Microsoft

AZ-700 Free Practice Questions — Page 5

Question 42

DRAG DROP - You have two Azure subscriptions named Sub1 and Sub2 that contain the resources shown in the following table. VNet1 and VNet2 are NOT connected. You plan to create an Azure Private Link service named Link1 that will be used to connect VNet1 and VNet2. You need to ensure that Link1 meets the following requirements: • Ensures that VM1 can connect only to a web app hosted on VM2 • Prevents VM1 from connecting to the other resources that are connected to VNet2 Which additional resources should you create for each virtual network? To answer, drag the appropriate resources to the correct virtual networks. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 42 Illustration for AZ-700 question 42
Show Answer
Correct Answer: VNet1: A private endpoint VNet2: A load balancer
Explanation:
Azure Private Link requires a private endpoint in the consumer virtual network (VNet1) to provide private access. The provider side (VNet2) must expose the service behind a standard load balancer, which fronts VM2 only, ensuring VM1 can reach only the intended web app and not other VNet2 resources.

Question 44

HOTSPOT - You have an Azure subscription that contains six Azure App Service apps. The apps have an identical configuration and are deployed across multiple Azure regions. You plan to deploy Azure Front Door to load balance traffic across the apps. You need to ensure that the round robin load-balancing algorithm will send traffic only to a limited number App Service apps based on their proximity to a user. The solution must minimize administrative effort. What should you modify, and what should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 44
Show Answer
Correct Answer: Modify: The origin group Configure: The latency sensitivity
Explanation:
In Azure Front Door, proximity-based routing is controlled at the origin group level. Configuring latency sensitivity limits round-robin traffic to the closest origins based on measured latency, ensuring users are served by nearby App Service apps with minimal administrative effort.

Question 45

HOTSPOT - You have an Azure subscription that contains a virtual machine scale set named VMSS1 and a public standard Azure load balancer named LB1. VMSS1 contains eight virtual machines that have private IP addresses only. VMSS1 is configured as a backend pool of LB1. LB1 has two frontend IP addresses and one outbound rule that provides internet connectivity to VMSS1. What is the maximum number of ports available to the virtual machines in VMSS1, and what should you change to increase the maximum number of SNAT ports available to VMSS1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 45
Show Answer
Correct Answer: Maximum number of ports: 128K Increase the number of: Frontend IP addresses for LB1
Explanation:
In a Standard Azure Load Balancer, each frontend IP address provides up to 64,000 SNAT ports per outbound rule. With two frontend IPs, the total available SNAT ports are 2 × 64,000 = 128K. To increase the total SNAT port pool for the VM scale set, you add more frontend IP addresses to the load balancer.

Question 46

You have an Azure subscription that contains the resources shown in the following table. You need to configure a solution to meet the following requirements: • App1 must be assigned a private endpoint. • Access to App1 from the internet must be routed via FD1. What should you configure on FD1?

A. a security policy that redirects traffic
B. a rule that has the route configuration override action
C. an origin that enables the Azure Private Link service
D. a route that redirects traffic
Show Answer
Correct Answer: C
Explanation:
To allow Azure Front Door (FD1) to access App1 via a private endpoint while ensuring all internet traffic routes through FD1, you must configure an origin that uses Azure Private Link. This enables Front Door to privately connect to the App Service over Private Link. Redirect rules, routes, or security policies do not establish private connectivity to a private endpoint.

Question 47

HOTSPOT - You have an on-premises web server that hosts a web app named App1 and has the following configurations: • IP address: 131.107.50.60 • FQDN: server1.contoso.com You have an Azure subscription. You need to publish App1 by using Azure Front Door. The solution must meet the following requirements: • Ensure that internet users can connect to App1 by using an FQDN of app1.contoso.com. • Minimize the changes required to the configuration of Front Door if Server1 is migrated to Azure. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 47
Show Answer
Correct Answer: Set the DNS record for app1.contoso.com to: A CNAME record of app1-<GUID>.z01.azurefd.net From the Front Door profile, set the origin host name to: server1.contoso.com
Explanation:
The custom domain must CNAME to the Azure Front Door endpoint so users access Front Door via app1.contoso.com. Using server1.contoso.com as the origin host name preserves the backend Host header and allows Server1 to be migrated to Azure by only updating its DNS record, minimizing Front Door changes.

