AZ-700 practice questions 311–320

1. Question 311 · 339 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   VNet1 contains a subnet named Subnet. You need to ensure that the resources connected to Subnet1 can access only storage1 and storage3. The solution must minimize administrative effort. What should you configure?

   • Aan application security group
   • BAzure Private Link
   • Ca service endpoint policy
   • Da service tag

   Show answer

   Answer: C

   Explanation

   C Service endpoint policy Read the note in this article https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview "Service endpoint policies are allow policies, so apart from the specified resources, all other resources are restricted."

   Source: Adapted from community discussion — manhattan

   References

   • Microsoft Learn

   Next question

2. Question 312 · 339 in bank

   You have an on-premises network named Site1. You have an Azure subscription that contains a storage account named storage1 and a virtual network named VNet1. VNet1 contains a subnet named Subnet1. A private endpoint for storage1 is connected to Subnet1. Site1 is connected to VNet1 by using a Site-to-Site (S2S) VPN. You need to control access to storage1 from Site1 by using network security groups (NSGs), What should you do first?

   • AConfigure a network policy for private endpoints on Subnet1.
   • BCreate a subnet delegation on Subnet1.
   • CAssociate a route table with Subnet1.
   • DAssociate a NAT gateway with Subnet1.

   Show answer

   Answer: A

   Explanation

   it should be the right one A, network policies for private endpoints This setting only applies to private endpoints in the subnet and affects all private endpoints in the subnet. For other resources in the subnet, access is controlled based on security rules in the network security group. https://learn.microsoft.com/en-us/azure/private-link/disable-private-endpoint-network-policy?tabs=network-policy-portal

   Source: Adapted from community discussion — manhattan

   References

   • Microsoft Learn

   Next question

3. Question 313 · 339 in bank

   DRAG DROP - You have two Azure subscriptions named Sub1 and Sub2 that contain the resources shown in the following table.

   

   VNet1 and VNet2 are NOT connected. You plan to create an Azure Private Link service named Link1 that will be used to connect VNet1 and VNet2. You need to ensure that Link1 meets the following requirements: • Ensures that VM1 can connect only to a web app hosted on VM2 • Prevents VM1 from connecting to the other resources that are connected to VNet2 Which additional resources should you create for each virtual network? To answer, drag the appropriate resources to the correct virtual networks. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

4. Question 314 · 339 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You need to ensure that the virtual machines can access storage1, storage2, and DB1 by using service endpoints. What is the minimum number of service endpoints you should create?

   • A2
   • B3
   • C4
   • D12

   Show answer

   Answer: A

   Explanation

   2 Both storage accounts require a single service endpoint for "Microsoft.Storage." The Azure SQL Database requires a service endpoint for "Microsoft.Sql."

   Source: Adapted from community discussion — alinuxguru70

   Next question

5. Question 315 · 339 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   Subnet1 is associated with a service endpoint policy named Policy1. Policy1 specifies a single resource that references storage1. To Subnet1, you deploy an Azure Batch pool named Pool1. You need to ensure that the compute resources in Pool1 can access storage1. What should you do?

   • ATo Policy1, add a resource.
   • BTo Policy1, add an alias.
   • CTo Subnet1, add a storage endpoint for the storage service.
   • DTo Subnet1, add a subnet delegation.

   Show answer

   Answer: A

   Explanation

   B. To Policy1, add an alias: Adding an alias to Policy1 does not solve the problem because the issue is about explicitly referencing the resource, not using aliases. C. To Subnet1, add a storage endpoint for the storage service: Subnet1 already has a storage endpoint enabled (otherwise, Policy1 wouldn't work). Adding it again isn't needed. D. To Subnet1, add a subnet delegation: Subnet delegation is used to dedicate a subnet to a specific Azure service, such as Azure Batch or Azure Kubernetes Service. It does not address the issue of enabling access to the storage account.

   Source: Adapted from community discussion — Harish63

   References

   • Microsoft Learn

   Next question

6. Question 316 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You need to ensure that network traffic is routed over the Azure backbone network for the following scenarios: • Traffic from SQLMIT to storage1 • Traffic from domain joined servers on VNet2 to storage The solution must minimize costs. What should you configure for each scenario? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   actually I have dug a bit more and change my mind, the first one seems to point me straight to the service endpoint for SQL, to me it makes sense https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/public-endpoint-configure?view=azuresql&tabs=azure-portal 1) service endpoint policy for SQL 2) Private endpoint

   Source: Adapted from community discussion — manhattan

   References

   • Microsoft Learn

   

   Next question

7. Question 317 · 339 in bank

   You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1. You plan to add a private endpoint to Subnet. You need to ensure that you can route traffic between the private endpoint and the Azure Private Link service by using a user-defined route. What should you do first on Subnet1?

   • AEnable network policy.
   • BEnable delegation.
   • CCreate a service endpoint.
   • DProvision a Standard Azure load balancer.

   Show answer

   Answer: B

   Explanation

   To route traffic between the private endpoint and the Azure Private Link service using a user-defined route, you should Enable delegation on Subnet1. So, the correct answer is: B. Enable delegation. Delegation on a subnet is necessary for private endpoints to communicate with Azure Private Link services, as it allows the necessary configuration and management of private endpoints within that subnet.

   Source: Adapted from community discussion — nap61

   References

   • Microsoft Learn

   Next question

8. Question 318 · 339 in bank

   You have an Azure virtual network named Vnet1 that has one subnet. Vnet1 is in the West Europe region. You deploy an Azure App Service app named App1 to the West Europe region. You need to provide App1 with access to the resources in Vnet1. The solution must minimize costs. What should you do first?

   • ACreate a private link.
   • BCreate a new subnet.
   • CCreate a NAT gateway.
   • DCreate a gateway subnet and deploy a virtual network gateway.

   Show answer

   Answer: B

   Explanation

   I think answer should be B. Create a new subnet, since both Vnet and App Service are in the same region. https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet#enable-vnet-integration Regional VNet Integration = "If the VNet is in the same region, either create a new subnet or select an empty pre-existing subnet"

   Source: Adapted from community discussion — christianpageqc

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 319 · 339 in bank

   HOTSPOT - You have an Azure subscription. The subscription contains multiple Azure SQL Database resources and a virtual network named VNet1 that has five subnets. All the subnets are associated with a network security group (NSG) named NSG1. NSG1 blocks all outbound traffic, unless specifically allowed by a rule. Each subnet contains 50 virtual machines. Multiple virtual machines host instances of SQL Server on Virtual Machines and will be configured to replicate with the Azure SQL Database resources. You need to configure a new outbound rule in NSG1 to allow the SQL Server on Virtual Machines instances to connect to the Azure SQL Database resources. The solution must meet the following requirements: • Minimize modifications to NSG1 when additional instances of SQL Server on Virtual Machines are deployed. • Ensure that only SQL Server on Virtual Machines instances can connect to the Azure SQL Database resources. How should you configure each setting for the new outbound rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

10. Question 320 · 339 in bank

    You have an Azure subscription that contains the resources shown in the following table.

    

    You create a service endpoint policy that has the following settings: • Associated subnets: Subnet1 • Service: Microsoft.Storage • Scope: Single account • Resource: storage1 Which resources can VM1 access?

    • Astorage1 in the East US Azure region and its replica in the paired region
    • Bstorage1 in the East US Azure region only
    • Cstorage1 and storage2 in the East US Azure region only
    • Dstorage1 and storage2 in the East US Azure region and their replicas in the paired region

    Show answer

    Answer: A

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 311. 339 questions available.