   Explanation

   Correct Answer is B. A: AzureCloud is the wrong tag. Apparently would need to be AzurePlatformLKM-Windows licensing or key management service. https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags B: Something is blocking access to KMS, so a route should fix that. https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems#cause C: DNAT rules are inbound only. D: A Nat rule wouldn't work, for reasons. https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules

   Source: Adapted from community discussion — flurgen248

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 180 · 339 in bank

    You have an Azure subscription. You plan to implement Azure Virtual WAN as shown in the following exhibit.

    

    What is the minimum number of route tables that you should create?

    • A1
    • B2
    • C4
    • D6

    Show answer

    Answer: B

    Explanation

    Standard Virtual WAN is enabled due to the presence of a router in every virtual hub. This router is instantiated when the virtual hub is first created. If it has a router. Then it needs a routing table. Therefore two hubs. Two routing tables.

    Source: Adapted from community discussion — DeepMoon

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 171. 339 questions available.