47 free Microsoft AZ-700 practice questions from the CertStash pack of 387, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 47 free here, all 387 in the pack, and each step includes the one before it.
Get all 387 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Your company has a single on-premises datacenter in Washington DC. The East US Azure region has a peering location in Washington DC.
The company only has Azure resources in the East US region.
You need to implement ExpressRoute to support up to 1 Gbps. You must use only ExpressRoute Unlimited data plans. The solution must minimize costs.
Which type of ExpressRoute circuits should you create?
Show answer and explanation
Correct answer: A. ExpressRoute Local
ExpressRoute Local is designed for a company that connects at a peering location close to the Azure region it uses. Here the datacenter is in Washington DC, which is the peering location for East US, and all Azure resources are in East US, so the local scope of the circuit covers everything required. Local circuits are sold only with the unlimited data plan and include egress data transfer in the port charge, which makes them the lowest cost unlimited option at 1 Gbps. The narrower regional scope is the only trade-off, and it does not matter when every resource sits in the local region.
Why the other options are wrong
- B. ExpressRoute Direct provides dedicated high-capacity ports at a peering location and is far more expensive than needed for a 1 Gbps requirement.
- C. ExpressRoute Premium adds global connectivity and higher route and link limits that a single-region deployment does not need, so it raises costs.
- D. ExpressRoute Standard offers an unlimited plan as well, but it costs considerably more than a Local circuit of the same bandwidth for an East US only deployment.
Question 2
You are planning an Azure Point-to-Site (P2S) VPN that will use OpenVPN.
Users will authenticate by an on-premises Active Directory domain.
Which additional service should you deploy to support the VPN authentication?
Show answer and explanation
Correct answer: B. a RADIUS server
Point-to-Site VPN connections can authenticate users with their organization domain credentials, but the VPN gateway does not talk to Active Directory directly. Authentication against an on-premises Active Directory domain requires a RADIUS server that integrates with the domain. The VPN gateway forwards the authentication request to the RADIUS server, which validates the user against Active Directory and returns the result. An existing RADIUS deployment, such as Network Policy Server, can be reused, and the RADIUS server can run on-premises or in the Azure virtual network as long as the gateway can reach it.
Why the other options are wrong
- A. An Azure key vault stores secrets, keys and certificates and plays no part in validating VPN users against Active Directory.
- C. A certification authority supports certificate authentication, not authentication with domain user credentials.
- D. Azure AD Application Proxy publishes on-premises web applications to remote users and does not authenticate VPN connections.
Question 3
You plan to configure BGP for a Site-to-Site VPN connection between a datacenter and Azure.
Which two Azure resources should you configure? Each correct answer presents a part of the solution. (Choose two.)
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. a virtual network gateway; a local network gateway
BGP on a Site-to-Site VPN is configured on both ends of the connection as Azure sees it. The virtual network gateway is the Azure VPN gateway, and BGP is enabled on it together with its autonomous system number, which also gives it a BGP peer IP address. The local network gateway represents the on-premises VPN device, and its BGP settings hold the ASN of the on-premises network and the BGP peer IP address of the device. With both resources configured and BGP enabled on the connection, the two sides exchange routes dynamically.
Why the other options are wrong
- B. Azure Application Gateway is a web traffic load balancer and has no role in a Site-to-Site VPN or its routing.
- C. Azure Firewall filters network traffic and is not where BGP for a VPN connection is configured.
- E. Azure Front Door is a global entry point for web applications and is unrelated to Site-to-Site VPN routing.
Question 4
You fail to establish a Site-to-Site VPN connection between your company's main office and an Azure virtual network.
You need to troubleshoot what prevents you from establishing the IPsec tunnel.
Which diagnostic log should you review?
Show answer and explanation
Correct answer: A. IKEDiagnosticLog
IKEDiagnosticLog provides verbose debug logging for IKE and IPsec negotiation, which is the process that builds the tunnel. When a Site-to-Site connection never comes up, the log shows the IKE exchanges between Azure and the on-premises device, such as proposal mismatches or authentication failures with the shared key. Because Azure keeps retrying a failed tunnel every few seconds, the relevant entries appear quickly without waiting to reproduce the problem. This makes it the right log for finding out what prevents the IPsec tunnel from being established.
Why the other options are wrong
- B. RouteDiagnosticLog traces static route changes and routes learned over BGP, not tunnel negotiation.
- C. GatewayDiagnosticLog records configuration changes and maintenance events on the gateway rather than IKE negotiation details.
- D. TunnelDiagnosticLog records the history of tunnel connect and disconnect events but does not show why the IKE negotiation fails.
Question 5
You have an Azure virtual network and an on-premises datacenter.
You are planning a Site-to-Site VPN connection between the datacenter and the virtual network.
Which two resources should you include in your plan? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, G. a virtual network gateway; a local network gateway
A Site-to-Site VPN needs a virtual network gateway and a local network gateway. The virtual network gateway, created with the VPN gateway type in the GatewaySubnet of the virtual network, is the Azure endpoint that terminates the IPsec tunnel. The local network gateway is an Azure object that represents the datacenter: it stores the public IP address or FQDN of the on-premises VPN device and the address prefixes located on-premises. A connection resource then links the two gateways with a shared key to form the tunnel.
Why the other options are wrong
- A. A user-defined route is optional and the VPN gateway already propagates the routes needed for the connection.
- C. Azure Firewall filters traffic and is not required to build a Site-to-Site VPN.
- D. Azure Web Application Firewall protects web applications from attacks and has no role in VPN connectivity.
- E. An on-premises data gateway lets cloud services such as Power BI reach on-premises data and does not create VPN tunnels.
- F. An Azure application gateway load balances web traffic and is not part of a Site-to-Site VPN.
Question 6
Your company has offices in New York and Amsterdam. The company has an Azure subscription. Both offices connect to Azure by using a Site-to-Site VPN connection.
The office in Amsterdam uses resources in the North Europe Azure region. The office in New York uses resources in the East US Azure region.
You need to implement ExpressRoute circuits to connect each office to the nearest Azure region. Once the ExpressRoute circuits are connected, the on-premises computers in the Amsterdam office must be able to connect to the on-premises servers in the New York office by using the ExpressRoute circuits.
Which ExpressRoute option should you use?
