AZ-700 practice questions 301–310

1. Question 301 · 339 in bank

   You have an Azure virtual network named VNet1 that contains the subnets shown in the following table.

   

   You need to deploy an Azure application gateway named AppGW1 to VNet1. To where can you deploy AppGW1?

   • AGatewaySubnet only
   • BSubnet2 only
   • CSubnet1 or Subnet2 only
   • DSubnet2 or GatewaySubnet only
   • ESubnet1, Subnet2, and GatewaySubnet

   Show answer

   Answer: B

   Explanation

   provided answer is correct ! a dedicated subnet is required for the application gateway.You can have multiple instances of a given application gateway deployment in a subnet. You can also deploy other application gateways in the subnet. But you can't deploy any other resource in the application gateway subnet. You can't mix v1 and v2 Azure Application Gateway SKUs on the same subnet. https://learn.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure

   Source: Adapted from community discussion — tfktfk

   References

   • Microsoft Learn

   Next question

2. Question 302 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains multiple virtual machine scale sets and multiple Azure load balancers. The load balancers balance traffic across the scale sets. You plan to deploy Azure Front Door to load balance traffic across the load balancers. You need to identify which Front Door SKU to configure, and what to use to route the traffic to the load balancers. The solution must minimize costs. What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Not sure if the question is framed right. Found this in the FAQ. Azure Front Door Standard, Premium and (classic) tier requires a public IP or publicly resolvable DNS name to route traffic to backend resources. Azure resources such as Application Gateways or Azure Load Balancers can enable routing to resources within a virtual network. If you're using a Front Door Premium tier, you can enable Private Link to connect to origins behind an internal load balancer over a private endpoint.

   Source: Adapted from community discussion — khksoma

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 303 · 339 in bank

   DRAG DROP - You have an Azure subscription that contains the resources shown in the following table.

   

   You discover that users connect directly to App1. You need to meet the following requirements: • Administrators must only access App1 by using a private endpoint. • All user connections to App1 must be routed through FD1. • The downtime of connections to App1 must be minimized. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You have to minimize impact on users, so wouldn't it be? 1-configure the origin group 2-approve the private endpoint connection 3-Change DNS record of app1

   Source: Adapted from community discussion — ironbornson

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 304 · 339 in bank

   Your on-premises network contains a DNS server named Server1. You have an Azure subscription that contains the resources shown in the following table.

   

   The on-premises network is connected to VNet1 by using a Site-to-Site (S2S) VPN. You need to ensure that Server1 can resolve the DNS name of storage1. The solution must minimize costs and administrative effort. What should you use?

   • AAzure DNS Private Resolver
   • Ban Azure public DNS zone
   • Can Azure Private DNS zone
   • Dan Azure virtual machine that hosts a DNS service

   Show answer

   Answer: A

   Explanation

   A. Azure DNS Private Resolver Azure DNS Private Resolver is a new service that enables you to query Azure DNS private zones from an on-premises environment and vice versa without deploying VM based DNS servers. https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview

   Source: Adapted from community discussion — Acaer

   References

   • Microsoft Learn

   Next question

5. Question 305 · 339 in bank

   You have an Azure Private Link service named PL1 that uses an Azure load balancer named LB1. You need to ensure that PL1 can support a higher volume of outbound traffic. What should you do?

   • AIncrease the number of frontend IP configurations for LB1.
   • BIncrease the number of NAT IP addresses assigned to PL1.
   • CDeploy an Azure Application Gateway v2 instance to the source NAT subnet.
   • DRedeploy LB1 with a different SKU.

   Show answer

   Answer: B

   Explanation

   B. Increase the number of NAT IP addresses assigned to PL1. Since the question ask for outbound traffic: Each NAT IP provides 64k TCP connections (64k ports) per VM behind the Standard Load Balancer. In order to scale and add more connections, you can either add new NAT IPs or add more VMs behind the Standard Load Balancer. Doing so will scale the port availability and allow for more connections. Connections will be distributed across NAT IPs and VMs behind the Standard Load Balancer. https://learn.microsoft.com/en-us/azure/private-link/private-link-faq#what-is-the-nat--network-address-translation--ip-configuration-used-in-private-link-service--how-can-i-scale-in-terms-of-available-ports-and-connections--

   Source: Adapted from community discussion — Acaer

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 306 · 339 in bank

   You have an on-premises network named Site1. You have an Azure subscription that contains a virtual network named VNet1 and a storage account named storage1. Site1 and VNet1 are connected by using a Site-to-Site (S2S) VPN. You need to ensure that the servers in Site1 can connect to storage1 by using the S2S VPN. The solution must minimize administrative effort. What should you create on VNet1?

