Designing and Implementing Microsoft Azure Networking Solutions practice questions

1. Question 1 of 25

   HOTSPOT - You have an on-premises datacenter. You have an Azure subscription that contains 10 virtual machines and a virtual network named VNet1 in the East US Azure region. The virtual machines are connected to VNet1 and replicate across three availability zones. You need to connect the datacenter to VNet1 by using ExpressRoute. The solution must meet the following requirements: • Maintain connectivity to the virtual machines if two availability zones fail. • Support 1000-Mbps connections. • Minimize costs. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   As I researched here in these 3 reference documentations: 1. https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview; 2. https://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway 3. https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways#gwsku When deploying an ErGw1AZ, it is possible to define its zone availability as "Zone-Redundant", in addition it is also essential that the ip used by the ER Gateway be "Standard", because at the time of provisioning this ip will become redundant between the availability zones . Regarding the ER Circuit, it can be "Local", but in this scenario it would be unlimited and more expensive than the "Standard" Limited in 1Gbps. In my opinion the best answer would be: 1. One ExpressRoute Standard circuit 2. One ExpressRoute gateway of the ErGw1AZ SKU

   Adapted from community discussion by charrua86 · 2023-07-28 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. B

      bakamon

      2023-05-31

      39 upvotes

      Answer : --> One ExpressRoute Standard circuit --> One ExpressRoute gateway of the ErGw1AZ SKU

   2. C

      charrua86

      2023-07-28

      29 upvotes

      As I researched here in these 3 reference documentations: 1. https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview; 2. https://learn.microsoft.com/en-us/azure/vpn-gateway/create-zone-redundant-vnet-gateway 3. https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways#gwsku When deploying an ErGw1AZ, it is possible to define its zone availability as "Zone-Redundant", in addition it is also essential that the ip used by the ER Gateway be "Standard", because at the time of provisioning this ip will become redundant between the availability zones . Regarding the ER Circuit, it can be "Local", but in this scenario it would be unlimited and more expensive than the "Standard" Limited in 1Gbps. In my opinion the best answer would be: 1. One ExpressRoute Standard circuit 2. One ExpressRoute gateway of the ErGw1AZ SKU

   3. _

      _fvt

      2023-04-05

      20 upvotes

      I tested in lab, deployed an ErGw1AZ in a Region (France Central) with 3Az an I well have 3 Instances of the Public IP and ER Gateway. So the Answer is: - one ErGw1AZ - one Circuit.

   4. M

      MCCC454

      2024-01-21

      15 upvotes

      These kind of questions really baffle my mind. How we suppose to memorize all the sku's and differences?

2. Question 2 of 25

   You have an Azure subscription that contains a virtual network named VNet1 and the virtual machines shown in the following table.

   

   All the virtual machines are connected to Vnet1. You need to ensure that the applications hosted on the virtual machines can be accessed from the internet. The solution must ensure that the virtual machines share a single public IP address. What should you use?

   • Aan internal load balancer
   • BAzure Application Gateway
   • Ca NAT gateway
   • Da public load balancer

   Show answer

   Correct answer: D

   How others answered

   • D92%

   Explanation

   Public load balancers allow internet traffic to your VMs by translating their private IP addresses to public IP addresses. You can configure your load balancer with a frontend IP address and load balancer rules to define how incoming traffic is distributed. Azure NAT gateways handle outbound traffic, and only packets arriving as a response to an outbound connection can pass through the NAT gateway. Application gateways operate at layer 7 OSI and can only manage web traffic. Since the question is asking for a solution to ensure Internet traffic can reach the VMs, public load balancer is the way to go. https://learn.microsoft.com/en-us/azure/load-balancer/components https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview

   Adapted from community discussion by kncappy · 2024-08-29 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. K

      kncappy

      2024-08-29

      12 upvotes

      Public load balancers allow internet traffic to your VMs by translating their private IP addresses to public IP addresses. You can configure your load balancer with a frontend IP address and load balancer rules to define how incoming traffic is distributed. Azure NAT gateways handle outbound traffic, and only packets arriving as a response to an outbound connection can pass through the NAT gateway. Application gateways operate at layer 7 OSI and can only manage web traffic. Since the question is asking for a solution to ensure Internet traffic can reach the VMs, public load balancer is the way to go. https://learn.microsoft.com/en-us/azure/load-balancer/components https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview

   2. G

      GiorgioLDN

      2023-12-21

      12 upvotes

      Because Application Gateway is a layer 7 load balancer, which means it works only with web traffic (HTTP, HTTPS)!

   3. B

      Ben_88

      2023-12-12

      6 upvotes

      bad idea , just realized that nat gateway can only handle outbound traffic . so it can only be D

   4. U

      ubdubdoo

      2023-11-14

      2 upvotes

      an Azure NAT Gateway is a dedicated network appliance that provides outbound NAT functionality for virtual networks in Azure. It allows resources within a virtual network to access the internet or other resources outside of the virtual network using a single or a pool of public IP addresses.

3. Question 3 of 25

   HOTSPOT - You need to connect an on-premises network and an Azure environment. The solution must use ExpressRoute and support failing over to a Site-to-Site VPN connection if there is an ExpressRoute failure. What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   The correct answer is route based and two virtual network gateways - one for ExpressRoute connection (ExpressRoute virtual network gateway) and the second for the VPN connection (VPN virtual network gateway). Check the architecture and read the description at the source. Source: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/expressroute-vpn-failover

   Adapted from community discussion by nawere · 2022-05-07 · 102 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. N

      nawere

      2022-05-07

      102 upvotes

      The correct answer is route based and two virtual network gateways - one for ExpressRoute connection (ExpressRoute virtual network gateway) and the second for the VPN connection (VPN virtual network gateway). Check the architecture and read the description at the source. Source: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/expressroute-vpn-failover

   2. J

      jellybiscuit

      2022-09-27

      10 upvotes

      The doc is correct. You are misreading it. "If you have a virtual network that has only one virtual network gateway (let's say, Site-to-Site VPN gateway) and you want to add another gateway of a different type (let's say, ExpressRoute gateway), " Another gateway of a different type. Two total.

   3. S

      SaranJ

      2022-08-06

      4 upvotes

      Correct Answer: Route Based + 2 VPN GW Refer: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways ============== When you configure a virtual network gateway, you configure a setting that specifies the gateway type. The gateway type determines how the virtual network gateway will be used and the actions that the gateway takes. The gateway type 'Vpn' specifies that the type of virtual network gateway created is a 'VPN gateway'. This distinguishes it from an ExpressRoute gateway, which uses a different gateway type. A virtual network can have two virtual network gateways; one VPN gateway and one ExpressRoute gateway. For more information, see Gateway types. ==============

   4. J

      Jamesat

      2024-09-24

      4 upvotes

      The answer is Route Based and 2 Virtual Network Gateways. Both the Expressroute and VPN need distinct gateways identified by their SKU. You cannot have Expressroute on a VpnGw SKU. It must be on a dedicated ExpressRoute SKU gateway. Both VPN Gateways will exist inside the same subnet but the connection are via 2 separate gateways. This doc clearly shows the step of create 2 gateways. https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-coexist-resource-manager Step 10: $gw = New-AzVirtualNetworkGateway -Name "ERGateway" -ResourceGroupName $resgrp.ResourceGroupName -Location $location -IpConfigurations $gwConfig -GatewayType "ExpressRoute" -GatewaySku Standard

4. Question 4 of 25

   Your company has an on-premises network and three Azure subscriptions named Subscription1, Subscription2, and Subscription3. The departments at the company use the Azure subscriptions as shown in the following table.

   

   All the resources in the subscriptions are in either the West US Azure region or the West US 2 Azure region. You plan to connect all the subscriptions to the on-premises network by using ExpressRoute. What is the minimum number of ExpressRoute circuits required?