Show answer and explanation
Correct answer: B. ExpressRoute Global Reach
ExpressRoute Global Reach links two ExpressRoute circuits so that the on-premises networks connected to them can exchange traffic over the Microsoft global network. Each office connects its own circuit to the nearest Azure region, and enabling Global Reach between the New York and Amsterdam circuits creates a private path between the offices. Global Reach is configured between the private peerings of the circuits, and no extra devices or VPN tunnels are needed for the on-premises computers in Amsterdam to reach the servers in New York.
Why the other options are wrong
- A. ExpressRoute FastPath sends traffic from on-premises directly to virtual machines, bypassing the gateway, and does not connect two on-premises sites.
- C. ExpressRoute Direct provides dedicated physical ports at a peering location and does not by itself route traffic between two offices.
- D. ExpressRoute Local limits access to the Azure regions near the peering location, and Global Reach is not available on Local circuits.
Question 7
You have an Azure subscription that contains a virtual network.
You plan to deploy an Azure VPN gateway and 90 Site-to-Site VPN connections. The solution must meet the following requirements:
• Ensure that the Site-to-Site VPN connections remain available if an Azure datacenter fails.
• Minimize costs.
Which gateway SKU should you specify?
Show answer and explanation
Correct answer: C. VpnGw4AZ
The AZ gateway SKUs deploy the VPN gateway instances across availability zones, so the gateway and its connections stay available if one Azure datacenter fails. All four options are zone-redundant, so the deciding factor is the number of Site-to-Site tunnels. VpnGw1AZ, VpnGw2AZ and VpnGw3AZ support a maximum of 30 Site-to-Site tunnels, while VpnGw4AZ and VpnGw5AZ support up to 100. VpnGw4AZ is the lowest-cost SKU that can carry 90 connections.
Why the other options are wrong
- A. VpnGw1AZ supports a maximum of 30 Site-to-Site tunnels, far below the 90 connections required.
- B. VpnGw2AZ also supports a maximum of 30 Site-to-Site tunnels, which is not enough for 90 connections.
- D. VpnGw5AZ supports the same 100 tunnels as VpnGw4AZ but costs more, so it does not minimize costs.
Question 8
You have three on-premises networks.
You have an Azure subscription that contains a Basic Azure virtual WAN. The virtual WAN contains a single virtual hub and a virtual network gateway that is limited to a throughput of 1 Gbps.
The on-premises networks connect to the virtual WAN by using Site-to-Site (S2S) VPN connections.
You need to increase the throughput of the virtual WAN to 3 Gbps. The solution must minimize administrative effort.
What should you do?
Show answer and explanation
Correct answer: D. Increase the number of gateway scale units.
The aggregate throughput of a virtual hub site-to-site VPN gateway is set by its gateway scale units, configured on the Site to site page of the hub, and each site-to-site scale unit corresponds to 500 Mbps. Raising the existing gateway from 2 scale units (1 Gbps) to 6 scale units gives 3 Gbps without deploying new resources or changing the three on-premises connections. A Basic virtual WAN supports site-to-site VPN, which is the only connection type in use, so the virtual WAN type does not need to change. Adjusting one setting on the existing gateway is the least administrative effort.
Why the other options are wrong
- A. Upgrading to the Standard SKU adds hub features such as ExpressRoute, User VPN, and transit routing, but gateway throughput is governed by scale units, not by the virtual WAN type.
- B. A virtual hub contains one site-to-site VPN gateway, and a separate VPN gateway elsewhere in the subscription would not add capacity to the hub gateway that the branches use.
- C. A second hub needs its own gateway and its own branch connections, which is far more administrative effort than changing the scale units.
Question 9
You have 10 on-premises networks that are connected by using a 3rd party Software Defined Wide Area Network (SD-WAN) solution. You have an Azure subscription that contains five virtual networks.
You plan to connect the Azure virtual networks and the on-premises networks by using an Azure Virtual WAN with a single virtual WAN hub.
You need to ensure that the Azure Virtual WAN can act as a node in the 3rd party SD-WAN solution.
What should you include in the solution?
Show answer and explanation
Correct answer: B. A Network Virtual Appliance (NVA)
Azure Virtual WAN supports deploying select SD-WAN network virtual appliances directly into the virtual hub, in a solution that is jointly managed by Microsoft and the appliance vendor. The NVA in the hub runs the same SD-WAN software as the branch devices, so the hub becomes a node of the existing SD-WAN fabric. The 10 on-premises networks then reach the five Azure virtual networks through that node, and the SD-WAN policies stay under the control of the third-party solution.
Why the other options are wrong
- A. An ExpressRoute gateway terminates ExpressRoute circuits from a connectivity provider and cannot join a third-party SD-WAN overlay.
- C. A site-to-site VPN gateway terminates standard IPsec tunnels and does not participate in the control plane of a third-party SD-WAN solution.
- D. A User VPN gateway terminates point-to-site connections from individual clients and has no role in a branch SD-WAN.
Question 10
You have an on-premises datacenter and an Azure subscription.
You plan to implement ExpressRoute FastPath.
You need to create an ExpressRoute gateway. The solution must minimize downtime if a single Azure datacenter fails.
Which SKU should you use?
Show answer and explanation
Correct answer: D. ErGw3AZ
ExpressRoute FastPath is supported on the Ultra Performance and ErGw3AZ gateway SKUs, and on the scalable gateway with at least 10 scale units. Of the SKUs that support FastPath, only ErGw3AZ is availability zone-enabled, so its instances are spread across availability zones in the region and the gateway keeps working if a single Azure datacenter fails. ErGw3AZ therefore meets both the FastPath requirement and the requirement to minimize downtime.
Why the other options are wrong
- A. ErGw1AZ does not support FastPath, so it fails the main requirement.
- B. High Performance does not support FastPath and is not availability zone-enabled.
- C. Ultra Performance is not availability zone-enabled, so a single datacenter failure can take the gateway down.
- E. ErGw2AZ does not support FastPath, so it fails the main requirement.
What people say about the full AZ-700 pack 5.0 from 7
The best part about these dumps wasn't just the answers, but the explanations. They were clear and helped me actually understand the 'why' behind VPN Gateway configurations. I didn't just memorize; I learned. Passed with a 910.
I was skeptical about dumps, but a friend vouched for Certstash. For the AZ-700, their material is legit. The scenario-based questions are incredibly well-written and force you to think, which is exactly what the real exam does. I'm a believer now.
The practice guide had scenario-based exercises that felt like real networking cases. They helped me connect the theory to real-world problem-solving, making studying more engaging and practical for the exam.
