Online Access Free AZ-700 Exam Questions

No.# A-3 subnets for: subnet1 for the 3+1 VM, subnet2 as per requirements, GatewaySubnet for VPN
B-Two service endpoints for keyvault and DB1, VNET1 conection can use peering

No.# correction: tested in lab given answer is right. N,N, Y
1) Inbound rule on subnet1 will deny
2) Inbound rule on subnet2 will deny
3) No rule on VM3 so it would allow connections

No.# NYN

VM5 is in VNET3 and VNET3 isn't linked to the fabrikam.com private DNS zone. This means it won't be able to resolve anything in that private DNZ zone until it is linked.

No.# One parent profile configured with geographical routing method, 2 child profiles configured with weighted routing method.
So:
3 minimum profiles
Weighted (the question is the routing method in each region)

No.# D. IP3

No.# You can share an ExpressRoute circuit across multiple subscriptions.
The circuit owner is the administrator/coadministrator of the subscription in which the ExpressRoute circuit is created. The circuit owner can authorize administrators/coadministrators of other subscriptions, referred to as circuit users, to use the dedicated circuit that they own. Circuit users who are authorized to use the organization's ExpressRoute circuit can link the virtual network in their subscription to the ExpressRoute circuit after they're authorized.

https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-linkvnet-classic#administration

Sub1 : An ExpressRoute circuit connection authorization
Sub2 : An ExpressRoute circuit connection

No.# 8 S2S
4 ExpressRoute

For S2S 1 scale unit = 500 Mbps
4000/500 = 8 scale units
https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings#s2s

For ExpressRoute 1 scale unit = 2Gbps
8/2 = 4
https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-about#expressroute-performance

No.# custom rule that uses a match rule: Custom rules allow you to create tailored rules to suit the exact needs of your applications and security policies. Now, you can restrict access to your web applications by country/region. As with all custom rules, this logic can be compounded with other rules to suit the needs of your application.

To create a geo-filtering custom rule in the Azure portal, simply select Geo location as the Match Type, and then select the country/region or countries/regions you want to allow/block from your application.

No.# The answer is correct!
Enterprise Application and OpenVPN (SSL).

No.# First: No, this statement is not correct. The search results indicate that to add VM4 to the existing load balancer LB1, you do not need to create a new backend pool. This is because VM4 is in a different virtual network (Vnet3) than the existing backend pool (Vnet2), and the backend pool configuration is set to "NIC", which means it is based on the network interface of the VMs, not their IP addresses. Therefore, the backend resources do not need to be in the same virtual network as the load balancer for IP-based load balancers. The load balancer can load balance traffic to backend resources in different virtual networks, as long as the network interfaces of those resources are configured correctly.

Second: No its connected to Vnet1.

Third: NO Lb configured with http not https.

No.# Box 1: Yes -
VM3 is Subnet2. NSG2 applies. The default rule will allow communication.

Box 2: No -
VM1 & VM2 is in Subnet1. NSG1 applies. Only traffic on ports 80 and 443 will be allowed. Connection on port 9090 will be denied.
Note: Priority: A number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.

Box 3: No -
VM1 is in Subnet1. NSG1 applies. Only traffic on ports 80 and 443 will be allowed. Connection on port 9090 will be denied.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

No.# 8 Gig Express Route. 2 GB per ER scale unit. Therefore number of scale units = 8/2 = 4
https://www.wwt.com/article/microsoft-azure-virtual-wan-cloud-networking-architecture

No.# We want to minimize administrative effort
D. Increase the number of scale units
https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings#s2s

No.# E. Endpoint2 and Endpoint3 only

No.# 1 group: Multi-region active/active deployment: Create a single origin group. Within that origin group, create an origin for each of the App Service apps.
2 origins: Your App Service app might be configured to scale out across worker instances, but from Front Door's perspective there's a single origin.

No.# response D: "You need to test the website and ContosoFD1 without affecting user access to the on-premises web server." afdverify permits to do it without impact.

No.# B. a route table associated to Subnet1-1 and Subnet2-1

1. You have to create a route table first
2. Next you create the route in the table like this
Route name: toFW
Destination type: IP Addresses
Destination IP addresses/CIDR ranges: 0.0.0.0/0
Next hop type: Virtual appliance
Next hop address: Firewall IP
3. Go to Subnets
Select the Vnet
Associate Subnet1-1 and Subnet2-1

No.# correct anwser A,D

No.# 1. NO. A backend pool can only contain resources from one virtual network. VM2 (VNet1) VM3 (VNet2)
2.YES. using the frondend Ip address.
3. NO. the defualt NSGs are blocking any ingress internet traffic

No.# I think answer should be B. Create a new subnet, since both Vnet and App Service are in the same region.
https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet#enable-vnet-integration
Regional VNet Integration = "If the VNet is in the same region, either create a new subnet or select an empty pre-existing subnet"