   • A1
   • B2
   • C3
   • D4
   • E5

   Show answer

   Correct answer: A

   How others answered

   • A90%

   Explanation

   Answer: A - 1 Managing Authorization The circuit owner can share a circuit with up to 10 Azure subscriptions. The circuit owner can view who has been authorized to the circuit. The owner can revoke the authorization at any time. https://azure.microsoft.com/en-us/blog/enable-multiple-subscription-expressroute/#:~:text=The%20circuit%20owner%20can%20share,the%20authorization%20at%20any%20time.

   Adapted from community discussion by Hawaii_IT · 2022-08-16 · 25 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. H

      Hawaii_IT

      2022-08-16

      25 upvotes

      Answer: A - 1 Managing Authorization The circuit owner can share a circuit with up to 10 Azure subscriptions. The circuit owner can view who has been authorized to the circuit. The owner can revoke the authorization at any time. https://azure.microsoft.com/en-us/blog/enable-multiple-subscription-expressroute/#:~:text=The%20circuit%20owner%20can%20share,the%20authorization%20at%20any%20time.

   2. A

      AdityaGupta

      2022-09-22

      Selected A7 upvotes

      1 Express Route Circuit standard sku would be good enough. With 1 er circuit you can connect upto 10 vnets and standard sku allows you to connect within same geopolitical region without additional cost.

   3. K

      khanda

      2024-09-24

      Selected A4 upvotes

      You can link up to 10 virtual networks to a standard ExpressRoute circuit. All virtual networks must be in the same geopolitical region when using a standard ExpressRoute circuit. West US and West US 2 are in the same Azure geopolitical region, so you would need only one ER circuits. https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-linkvnet-portal-resource-manager#connect-a-vnet-to-a-circuit---different-subscription https://learn.microsoft.com/en-us/azure/expressroute/expressroute-locations-providers

   4. J

      jellybiscuit

      2022-10-01

      6 upvotes

      You are correct, though network topology can negate the ExpressRoute subscription limit anyway. For example, connect the ExpressRoute to a hub vmet and peer the subscription vnets to it.

5. Question 5 of 25

   You need to configure the default route on Vnet2 and Vnet3. The solution must meet the virtual networking requirements. What should you use to configure the default route?

   • Aroute filters
   • BBGP route exchange
   • Ca user-defined route assigned to GatewaySubnet in Vnet1
   • Da user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3

   Show answer

   Correct answer: B

   How others answered

   • B94%

   Explanation

   B. BGP route exchange Virtual Networking Requirements Direct the default route of 0.0.0.0/0 on Vnet2 and Vnet3 to the Boston datacenter over an ExpressRoute circuit.

   Adapted from community discussion by Fearless90 · 2022-06-28 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. F

      Fearless90

      2022-06-28

      Selected B12 upvotes

      B. BGP route exchange Virtual Networking Requirements Direct the default route of 0.0.0.0/0 on Vnet2 and Vnet3 to the Boston datacenter over an ExpressRoute circuit.

   2. [

      [Removed]

      2023-03-28

      5 upvotes

      To configure the default route on Vnet2 and Vnet3, we can use BGP route exchange. This would allow us to advertise the default route of 0.0.0.0/0 from the Boston datacenter over an ExpressRoute circuit to Vnet2 and Vnet3. This meets the requirement to direct the default route of 0.0.0.0/0 on Vnet2 and Vnet3 to the Boston datacenter over an ExpressRoute circuit. Option A, route filters, are used to allow or deny routes based on a set of defined rules. They are not used to configure the default route. Option C, a user-defined route assigned to GatewaySubnet in Vnet1, would only affect traffic within Vnet1, and not traffic from Vnet2 and Vnet3 to the Boston datacenter. Option D, a user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3, would only affect traffic within Vnet2 and Vnet3, and not traffic from Vnet2 and Vnet3 to the Boston datacenter. Therefore, the correct answer is B. BGP route exchange.

   3. F

      Fearless90

      2022-06-28

      2 upvotes

      https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#user-defined Virtual network gateway: Specify when you want traffic destined for specific address prefixes routed to a virtual network gateway. The virtual network gateway must be created with type VPN. You can't specify a virtual network gateway created as type ExpressRoute in a user-defined route because with ExpressRoute, you must use BGP for custom routes. You can't specify Virtual Network Gateways if you have VPN and ExpressRoute coexisting connections either. You can define a route that directs traffic destined for the 0.0.0.0/0 address prefix to a route-based virtual network gateway. On your premises, you might have a device that inspects the traffic and determines whether to forward or drop the traffic. If you intend to create a user-defined route for the 0.0.0.0/0 address prefix, read 0.0.0.0/0 address prefix first. Instead of configuring a user-defined route for the 0.0.0.0/0 address prefix, you can advertise a route with the 0.0.0.0/0 prefix via BGP, if you've enabled BGP for a VPN virtual network gateway.

   4. F

      Fearless90

      2022-06-28

      3 upvotes

      https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#border-gateway-protocol Border gateway protocol An on-premises network gateway can exchange routes with an Azure virtual network gateway using the border gateway protocol (BGP). Using BGP with an Azure virtual network gateway is dependent on the type you selected when you created the gateway. If the type you selected were: • ExpressRoute: You must use BGP to advertise on-premises routes to the Microsoft Edge router. You can't create user-defined routes to force traffic to the ExpressRoute virtual network gateway if you deploy a virtual network gateway deployed as type: ExpressRoute. You can use user-defined routes for forcing traffic from the Express Route to, for example, a Network Virtual Appliance.

6. Question 6 of 25

   HOTSPOT - You are planning an Azure solution that will contain the following types of resources in a single Azure region: ✑ Virtual machine ✑ Azure App Service ✑ Virtual Network gateway ✑ Azure SQL Managed Instance App Service and SQL Managed Instance will be delegated to create resources in virtual networks. You need to identify how many virtual networks and subnets are required for the solution. The solution must minimize costs to transfer data between virtual networks. What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services#services-that-can-be-deployed-into-a-virtual-network

   Adapted from community discussion by Pravda · 2022-06-15 · 41 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. P

      Pravda

      2022-06-15

      41 upvotes

      Question was on exam 11/2021 I believe the answer to be 1 and 4. Web page given in answer, and below states App Service Environment requires a dedicated subnet. https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services#services-that-can-be-deployed-into-a-virtual-network

   2. G

      get_aznoobie

      2022-05-08

      25 upvotes

      Answer should be 1 VNET and 4 subnet: 1 for VPN Gateway 1 for SQL managed instance 1 for App service/WebApp VM is bound to have a separate subnet Article: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services#services-that-can-be-deployed-into-a-virtual-network

   3. P

      prepper666

      2022-05-01

      16 upvotes

      Correct answer is 1 Vnet. 3 Subnets are needed. Gateway subnet for VPN Gateway. Default subnet for VM Dedicated subnet for SQL Managed instance. https://azure.microsoft.com/en-gb/resources/templates/sql-managed-instance-azure-environment/ No subnet is needed for App Service. Build it and dont just believe the answers written here as many answers are wrong.

   4. M

      Madball

      2022-10-20

      9 upvotes

      I believe the given answer is correct, my reasoning for this is as follows. 1. Azure SQL Managed Instance requires its own subnet. 2. A Virtual Network Gateway requires its own subnet. 3. An app service by default does not connect to a virtual network and is accessible by its public frontend. It is my understanding that if you want an app service to integrate with a virtual network you need to enable VNET integration, which requires its own subnet. 4. The VM can share subnets, however in this question there are 4 resources and three of them require their own subnet, meaning the VM will require its own subnet in this instance.

7. Question 7 of 25

   You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to deploy an Azure Virtual Network NAT gateway named Gateway1. The solution must meet the following requirements: • VM1 will access the internet by using its public IP address. • VM2 will access the internet by using its public IP address. • Administrative effort must be minimized. You need to ensure that you can deploy Gateway1 to Vnet1. What is the minimum number of subnets required on Vnet1?