Question 11
You have an Azure subscription that contains the following resources:
• A virtual network named Vnet1
• Two subnets named subnet1 and AzureFirewallSubnet
• A public Azure Firewall named FW1
• A route table named RT1 that is associated to subnet1
• A rule routing of 0.0.0.0/0 to FW1 in RT1
After deploying 10 servers that run Windows Server to subnet1, you discover that none of the virtual machines were activated.
You need to ensure that the virtual machines can be activated.
What should you do?
Show answer and explanation
Correct answer: C. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).
Windows virtual machines in Azure activate against the Azure Key Management Service at kms.core.windows.net and azkms.core.windows.net on TCP port 1688. RT1 sends all traffic from subnet1, including activation traffic, to FW1, and Azure Firewall denies traffic that no rule allows. Creating an outbound network rule on FW1 that allows traffic from subnet1 to the Azure KMS endpoints on TCP 1688 lets the activation requests through the firewall, so the virtual machines can activate while the 0.0.0.0/0 route to FW1 stays in place.
Why the other options are wrong
- A. A DNAT rule translates inbound traffic arriving at the firewall public IP address and does not permit outbound activation requests from the virtual machines.
- B. An application security group only groups virtual machines for NSG rules and does not change the route through FW1, where the traffic is still denied.
- D. A rule for the entire AzureCloud service tag opens outbound access to every Azure public range instead of targeting the KMS endpoints, so it is not the targeted rule that activation requires.
Question 12
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have two Azure virtual networks named Vnet1 and Vnet2.
You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.
You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.
You discover that Client1 cannot communicate with Vnet2.
You need to ensure that Client1 can communicate with Vnet2.
Solution: You download and reinstall the VPN client configuration.
Does this meet the goal?
Show answer and explanation
Correct answer: A. Yes
The VPN client package for a Windows device includes the routes the client sends through the tunnel. Client1 installed its package before Vnet1 was peered with Vnet2, so the Vnet2 address space is missing from its routes even though gateway transit is correctly configured. Microsoft states that when the network topology changes and Windows VPN clients are used, the VPN client package must be downloaded and installed again for the changes to apply. Downloading and reinstalling the configuration adds the Vnet2 route, so Client1 can communicate with Vnet2.
Why the other options are wrong
- B. Reinstalling the client package does add the Vnet2 route that Client1 is missing, so the solution meets the goal.
Question 13
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
Show answer and explanation
Correct answer: B. internal load balancers
An internal load balancer is deployed into a subnet and its frontend IP configuration takes a private IP address from that subnet's range. Clients in the virtual network and connected networks send traffic to that private frontend address, and the load balancer distributes it to the backend pool. When planning subnet sizes, each internal load balancer frontend must therefore be counted alongside virtual machines and other resources that receive private addresses. The other listed items are platform features or external services that do not draw addresses from the subnet.
Why the other options are wrong
- A. A storage account is a PaaS service reached through its public endpoint and receives no address from your subnet.
- C. A service endpoint is a subnet setting that changes the route to an Azure service and consumes no subnet IP addresses.
- D. Virtual network peering links two virtual networks and assigns no IP addresses from either subnet.
Question 14
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
Show answer and explanation
Correct answer: C. internal load balancers
An internal load balancer is placed in a subnet, and its frontend IP configuration is assigned a private IP address from that subnet's range. Clients reach the load-balanced service through that private address, and the load balancer forwards the traffic to backend instances. When planning address space, each internal load balancer frontend must be counted in the subnet in the same way as virtual machine network interfaces. The other options attach to subnets or virtual networks without taking private addresses from them.
Why the other options are wrong
- A. Azure Virtual Network NAT is associated with a subnet and uses public IP addresses, not private addresses from the subnet.
- B. A service endpoint policy is a filter of allowed storage accounts and consumes no subnet IP addresses.
- D. Virtual network peering connects two virtual networks and assigns no IP addresses from their subnets.
Question 15
You have an Azure application gateway for a web app named App1. The application gateway allows end-to-end encryption.
You configure the listener for HTTPS by uploading an enterprise-signed certificate.
You need to ensure that the application gateway can provide end-to-end encryption for App1.
What should you do?
Show answer and explanation
Correct answer: D. Upload the public key certificate to the HTTP settings.
End-to-end TLS on Application Gateway has two legs. The listener certificate handles TLS between the client and the gateway, and that part is already configured. For the gateway to re-encrypt traffic to App1 and trust the backend certificate, which is signed by an enterprise CA rather than a well-known public CA, the matching public key certificate (the authentication certificate on the v1 SKU, or the trusted root certificate on the v2 SKU) must be uploaded to the HTTP settings used for the backend. With that certificate in place, the gateway can validate the backend and complete encryption all the way to App1.
Why the other options are wrong
- A. The unhealthy threshold only controls how many failed probes mark a backend as unhealthy and does not establish trust with the backend certificate.
- B. An SSL profile sets client-side TLS policy and client authentication on the listener and does not secure the connection to the backend.
- C. A multisite listener lets one gateway host several domains and has no effect on encryption to the backend.
Question 16
You have an Azure subscription that contains four virtual networks named VNet1, VNet2, VNet3, and VNet4.
You plan to deploy a hub and spoke topology by using virtual network peering.
You need to configure VNet1 as the hub network. The solution must meet the following requirements:
• Support transitive routing between spokes.
• Maximize network throughput.
What should you include in the solution?
Show answer and explanation
Correct answer: D. Azure Firewall
Virtual network peering is not transitive, so spokes that peer only with VNet1 cannot reach each other on their own. Microsoft's hub and spoke guidance is to deploy Azure Firewall or another network virtual appliance in the hub, create user-defined routes in the spokes that send spoke-to-spoke traffic to it, and allow forwarded traffic on the peerings. A VPN gateway can also route between spokes, but that choice affects latency and throughput. Azure Firewall scales automatically, so it supports transitive routing while maximizing throughput.
Why the other options are wrong
- A. Routing spoke traffic through a VPN gateway works but affects latency and throughput, which conflicts with maximizing throughput.
- B. Azure Route Server exchanges BGP routes with network virtual appliances but does not forward traffic between spokes itself.
- C. Private Link exposes individual services through private endpoints and does not route traffic between virtual networks.
Question 17
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
Show answer and explanation
Correct answer: B. internal load balancers
An internal load balancer is created in a subnet, and its frontend IP configuration receives a private IP address from that subnet's address range. Clients send traffic to that private frontend, and the load balancer forwards it to the backend instances. Subnet planning must therefore reserve an address for each internal load balancer frontend in addition to the addresses used by virtual machines and other resources. The other options are services or configuration objects that do not draw any addresses from the subnet.