   • Aan Azure application gateway
   • Ban Azure Private Link service
   • Ca service endpoint
   • Da private endpoint

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

7. Question 307 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You need to restrict access to storage1 and sql1 by using service endpoints. The solution must meet the following requirements: • Allow access from Subnet1 to SQLDB1. • Implement service endpoint policies to restrict access to supported resources. • Allow access from Subnet1 to storage1 and the read-only replica of storage1 in the paired Azure region. What is the minimum number of service endpoints and service endpoint policies you should create? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correction, 1. Now we have Azure Storage cross-region service endpoints 2. You dont need a second policy for the second region: "RA-GRS secondary access is automatically allowed if the primary account is listed." https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview Then answer should be 2 & 1

   Source: Adapted from community discussion — Andrewwfw

   References

   • Microsoft Learn

   

   Next question

8. Question 308 · 339 in bank

   DRAG DROP - You have an Azure virtual network named Vnet1 that connects to an on-premises network. You have an Azure Storage account named storageaccount1 that contains blob storage. You need to configure a private endpoint for the blob storage. The solution must meet the following requirements: ✑ Ensure that all on-premises users can access storageaccount1 through the private endpoint. ✑ Prevent access to storageaccount1 from being interrupted. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   168.63.129.16 is the IP address of Azure DNS which hosts Azure Private DNS zones. It is only accessible from within a VNet which is why we need to forward on-prem DNS requests to the VM running DNS in the VNet. The VM will then forward the request to Azure DNS for the IP of the storage account private endpoint. Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

   Source: Adapted from community discussion — kerberos999

   References

   • Microsoft Learn

   

   Next question

9. Question 309 · 339 in bank

   HOTSPOT - You have an Azure subscription that is linked to a Microsoft Entra tenant. The subscription contains a virtual network named VNet1, a storage account named storage1, an Azure App Service app named App1, and an Azure SQL database named DB1. VNet1 contains two subnets named Subnet1 and Subnet2. Subnet1 and Subnet2 each has a subnet mask of 255.255.255.224. You plan to perform the following actions: • On Subnet1, configure a service endpoint to connect to storage1 and a service endpoint to connect to the Microsoft Entra tenant. • On Subnet2, configure a private endpoint to connect to App1 and a private endpoint to connect to DB1. How many IP addresses will be available on each subnet once the planned actions are complete? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct answer: a subnet mask of 255.255.255.224 equals a /27 CIDR, which has 32 host - 5 azure reserved = 27. Subnet1: Service endpoint does not use an IP from your network, which means subnet 1 has 27IPs available. Subnet2: a private endpoint uses a private IP from your subnet. Which means you lose 2 IPs since you need 2 private endpoints. then you have 25 IPs remaining.

   Source: Adapted from community discussion — bilzi

   

   Next question

10. Question 310 · 339 in bank

    You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a virtual machine named VM1. You plan to make VM1 available to the resources in Sub2 by using Azure Private Link. You need to ensure that the private link service can be configured to provide access to VM1. What should you configure in Sub1 first?

    • Aan Azure Private DNS zone
    • Ban Azure load balancer
    • Ca service endpoint
    • Da private endpoint

    Show answer

    Answer: B

    Explanation

    Configure 1. Standard LB (Provider side) 2. Enable private link service and attach to front end ip of LB(Provider side) 3.Shared private service id with user which can be uri (Provider side) 4. Create a private endpoint using private service id in step 3 (Subscriber side) 5. approve the request (Provider side) 6. Configure DNS record pointing to private ip address of endpoint (Subscriber side) 7. connection approved/rejected(Subscriber side) ============= https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview

    Source: Adapted from community discussion — gaurav4101

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 301. 339 questions available.