   • A2
   • B3
   • C4
   • D5

   Show answer

   Correct answer: C

   How others answered

   • C59%
   • B40%

   Only 59% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Correct Answer : 4 1. GatewaySubnet 2. Subnet 2 3. Subnet 1 with Basic SKU for Public IP 4. NAT Gatway requires in VNET 1 and hence 4. Otherwise you could have used Subnet2 to avoid creating 4th Subnet. Requirement is to create NAT GW in VNET1 so you need 4th Subnet. https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview Check out - NAT gateway and basic SKU resources section

   Adapted from community discussion by amt2022 · 2023-01-22 · 25 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. A

      amt2022

      2023-01-22

      25 upvotes

      Correct Answer : 4 1. GatewaySubnet 2. Subnet 2 3. Subnet 1 with Basic SKU for Public IP 4. NAT Gatway requires in VNET 1 and hence 4. Otherwise you could have used Subnet2 to avoid creating 4th Subnet. Requirement is to create NAT GW in VNET1 so you need 4th Subnet. https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview Check out - NAT gateway and basic SKU resources section

   2. W

      wooyourdaddy

      2023-03-13

      Selected C19 upvotes

      The correct answer is 4. 1. The Gateway Subnet must exist on its own. 2. As per this link https://learn.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-overview#nat-gateway-and-basic-sku-resources Basic resources, such as basic load balancer or basic public IPs aren't compatible with Virtual Network NAT. Basic resources must be placed on a subnet not associated to a NAT gateway. 3. The question also states that VM1 and VM2 will access the internet by using their respective public IP address. From the same link above we have the statement: NAT gateway takes precedence over other outbound scenarios (including Load balancer and instance-level public IP addresses) and replaces the default Internet destination of a subnet. So to meet that requirement, we would need a 4th subnet where the NAT gateway is deployed.

   3. L

      Lazylinux

      2023-07-09

      6 upvotes

      Based on the below facts and per link vNET NAT GWY > Basic SKU resources, such as basic load balancer or basic public IPs aren't compatible with NAT gateway. NAT gateway can't be used with subnets where basic SKU resources exist. Basic load balancer and basic public IP can be upgraded to standard to work with a NAT gateway vNET NAT gateway takes precedence over other outbound connectivity methods, including Load balancer, instance-level public IP addresses, and Azure Firewall. Gateway subnet cannot have any VMs or NVA except for VPN GWY VMs (instances), and as per MS restrictions "A NAT gateway can’t be deployed in a gateway subnet." Hence total required is 4 FOR SURE https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview

   4. D

      daemon101

      2023-07-11

      Selected C5 upvotes

      Answer seems to be 4 subnets. 1. Subnet1 for VM1 2. Subnet2 for VM2 - you can't associate the NAT gateway with this subnet as the requirement says VM2 needs to use its public IP address. NAT gateway takes precedence over other outbound connectivity methods, including Load balancer, instance-level public IP addresses, and Azure Firewall. 3. Subnet 3 for GatewaySubnet 4. Subnet 4 for NAT Gateway - NAT gateway doesn't need a delegated subnet but you associate it with subnet for the LBs and VMs outbound connectivity. Also, one of the requirements is to deploy NAT gateway. https://learn.microsoft.com/en-us/azure/nat-gateway/nat-overview

8. Question 8 of 25

   You have an Azure subscription mat contains tour virtual networks named VNet1, VNet2, VNet3, and VNet4. You plan to deploy a hub and spoke topology by using virtual network peering. You need to configure VNet1 as the hub network. The solution must meet the following requirements: • Support transitive routing between spokes. • Maximize network throughput. What should you include in the solution?

   • AAzure VPN Gateway
   • BAzure Route Server
   • CAzure Private Link
   • DAzure Firewall

   Show answer

   Correct answer: D

   How others answered

   • D88%

   Explanation

   Azure Firewall is the best response Communication through an NVA If you need connectivity between spokes, consider deploying Azure Firewall or another NVA in the hub. Then create routes to forward traffic from a spoke to the firewall or NVA, which can then route to the second spoke. In this scenario, you must configure the peering connections to allow forwarded traffic. You can also use a VPN gateway to route traffic between spokes, although this choice affects latency and throughput. For configuration details, see Configure VPN gateway transit for virtual network peering. https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli

   Adapted from community discussion by Ayboum · 2023-02-08 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. A

      Ayboum

      2023-02-08

      Selected D18 upvotes

      Azure Firewall is the best response Communication through an NVA If you need connectivity between spokes, consider deploying Azure Firewall or another NVA in the hub. Then create routes to forward traffic from a spoke to the firewall or NVA, which can then route to the second spoke. In this scenario, you must configure the peering connections to allow forwarded traffic. You can also use a VPN gateway to route traffic between spokes, although this choice affects latency and throughput. For configuration details, see Configure VPN gateway transit for virtual network peering. https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli

   2. O

      omgMerrick

      2023-02-21

      4 upvotes

      D. Azure Firewall There are two main ways to allow spoke virtual networks to communicate with each other: Communication via an NVA like a firewall and router. This method incurs a hop between the two spokes. Communication by using virtual network peering or Virtual Network Manager direct connectivity between spokes. This approach doesn't cause a hop between the two spokes and is recommended for minimizing latency. Communication through an NVA If you need connectivity between spokes, consider deploying Azure Firewall or another NVA in the hub. Then create routes to forward traffic from a spoke to the firewall or NVA, which can then route to the second spoke. In this scenario, you must configure the peering connections to allow forwarded traffic. Source: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli#spoke-network-communications

   3. O

      omgMerrick

      2023-02-21

      Selected D5 upvotes

      Forgot to vote. Wish you could edit your posts... Source: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli#spoke-network-communications

   4. D

      daemon101

      2023-07-12

      Selected D3 upvotes

      First requirement is "Support transitive routing between spokes". Both VPN GW and Azure Firewall can accomplish this. Second requirement is "Maximize network throughput". Azure firewall has a higher throughput than VPN GW. VPN GW throughput reference: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways Azure Firewall throuhput reference: https://learn.microsoft.com/en-us/azure/firewall/firewall-faq#:~:text=Azure%20Firewall's%20initial%20throughput%20capacity,100%20Gbps%20for%20Premium%20SKU.

9. Question 9 of 25

   Select 3

   You plan to deploy Azure virtual network. You need to design the subnets. Which three types of resources require a dedicated subnet? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AAzure Bastion
   • BAzure Active Directory Domain Services (Azure AD DS)
   • CAzure Private Link
   • DAzure Application Gateway v2
   • EVPN gateway

   Show answer

   Correct answer: A, D, E

   How others answered

   • ADE90%

   Explanation

   A. Azure Bastion = Name unique - AzureBastionSubnet D. Azure Application Gateway v2 = Name does not have to be unique, just the subnet E. VPN gateway = Name unique - GatewaySubnet

   Adapted from community discussion by ESAJRR · 2023-09-23 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

   1. E

      ESAJRR

      2023-09-23

      6 upvotes

      A. Azure Bastion = Name unique - AzureBastionSubnet D. Azure Application Gateway v2 = Name does not have to be unique, just the subnet E. VPN gateway = Name unique - GatewaySubnet

   2. 1

      1particle

      2023-01-31

      5 upvotes

      A,D, & E https://docs.microsoft.com/en-us/azure/bastion/bastion-overview#architecture https://docs.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#gwsub

   3. A

      az4o2n

      2022-08-12

      Selected A, D, E4 upvotes

      The answer is correct, looking at the MS documents under Network resource support evidence https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services#services-that-can-be-deployed-into-a-virtual-network

   4. H

      HasanHHH

      2023-04-07

      Selected A, D, E3 upvotes

      Network Application Gateway- WAF-Dedicated Subnet-YES VPN Gateway-Dedicated Subnet-YES Azure Firewall-Dedicated Subnet-YES Azure Bastion-Dedicated Subnet-YES Network Virtual Appliances-Dedicated Subnet-NO https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-for-azure-services#services-that-can-be-deployed-into-a-virtual-network

10. Question 10 of 25

    HOTSPOT - You have an Azure private DNS zone named contoso.com that is linked to the virtual networks shown in the following table.

