AZ-700 practice questions 331–339

1. Question 331 · 339 in bank

   Select 2

   You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. The subscription contains the following resources: ✑ A virtual network named Vnet1 ✑ An App Service plan named ASP1 ✑ An Azure App Service named webapp1 An Azure private DNS zone named private.contoso.com

   

   ✑ Virtual machines on Vnet1 that cannot communicate outside the virtual network You need to ensure that the virtual machines on Vnet1 can access webapp1 by using a URL of https://www.private.contoso.com. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate a CNAME record that maps www.private.contoso.com to webapp1.contoso.onmicrosoft.com.
   • BCreate a CNAME record that maps www.private.contoso.com to webapp1.private.contoso.com.
   • CCreate a service endpoint for webapp1.
   • DRegister an enterprise application in Azure AD for webapp1.
   • ECreate a private endpoint for webapp1.
   • FCreate a CNAME record that maps www.private.contoso.com to webapp1.privatelink.azurewebsites.net.

   Show answer

   Answer: EF

   Explanation

   EF are correct as per answer - outbound from App Services to vNET requires vNET integration where as inbound i.e. from vNET to App services requires private endpoint

   Source: Adapted from community discussion — Lazylinux

   Next question

2. Question 332 · 339 in bank

   HOTSPOT - You need to recommend a configuration for the ExpressRoute connection from the Boston datacenter. The solution must meet the hybrid networking requirements and business requirements. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath#gateways box1: Ultra Performance https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath#limited-general-availability-ga in the NOTE section point 3: FastPath connectivity to a Private endpoint/Link service deployed to a spoke Virtual Network, peered to the Hub Virtual Network (where the ExpressRoute Virtual Network Gateway is deployed), IS NOT SUPPORTED. FastPath only supports connectivity to Private Endpoints/Link services deployed to the Hub Virtual Network. FastPath connectivity to a Private endpoint/Link service deployed to a spoke Virtual Network, peered to the Hub Virtual Network (where the ExpressRoute Virtual Network Gateway is deployed), is not supported. FastPath only supports connectivity to Private Endpoints/Link services deployed to the Hub Virtual Network. box 2: connect vnet2 directly to the ER circuit

   Source: Adapted from community discussion — matanzpl

   References

   • Microsoft Learn
   • azure.microsoft.com documentation

   

   Next question

3. Question 333 · 339 in bank

   You need to provide access to storage1. The solution must meet the PaaS networking requirements and the business requirements. What should you include in the solution?

   • Aa private endpoint
   • BAzure Traffic Manager
   • CAzure Front Door
   • Da service endpoint

   Show answer

   Answer: A

   Explanation

   service endpoint limitation Endpoints are enabled on subnets configured in Azure virtual networks. Endpoints can't be used for traffic from your premises to Azure services

   Source: Adapted from community discussion — tkcltoh

   References

   • Microsoft Learn

   Next question

4. Question 334 · 339 in bank

   You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements. Which connectivity method should you use?

   • Aa private endpoint
   • BAzure Firewall
   • CAzure Front Door
   • Da service endpoint

   Show answer

   Answer: A

   Explanation

   Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network. Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK A is the answer

   Source: Adapted from community discussion — wsrudmen

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 335 · 339 in bank

   HOTSPOT - You need to implement name resolution for the cloud.litwareinc.com. The solution must meet the networking requirements. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

   Source: Adapted from community discussion — jellybiscuit

   References

   • azure.microsoft.com documentation
   • Microsoft Learn

   

   Next question

6. Question 336 · 339 in bank

   You need to configure GW1 to meet the network security requirements for the P2S VPN users. Which Tunnel type should you select in the Point-to-site configuration settings of GW1?

   • AIKEv2 and OpenVPN (SSL)
   • BIKEv2
   • CIKEv2 and SSTP (SSL)
   • DOpenVPN (SSL)
   • ESSTP (SSL)

   Show answer

   Answer: D

   Explanation

   Azure AD authentication is supported for OpenVPN® protocol connections only and requires the Azure VPN Client. And also SSTP and IKEv2 don't support all client devices: SSTP limited to Windows IKEv2 limited to Mac devices

   Source: Adapted from community discussion — wsrudmen

   References

   • Microsoft Learn

   Next question

7. Question 337 · 339 in bank

   DRAG DROP - You need to prepare Vnet1 for the deployment of an ExpressRoute gateway. The solution must meet the hybrid connectivity requirements and the business requirements. Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Delete the VPN GW1. The existing VPN GW1 GatewaySubnet is too small with /29. Users must be able to connect to Vnet1 by using a Point-to-Site (P2S) VPN when working remotely. Connections must be authenticated by Azure AD. Litware wants to minimize costs whenever possible, as long as all other requirements are met. Step 2: Create a VPN gateway by using Basic SKU. Basic SKU is good enough. Note - The Basic gateway SKU does not support IKEv2 or RADIUS authentication. If you plan on having Mac clients connect to your virtual network, do not use the Basic SKU. Step 3: Set the subnet mask of Gateway Subnet to /27. When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. The number of IP addresses needed depends on the VPN gateway configuration that you want to create. Some configurations require more IP addresses than others. We [Microsoft] recommend that you create a gateway subnet that uses a /27 or /28. It's best to specify /27 or larger (/26,/25 etc.). This allows enough IP addresses for future changes, such as adding an ExpressRoute gateway. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

   Source: Adapted from community discussion — [Removed]

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 338 · 339 in bank

   Select 2

   You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements. Which two actions should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AOn the peering from Vnet1, select Allow gateway transit.
   • BOn the peerings from Vnet2 and Vnet3, select Use remote gateways.
   • COn the peerings from Vnet2 and Vnet3, select Allow gateway transit.
   • DOn the peering from Vnet1, select Use remote gateways.
   • EOn the peering from Vnet1, select Allow forwarded traffic.

   Show answer

   Answer: AB

   Explanation

   AB To use virtual network peerings, in the virtual network Peering setup: - Configure the peering connection in the hub to Allow gateway transit. - Configure the peering connection in each spoke to Use the remote virtual network's gateway. - Configure all peering connections to Allow forwarded traffic. https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli#spoke-connections-to-remote-networks-through-a-hub-gateway

   Source: Adapted from community discussion — mabalon

   References

   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 339 · 339 in bank

   HOTSPOT - You need to implement a P2S VPN for the users in the branch office. The solution must meet the hybrid networking requirements. What should you do? To answer, select the appropriate options in the answer area. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

   Source: Adapted from community discussion — wsrudmen

   References

   • Microsoft Learn

   

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 331. 339 questions available.