Why the other options are wrong
- A. A storage account is a PaaS service reached on its own endpoint and takes no address from your subnet.
- C. A service endpoint is a subnet setting that optimizes the route to an Azure service and consumes no subnet IP addresses.
- D. A service endpoint policy is a filter of allowed storage accounts applied to a subnet and uses no IP addresses.
Question 18
You have an Azure Virtual Desktop deployment that has 500 session hosts.
All outbound traffic to the internet uses a NAT gateway.
During peak business hours, some users report that they cannot access internet resources. In Azure Monitor, you discover many failed SNAT connections.
You need to increase the available SNAT connections.
What should you do?
Show answer and explanation
Correct answer: B. Add a public IP address.
A NAT gateway draws its SNAT port inventory from the public IP addresses and prefixes attached to it. Each public IP address provides 64,512 SNAT ports, and a NAT gateway scales out by adding public IP addresses (up to 16) or a public IP prefix. When Azure Monitor shows failed SNAT connections during peak load from 500 session hosts, the inventory is exhausted, so adding another public IP address to the NAT gateway directly increases the number of SNAT ports available to every instance in the attached subnets.
Why the other options are wrong
- A. Attaching the NAT gateway to another subnet shares the same SNAT port inventory across more instances, so it adds no ports and can worsen exhaustion.
- C. NAT gateway takes precedence over load balancer outbound rules for outbound internet traffic, so a Standard Load Balancer with outbound rules would not add SNAT capacity for these hosts.
Question 19
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have two Azure virtual networks named Vnet1 and Vnet2.
You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.
You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.
You discover that Client1 cannot communicate with Vnet2.
You need to ensure that Client1 can communicate with Vnet2.
Solution: You enable BGP on the gateway of Vnet1.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
The problem is on the client side: the VPN client package that Client1 installed was generated before the peering existed, so it does not include the Vnet2 address space. For Windows VPN clients, a change in network topology requires the VPN client package to be downloaded and installed again. Enabling BGP on the Vnet1 gateway affects route exchange with on-premises VPN devices and other gateways, not the routes stored in the Point-to-Site client configuration, so Client1 still cannot communicate with Vnet2.
Why the other options are wrong
- A. BGP on the gateway does not update the routes in the Windows Point-to-Site client package, so Client1 still lacks the Vnet2 route.
Question 20
You have a hub-and-spoke topology. The topology includes multiple on-premises locations that connect to a hub virtual network in Azure via ExpressRoute circuits.
You have an Azure Application Gateway named GW1 that provides a single point of ingress from the internet.
You plan to migrate the hub-and-spoke topology to Azure Virtual WAN.
You need to identify which changes must be applied to the existing topology. The solution must ensure that you maintain a single point of ingress from the internet.
Which three changes should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, D, E. Replace the user-defined routes used by the current topology; Create virtual network connections; Remove the existing virtual network peerings.
Migrating a hub-and-spoke design to Azure Virtual WAN replaces the customer-managed hub with a Microsoft-managed virtual hub. Each spoke is attached by creating a virtual network connection to the hub, and the existing peerings to the old hub virtual network are removed because a spoke cannot keep both. The user-defined routes that steered spoke-to-spoke and on-premises traffic through the old hub are replaced, since the virtual hub router now propagates those routes dynamically. GW1 stays where it is and remains the single point of ingress from the internet.
Why the other options are wrong
- A. Virtual WAN hub routing propagates routes to connected spokes, so adding new user-defined routes is not part of the migration.
- B. Spokes attach to a virtual hub through virtual network connections, not through new peerings that you add.
- F. GW1 continues to serve internet ingress from its current virtual network, so it does not need to be redeployed.
Question 21
You have an on-premises datacenter named DC1 that contains two routers.
You have an Azure subscription. The subscription contains a virtual network named VNet1 and a zone-redundant ExpressRoute virtual network gateway named GW1 that uses the ErGw3Az SKU. GW1 is attached to VNet1. DC1 is connected to VNet1 by using an ExpressRoute Standard circuit named Circuit1. The DC1 routers are configured as endpoints for Circuit1.
Circuit1 traffic traverses two physical links.
During a link outage, the connection takes three minutes to fail over.
You need to ensure that failovers between the links take less than one second.
What should you do?
Show answer and explanation
Correct answer: B. On the routers, configure Bidirectional Forwarding Detection (BFD).
A three minute failover is the result of relying on BGP timers alone to notice that a link has gone down, because the BGP hold time must expire before routes are withdrawn. Bidirectional Forwarding Detection runs lightweight hello packets between the BGP peers and declares a link dead in well under a second. BFD is already enabled on the Microsoft edge routers of the ExpressRoute circuit, so configuring it on the DC1 routers that act as the customer endpoints completes the session and gives sub-second failover between the two physical links.
Why the other options are wrong
- A. FastPath bypasses the gateway in the data path for performance and does not change how quickly a failed link is detected.
- C. The UltraPerformance SKU increases gateway throughput but has no effect on link failure detection between the routers and the circuit.
- D. Active-active mode concerns gateway instance redundancy and does not shorten the BGP based detection of a failed physical link.
Question 22
You have an Azure subscription that contains 100 network security groups (NSGs).
You need to ensure that you log the application of specific NSG rules.
Which type of log should you configure?
Show answer and explanation
Correct answer: C. Azure resource log
Network security groups support resource logs that are enabled through diagnostic settings. The NetworkSecurityGroupRuleCounter category records how many times each rule is applied to allow or deny traffic, and the NetworkSecurityGroupEvent category records which rules are applied to virtual machines based on their addresses. Configuring Azure resource logs on the network security groups is therefore the way to log the application of specific rules, and the logs can be sent to a Log Analytics workspace, a storage account, or an event hub.
Why the other options are wrong
- A. Flow logs record IP traffic flows through a network security group, not a per-rule record of how often each rule is applied.
- B. The activity log records management operations such as creating or changing a network security group, not the application of its rules to traffic.
- D. An audit log records directory and administrative actions and does not capture network security group rule activity.
Question 23
You have an Azure virtual network named Vnet1 that hosts an Azure firewall named FW1 and 150 virtual machines. Vnet1 is linked to a private DNS zone named contoso.com. All the virtual machines have their name registered in the contoso.com zone.
Vnet1 connects to an on-premises datacenter by using ExpressRoute.
