Microsoft

AZ-700 Free Practice Questions — Page 7

Question 63

HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. You need to deploy an instance of Azure Application Gateway v2 named AppGw1 to VNet1. AppGw1 will include one basic listener and two multi-site listeners. The listeners will be accessible only from VNet1. What is the minimum number of IP addresses required for AppGw1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 63
Show Answer
Correct Answer: Private IP addresses: 1 Public IP addresses: 0
Explanation:
AppGw v2 can be deployed as internal-only. All basic and multi-site listeners can share a single private frontend IP using different hostnames/ports. The number of listeners does not increase required IPs, and no public access is needed since it’s accessible only from VNet1.

Question 64

HOTSPOT - You have an on-premises network that includes the sites shown in the following table. Each site is connected to the Internet by a firewall. All sites are connected to an SD-WAN. Each site is configured to propagate routes by using BGP. You have an Azure subscription that includes a virtual network named Vnet1 that contains a Virtual Network Gateway named Gateway1. You create a local network gateway with the configuration shown in the gateway exhibit (Click the Gateway tab.) You create a Site-to-Site (S2S) connection with the configuration shown in connection exhibit. (Click the Connection tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 64 Illustration for AZ-700 question 64 Illustration for AZ-700 question 64 Illustration for AZ-700 question 64
Show Answer
Correct Answer: Yes Yes No
Explanation:
The S2S VPN terminates at the Paris firewall, and the Local Network Gateway address space (172.16.0.0/16) includes Berlin, so Berlin can reach VNet1 via SD‑WAN and BGP. A direct tunnel to Berlin would require a separate Local Network Gateway for Berlin’s public IP. The Local Network Gateway must use the on‑premises public IP, not the private IP, so no change to 172.16.0.1 is required.

Question 65

HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You plan to deploy Azure virtual machines and Azure Bastion to VNet1. You need to recommend an IP subnetting configuration for VNet1. The solution must maximize the number of IP addresses that can be assigned to the virtual machines. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 65
Show Answer
Correct Answer: /25 182
Explanation:
Azure Bastion requires a dedicated AzureBastionSubnet with a minimum size of /26 (64 addresses). From the VNet /24 (256 addresses), this leaves 192 addresses for VM subnets. To maximize usable VM IPs, split the remaining space into one /25 (128 addresses) and one /26 (64 addresses). After Azure’s 5 reserved IPs per subnet, usable VM IPs are 123 + 59 = 182. The larger VM subnet therefore uses a /25 mask.

Question 66

HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. Your on-premises network connects to VNet1 by using a Site-to-Site (S2S) VPN connection. You need to ensure that Azure Network Watcher generates an alert if the VPN connection fails. Which Network Watcher feature should you use to generate the alert, and which data source should the feature query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 66
Show Answer
Correct Answer: Feature: VPN troubleshoot Data source: Network security group (NSG) flow logs
Explanation:
VPN troubleshoot is the Network Watcher feature designed to detect and diagnose Site-to-Site VPN connection failures. It evaluates gateway and tunnel health and relies on Network Watcher–collected data, including NSG flow logs, which can be queried by Azure Monitor to trigger alerts when the VPN connection fails.

Question 67

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. You create a service endpoint policy as shown in the Policy exhibit. (Click the Policy tab.) You configure the Service Endpoints settings for Subnet3 as shown in the Subnets exhibit. (Click the Subnets tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Show Answer
Correct Answer: C
Explanation:
A service endpoint policy applied to a subnet allows access only to the explicitly listed resources for the specified service (here, Microsoft.Storage). Therefore, only the storage account included in the policy is accessible (first statement: No). The same service endpoint policy can be associated with multiple subnets as long as the required service endpoint is enabled on them (second statement: Yes). The policy does not apply to non-Storage resources such as Azure SQL Database, so it does not control access to DB1 (third statement: No).