    

    The links have auto registration enabled. You create the virtual machines shown in the following table.

    

    You manually add the following entry to the contoso.com zone: ✑ Name: VM1 IP address: 10.1.10.9 -

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Box 1: No - The manual DNS record will overwrite the auto-registered DNS record so VM1 will resolve to 10.1.10.9. Box 2: No - The DNS record for VM1 is now a manually created record rather than an auto-registered record. Only auto-registered DNS records are deleted when a VM is deleted. Box 3: No - This answer depends on how the IP address is changed. To change the IP address of a VM manually, you would need to select 'Static' as the IP address assignment. In this case, the DNS record will not be updated because only DHCP assigned IP addresses are auto-registered. Reference: https://docs.microsoft.com/en-us/azure/dns/dns-faq-private

    Adapted from community discussion by rakesh333 · 2021-12-28 · 39 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. R

       rakesh333

       2021-12-28

       39 upvotes

       NNN 1. VM2 can't resolve v1.contoso.com to 10.1.10.10 because, there is a manual dns entry for vm1 points to 10.1.10.9 which over writes the automatic entry. So the answer is "NO" 2. Deleting a VM will delete only the automatic dns entry. Since we have a manual entry for vm1, that wouldn't be deleted when deleting the vm1. So the answer is "NO" 3. Manually changing the IP address of VM will not update the dns record. Auto DNS will only work if the VM gets ip via DHCP. So the answer is "NO:

    2. W

       walkwolf3

       2021-11-15

       33 upvotes

       Answer is correct, N,N,N, lab tested. For box3, when IP of VM3 is changed, VM3 will reboot, DNS record will disappear. Then VM3 is back, and registers to the new IP in the DNS zone.

    3. A

       Acrophat

       2021-12-13

       13 upvotes

       I also labbed this out for question 3 and it should be YES! Private DNS zone will remove and re-add the new static IP address.

    4. K

       Kevmeister

       2022-11-23

       9 upvotes

       I would definitely answer N,N,Y As per the MS site: https://learn.microsoft.com/en-us/azure/dns/private-dns-overview It clearly states: To resolve the records of a private DNS zone from your virtual network, you must link the virtual network with the zone. Linked virtual networks have full access and can resolve all DNS records published in the private zone. You can also enable autoregistration on a virtual network link. When you enable autoregistration on a virtual network link, the DNS records for the virtual machines in that virtual network are registered in the private zone. When autoregistration gets enabled, Azure DNS will update the zone record whenever a virtual machine gets created, changes its' IP address, or gets deleted. The only way to change the IP address is to set it to static within the portal as changing it on the VM itself is a BIG no no. So as per the documentation this proves that the answer is Y for Box 3.

11. Question 11 of 25

    HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

    

    The virtual network topology is shown in the following exhibit.

    

    Firewall1 is configured as shown in following exhibit.

    

    FirewallPolicy1 contains the following rules: • Allow outbound traffic from Vnet1 and Vnet2 to the internet. • Allow any traffic between Vnet1 and Vnet2. No custom private endpoints, service endpoints, routing tables, or network security groups (NSGs) were created. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Should be YNY Y - You need to add User Defined Route to the Firewall Appliance from the subnets (https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal) N - The firewall is not a VPN Gateway, and we do not have any connection with On-Premises here (https://learn.microsoft.com/en-us/answers/questions/516530/how-to-set-up-a-multi-spoke-virtual-network-in-azu) Y - Azure Firewall can filter by web categories (https://learn.microsoft.com/en-us/azure/firewall/web-categories)

    Adapted from community discussion by _fvt · 2023-10-06 · 48 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. _

       _fvt

       2023-10-06

       48 upvotes

       Should be YNY Y - You need to add User Defined Route to the Firewall Appliance from the subnets (https://learn.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal) N - The firewall is not a VPN Gateway, and we do not have any connection with On-Premises here (https://learn.microsoft.com/en-us/answers/questions/516530/how-to-set-up-a-multi-spoke-virtual-network-in-azu) Y - Azure Firewall can filter by web categories (https://learn.microsoft.com/en-us/azure/firewall/web-categories)

    2. A

       Apptech

       2023-12-12

       7 upvotes

       Standard SKU supports category filtering. "Azure Firewall Standard is recommended for customers looking for Layer 3–Layer 7 firewall and needs autoscaling to handle peak traffic periods of up to 30 Gbps. It supports enterprise features like threat intelligence, DNS proxy, custom DNS, and web categories." https://learn.microsoft.com/en-us/azure/firewall/choose-firewall-sku

    3. K

       KyleHodg

       2023-11-30

       8 upvotes

       The Firewall SKU states standard. Wouldn't Premium be required for filtering by category? Meaning YNN?

    4. L

       Lazylinux

       2024-01-29

       6 upvotes

       YNY 1- Y - because - routing table is required- You need to create routing table, add a router - next hop type select VNA and put the firewall local ip - in this case the private IP 2- N Because there is no VPN GWY but alos you need one vNET2 to tick use REMOTE GWY and one vNET1 tick allow GWY Transit 3- YES as per this link https://learn.microsoft.com/en-us/azure/firewall/choose-firewall-sku check the table at bottom

12. Question 12 of 25

    HOTSPOT - Your company has 40 branch offices across North America and Europe. You have an Azure subscription that contains the following virtual networks: • Two networks in the East US Azure region • Three networks in the West Europe Azure region You need to implement Azure Virtual WAN. The solution must meet the following requirements: • Each branch office in North America must have an ExpressRoute circuit and a Site-to-Site VPN that connects to the East US region. • Each branch office in Europe must have an ExpressRoute circuit and a Site-to-Site VPN that connects to the West Europe region. • Transitive connections must be supported between all the branch offices and all the virtual networks. • Costs must be minimized. What is the minimum number of Virtual WAN resources required? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    1 Standard VWAN (all hubs can be connected globally across regions with Standard VWAN) 2 VHUBS (one for each region) 4 Gateways (1 ER Gateway in US, 1 VPNGW in US + 1 ER Gateway in Europe + 1 VPNGW in Europe)

    Adapted from community discussion by MrBlueSky · 2023-04-17 · 54 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. M

       MrBlueSky

       2023-04-17

       54 upvotes

       1 Standard VWAN (all hubs can be connected globally across regions with Standard VWAN) 2 VHUBS (one for each region) 4 Gateways (1 ER Gateway in US, 1 VPNGW in US + 1 ER Gateway in Europe + 1 VPNGW in Europe)

    2. S

       stack120566

       2023-04-05

       13 upvotes

       "When multiple hubs are enabled in a single virtual WAN, the hubs are automatically interconnected via hub-to-hub links, thus enabling global connectivity between branches and Vnets that are distributed across multiple regions." ref: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-global-transit-network-architecture 1 wan 2 hubs . 2 gateways each gateway supporting the vpn connections to the offices

    3. L

       Lazylinux

       2023-07-29

       7 upvotes

       Answer is 1 STD VWAN + 2 vHUBS and 4 VPNGWY and ER GWY 1 Standard VWAN as it will cross region support and hence connect both regions 2 vHUBS - each region will require one 4 Gateways - Most people i witnessed get this one wrong even in other questions that related to VPN, one MUST know when you create ER or S2S connection, the gateway for ER and S2S are different and hence you need to create one for each - so here 1 for ER and 1 for S2S in each region so total is 4

    4. B

       BenyIR

       2023-04-06

       8 upvotes

       it shouldnot be 4 gateways ? since it is said that needs Express route and VPN ? I mean 2 gateways in one hub or to configure both express route and vpn one gateway is enough ?