You need to ensure that on-premises DNS servers can resolve the names in the contoso.com zone.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: C, D. For FW1, enable DNS proxy; On the on-premises DNS servers, configure forwarders that point to the frontend IP address of FW1.
The private zone is answered by Azure DNS at 168.63.129.16, which can be reached only from inside Azure, so on-premises servers need a forwarder inside Vnet1. Enabling DNS proxy on FW1 makes the firewall listen on port 53 and forward queries to Azure DNS, which resolves contoso.com because the zone is linked to Vnet1. Configuring forwarders on the on-premises DNS servers that point to the private IP address of FW1 then sends queries for contoso.com across ExpressRoute to the proxy, which returns the virtual machine records.
Why the other options are wrong
- A. The DNS server settings of Vnet1 control how resources inside Vnet1 resolve names and do nothing for queries arriving from on-premises.
- B. A custom DNS server only changes where the firewall sends queries, and the firewall does not accept DNS queries at all unless DNS proxy is enabled.
- E. The 168.63.129.16 address is reachable only from within Azure virtual networks, so on-premises servers cannot forward to it.
Question 24
You have an Azure application gateway named AppGW1 that balances requests to a web app named App1.
You need to modify the server variables in the response header of App1.
What should you configure on AppGW1?
Show answer and explanation
Correct answer: B. rewrites
Application Gateway rewrites let you add, remove or update HTTP request and response headers, and the URL path and query string, as traffic passes through the gateway. Rewrite rules can use server variables, such as client and connection details, to set header values, and conditions can control when a rewrite is applied. Modifying the response headers returned from App1 is therefore configured as a rewrite set that is associated with the routing rule for App1.
Why the other options are wrong
- A. HTTP settings define how the gateway connects to the backend, such as port, protocol and affinity, and do not modify response headers.
- C. Rules link listeners to backend targets and settings, and a rule only applies header changes through an associated rewrite set.
- D. Listeners define the frontend IP, port, protocol and host name for incoming requests and do not change response headers.
Question 25
You plan to implement an Azure virtual network that will contain 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.
You need to recommend which subnet mask size to use for the virtual subnets.
What should you recommend?
Show answer and explanation
Correct answer: A. /64
Azure requires every IPv6 subnet in a virtual network to be exactly /64 in size, regardless of how many hosts it serves. Microsoft sets this rule for future compatibility, because some routers accept only /64 IPv6 routes if the subnet is later routed to an on-premises network. A /64 also provides far more addresses than the 200 load-balanced virtual machines each subnet must host, so all ten subnets use a /64 prefix carved from the IPv6 address space of the virtual network.
Why the other options are wrong
- B. A /120 is smaller than /64, and Azure does not accept IPv6 subnets of any size other than /64.
- C. A /48 is an allocation size for a whole site or address space, and Azure rejects it as an IPv6 subnet size.
- D. A /24 is an IPv4-style prefix length and is not a valid size for an Azure IPv6 subnet.
Question 26
You have an application named App1 that listens for incoming requests on a preconfigured group of 50 TCP ports and UDP ports.
You install App1 on 10 Azure virtual machines.
You need to implement load balancing for App1 across all the virtual machines. The solution must minimize the number of load balancing rules.
What should you include in the solution?
Show answer and explanation
Correct answer: C. Azure Standard Load Balancer that has high availability (HA) ports enabled
App1 listens on 50 TCP and UDP ports, so the load balancer must handle layer 4 traffic of both protocols. An HA ports rule on an internal Standard Load Balancer sets the frontend and backend ports to 0 and the protocol to All, and it balances every TCP and UDP flow regardless of port number. Microsoft notes that a single HA ports rule replaces the individual rules that would otherwise be needed for each port, so the 10 virtual machines go in one backend pool behind one rule, which minimizes the number of load-balancing rules.
Why the other options are wrong
- A. Application Gateway v2 is a web traffic load balancer that cannot balance UDP and would need a separate listener for every port.
- B. Floating IP lets several rules reuse the same backend port but still requires a separate rule for each port.
- D. Multiple site hosting routes HTTP requests by host name and cannot balance arbitrary TCP and UDP ports.
Question 27
You have an on-premises datacenter in Seattle.
You have an Azure subscription that contains an Azure Network Watcher resource in the West US 2 Azure region.
You need to document network latency between the on-premises datacenter and the West US 2 region and between the on-premises datacenter and the East US 2 public Azure region. The solution must minimize administrative effort.
What should you do first?
Show answer and explanation
Correct answer: B. Run the Get-AzNetworkWatcherReachabilityProvidersList cmdlet.
The Azure Reachability Report in Network Watcher shows relative latency between internet service providers in a specific location and Azure regions, without deploying any agents. To produce it, you first run the Get-AzNetworkWatcherReachabilityProvidersList cmdlet to find the internet service providers available in Seattle, and then run Get-AzNetworkWatcherReachabilityReport for those providers against the West US 2 and East US 2 regions. The existing Network Watcher in West US 2 can return data for both regions, so this approach documents the latency with the least administrative effort.
Why the other options are wrong
- A. Get-AzNetworkWatcherConnectionMonitor only retrieves existing connection monitors, and none has been created.
- C. A Network Watcher resource in East US 2 is not needed, because the reachability report from the existing Network Watcher can cover both regions.
- D. A connection monitor requires monitoring agents on on-premises hosts and endpoints in each region, which adds more administrative effort than the reachability report.
Question 28
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have two Azure virtual networks named Vnet1 and Vnet2.
You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.
You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.
You discover that Client1 cannot communicate with Vnet2.
You need to ensure that Client1 can communicate with Vnet2.
Solution: You resize the gateway of Vnet1 to a larger SKU.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
A Point-to-Site client receives its routes from the VPN client configuration package that it installed. When peering with gateway transit is added after the client was configured, the client does not learn the Vnet2 address space until the VPN client configuration is downloaded and installed again. Resizing the gateway of Vnet1 to a larger SKU changes capacity, such as throughput and the number of connections, but it does not change the routes held by Client1. The SKU change therefore does not let Client1 reach Vnet2, so the solution does not meet the goal.
Why the other options are wrong
- A. A larger gateway SKU only adds capacity and does not give Client1 the route to Vnet2, which requires reinstalling the VPN client configuration.