Question 48

SIMULATION - Username and password - Use the following login credentials as needed: To enter your username, place your cursor in the Sign in box and click on the username below. To enter your password, place your cursor in the Enter password box and click on the password below. Azure Username: Azure Password: xxxxxxxxxx - If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab. The following information is for technical support purposes only: Lab Instance: 12345678 - You have two servers that are each hosted by a separate service provider in New York and Germany. The server hosted in New York is accessible by using a host name of ny.contoso.com. The server hosted in Germany is accessible by using a host name of de.contoso.com. You need to provide a single host name to access both servers. The solution must ensure that traffic originating from Germany is routed to de.contoso.com. All other traffic must be routed to ny.contoso.com. To complete this task, sign in to the Azure portal.

Illustration for AZ-700 question 48
Show Answer
Correct Answer: Use Azure Traffic Manager with Geographic routing. Create a Traffic Manager profile. Add endpoint ny.contoso.com for all regions except Germany. Add endpoint de.contoso.com for Germany.
Explanation:
Azure Traffic Manager supports DNS-based geographic routing, allowing a single hostname to route users based on their source location. Traffic from Germany is directed to the German endpoint, while all other traffic is routed to the New York endpoint. Application Gateway cannot provide global, location-based routing across regions.

Question 49

DRAG DROP - You have an on-premises network. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway named Gateway1. You need to implement an ExpressRoute solution from a third-party provider named Fabrikam, Inc. The solution must ensure that devices on the on-premises network can connect to the Azure resources on VNet1. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for AZ-700 question 49
Show Answer
Correct Answer: Create an ExpressRoute circuit. Send the service key to Fabrikam. Configure Azure private peering. Connect Gateway1 to the ExpressRoute circuit.
Explanation:
First create the ExpressRoute circuit in Azure. The service key is then provided to the connectivity provider to provision the circuit. Azure private peering is required for VNet-to-on-premises connectivity. Finally, link the ExpressRoute gateway to the circuit to enable traffic flow.

Question 50

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. You need to ensure that remote users can establish RDP connections to the virtual machines by using Bastion1. How should you configure the rules for NSG1 for traffic from the internet to AzureBastionSubnet and for traffic from AzureBastionSubnet to Subnet1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 50 Illustration for AZ-700 question 50
Show Answer
Correct Answer: Traffic from the internet to AzureBastionSubnet: Enable TCP port 443 inbound. Traffic from AzureBastionSubnet to Subnet1: Enable TCP port 3389 outbound.
Explanation:
Azure Bastion is accessed by users over HTTPS (TCP 443) from the internet. Bastion then establishes RDP connections to Windows VMs inside the VNet using TCP 3389, which must be allowed outbound from AzureBastionSubnet to Subnet1.

Question 51

DRAG DROP - You have an on-premises network. You have an Azure subscription that contains a virtual network named VNet1. VNet1 is connected to an Azure Virtual WAN hub named Hub1. You need to enable connectivity between the on-premises network and VNet1 by using Hub1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Show Answer
Correct Answer: Configure site-to-site VPN gateway settings, Create a site, Connect a site to a virtual hub
Explanation:
VNet1 is already connected to the Virtual WAN hub, so only Site-to-Site VPN is required. First, enable/configure the S2S VPN gateway on Hub1. Next, create a VPN site that represents the on‑premises network. Finally, connect the VPN site to the virtual hub to establish connectivity between on‑premises and VNet1 through Hub1.

Question 52

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. You need to ensure that network traffic is routed over the Azure backbone network for the following scenarios: • Traffic from SQLMIT to storage1 • Traffic from domain joined servers on VNet2 to storage The solution must minimize costs. What should you configure for each scenario? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 52 Illustration for AZ-700 question 52
Show Answer
Correct Answer: Traffic from SQLMI1 to storage1: A private endpoint Traffic from domain joined servers on VNet2 to storage1: A service endpoint policy
Explanation:
Azure SQL Managed Instance accesses Azure Storage over the Azure backbone using a private endpoint, which is supported and cost‑effective for PaaS integration. For VNet2 workloads, a service endpoint with a service endpoint policy keeps traffic on the Azure backbone while avoiding the higher cost and management overhead of private endpoints.

$19

Get all 344 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.