13. Question 13 of 25

    HOTSPOT - Your company has an Azure virtual network named Vnet1 that uses an IP address space of 192.168.0.0/20. Vnet1 contains a subnet named Subnet1 that uses an IP address space of 192.168.0.0/24. You create an IPv6 address range to Vnet1 by using a CIDR suffix of /48. You need to enable the virtual machines on Subnet1 to communicate with each other by using IPv6 addresses assigned by the company. The solution must minimize the number of additional IPv4 addresses. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-overview https://docs.microsoft.com/en-us/azure/virtual-network/ipv6-add-to-existing-vnet-powershell

    Adapted from community discussion by Wesgo · 2021-10-29 · 31 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. W

       Wesgo

       2021-10-29

       31 upvotes

       1) Correct: /64 Explanation: The subnets for IPv6 must be exactly /64 in size. This ensures future compatibility should you decide to enable routing of the subnet to an on-premises network since some routers can only accept /64 IPv6 routes. Source: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/ipv6-overview 2) Correct: Public IPv6 Address Explanation: Add IPv6 configuration to NIC. "Configure all of the VM NICs with an IPv6 address using Add-AzNetworkInterfaceIpConfig" Source: https://docs.microsoft.com/en-us/azure/load-balancer/ipv6-add-to-existing-vnet-powershell

    2. J

       jelley

       2021-10-27

       17 upvotes

       Even based on the stated it should make sense: And regarding the total VNET uses /48, thus it can never be lower and considering the probable need for another subnet at a later point /64 is the most likely. You can add multiple IP configurations to a NIC thus NIC is incorrect (1x ipv4 and an ipv6 to 1 NIC). It can't be public IP's because we are talking about internal transfers thus IP Configuration is correct

    3. W

       Windows98

       2021-11-02

       8 upvotes

       Your IPV6 address is already public. The powershell config for this has separate IPV4 and IPV6 config blocks and I think examtopics is correct in this instance.

    4. H

       HasanHHH

       2022-10-08

       6 upvotes

       Answer: /64 - IP configuration #Add IPv6 prefix to the VNET $vnet.addressspace.addressprefixes.add("fd00:db8:deca::/48") #Add IPv6 prefix to the Subnet (smaller than addressspace) $subnet.addressprefix.add("fd00:db8:deca::/64") https://learn.microsoft.com/en-us/azure/load-balancer/ipv6-add-to-existing-vnet-powershell A single service instance can connect with both IPv4 and IPv6, IPv6-only are not supported, each NIC must include at least one IPv4 IP configuration.

14. Question 14 of 25

    HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. Your on-premises network connects to VNet1 by using a Site-to-Site (S2S) VPN connection. You need to ensure that Azure Network Watcher generates an alert if the VPN connection fails. Which Network Watcher feature should you use to generate the alert, and which data source should the feature query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    It is VPN troubleshoot and Network Watcher Agent Enable Network Watcher: Ensure Network Watcher is enabled in the region where your resources are located. Configure VPN Troubleshoot: In the Azure portal, navigate to Network Watcher. Under Network diagnostic tools, select VPN troubleshoot. Select the virtual network gateway and connection you want to monitor. Choose a storage account to save the diagnostic logs. Create an Alert Rule: Go to Alerts in the Azure portal. Create a new alert rule. Set the condition to monitor the VPN connection status. Define the action group to notify you when the alert is triggered.

    Adapted from community discussion by exam2301 · 2025-01-04 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. E

       exam2301

       2025-01-04

       4 upvotes

       It is VPN troubleshoot and Network Watcher Agent Enable Network Watcher: Ensure Network Watcher is enabled in the region where your resources are located. Configure VPN Troubleshoot: In the Azure portal, navigate to Network Watcher. Under Network diagnostic tools, select VPN troubleshoot. Select the virtual network gateway and connection you want to monitor. Choose a storage account to save the diagnostic logs. Create an Alert Rule: Go to Alerts in the Azure portal. Create a new alert rule. Set the condition to monitor the VPN connection status. Define the action group to notify you when the alert is triggered.

    2. X

       xRiot007

       2025-04-06

       1 upvote

       NSG Flow logs have to do with allowing/denying packets. I can deny packets while my connection is up, so this is not a good indicator if the VPN failed or not. The correct answer is to use VPN troubleshoot. This feature uses Network Watcher agent to retrieve your data that will be inspected to decide if alerts need to be created. Ref: https://learn.microsoft.com/en-us/azure/network-watcher/vpn-troubleshoot-overview

    3. M

       manhattan

       2025-01-20

       1 upvote

       ahh, this question is driving me mad 1) I'll go for Connection monitor https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview#diagnose-issues-in-your-network Virtual network gateway issues: Missing routes. The tunnel between two gateways is disconnected or missing. The second gateway wasn't found by the tunnel. No peering info was found. 2) I'm really confused, NSG logs or Network logs?

    4. M

       manhattan

       2025-01-08

       1 upvote

       it seems that you have to do that with two separate steps. 1) write the VPN troubleshooting logs in a storage account 2) create an alert (in the procedure above after "create a new alert rule" you have to select the resource for your alert before setting the condition, and I suppose it is the storage account you have selected before via VPN troubleshooting, right?

15. Question 15 of 25

    DRAG DROP - You have Azure virtual networks named Hub1 and Spoke1. Hub1 connects to an on-premises network by using a Site-to-Site VPN connection. You are implementing peering between Hub1 and Spoke1. You need to ensure that a virtual machine connected to Spoke1 can connect to the on-premises network through Hub1. How should you complete the PowerShell script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke?tabs=cli#virtual-network-peering

    Adapted from community discussion by walkwolf3 · 2022-05-15 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. B

       Bharat

       2022-04-11

       30 upvotes

       The answer is correct. However, this is a better reference: https://docs.microsoft.com/en-us/azure/firewall/tutorial-hybrid-ps

    2. W

       walkwolf3

       2022-05-15

       22 upvotes

       Answer is correct -AllowGatewayTransit Select Use this virtual network's gateway or Route Server: - If you have a virtual network gateway attached to this virtual network and want to allow traffic from the peered virtual network to flow through the gateway. -UseremoteGateways Select Use the remote virtual network gateway or Route Server: - If you want to allow traffic from this virtual network to flow through a virtual network gateway attached to the virtual network you're peering with. Box1: Hub told spoke to use hub's VPN gateway to reach on-premise network Box2: Spoke told hub to use hub's VPN gateway to reach on-premise network https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering

    3. J

       jeepTango123456

       2023-02-12

       8 upvotes

       From the link the example, the answer here seems to be reversed. # Peer hub to spoke Add-AzVirtualNetworkPeering -Name HubtoSpoke -VirtualNetwork $VNetHub -RemoteVirtualNetworkId $VNetSpoke.Id -AllowGatewayTransit # Peer spoke to hub Add-AzVirtualNetworkPeering -Name SpoketoHub -VirtualNetwork $VNetSpoke -RemoteVirtualNetworkId $VNetHub.Id -AllowForwardedTraffic -UseRemoteGateways

    4. D

       DatBroNZ

       2022-06-11

       6 upvotes

       I thought that as well, but we have to pay attention to the PS command. On the 1st box we are creating the peering on the Hub VNET which will have the Allow Gateway In Transit Enabled. On the 2nd box we are creating the peering on the Spoke VNET which needs to Use the Remote Gateway.

16. Question 16 of 25

    You have the Azure environment shown in the exhibit.

    

    VM1 is a virtual machine that has an instance-level public IP address (ILPIP). Basic Load Balancer uses a public IP address. VM1 and VM2 are in the backend pool. NAT Gateway uses a public IP address named IP3 that is associated to SubnetA. VNet1 has a virtual network gateway that has a public IP address named IP4. When initiating outbound traffic to the internet from VM1, which public address is used?