Question 29
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
Show answer and explanation
Correct answer: A. internal load balancers
An internal load balancer exposes a private frontend IP address that is allocated from a subnet of the virtual network, and its backend instances also use addresses from their subnets, so it must be accounted for when sizing subnet ranges. The other options do not take addresses from a subnet: they are either services that live outside the virtual network or settings that are attached to a subnet without placing any network interface in it.
Why the other options are wrong
- B. A storage account is a platform service with public endpoints and consumes no subnet addresses unless a separate private endpoint is created.
- C. A NAT gateway uses public IP addresses for outbound traffic and is associated with a subnet without consuming its private addresses.
- D. Service endpoint policies are policy objects applied to a subnet and do not use any IP addresses.
Question 30
You have an Azure subscription that contains an Azure App Service app. The app uses a URL of https://www.contoso.com.
You need to use a custom domain on Azure Front Door for www.contoso.com. The custom domain must use a certificate from an allowed certification authority (CA).
What should you include in the solution?
Show answer and explanation
Correct answer: C. Azure Key Vault
Azure Front Door can secure a custom domain with a managed certificate or with your own certificate. When you bring your own certificate, it must be issued by an allowed certification authority with a complete chain, and it must be stored in Azure Key Vault. Front Door is granted access to the key vault and retrieves the certificate from it to serve HTTPS for www.contoso.com. Azure Key Vault is therefore the component the solution must include.
Why the other options are wrong
- A. An enterprise application in Azure AD does not store or deploy certificates for Azure Front Door custom domains.
- B. Active Directory Certificate Services issues private enterprise certificates, which do not come from an allowed public certification authority.
- D. Azure Application Gateway is a separate regional load balancer and is not used to provide certificates to Azure Front Door.
Question 31
Your company has five offices. Each office has a firewall device and a local internet connection. The offices connect to a third-party SD-WAN.
You have an Azure subscription that contains a virtual network named Vnet1. Vnet1 contains a virtual network gateway named Gateway1. Each office connects to Gateway1 by using a Site-to-Site VPN connection.
You need to replace the third-party SD-WAN with an Azure Virtual WAN.
What should you include in the solution?
Show answer and explanation
Correct answer: A. Delete Gateway1.
In Azure Virtual WAN, branch offices connect to VPN gateways that run inside the virtual hub, and virtual networks attach to the hub through VNet connections. The office firewall devices therefore build new Site-to-Site connections to the hub, and the existing virtual network gateway in Vnet1 is no longer needed. Microsoft's migration guidance decommissions the existing VPN gateways in the customer-managed hub before connecting that network to the Virtual WAN hub, so the solution includes deleting Gateway1 once the hub connections are in place.
Why the other options are wrong
- B. Point-to-Site connections are for individual client devices, while branch firewall devices connect to a Virtual WAN hub with Site-to-Site VPN.
- C. Traffic Manager is a DNS-based traffic router for application endpoints and plays no part in branch connectivity.
- D. Active-active mode adds resilience to Gateway1, but the branches will connect to the hub gateway, so Gateway1 is retired instead.
Question 32
You are configuring two network virtual appliances (NVAs) in an Azure virtual network. The NVAs will be used to inspect all the traffic within the virtual network.
You need to provide high availability for the NVAs. The solution must minimize administrative effort.
What should you include in the solution?
Show answer and explanation
Correct answer: A. Azure Standard Load Balancer
Azure Standard Load Balancer is the standard way to make network virtual appliances highly available inside a virtual network. An internal Standard Load Balancer with the NVAs in its backend pool and a health probe sends traffic only to healthy appliances, and an HA ports rule load balances all TCP and UDP flows on all ports, which suits appliances that must inspect all traffic within the virtual network. User-defined routes point to the load balancer frontend, so a failed NVA is removed automatically without manual route changes, which minimizes administrative effort.
Why the other options are wrong
- B. Application Gateway is a layer 7 HTTP and HTTPS load balancer and cannot distribute all traffic types to NVAs.
- C. Traffic Manager is a DNS-based global traffic router and cannot act as a next hop for traffic inside a virtual network.
- D. Azure Front Door is a global HTTP and HTTPS entry point for internet traffic and does not load balance internal traffic to NVAs.
Question 33
You have an Azure application gateway named AGW1 that has a routing rule named Rule1. Rule1 directs traffic for http://www.contoso.com to a backend pool named Pool1. Pool1 targets an Azure virtual machine scale set named VMSS1.
You deploy another virtual machine scale set named VMSS2.
You need to configure AGW1 to direct all traffic for http://www.adatum.com to VMSS2.
The solution must ensure that requests to http://www.contoso.com continue to be directed to Pool1.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D, E. Add a backend pool; Add a listener; Add a rule.
Routing www.adatum.com to VMSS2 requires three new components. A new backend pool is added that targets VMSS2, because Pool1 must continue to serve www.contoso.com. A new multisite listener is added for the host name www.adatum.com so the gateway can recognize those requests. A new routing rule is added that binds the new listener to the new backend pool. The existing HTTP setting can be referenced by the new rule, so Rule1 and its traffic to Pool1 remain unchanged.
Why the other options are wrong
- B. Modifying the existing HTTP setting is unnecessary and could affect Rule1 traffic to Pool1.
- C. A new HTTP setting is not required because the existing one can be reused by the new rule.
Question 34
You have an Azure subscription that contains a virtual network named VNet1. VNet1 has a subnet mask of /24.
You plan to implement an Azure application gateway that will have the following configurations:
• Public endpoints: 1
• Private endpoints: 1
• Minimum instances: 1
• Maximum instances: 10
You need to configure the address space for the subnet of the application gateway. The solution must minimize the number of IP addresses allocated to the application gateway subnet.
What is the minimum number of assignable IP addresses required?
Show answer and explanation
Correct answer: C. 11
Application Gateway uses one private IP address from its subnet for each instance, plus one more private IP address when a private frontend IP is configured. Sizing must cover the maximum instance count, so ten instances need ten addresses and the private endpoint needs one more, for a total of 11 assignable addresses. The public endpoint uses a public IP address resource, so it consumes nothing from the subnet. The five addresses that Azure reserves in every subnet are not assignable and are therefore not part of this count.
Why the other options are wrong
- A. One address covers only the private frontend and leaves nothing for the gateway instances.
- B. Two addresses would not cover the ten instances the gateway can scale out to.
- D. Twelve counts the public endpoint, which uses a public IP address resource and takes no subnet address.
- E. Twenty overstates the requirement because each instance needs only one private address.
Question 35
You have five virtual machines that run Windows Server. Each virtual machine hosts a different web app.