Question 68

HOTSPOT - You have an on-premises network. You have an Azure subscription that contains the resources shown in the following table. You need to ensure that on-premises devices can communicate with Azure resources that are connected to Subnet4. What should you do on each resource? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 68 Illustration for AZ-700 question 68
Show Answer
Correct Answer: Server1: Deploy the On-Premises Extended-Network Gateway appliance. VM2: Deploy the Azure Extended-Network Gateway appliance.
Explanation:
Subnet4 in Azure overlaps with on‑premises Subnet1 (10.1.1.0/24), so standard S2S routing cannot be used. Azure Extended Network enables hybrid connectivity with overlapping IP spaces by placing an extended-network gateway on‑premises and a corresponding gateway in Azure to bridge traffic to Subnet4.

Question 69

HOTSPOT - You have an Azure subscription that contains a dual-stack virtual network named VNet1. VNet1 has the following IP address spaces: • IPv4: 192.168.0.0/24 • IPv6: fd00:db8:deca:deed:/48 You plan to deploy an Azure VPN gateway and multiple virtual machines to VNet1. You need to configure the subnet masks for VNet1. The solution must meet the following requirements: • Maximize the number of usable IP addresses. • Support the deployment of the VPN gateway and the virtual machines. Which subnet mask should you use for each address space? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Show Answer
Correct Answer: /25, /64
Explanation:
IPv4 must be split to support a dedicated GatewaySubnet (minimum /29). To maximize usable addresses for workloads while still allowing a gateway, the largest practical subnet size is /25. For IPv6, Azure requires all subnets (including GatewaySubnet) to be /64, which also maximizes usable IPv6 addresses.

Question 70

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. You need to identify the number of established outbound connections from the virtual machines. Which resource and metric should you review? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Show Answer
Correct Answer: A
Explanation:
To identify the number of established outbound connections from the virtual machines, you should review the Azure Load Balancer resource and the SNAT ports metric. The SNAT ports metric reflects outbound connection usage because each outbound connection consumes a source network address translation (SNAT) port on the load balancer. Monitoring this metric on the load balancer shows how many outbound connections are established.

Question 71

DRAG DROP - You have an Azure subscription that contains a virtual machine named VM1. VM1 contains a NIC named NIC1 and a public IP address named PIP1. PIP1 is assigned to NIC1. You plan to deploy four Network Virtual Appliances (NVAs). You need to ensure that all the inbound traffic from the internet to PIP1 is inspected by the NVAs. The solution must ensure that the NVA deployment is highly available. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for AZ-700 question 71
Show Answer
Correct Answer: Create a gateway load balancer. Deploy the NVAs. Link NIC1 to the load balancer.
Explanation:
To inspect inbound internet traffic with high availability, Azure requires a Gateway Load Balancer. The NVAs must exist to be registered behind it, and then VM1’s NIC is chained to the Gateway Load Balancer so all traffic to PIP1 is transparently steered through the NVAs.

Question 72

DRAG DROP - You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. You plan to deploy the resources shown in the following table. You need to deploy two load balancers to manage the traffic for VMSS1, VM1, and VM2. The solution must meet the following requirements: • Either VM1 or VM2 must inspect all the traffic from the internet to App1. • All user connections from the internet to App1 must be load balanced. • Costs must be minimized. Which load balancer SKU should you include in the solution? To answer, drag the appropriate SKUs to the correct resources. Each SKU may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Show Answer
Correct Answer: A
Explanation:
To meet the requirements, App1 traffic from the internet must be load balanced and chained through an inspection tier. This requires an internet-facing Standard Load Balancer for VMSS1 (to support scalability and integration with Gateway Load Balancer) and a Gateway Load Balancer in front of VM1 and VM2, which act as traffic inspection NVAs. Basic Load Balancer does not support gateway chaining or cross-scenario requirements. This combination also minimizes cost while meeting functionality.

$19

Get all 344 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.