    • AIP1
    • BIP2
    • CIP3
    • DIP4

    Show answer

    Correct answer: C

    How others answered

    • C94%

    Explanation

    More this https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource#nat-and-vm-with-instance-level-public-ip-and-public-load-balancer Anyway the article says "On a subnet with a NAT gateway, all outbound to Internet scenarios are superseded by the NAT gateway"

    Adapted from community discussion by christianpageqc · 2021-10-14 · 36 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. C

       christianpageqc

       2021-10-14

       100 upvotes

       According to this article correct answer would be NAT Gateway (IP3) https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource#nat-and-vm-with-instance-level-public-ip

    2. C

       christianpageqc

       2021-10-14

       36 upvotes

       More this https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource#nat-and-vm-with-instance-level-public-ip-and-public-load-balancer Anyway the article says "On a subnet with a NAT gateway, all outbound to Internet scenarios are superseded by the NAT gateway"

    3. V

       vunder

       2022-04-27

       20 upvotes

       No, the article says " When NAT gateway is configured to subnets, all previous outbound configurations, such as Load balancer or instance-level public IPs (IL PIPs) are superseded and NAT gateway directs all outbound traffic to the internet. " So the correct answer is C: Ref: https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource#connect-to-the-internet-with-nat-gateway

    4. N

       northgaterebel

       2021-11-18

       Selected C13 upvotes

       https://docs.microsoft.com/en-us/azure/virtual-network/nat-gateway/nat-gateway-resource#nat-and-vm-with-instance-level-public-ip-and-public-load-balancer

17. Question 17 of 25

    You are configuring two network virtual appliances (NVAs) in an Azure virtual network. The NVAs will be used to inspect all the traffic within the virtual network. You need to provide high availability for the NVAs. The solution must minimize administrative effort. What should you include in the solution?

    • AAzure Standard Load Balancer
    • BAzure Application Gateway
    • CAzure Traffic Manager
    • DAzure Front Door

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    The solution must minimize administrative effort. When it comes to the simplest solution, do you really want to be configuring a CDN (Azure Front Door), Azure Traffic Manager - with all those profiles and child profiles as we saw from the other convoluted question on this exam, or even an Azure Application Gateway (Whatever that is) Or do you want to stick with the tried and true method of just creating a Load Balancer and be done with it? Gentlemen, I think answer is obvious: Load Balancer. Hope this helps you to remember!

    Adapted from community discussion by derrrp · 2023-07-21 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. D

       derrrp

       2023-07-21

       17 upvotes

       The solution must minimize administrative effort. When it comes to the simplest solution, do you really want to be configuring a CDN (Azure Front Door), Azure Traffic Manager - with all those profiles and child profiles as we saw from the other convoluted question on this exam, or even an Azure Application Gateway (Whatever that is) Or do you want to stick with the tried and true method of just creating a Load Balancer and be done with it? Gentlemen, I think answer is obvious: Load Balancer. Hope this helps you to remember!

    2. S

       sapien45

       2023-10-05

       8 upvotes

       Your response is a lot of things ... but obvious is not one of them. Obvious answers comes with Azure links This design uses two Azure Load Balancers to expose a cluster of NVAs to the rest of the network: https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha?tabs=cli

    3. N

       Nicolas_UY

       2023-12-16

       Selected A5 upvotes

       To provide high availability for the NVAs and minimize administrative effort, you should include an Azure Standard Load Balancer in the solution. The Azure Standard Load Balancer is a load balancing service that distributes incoming traffic across multiple VMs or appliances, such as the NVAs in this case. It uses a health probe to monitor the health of the VMs or appliances, and only directs traffic to healthy instances. This ensures that traffic is always directed to a healthy NVA, providing high availability for the NVAs. Using a Standard Load Balancer also minimizes administrative effort, as it automatically distributes traffic and monitors the health of the VMs or appliances. There is no need to manually configure or manage the load balancing process. Therefore, the correct answer is A: Azure Standard Load Balancer.

    4. J

       Jamesat

       2023-08-16

       Selected A2 upvotes

       Agree. Load balancer would be the simplest solution. Also with the NVA you would be using Transport Layer addressing not Application Layer. So a standard Load Balancer would be best.

18. Question 18 of 25

    HOTSPOT - Your company has 10 instances of a web service. Each instance is hosted in a different Azure region and is accessible through a public endpoint. The development department at the company is creating an application named App1. Every 10 minutes, App1 will use a list of endpoints and connect to the first available endpoint. You plan to use Azure Traffic Manager to maintain the list of endpoints. You need to configure a Traffic Manager profile that will minimize the impact of DNS caching. What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Reference: https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-endpoint-types

    Adapted from community discussion by VonKellus · 2023-04-22 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. V

       VonKellus

       2023-04-22

       27 upvotes

       he Multivalue traffic-routing method allows you to get multiple healthy endpoints in a single DNS query response. This configuration enables the caller to do client-side retries with other endpoints in case a returned endpoint being unresponsive. This pattern can increase the availability of a service and reduce the latency associated with a new DNS query to obtain a healthy endpoint. MultiValue routing method works only if all the endpoints of type ‘External’ and are specified as IPv4 or IPv6 addresses. When a query is received for this profile, all healthy endpoints are returned and are subject to a configurable maximum return count.

    2. P

       pinpin06

       2023-04-25

       7 upvotes

       • Azure endpoints are used for services hosted in Azure. • External endpoints are used for services hosted outside Azure, either on-premises or with a different hosting provider. • Nested endpoints are used to combine Traffic Manager profiles to create more flexible traffic-routing schemes to support the needs of larger, more complex deployments. as per the following I assume we are talking about azure endpoints, not external endpoints

    3. W

       wmohsen

       2023-04-22

       8 upvotes

       Has to be Azure endpoints? https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-endpoint-types

    4. D

       Dean208

       2023-06-07

       6 upvotes

       I have tested it in the Azure Portal. If you try to use Azure endpoint you get error ..."MultiValue profiles cannot have endpoint with domain names, Azure endpoints or nested endpoints as targets"

19. Question 19 of 25

    You have an Azure subscription that contains the following resources: • A virtual network named Vnet1 • Two subnets named subnet1 and AzureFirewallSubnet • A public Azure Firewall named FW1 • A route table named RT1 that is associated to Subnet1 • A rule routing of 0.0.0.0/0 to FW1 in RT1 After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated. You need to ensure that the virtual machines can be activated. What should you do?

    • AOn FW1, create an outbound service tag rule for AzureCloud.
    • BAdd an internet route to RT1 for the Azure Key Management Service (KMS).
    • COn FW1, configure a DNAT rule for port 1688.
    • DDeploy an Azure Standard Load Balancer that has an outbound NAT rule.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    Correct Answer is B. A: AzureCloud is the wrong tag. Apparently would need to be AzurePlatformLKM-Windows licensing or key management service. https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags B: Something is blocking access to KMS, so a route should fix that. https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems#cause C: DNAT rules are inbound only. D: A Nat rule wouldn't work, for reasons. https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules

    Adapted from community discussion by flurgen248 · 2024-03-15 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. F

       flurgen248

       2024-03-15

       Selected B4 upvotes

       Correct Answer is B. A: AzureCloud is the wrong tag. Apparently would need to be AzurePlatformLKM-Windows licensing or key management service. https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags B: Something is blocking access to KMS, so a route should fix that. https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/troubleshoot-activation-problems#cause C: DNAT rules are inbound only. D: A Nat rule wouldn't work, for reasons. https://learn.microsoft.com/en-us/azure/load-balancer/outbound-rules

    2. T

       TJ001

       2024-01-19

       5 upvotes

       There are two options ... 1) Add specific outbound rule for KMS in the FW as there is already default route points FW 2) Add specific address prefix route in route table so it can by pass default route to FW In this case the chosen Answer - B looks correct

    3. T

       tester2023

       2024-01-31

       4 upvotes

       The article below is a simiar scenario and it points out you need a route (in our case FW or Route Table) that will route traffic to the Microsoft KMS service on port 1688. https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/custom-routes-enable-kms-activation

    4. A

       alfonzo47

       2024-01-18

       1 upvote

       i think that DNAT is only for inbound rules. In this case the windows VMs will try to reach the KMS server (outbound traffic) hence i would go with option B even tho there is no service tag for KMS that can be chosen...