You plan to use an Azure application gateway to provide access to each web app by using a hostname of www.contoso.com and a different URL path for each web app, for example: https://www.contoso.com/app1.
You need to control the flow of traffic based on the URL path.
What should you configure?
Show answer and explanation
Correct answer: C. rules
Application Gateway decides where to send a request by evaluating its request routing rules. A path-based rule uses a URL path map so that requests for www.contoso.com/app1, /app2 and so on are each sent to the backend pool that hosts the matching web app, with a default pool for paths that do not match. Because all five web apps share the same host name and differ only by URL path, configuring path-based routing rules is what controls the flow of traffic based on the URL path.
Why the other options are wrong
- A. HTTP settings define how the gateway connects to backend servers, such as port, protocol and cookie affinity, not which backend receives a path.
- B. Listeners match the frontend IP address, port, protocol and host name, and they do not route by URL path.
- D. Rewrites modify headers and URL components of requests and responses rather than defining which backend pool serves each path.
Question 36
You have an Azure subscription. The subscription contains a locally-redundant storage (LRS) account named storage1 that is deployed to the US East Azure region and has a Microsoft.Storage service endpoint.
You set Redundancy for storage1 to Read-access geo-redundant storage (RA-GRS).
You need to ensure that the contents of storage1 will be accessible by using a service endpoint in a paired region. The solution must minimize administrative effort.
What should you do first?
Show answer and explanation
Correct answer: D. Create a service endpoint policy.
A Microsoft.Storage service endpoint applies to storage accounts in a limited regional scope. When a service endpoint policy is applied to a subnet, the scope of the Azure Storage service endpoint is upgraded from regional to global, and access is then limited to the storage accounts that the policy explicitly allows. Creating a service endpoint policy that allows storage1 is therefore the first step that makes the RA-GRS copy of storage1 reachable through a service endpoint in the paired region, with no data copying or endpoint rebuilding required.
Why the other options are wrong
- A. Object replication copies blobs to another storage account, which adds administrative effort and does not change how the service endpoint reaches storage1.
- B. Deleting the existing service endpoint removes the private path to storage and does not extend access to the paired region.
- C. Secure transfer required only forces HTTPS connections and has no effect on service endpoint scope.
Question 37
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
Show answer and explanation
Correct answer: A. private endpoints
A private endpoint is a network interface that is placed in a subnet of a virtual network and receives a private IP address from that subnet's address range. Each private endpoint therefore consumes an address in the subnet, and the subnets that will host private endpoints must be sized to include them. Virtual network peering, DDoS Protection and the storage account itself do not take addresses from the subnet ranges.
Why the other options are wrong
- B. Virtual network peering links two virtual networks and does not consume any addresses from their subnets.
- C. Azure DDoS Protection is applied to virtual networks and public IP addresses and does not use subnet addresses.
- D. A storage account is a platform service that is reached through public endpoints and does not receive an address from a subnet on its own.
Question 38
You are planning the IP addressing for the subnets in Azure virtual networks.
Which type of resource requires IP addresses in the subnets?
Show answer and explanation
Correct answer: A. internal load balancers
An internal load balancer uses a private frontend IP address that is allocated from a subnet of the virtual network, so its frontends must be counted when sizing subnets. Azure DDoS Protection is enabled on a virtual network and protects public IP addresses without using any private addresses. Service endpoints and service endpoint policies are settings applied to a subnet that change how traffic reaches Azure services, and neither of them places an interface or consumes an address in the subnet.
Why the other options are wrong
- B. DDoS Protection is a plan linked to the virtual network and does not consume subnet addresses.
- C. Service endpoint policies are filtering settings on a subnet and do not use IP addresses.
- D. Service endpoints extend the subnet identity to Azure services without adding any interface or address to the subnet.
Question 39
You have an on-premises network.
You have an Azure subscription that contains a virtual network.
You have an ExpressRoute service provider.
You plan to connect the Azure virtual network and the on-premises network by using an ExpressRoute circuit.
You create a new ExpressRoute circuit.
You need to provision the new circuit.
Which information should you provide to the service provider?
Show answer and explanation
Correct answer: D. the service key
When an ExpressRoute circuit is created, Azure generates a service key that uniquely identifies the circuit. The key is shown on the Overview page of the circuit, and the connectivity provider uses it to complete the provisioning process on its side, after which the provider status of the circuit changes to Provisioned. The service key is the only information the provider needs from Azure to provision the new circuit.
Why the other options are wrong
- A. An IKEv2 shared key authenticates a site-to-site VPN tunnel and has no role in ExpressRoute provisioning.
- B. Certificates authenticate point-to-site VPN clients and are not used to provision an ExpressRoute circuit.
- C. A public IP address does not identify the circuit, so the provider cannot provision it from that information.
Question 40
You have an Azure subscription that contains an ExpressRoute Standard gateway named GW1.
You need to upgrade GW1 to support ExpressRoute FastPath. The solution must minimize downtime.
Which SKU should you use?
Show answer and explanation
Correct answer: B. ErGw3AZ
FastPath is available only on the Ultra Performance and ErGw3AZ SKUs among the choices, so GW1 must move to one of them. A Standard gateway moves to ErGw3AZ through the ExpressRoute gateway migration experience, which deploys the new gateway in the same GatewaySubnet and runs both gateways side by side while the configuration is transferred, to minimize disruption. The result is also zone redundant, which Microsoft recommends for reliability and high availability, so the upgraded gateway is better protected against future outages as well.
Why the other options are wrong
- A. Ultra Performance is not availability zone-enabled, and Microsoft directs Standard gateways to an availability zone-enabled SKU through the migration experience for reliability and high availability.
- C. ErGw2AZ does not support FastPath.
- D. High Performance does not support FastPath.
Question 41
You have an instance of Azure Web Application Firewall (WAF) on Azure Front Door.
You plan to create a WAF rule that will block high rates of requests from a single IP address.
You need to query Log Analytics to identify the optimal threshold for the rule.
Which table should you query in Log Analytics?
Show answer and explanation
Correct answer: B. AzureDiagnostics
Azure Front Door sends its WAF logs, the FrontDoorWebApplicationFirewallLog category, to Log Analytics in the AzureDiagnostics table. Querying that table, which also holds the Front Door access log when it is enabled, and counting requests per client IP address over a fixed time window shows the normal and peak request rates of legitimate clients. Those figures give a sound basis for the threshold of a rate limit rule, so that it blocks abusive clients without blocking ordinary traffic.
