Online Access Free AZ-700 Exam Questions

No.# Well, after reviewing more, I think I was premature in saying the answer was 100% C. I was 100% wrong!! The correct answer is absolutely, 100% A. User Access Administrator

The key to the questions is that we're being asked what permissions are required to place a __lock__ (resource lock) on the Network Watcher resource. To create or delete management locks, you need access to Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions. Only the Owner and the User Access Administrator built-in roles can create and delete management locks. You can create a custom role with the required permissions.

Source:
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#who-can-create-or-delete-locks

No.# should be N,N, Y

1) Inbound rule on subnet1 will deny
2) Inbound rule on subnet2 will deny
3) No rule on VM3 so it would allow connections

No.# given answer is correct. explanation:To implement outbound connectivity for VMScaleSet1 while meeting the virtual networking requirements and business requirements, the following three actions should be performed in sequence:

Create a public load balancer in the Standard SKU
Create a backend pool that contains VMScaleSet1
Create an outbound rule
In the context of Azure networking, a health probe is typically used in load balancers to monitor the health of backend instances and ensure that traffic is directed only to healthy instances. In the scenario of implementing outbound connectivity for VMScaleSet1, the health probe is not a prerequisite before creating an outbound rule because outbound rules are primarily used to define how traffic should be routed from the virtual network to external destinations. Creating an outbound rule allows you to control and secure outbound traffic from your virtual network, specifying which resources can initiate outbound connections. Once the outbound rule is defined, it governs how traffic flows out of the virtual network. On the other hand, a health probe is more relevant in scenarios where load balancing and monitoring the health of backend instances are crucial, which is not directly related to defining outbound connectivity rules. Therefore, in the sequence of actions for implementing outbound connectivity for VMScaleSet1, creating an outbound rule would logically come before setting up a health probe as it directly addresses how outbound traffic is managed without requiring health monitoring of backend instances....

No.# Say your application gateway has a global policy applied to it. Then you apply a different policy to a listener on that application gateway. The listener's policy now takes effect for just that listener. The application gateway’s global policy still applies to all other listeners and path-based rules that don't have a specific policy assigned to them.

No.# Answer
To configure additional redirection settings in Azure Front Door where requests to Frontend1 with a header containing "string2" must be redirected to https://www.contoso.com/redirect2, the following three actions should be performed: Actions:

A. Create a custom rule: This is needed to define the specific condition for redirecting requests with "string2" in the header.
B. Add a custom rule to Policy1: The custom rule created in step A should be added to Policy1 to enforce the redirection based on the defined condition.
C. Create an association: An association needs to be created between the custom rule and Frontend1 to apply the redirection logic for requests with "string2" in the header.

No.# response D: "You need to test the website and ContosoFD1 without affecting user access to the on-premises web server." afdverify permits to do it without impact.

No.# Also all subnets within the same vNET can communicate free with each other

So having 1 VM inspect and route traffic between all the subnets on both the virtual networks DOES NOT MAKE SENSE but anyway it requires 1 IP but if the vNETs were NOT peered than the VM acts as router and in that case 2 IPs

No.# C. performance Using the performance routing method in Azure Traffic Manager will direct users to the Azure App Service instance with the lowest latency. This method is ideal for scenarios where users need to be directed to the closest or fastest endpoint based on performance metrics like latency.

No.# Listeners:

Two listeners, one for each unique HTTP host header (app1.contoso.com and app2.contoso.com) to differentiate between the web apps hosted on the Azure App Service instances.

Routing Rules:

Two routing rules, one for each backend pool (as1.contoso.com and as2.contoso.com), to direct traffic from the respective listeners to the correct backend pools based on the HTTP host headers.

Therefore, the correct options to select are:

Listeners: 2
Routing Rules: 2

No.# A. On the peering from Vnet1, select Allow gateway transit.

B. On the peerings from Vnet2 and Vnet3, select Use remote gateways

No.# Answer: C
Custom rules allow you to create tailored rules to suit the exact needs of your applications and security policies. Now, you can restrict access to your web applications by country/region. As with all custom rules, this logic can be compounded with other rules to suit the needs of your application.

To create a geo-filtering custom rule in the Azure portal, simply select Geo location as the Match Type, and then select the country/region or countries/regions you want to allow/block from your application

No.# You can store NSG flow logs from multiple NSGs in a single storage account. The NSGs and the SA have to be in the same region and subscription though.
https://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-overview
Min No. of instant required: One instant

No.# tep 1: Deploy an Azure Load Balancer in front of the application server
Configure your application to run behind a standard load balancer in your virtual network.
Step 2: In Subscription 1, create a private link service and attach the service to the frontend IP configuration of the load balancer.
Create a Private Link Service referencing the load balancer above.
Step 3: In Subscription 2, create a private endpoint by using the private link service.
Private Link service can be accessed from approved private endpoints in any public region. The private endpoint can be reached from the same virtual network, regionally peered VNets, globally peered VNets and on premises using private VPN or ExpressRoute connections.

Step 4: In Subscription1, accept the private endpoint connection request.
Network connections can be initiated only by clients that are connecting to the private endpoint.

No.# To ensure that you can use the service endpoint to connect to the read-only endpoint of storage1 in the paired Azure region, the first step you should take is:

**C. Create a virtual network in the paired Azure region.**

Creating a virtual network in the paired Azure region will establish the necessary network connectivity for accessing the read-only endpoint of storage1 from that region. This step is crucial to enable communication between resources in different regions and ensure seamless data access and transfer across regions.

No.# Policy, Association, Custom rule

No.# performance

No.# 1,2 the right answer

No.# 1. Delete VPN GW1.
2. Set the subnet mask of Gateway Subnet to /27.
3. Create a VPN gateway by using the VPN GW1 SKU.