20. Question 20 of 25

    DRAG DROP - Your company, named Contoso, Ltd., has an Azure subscription that contains the resources shown in the following table.

    

    You plan to deploy Azure Front Door. The solution must meet the following requirements: • Requests to a URL of https://contoso.azurefd.net/uk must be routed to App1uk. • Requests to a URL of https://contoso.azurefd.net/us must be routed to App1us. • Requests to a URL of https://contoso.azurefd.net/images must be routed to the storage account closest to the user. What is the minimum number of backend pools and routing rules you should create? To answer, drag the appropriate number to the correct components. Each number may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    3 Backend Pools | 3 Rules I believe this is a Classic Front Door question. The first reference link provides an overview of classic routing. The questions shows we have a single frontend (contoso.azurefd.net) and there are three paths - /uk, /us, and /images. The second link shows the three paths would each be a separate rule. Regarding the number of backend pools, the question states, "...must be routed to [App1uk or App1us]" for the two App Services. The third link does not indicate there is a way to route traffic to a specific app service based on location. However, if we put each app service in its own backend pool, we can have the path rule route to the correct App Service everytime. The Latency routing logic is fine for storage accounts, but not the App Services based on the question requirements. References https://learn.microsoft.com/en-us/azure/frontdoor/front-door-routing-architecture?pivots=front-door-classic https://learn.microsoft.com/en-us/azure/frontdoor/front-door-route-matching?pivots=front-door-classic#frontend-host-matching https://learn.microsoft.com/en-us/azure/frontdoor/routing-methods

    Adapted from community discussion by tester2023 · 2023-02-07 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. T

       tester2023

       2023-02-07

       27 upvotes

       3 Backend Pools | 3 Rules I believe this is a Classic Front Door question. The first reference link provides an overview of classic routing. The questions shows we have a single frontend (contoso.azurefd.net) and there are three paths - /uk, /us, and /images. The second link shows the three paths would each be a separate rule. Regarding the number of backend pools, the question states, "...must be routed to [App1uk or App1us]" for the two App Services. The third link does not indicate there is a way to route traffic to a specific app service based on location. However, if we put each app service in its own backend pool, we can have the path rule route to the correct App Service everytime. The Latency routing logic is fine for storage accounts, but not the App Services based on the question requirements. References https://learn.microsoft.com/en-us/azure/frontdoor/front-door-routing-architecture?pivots=front-door-classic https://learn.microsoft.com/en-us/azure/frontdoor/front-door-route-matching?pivots=front-door-classic#frontend-host-matching https://learn.microsoft.com/en-us/azure/frontdoor/routing-methods

    2. R

       roshingrg

       2023-06-12

       8 upvotes

       To meet the requirements mentioned, you would need to create the following backend pools and routing rules: Backend pools: Backend pool for App1uk: This backend pool will include the App1uk Azure App Service. Backend pool for App1us: This backend pool will include the App1us Azure App Service. Backend pool for the storage account closest to the user: This backend pool will include the storage account in the location closest to the user. Routing rules: Routing rule for https://contoso.azurefd.net/uk: This routing rule will route requests to the App1uk backend pool when the URL is https://contoso.azurefd.net/uk. Routing rule for https://contoso.azurefd.net/us: This routing rule will route requests to the App1us backend pool when the URL is https://contoso.azurefd.net/us. Routing rule for https://contoso.azurefd.net/images: This routing rule will route requests to the backend pool for the storage account closest to the user when the URL is https://contoso.azurefd.net/images. Therefore, the minimum number of backend pools to create is 3, and the minimum number of routing rules to create is also 3.

    3. M

       Mbrigaldino97

       2023-01-18

       8 upvotes

       correct answer should be 2 and 2. You have 1 Frontend, which is contoso.com, this is one frontend with a custom domain and not App Service as origin! You then create 2 Backend Pools, (1 for the App Services, one for both Storage Accounts) and 2 routing rules -> 1 routing rule containing both entries for the App Services ( /uk and /us) and 1 for the Storage Accounts (/images). The latter one will be configured to route by latency (default) https://learn.microsoft.com/en-us/azure/frontdoor/create-front-door-portal https://learn.microsoft.com/en-us/azure/frontdoor/front-door-route-matching?pivots=front-door-standard-premium#frontend-host-matching The App Service Routing Rules specifies the precise paths, the Storage Account routing rule

    4. T

       TJ001

       2023-01-19

       8 upvotes

       for storage account yes ...it will be one pool containing two storage accounts... but for app service it should be separate as the routing is totally path based ...so 3 ,3

21. Question 21 of 25

    You have a network security group named NSG1. You need to enable network security group (NS) flow logs for NSG1. The solution must support retention policies. What should you create first?

    • AA standard general-purpose v2 Azure Storage account
    • BAn Azure Log Analytics workspace
    • CA standard general-purpose v1 Azure Storage account
    • DA premium Block blobs Azure Storage account

    Show answer

    Correct answer: A

    How others answered

    • A80%
    • B20%

    Explanation

    "Network security group (NSG) flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG. Flow data is sent to Azure Storage accounts from where you can access it as well as export it to any visualization tool, SIEM, or IDS of your choice." https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

    Adapted from community discussion by Akodo_Shado · 2023-01-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. S

       SJHCI

       2024-01-21

       Selected A6 upvotes

       A for sure. https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#how-nsg-flow-logs-work "Retention is available only if you use general-purpose v2 storage accounts."

    2. A

       alfonzo47

       2023-01-17

       Selected A4 upvotes

       The answer is correct as stated right here in documentation: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview#:~:text=Retention%20is%20available%20only%20if%20you%20use%20General%20purpose%20v2%20Storage%20accounts%20(GPv2).

    3. O

       omgMerrick

       2023-02-24

       Selected A3 upvotes

       A. Standard general-purpose v2 storage account Read my correction and source: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal#enable-nsg-flow-log

    4. A

       Akodo_Shado

       2023-01-09

       Selected A2 upvotes

       "Network security group (NSG) flow logs is a feature of Azure Network Watcher that allows you to log information about IP traffic flowing through an NSG. Flow data is sent to Azure Storage accounts from where you can access it as well as export it to any visualization tool, SIEM, or IDS of your choice." https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

22. Question 22 of 25

    You have an Azure subscription that contains an Azure Front Door named FD1. You plan to deploy an app named App1 by using Azure App Service. Users will access App1 by using FD1. You need to provide FD1 with access to App1. The solution must meet the following requirements: • Ensure that users can only access App1 by using FD1. • Ensure that users cannot access App1 directly from the internet. What should you create for App1?

    • Aan access restriction
    • Ba private endpoint
    • Ca subnet delegation
    • Da service endpoint

    Show answer

    Correct answer: A

    How others answered

    • A75%
    • B25%

    Explanation

    If you follow your own link under headline access restrictions you also can find a link that states that a private endpoint is needed: https://learn.microsoft.com/de-de/azure/app-service/networking-features#access-restrictions

    Adapted from community discussion by Apptech · 2023-05-14 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. B

       Billabongs

       2023-07-26

       Selected A4 upvotes

       Access Restriction Create a Rule pointing to Azure Front Door https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure-front-door-to-azure-app-service-as/ba-p/2000173

    2. B

       Ben_88

       2023-06-13

       Selected A4 upvotes

       if you follow this procedure https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure-front-door-to-azure-app-service-as/ba-p/2000173

    3. O

       occupatissimo

       2023-05-09

       4 upvotes

       A, access comes from internet https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions?tabs=azurecli

    4. C

       CharlesS76

       2024-06-13

       Selected A3 upvotes

       https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure-front-door-to-azure-app-service-as/ba-p/2000173

23. Question 23 of 25

    You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. The subscription contains the following resources: ✑ An Azure App Service app named App1 ✑ An Azure DNS zone named contoso.com ✑ An Azure private DNS zone named private.contoso.com ✑ A virtual network named Vnet1 You create a private endpoint for App1. The record for the endpoint is registered automatically in Azure DNS. You need to provide a developer with the name that is registered in Azure DNS for the private endpoint. What should you provide?

