AZ-700 practice questions 51–60

1. Question 51 · 339 in bank

   HOTSPOT - You have an Azure subscription that contains a single virtual network and a virtual network gateway. You need to ensure that administrators can use Point-to-Site (P2S) VPN connections to access resources in the virtual network. The connections must be authenticated by Azure Active Directory (Azure AD). What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: An enterprise application Enable Azure AD authentication on the VPN gateway: 1. Locate the Directory ID of the directory that you want to use for authentication. It's listed in the properties section of the Active Directory page. 2. Under your Azure AD, in Enterprise applications, you see Azure VPN listed. Copy the Directory ID. 3. Sign in to the Azure portal as a user that is assigned the Global administrator role. 4. Next, give admin consent. Copy and paste the URL that pertains to your deployment location in the address bar of your browser. 5. Select the Global Admin account if prompted. 6. Select Accept when prompted. 7. Under your Azure AD, in Enterprise applications, you see Azure VPN listed. Box 2: Open VPN (SSL) When you connect to your VNet using Point-to-Site, you have a choice of which protocol to use. The protocol you use determines the authentication options that are available to you. If you want to use Azure Active Directory authentication, you can do so when using the OpenVPN protocol. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 52 · 339 in bank

   HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - Zone2.contoso.com is not linked to any virtual networks. Therefore, no VMs are able to resolve names in the zone. Box 2: Yes - VM4 is in VNet3. Zone1.contoso.com has a link to VNet3 and auto-registration is enabled on the link. Box3: No - VNet3 is linked to zone1.contoso.com and auto-registration is enabled on the link. A virtual network can only have one registration zone. You can link zone2.contoso.com to VNet3 but you won't be able to enable auto-registration on the link.

   Source: Adapted from community discussion — derrrp

   References

   • Microsoft Learn

   

   Next question

3. Question 53 · 339 in bank

   HOTSPOT - Which virtual machines can VM1 and VM4 ping successfully? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: VM2, VM3 and VM4. VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3. There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocking inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3. Box 2: VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/ Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

   Source: Adapted from community discussion — derrrp

   References

   • Microsoft Learn

   

   Next question

4. Question 54 · 339 in bank

   You have an on-premises datacenter named DC1 that contains two routers. You have an Azure subscription. The subscription contains a virtual network named VNet1 and a zone-redundant ExpressRoute virtual network gateway named GW1 that uses the ErGw3Az SKU. GW1 is attached to VNet1 DC1 is connected to VNet1 by using an ExpressRoute Standard circuit named Circuit1. The DC1 routers are configured as endpoints for Circuit1. Circuit1 traffic traverses two physical links. During a link outage, the connection takes three minutes to fail over. You need to ensure that failovers between the links take less than one second. What should you do?

   • AFor Circuit1, select FastPath.
   • BOn the routers, configure Bidirectional Forwarding Detection (BFD).
   • CFor GW1, change SKU to UltraPerformance.
   • DFor GW1, set Active-active mode to Enabled.

   Show answer

   Answer: B

   Next question

5. Question 55 · 339 in bank

   What should you implement to meet the virtual network requirements for the virtual machines that connect to Vnet4 and Vnet5?

   • Aa private endpoint
   • Ba routing table
   • Ca service endpoint
   • Da private link service
   • Ea virtual network peering

   Show answer

   Answer: E

   Explanation

   E is correct however it should say GLOBAL virtual Network peering since both vNET 4 and 5 are in different regions https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

   Source: Adapted from community discussion — Lazylinux

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 56 · 339 in bank

   You need to configure the default route on Vnet2 and Vnet3. The solution must meet the virtual networking requirements. What should you use to configure the default route?

   • Aroute filters
   • BBGP route exchange
   • Ca user-defined route assigned to GatewaySubnet in Vnet1
   • Da user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3

   Show answer

   Answer: B

   Explanation

   B. BGP route exchange Virtual Networking Requirements Direct the default route of 0.0.0.0/0 on Vnet2 and Vnet3 to the Boston datacenter over an ExpressRoute circuit.

   Source: Adapted from community discussion — Fearless90

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 57 · 339 in bank

   DRAG DROP - You need to implement outbound connectivity for VMScaleSet1. The solution must meet the virtual networking requirements and the business requirements. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/load-balancer/skus https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections#outboundrules

   Source: Adapted from community discussion — Fearless90

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 58 · 339 in bank

   HOTSPOT - You are implementing the virtual network requirements for VM-Analyze. What should you include in a custom route that is linked to Subnet2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

   Source: Adapted from community discussion — tng69

   

   Next question

9. Question 59 · 339 in bank

   HOTSPOT - You create NSG10 and NSG11 to meet the network security requirements. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - NSG10 which is attached to VM1's subnet blocks RDP (port TCP 3389) to 'Any' which means the port is blocked to all destinations. Box 2: Yes - NSG10 blocks ICMP from VNet4 (source 10.10.0.0/16) but it is not blocked from VM2's subnet (VNet1/Subnet2). Box 3: No - NSG11 blocks RDP (port TCP 3389) destined for 'VirtualNetwork'. VirtualNetwork is a service tag and means the address space of the virtual network (VNet1) which in this case is 10.1.0.0/16. Therefore, RDP traffic from subnet2 to anywhere else in VNet1 is blocked.

   Source: Adapted from community discussion — pinpin06

   References

   • Microsoft Learn

   

   Next question

10. Question 60 · 339 in bank

    HOTSPOT - You need to restrict traffic from VMScaleSet1 to VMScaleSet2. The solution must meet the virtual networking requirements. What is the minimum number of custom NSG rules and NSG assignments required? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 2: One NSG - The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way you would need two custom NSG rules. Box 1: Two custom rules - With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic from VMScaleSet1. Then you would need to create another custom rule with a higher priority than the first rule that allows traffic on port 443. The default rules in the NSG will allow all other traffic to VMScaleSet2.

    Source: Adapted from community discussion — MrBlueSky

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 51. 339 questions available.