AZ-700 practice questions 321–330

1. Question 321 · 339 in bank

   You have the resources shown in the following table.

   

   You need to protect the virtual machines by using Azure DDoS Network Protection plans. What is the minimum number of DDoS Network Protection plans you should deploy?

   • A1
   • B2
   • C3
   • D20

   Show answer

   Answer: A

   Explanation

   For DDoS Network Protection, under a tenant, a single DDoS protection plan can be used across multiple subscriptions, so there's no need to create more than one DDoS protection plan. For DDoS IP Protection, there's no need to create a DDoS protection plan. Customers can enable DDoS IP protection on any public IP resource. https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview

   Source: Adapted from community discussion — D10SJoker

   References

   • Microsoft Learn

   Next question

2. Question 322 · 339 in bank

   You have an Azure subscription that contains a virtual network named VNet1. You plan to deploy Point-to-Site (P2S) VPN access to VNet1. You need to recommend an authentication method for the deployment. The solution must meet the following requirements: • Require the use of a FIDO2 security key • Analyze user sign-in behavior • Require a user to change their password if their sign-in behavior is identified as risky What should you recommend?

   • ARADIUS
   • BMicrosoft Entra
   • Csmart card
   • DAzure certificate

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

3. Question 323 · 339 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named Tenant1. Sub1 contains an Azure VPN gateway named VNetGW1. You manually register the Azure VPN Client in Tenant1. You need to configure VNetGW1 to support the Microsoft Entra authentication of Point-to-Site (P2S) VPN connections. The solution must ensure that users can establish P2S VPN connections by using the Azure VPN Client. To what should you set Tenant and Issuer in the Point-to-site configuration settings of VNetGW1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

4. Question 324 · 339 in bank

   HOTSPOT - You have an Azure subscription. The subscription contains two virtual machine scale sets that host two apps named App1 and App2, an Azure Private Link service named PLS1, and an Azure load balancer named LB1. PLS1 uses LB1 and has TCP Proxy V2 disabled. PLS1 provides access to App1 only. You need to perform the following actions: • Provide access to App1 and App2. • Increase the number of supported private endpoint connections. What should you modify to provide access to App2, and what should you modify to increase the number of supported connections? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   App2: Azure Load Balancer inbound NAT rules Supported connections: The Azure Load Balancer frontend IP configuration To increase the number of supported private endpoint connections on a standard Azure load balancer, you can create multiple Private Link Services on the same load balancer. Create new Private Link services while specifying the existing standard load balancer as the target, ensuring you select the appropriate frontend IP configuration for each new service within the load balancer settings. https://learn.microsoft.com/en-us/azure/private-link/create-private-link-service-portal?tabs=dynamic-ip#create-private-endpoint

   Source: Adapted from community discussion — northgaterebel

   References

   • Microsoft Learn

   

   Next question

5. Question 325 · 339 in bank

   HOTSPOT - You have multiple remote users that have either a Windows 11 device or an Ubuntu Linux 22.04 device. Each device has a manually registered Azure VPN Client installed. You have an Azure subscription that contains an Azure VPN gateway named VNetGW1. The Windows 11 users establish Point-to-Site (P2S) VPN connections to VNetGW1 and authenticate by using their Microsoft Entra credentials. The Ubuntu Linux users cannot establish P2S VPN connections. You need to ensure that the Ubuntu Linux users can establish P2S VPN connections to VNetGW1. The solution must minimize administrative effort and maximize security. To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

6. Question 326 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains virtual networks, network security groups (NSGs), and virtual machines. You need to perform the following actions: • Identify unknown traffic between the resources. • Check the network connectivity between the virtual machines. What should you use to perform each action? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 327 · 339 in bank

   You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. The subscription contains the following resources: ✑ An Azure App Service app named App1 ✑ An Azure DNS zone named contoso.com ✑ An Azure private DNS zone named private.contoso.com ✑ A virtual network named Vnet1 You create a private endpoint for App1. The record for the endpoint is registered automatically in Azure DNS. You need to provide a developer with the name that is registered in Azure DNS for the private endpoint. What should you provide?