    • Aapp1.contoso.onmicrosoft.com
    • Bapp1.private.contoso.com
    • Capp1.privatelink.azurewebsites.net
    • Dapp1.contoso.com

    Show answer

    Correct answer: C

    How others answered

    • C83%
    • B17%

    Explanation

    When you use Private Endpoint for Web App, the requested URL must match the name of your Web App. By default mywebappname.azurewebsites.net. By default, without Private Endpoint, the public name of your web app is a canonical name to the cluster. For example, the name resolution will be: DNS Name Type Value mywebapp.azurewebsites.net CNAME clustername.azurewebsites.windows.net clustername.azurewebsites.windows.net CNAME cloudservicename.cloudapp.net cloudservicename.cloudapp.net A 40.122.110.154 When you deploy a Private Endpoint, we update the DNS entry to point to the canonical name mywebapp.privatelink.azurewebsites.net. For example, the name resolution will be: DNS Name Type Value Remark mywebapp.azurewebsites.net CNAME mywebapp.privatelink.azurewebsites.net mywebapp.privatelink.azurewebsites.net CNAME clustername.azurewebsites.windows.net clustername.azurewebsites.windows.net CNAME cloudservicename.cloudapp.net cloudservicename.cloudapp.net A 40.122.110.154 https://docs.microsoft.com/en-us/azure/app-service/networking/private-endpoint Hence answer is C

    Adapted from community discussion by Sahildange · 2022-10-17 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. S

       Sahildange

       2022-10-17

       18 upvotes

       When you use Private Endpoint for Web App, the requested URL must match the name of your Web App. By default mywebappname.azurewebsites.net. By default, without Private Endpoint, the public name of your web app is a canonical name to the cluster. For example, the name resolution will be: DNS Name Type Value mywebapp.azurewebsites.net CNAME clustername.azurewebsites.windows.net clustername.azurewebsites.windows.net CNAME cloudservicename.cloudapp.net cloudservicename.cloudapp.net A 40.122.110.154 When you deploy a Private Endpoint, we update the DNS entry to point to the canonical name mywebapp.privatelink.azurewebsites.net. For example, the name resolution will be: DNS Name Type Value Remark mywebapp.azurewebsites.net CNAME mywebapp.privatelink.azurewebsites.net mywebapp.privatelink.azurewebsites.net CNAME clustername.azurewebsites.windows.net clustername.azurewebsites.windows.net CNAME cloudservicename.cloudapp.net cloudservicename.cloudapp.net A 40.122.110.154 https://docs.microsoft.com/en-us/azure/app-service/networking/private-endpoint Hence answer is C

    2. C

       christianpageqc

       2022-10-14

       4 upvotes

       VNet DNS auto-registration won't create any DNS for private link according to this article : https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration#restrictions "Auto registration works only for virtual machines" As for private link auto DNS, it seems bound to public Microsoft domains.. I think we would need to deploy DNS forwarder and CNAME to resolve something other then A.

    3. D

       dpinlaguna

       2022-10-15

       3 upvotes

       https://docs.microsoft.com/en-us/learn/modules/introduction-azure-private-link/3-how-azure-private-link-works: Clients that connect to a Private Link resource don't need to use the Private Endpoint's assigned IP address in the connection string. Instead, if you configure the Private Endpoint to integrate with your private DNS zone, then Azure automatically assigns a FQDN to the endpoint. For example, if the Private Link resource is an Azure Storage table, the FQDN will be something like mystorageaccount1234.table.core.windows.net.

    4. K

       kjfdzkkbsm

       2023-02-03

       Selected C3 upvotes

       From the docs: When you deploy a Private Endpoint, we update the DNS entry to point to the canonical name mywebapp.privatelink.azurewebsites.net. https://docs.microsoft.com/en-us/azure/app-service/networking/private-endpoint#dns

24. Question 24 of 25

    You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements. Which connectivity method should you use?

    • Aa private endpoint
    • BAzure Firewall
    • CAzure Front Door
    • Da service endpoint

    Show answer

    Correct answer: A

    How others answered

    • A53%
    • D47%

    Only 53% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network. Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK A is the answer

    Adapted from community discussion by wsrudmen · 2022-05-23 · 31 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. W

       wsrudmen

       2022-05-23

       Selected A31 upvotes

       Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network. Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK A is the answer

    2. E

       erima21

       2022-09-08

       9 upvotes

       Correct! - Service endpoints does not remove public endpoint. - Private endpoints remove public access.

    3. R

       RVR

       2022-05-09

       6 upvotes

       Considering they want to meet business requirements as well which says "Litware wants to minimize costs whenever possible, as long as all other requirements are met" - a service endpoint will be fine

    4. L

       leocopek

       2022-04-29

       6 upvotes

       correct answer is A. service endpoint still have public endpoint

25. Question 25 of 25

    DRAG DROP - You need to prepare Vnet1 for the deployment of an ExpressRoute gateway. The solution must meet the hybrid connectivity requirements and the business requirements. Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer

    Explanation

    Step 1: Delete the VPN GW1. The existing VPN GW1 GatewaySubnet is too small with /29. Users must be able to connect to Vnet1 by using a Point-to-Site (P2S) VPN when working remotely. Connections must be authenticated by Azure AD. Litware wants to minimize costs whenever possible, as long as all other requirements are met. Step 2: Create a VPN gateway by using Basic SKU. Basic SKU is good enough. Note - The Basic gateway SKU does not support IKEv2 or RADIUS authentication. If you plan on having Mac clients connect to your virtual network, do not use the Basic SKU. Step 3: Set the subnet mask of Gateway Subnet to /27. When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. The number of IP addresses needed depends on the VPN gateway configuration that you want to create. Some configurations require more IP addresses than others. We [Microsoft] recommend that you create a gateway subnet that uses a /27 or /28. It's best to specify /27 or larger (/26,/25 etc.). This allows enough IP addresses for future changes, such as adding an ExpressRoute gateway. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

    Adapted from community discussion by [Removed] · 2024-03-11 · 27 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Answer figure

    

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-700 or CertExamHQ.

    1. [

       [Removed]

       2024-03-11

       27 upvotes

       1. Delete VPN GW1. 2. Set the subnet mask of Gateway Subnet to /27. 3. Create a VPN gateway by using the VPN GW1 SKU. Basic VPN Gateway does not support P2S. If the gateway subnet is /29, you've to first delete the virtual network gateway and increase the gateway subnet size. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways https://docs.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal

    2. A

       Alessandro365

       2024-03-29

       12 upvotes

       1. Delete VPN GW1. 2. Set the subnet mask of Gateway Subnet to /27. 3. Create a VPN gateway by using the VPN GW1 SKU. https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-coexisting-gateway-portal "To configure coexisting connections for an already existing VNet: 1- Delete the existing ExpressRoute or Site-to-site VPN gateway. 2 - Delete and recreate the GatewaySubnet to have prefix of /27 or shorter. 3- Configure a VNet with a Site-to-Site connection and then Configure the ExpressRoute gateway. 4 - Once the ExpressRoute gateway is deployed, you can link the virtual network to the ExpressRoute circuit."

    3. T

       tdienst

       2024-03-08

       5 upvotes

       1. Delete GW1 2. Create VPN GW with GW1 SKU 3. Edit subnet mask to /27 ExpressRoute-VPN Gateway coexist configurations are not supported on the Basic SKU. https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways although i feel that 2-3 are interchangable.

    4. [

       [Removed]

       2024-03-28

       5 upvotes

       I agree, but basic VPN gateway does support P2S (SSTP Connections) but not P2S IKEv2/OpenVPN Connections. And openVPN is needed for AzureAD. So basic can't be used here

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-700 practice, question 1 of 25