Why the other options are wrong
- A. AZFWThreatIntel holds Azure Firewall threat intelligence logs, not Front Door WAF requests.
- C. SecurityDetection is not where Front Door WAF request logs are stored, so it cannot show request rates per IP address.
- D. AGWFirewallLogs holds Application Gateway WAF logs, not Azure Front Door logs.
Question 42
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have two Azure virtual networks named Vnet1 and Vnet2.
You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.
You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.
You discover that Client1 cannot communicate with Vnet2.
You need to ensure that Client1 can communicate with Vnet2.
Solution: You reset the gateway of Vnet1.
Does this meet the goal?
Show answer and explanation
Correct answer: B. No
Client1 was configured before Vnet1 was peered with Vnet2, so the VPN client package installed on the Windows 10 device does not contain the routes for the Vnet2 address space. Microsoft states that when the network topology changes and Windows VPN clients are in use, the VPN client package must be downloaded and installed again so that the changes reach the client. Resetting the Vnet1 gateway only restarts the gateway instances with the same configuration and does nothing to the routes held by the client, so Client1 still cannot reach Vnet2.
Why the other options are wrong
- A. A gateway reset leaves the client package unchanged, so Client1 still lacks the route to Vnet2.
Question 43
You plan to deploy Azure virtual network.
You need to design the subnets.
Which three types of resources require a dedicated subnet? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D, E. Azure Bastion; Azure Application Gateway v2; VPN gateway
Azure Bastion must be deployed into a dedicated subnet named AzureBastionSubnet, and no other resources can share it. Application Gateway v2 requires its own subnet that contains only application gateways, because the gateway instances scale within that address range. A VPN gateway is deployed into the dedicated subnet named GatewaySubnet, and Microsoft advises against placing anything else there. These three resources therefore each need a subnet of their own when the virtual network is designed.
Why the other options are wrong
- B. Microsoft lists Microsoft Entra Domain Services among the services that do not require a dedicated subnet.
- C. Private Link private endpoints are network interfaces that can be placed in an ordinary subnet alongside virtual machines.
Question 44
You have an on-premises server named Server1 that runs Windows Server.
You have an Azure subscription that contains a virtual network named VNet1.
You plan to connect Server1 to VNet1 by using Azure Network Adapter.
You need to minimize how long it takes to deploy the adapter to Server1.
What should you create first?
Show answer and explanation
Correct answer: D. an Azure VPN gateway
Azure Network Adapter connects a Windows Server machine to a virtual network through a point-to-site VPN that terminates on an Azure VPN gateway in that virtual network. If no gateway exists, the adapter setup in Windows Admin Center must create one, and gateway deployment takes a long time, which holds up the whole process. Creating the Azure VPN gateway in VNet1 first means the adapter deployment only has to connect Server1 to an existing gateway, which minimizes how long it takes to deploy the adapter.
Why the other options are wrong
- A. Azure Route Server exchanges routes with network virtual appliances over BGP and is not used by Azure Network Adapter.
- B. Azure Bastion provides RDP and SSH access to Azure virtual machines and does not connect an on-premises server to a virtual network.
- C. A private endpoint gives private access to a specific Azure service and plays no part in the adapter VPN connection.
Question 45
You have an Azure application gateway named AppGW1 that balances requests to a web app named App1.
You need to modify the server variables in the response header of App1.
What should you configure on AppGW1?
Show answer and explanation
Correct answer: A. URL rewrite rules
Application Gateway rewrite rules, grouped into rewrite sets and associated with a routing rule, let you add, remove or change HTTP request and response headers and the URL. Rewrite conditions can evaluate server variables, and rewrite actions can use server variable values when they set response header values, so modifying the server variables returned in the App1 response header is done by configuring rewrite rules on AppGW1. The other components route or receive traffic and define backend connection behavior, but none of them has the ability to change header content in a response.
Why the other options are wrong
- B. Path-based rules choose a backend pool from the URL path of a request and do not change response headers.
- C. Listeners only accept incoming connections on a frontend IP address, port and host name and do not modify headers.
- D. HTTP settings define how the gateway connects to the backend, such as port, protocol and affinity, and do not rewrite response headers.
Question 46
You have an Azure subscription that contains a virtual machine named VM1, a virtual network interface card (NIC) named NIC1, and a Basic SKU public IP address named IP1. NIC1 is attached to VM1. IP1 is associated to NIC1.
You need to upgrade IP1 to the Standard SKU.
What should you do first?
Show answer and explanation
Correct answer: B. Disassociate IP1 from NIC1.
A Basic SKU public IP address can be upgraded to the Standard SKU in place, but only while it is not associated with any resource. Because IP1 is associated with NIC1, the first step is to disassociate IP1 from the network interface. After the upgrade completes, the same address, now a Standard SKU public IP, can be associated with NIC1 again. The virtual machine and its network interface stay as they are, so no new NIC, NIC detachment or VM shutdown is involved.
Why the other options are wrong
- A. A new network interface is not needed, because the upgrade acts on the public IP resource and NIC1 can keep serving VM1.
- C. The requirement is that the public IP is unassociated, so detaching the whole NIC from VM1 is unnecessary.
- D. Stopping VM1 does not remove the association between IP1 and NIC1, which is what blocks the upgrade.
Question 47
You have an Azure subscription that contains a virtual network named VNet1.
You deploy several web apps and configure the apps to use private endpoints on VNet1.
You need to identify which DNS records the web apps registered automatically.
Where will the records be created?
Show answer and explanation
Correct answer: C. an Azure Private DNS zone named privatelink.azurewebsites.net
When a web app is given a private endpoint with private DNS integration, Azure registers an A record for the app in an Azure Private DNS zone named privatelink.azurewebsites.net, which is linked to the virtual network. The public name of the app resolves through a CNAME to the privatelink name, and clients in VNet1 receive the private IP address of the endpoint from the private zone. Because the zone is private and linked to VNet1, those records are visible only to resolvers in linked virtual networks and never appear in public DNS.
Why the other options are wrong
- A. A public Azure DNS zone answers internet queries and is not where private endpoint records are registered.
- B. The private endpoint records go in the privatelink subdomain, and a private zone named azurewebsites.net would override resolution for every app on that domain.
- D. A public zone for azurewebsites.net is owned by Microsoft and does not hold private endpoint addresses.
That was 47 of 387.
The full Microsoft AZ-700 pack has all 387 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 193 free as one PDF by email. Get the Half Pack →