   • Aapp1.contoso.onmicrosoft.com
   • Bapp1.private.contoso.com
   • Capp1.privatelink.azurewebsites.net
   • Dapp1.contoso.com

   Show answer

   Answer: C

   Explanation

   When you use Private Endpoint for Web App, the requested URL must match the name of your Web App. By default mywebappname.azurewebsites.net. By default, without Private Endpoint, the public name of your web app is a canonical name to the cluster. For example, the name resolution will be: DNS Name Type Value mywebapp.azurewebsites.net CNAME clustername.azurewebsites.windows.net clustername.azurewebsites.windows.net CNAME cloudservicename.cloudapp.net cloudservicename.cloudapp.net A 40.122.110.154 When you deploy a Private Endpoint, we update the DNS entry to point to the canonical name mywebapp.privatelink.azurewebsites.net. For example, the name resolution will be: DNS Name Type Value Remark mywebapp.azurewebsites.net CNAME mywebapp.privatelink.azurewebsites.net mywebapp.privatelink.azurewebsites.net CNAME clustername.azurewebsites.windows.net clustername.azurewebsites.windows.net CNAME cloudservicename.cloudapp.net cloudservicename.cloudapp.net A 40.122.110.154 https://docs.microsoft.com/en-us/azure/app-service/networking/private-endpoint Hence answer is C

   Source: Adapted from community discussion — Sahildange

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 328 · 339 in bank

   You have Azure App Service apps in the West US Azure region as shown in the following table.

   

   You need to ensure that all the apps can access the resources in a virtual network named VNet1 without forwarding traffic through the internet. How many integration subnets should you create?

   • A0
   • B1
   • C3
   • D4
   • E6

   Show answer

   Answer: C

   Explanation

   one per App Service Plan: The feature supports only one virtual interface per worker. One virtual interface per worker means one regional virtual network integration per App Service plan. All the apps in the same App Service plan can only use the same virtual network integration to a specific subnet. If you need an app to connect to another virtual network or another subnet in the same virtual network, you need to create another App Service plan. The virtual interface used isn't a resource that customers have direct access to. https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration#how-regional-virtual-network-integration-works

   Source: Adapted from community discussion — pinchocr

   References

   • Microsoft Learn

   Next question

9. Question 329 · 339 in bank

   HOTSPOT - You have the Azure environment shown in the Azure Environment exhibit.

   

   The settings for each subnet are shown in the following table.

   

   The Firewalls and virtual networks settings for storage1 are configured as shown in the Storage1 exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - The firewall allows VNet1\Subnet1 through the service endpoint. Box 2: No - The firewall does not allow VNet1\Subnet2 through the service endpoint. Box 3: No - The firewall allows 132.124.53.0/26 which means it allows all IP addresses between 132.124.53.0 and 132.124.53.63. The public IP of VM3 is 132.124.53.76 which is outside the allowed range.

   Source: Adapted from community discussion — Jamesat

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 330 · 339 in bank

    DRAG DROP - You have two Azure subscriptions named Subscription1 and Subscription2. Subscription1 contains a virtual network named Vnet1. Vnet1 contains an application server. Subscription2 contains a virtual network named Vnet2. You need to provide the virtual machines in Vnet2 with access to the application server in Vnet1 by using a private endpoint. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Step 1: Deploy an Azure Load Balancer in front of the application server Configure your application to run behind a standard load balancer in your virtual network. Step 2: In Subscription 1, create a private link service and attach the service to the frontend IP configuration of the load balancer. Create a Private Link Service referencing the load balancer above. Step 3: In Subscription 2, create a private endpoint by using the private link service. Private Link service can be accessed from approved private endpoints in any public region. The private endpoint can be reached from the same virtual network, regionally peered VNets, globally peered VNets and on premises using private VPN or ExpressRoute connections. Step 4: In Subscription1, accept the private endpoint connection request. Network connections can be initiated only by clients that are connecting to the private endpoint. Not: Incorrect: Enable virtual network peering between Vnet1 and Vnet2. Reference: https://docs.microsoft.com/en-us/azure/private-link/private-link-service-overview https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview

    Source: Adapted from community discussion — jellybiscuit

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 321. 339 questions available.