AZ-700 practice questions 271–280

1. Question 271 · 339 in bank

   HOTSPOT - You have a firewall that is managed by using an Azure Firewall Premium policy named Policy1. You need to configure Policy1 to block outbound traffic to the following locations: • Malicious addresses identified by Microsoft. • Social networking sites The solution must minimize administrative effort. What should you configure in Policy1 for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

2. Question 272 · 339 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   NSG1 is associated to the NIC of VM1 and contains the rules shown in the following table.

   

   You collect NSG flow logs for five minutes for the following activities: • Two RDP sessions from VM1 to VM2, each initiated from a different TCP port • Three SSH sessions from VM2 to VM1, each initiated from a different TCP port You analyze the logs by using Traffic Analytics in Azure Network Watcher. How many aggregated flow entries will Traffic Analytics identify?

   • A1
   • B2
   • C5
   • D10

   Show answer

   Answer: C

   Explanation

   How traffic analytics works Traffic analytics examines raw flow logs. It then reduces the log volume by aggregating flows that have a common source IP address, destination IP address, destination port, and protocol. An example might involve Host 1 at IP address 10.10.10.10 and Host 2 at IP address 10.10.20.10. Suppose these two hosts communicate 100 times over a period of one hour. The raw flow log has 100 entries in this case. If these hosts use the HTTP protocol on port 80 for each of those 100 interactions, the reduced log has one entry. That entry states that Host 1 and Host 2 communicated 100 times over a period of one hour by using the HTTP protocol on port 80.

   Source: Adapted from community discussion — juancarlosdlar

   Next question

3. Question 273 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains 1,000 virtual machines. You collect network security group (NSG) flow logs. You need to identify all the virtual machines that have interacted with non-Azure public IP addresses during the last 30 days. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

4. Question 274 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table:

   

   Each quarter, you deploy five new virtual machines to host App1. You need to add a rule to NSG1 to ensure that the virtual machines that host App1 can connect to SQL1 and SQL2. The solution must follow the principle of least privilege and minimize administrative effort. How should you configure the source property and the destination property for the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Source: 10.1.0.0/24 Reason: The virtual machines hosting App1 are in Subnet2, which is part of the 10.1.0.0/24 subnet. Using Subnet2’s IP range (10.1.0.0/24) as the source ensures only these VMs can connect to SQL1 and SQL2. Destination: ASG1 Reason: ASG1 contains SQL1 and SQL2. Using ASG1 as the destination ensures only these SQL servers receive traffic, avoiding unnecessary exposure.

   Source: Adapted from community discussion — OhMyDandy

   

   Next question

5. Question 275 · 339 in bank

   You have an Azure subscription that contains an Azure Front Door named FD1. FD1 is configured as shown in the following exhibit.

   

   You need to enable Azure Private Link for FD1. What should you do first?

   • AAdd an endpoint.
   • BCreate a custom route.
   • CCreate an origin group.
   • DChange Pricing Tier to Azure Front Door Premium.

   Show answer

   Answer: D

   Next question

6. Question 276 · 339 in bank

   HOTSPOT - You have an Azure firewall shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: If forced tunneling was enabled, the Firewall Subnet would be named AzureFirewallManagementSubnet. Forced tunneling can only be enabled during the creation of the firewall. It cannot be enabled after the firewall has been deployed. Box 2: The ג€Visit Azure Firewall Manager to configure and manage this firewallג€ link in the exhibit shows that the firewall is managed by Azure Firewall Manager.

   Source: Adapted from community discussion — jkklim

   References

   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 277 · 339 in bank

   You have an Azure subscription that contains an instance of Azure Firewall Standard named AzFW1. You plan to enable the following: • TLS inspection • Threat intelligence • A network intrusion detection and prevention system (IDPS) What can you enable by using AzFW1?

   • ATLS inspection only
   • Bthreat intelligence only
   • CTLS inspection and the IDPS only
   • Dthreat intelligence and the IDPS only
   • ETLS inspection, threat intelligence, and the IDPS

   Show answer

   Answer: B

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 278 · 339 in bank

   DRAG DROP - You have an Azure Web Application Firewall (WAF) v2 tier named AG1 on an Azure application gateway. AG1 has a policy named Policy1. You need to add a custom rule to Policy1. The rule must block all requests from IP addresses in a specific IP address range. Which four PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

9. Question 279 · 339 in bank

   You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1. You need to deploy Azure Firewall to RG1. The solution must minimize administrative effort. What should you do first?

   • ACreate a secured virtual hub named AzureFirewallHub.
   • BCreate a new virtual network named AzureFirewallNetwork.
   • CCreate a new resource group named AzurFirewellRescurceGroup.
   • DOn VNet1, create virtual subnet named AzureFirewallSubnet

   Show answer

   Answer: D

   Next question

10. Question 280 · 339 in bank

    HOTSPOT - You have an Azure subscription. You plan to implement an Azure application gateway named AGW1. You need to implement an external TLS certificate store for AGW1. The solution must meet the following requirements: • Keys must be stored by using the highest possible security. • Administrative effort must be minimized. Which type of certificate store should you use, and which type of identity should you use to access the store? To answer, select the appropriate options in the answer area NOTE: Each correct answer is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 271. 339 questions available.