Microsoft

AZ-700 Free Practice Questions — Page 8

Question 73

You have an Azure subscription that contains the resources shown in the following table. You need to configure FW1 to filter traffic that originates from VNet1 and targets the FQDN of SQLDB1. Which type of rule should you use?

A. DNAT
B. network
C. application
D. infrastructure
Show Answer
Correct Answer: C
Explanation:
Filtering traffic based on a fully qualified domain name (FQDN), such as an Azure SQL Database endpoint, requires Azure Firewall Application rules. Network rules work only with IP addresses and ports, DNAT is for inbound address translation, and infrastructure rules are managed by Azure for firewall operations.

Question 74

HOTSPOT - You have an on-premises server named Server that is assigned a public IP address of 131.107.100.200. You have an Azure subscription that contains the resources shown in the following table. storage85347 has the Networking settings configured as shown in the following exhibit. From the Firewalls and virtual networks tab, you add Subnet1 to storage85347. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 74 Illustration for AZ-700 question 74 Illustration for AZ-700 question 74
Show Answer
Correct Answer: No No Yes
Explanation:
Adding Subnet1 to the storage account does not create a service endpoint on the entire VNet, only on the selected subnet. Only Subnet1 (and the allowed public IP) can access the storage account, so not all VMs have access. Enabling a service endpoint automatically adds system routes (VirtualNetworkService) to the subnet’s effective route table.

Question 75

HOTSPOT - You have an on-premises network and an Azure virtual network named VNet1. You need to implement Azure Extended Network. The solution must minimize costs. Which type of virtual machine should you deploy to VNet1, and which tool should you use to configure Azure Extended Network? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Show Answer
Correct Answer: Windows Server 2022 Azure Edition virtual machine, Windows Admin Center
Explanation:
Azure Extended Network requires a Windows Server Azure Edition VM deployed in the Azure virtual network to act as the proxy. The feature is configured and managed through Windows Admin Center, which is the supported and cost-effective configuration tool for Azure Extended Network.

Question 76

HOTSPOT - You have an Azure subscription that contains a virtual machine named VM1 and a virtual network named Vnet1. Vnet1 contains three subnets named Subnet1, Subnet2, and GatewaySubnet. VM1 is connected to Subnet1. You plan to deploy a new virtual machine named VM2 that will perform network traffic routing and inspection. You need to ensure that all the traffic from VM1 to the internet will be routed through VM2. What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Show Answer
Correct Answer: B
Explanation:
To force all internet-bound traffic from VM1 through VM2, VM2 must act as a network virtual appliance (NVA). Deploy VM2 in a separate subnet (Subnet2), not in GatewaySubnet. Then create a custom user-defined route with a default route (0.0.0.0/0) that points to VM2 as the next hop and associate this route table with Subnet1 where VM1 resides. This ensures all outbound traffic from VM1 is routed through VM2.

Question 77

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. Each virtual network contains 20 virtual machines and a subnet that has an IP address space of /24. You need to ensure that you can access the virtual machines from the internet by using Azure Bastion. What is the minimum number of bastion subnets you should deploy, and what is the smallest supported IP address space for each bastion subnet? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Show Answer
Correct Answer: B
Explanation:
Azure Bastion can be shared across peered virtual networks. Since VNet1 and VNet2 are already peered, a single Bastion deployment can provide access to both. VNet3 is not peered, so it requires its own Bastion. Therefore, the minimum number of Bastion subnets is two. The smallest supported subnet size for AzureBastionSubnet is /26.

Question 78

HOTSPOT - You have two Azure subscriptions. You need to perform the following actions in the East US Azure region of each subscription: • Deploy 50 virtual machines to availability zone 1. • Deploy 50 virtual machines to availability zone 2. • Deploy 50 virtual machines to availability zone 3. What is the minimum number of virtual networks and /25 subnets you should create? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-700 question 78
Show Answer
Correct Answer: Virtual networks: 2 Subnets: 4
Explanation:
Availability zones do not require separate virtual networks or subnets. A /25 subnet provides 123 usable IPs, sufficient for 50 VMs. Per subscription, one virtual network with two /25 subnets can host 150 VMs across all three zones. With two subscriptions, the minimum is two virtual networks and four /25 subnets total.

Question 79

You have an Azure subscription that contains the resources shown in the following table. You create a service endpoint policy that has the following settings: • Associated subnets: Subnet1 • Service: Microsoft.Storage • Scope: Single account • Resource: storage1 Which resources can VM1 access?

A. storage1 in the East US Azure region and its replica in the paired region
B. storage1 in the East US Azure region only
C. storage1 and storage2 in the East US Azure region only
D. storage1 and storage2 in the East US Azure region and their replicas in the paired region
Show Answer
Correct Answer: A
Explanation:
A service endpoint policy scoped to a single Storage account allows access only to that specific account. When the storage account uses replication (such as RA-GRS/GRS), access to the paired-region replica is automatically included. Therefore, VM1 can access storage1 in the East US region and its replica in the paired region, but not any other storage accounts.

Question 80

You have an Azure virtual machine named VM1. You need to capture all the network traffic of VM1 by using Azure Network Watcher. To which locations can the capture be written?

A. a file path on VM1 only
B. General purpose v2 standard only
C. a Block blob premium account only
D. General purpose v2 standard and a file path on VM1 only
E. General purpose v2 standard and a Block blob premium account only
F. blob storage, a file path on VM1, and a Block blob premium account
Show Answer
Correct Answer: D
Explanation:
Azure Network Watcher packet capture for a VM can write captures either to a local file path on the VM, to an Azure Storage account, or both. The supported storage account is a Standard (general-purpose v2) storage account; Premium Block Blob accounts are not supported. Therefore, the valid locations are a general-purpose v2 standard storage account and a file path on VM1.

Question 81

You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1. You need to deploy Azure Firewall to RG1. The solution must minimize administrative effort. What should you do first?

A. Create a secured virtual hub named AzureFirewallHub.
B. Create a new virtual network named AzureFirewallNetwork.
C. Create a new resource group named AzurFirewellRescurceGroup.
D. On VNet1, create virtual subnet named AzureFirewallSubnet
Show Answer
Correct Answer: D
Explanation:
Azure Firewall deployed into an existing virtual network requires a dedicated subnet named **AzureFirewallSubnet** as a prerequisite. Since RG1 and VNet1 already exist and the goal is to minimize administrative effort, the first required action is to create this mandatory subnet in VNet1. Other options either add unnecessary resources or apply to different architectures (such as secured virtual hubs).

Question 82

You have an on-premises server named Server1 that runs Windows Server. You have an Azure subscription that contains a virtual network named VNet1. You plan to connect Server1 to VNet1 by using Azure Network Adapter. You need to minimize how long it takes to deploy the adapter to Server1. What should you create first?

A. a route server
B. an Azure Bastion host
C. a private endpoint
D. an Azure VPN gateway
Show Answer
Correct Answer: D
Explanation:
Azure Network Adapter connects an on-premises Windows Server to an Azure virtual network by automatically configuring a Point-to-Site (P2S) VPN. A P2S connection requires an Azure VPN gateway in the target virtual network, and provisioning the VPN gateway is the prerequisite and longest step. Therefore, to minimize deployment time overall, the VPN gateway should be created first.

$19

Get all 344 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.