Hard — AZ-700 Practice Quiz

Question 1

Contoso deploys a single Azure Firewall (Standard SKU) with a firewall policy. The policy contains a network rule collection that allows outbound TCP traffic on port 443 to a specific server IP, and an application rule collection that denies HTTPS access to the FQDN 'downloads.contoso-partner.com' (which resolves to that same server IP). A VM behind the firewall initiates an HTTPS session to https://downloads.contoso-partner.com. What is the result?

Accepted Answer

The traffic is allowed because network rules are processed before application rules.

Answer

The traffic is denied because application rules take precedence over network rules.

Answer

The traffic is denied because the implicit deny-all rule is evaluated first.

Answer

The traffic is allowed only if Threat Intelligence mode is set to 'Alert and deny'.

Question 2

Your company deploys an Azure Firewall inside a Virtual WAN secured hub using Firewall Manager. The security team requires that all internet-bound traffic from the firewall itself be forced-tunneled through an on-premises appliance over ExpressRoute for centralized egress inspection. During design, you discover this requirement cannot be met with the current architecture. What is the correct explanation?

Accepted Answer

Forced tunneling of Azure Firewall traffic is not supported when the firewall is deployed in a Virtual WAN secured hub; forced tunneling requires a firewall deployed in a standard (customer-managed) VNet with an AzureFirewallManagementSubnet.

Answer

Forced tunneling is only available on the Basic SKU, so you must downgrade the secured hub firewall to Basic to enable it.

Answer

Forced tunneling requires enabling a 0.0.0.0/0 route in the hub routing intent, which the secured hub blocks by default and cannot be overridden.

Answer

Forced tunneling of the secured hub firewall works only if the hub also hosts a third-party NVA, so you must add one to the hub first.

Question 3

Your company deploys Azure Route Server in a hub VNet to exchange routes with a third-party SD-WAN NVA. Several spoke VNets are peered to the hub. Workloads in the spokes must automatically learn the on-premises branch routes that the NVA advertises to Route Server, without configuring user-defined routes in each spoke. When you configure the VNet peering between the hub and each spoke, which setting must you enable on the peering so the spokes receive the branch routes learned by Route Server?

Accepted Answer

Enable 'Use the remote virtual network's gateway or Route Server' on the spoke side of the peering

Answer

Enable 'Allow gateway transit' on the spoke side of the peering

Answer

Enable 'Allow forwarded traffic' on both sides of the peering

Answer

Enable 'Do not verify the remote gateway's IP address' on the hub side of the peering

Question 4

Your company runs several Azure VNets and an on-premises data center connected via ExpressRoute. Azure-hosted VMs must resolve records in a private DNS zone (azure.contoso.com) linked to the hub VNet, and on-premises servers must resolve those same Azure private DNS records. Additionally, Azure VMs must resolve on-premises Active Directory names (corp.contoso.com) hosted on on-premises DNS servers. You want a fully managed solution that avoids deploying and maintaining DNS forwarder VMs. What should you implement?

Accepted Answer

Deploy Azure DNS Private Resolver in the hub VNet with an inbound endpoint for on-premises queries and an outbound endpoint with a DNS forwarding ruleset for corp.contoso.com

Answer

Deploy a pair of Windows Server DNS forwarder VMs in the hub VNet and configure conditional forwarders in both directions

Answer

Configure the VNet's custom DNS server settings to point to the on-premises DNS servers and link the private DNS zone to all VNets

Answer

Enable Azure Firewall DNS proxy in the hub VNet and configure the on-premises DNS servers as forwarders

Question 5

Contoso has an ExpressRoute circuit with private peering connecting their on-premises datacenter to an Azure virtual network. A new compliance requirement mandates that all traffic traversing the ExpressRoute connection between on-premises and Azure must be encrypted, while continuing to use the existing ExpressRoute circuit as the transport path. Which solution meets this requirement with the least additional cost and complexity?

Accepted Answer

Configure a site-to-site IPsec VPN tunnel over the ExpressRoute private peering, terminating on the VPN gateway in the virtual network.

Answer

Enable Microsoft peering on the circuit and route the traffic through Microsoft peering instead of private peering.

Answer

Migrate the circuit to ExpressRoute Direct and enable MACsec encryption on the ExpressRoute gateway.

Answer

Deploy Azure Firewall Premium in the hub virtual network to encrypt traffic arriving over the ExpressRoute connection.

Question 6

You are designing outbound internet connectivity for workloads spread across three subnets in a zone-redundant Azure region. The security team requires all outbound SNAT to use a predictable set of static public IPs, and the architecture must survive the failure of a single availability zone. You plan to use Azure NAT Gateway. Which deployment approach correctly meets both the static-IP and zone-resilience requirements?

Accepted Answer

Deploy one zonal NAT Gateway per availability zone, associate each with subnets containing resources in that zone, and assign each its own static public IP or public IP prefix.

Answer

Deploy a single NAT Gateway configured as zone-redundant and associate it with all three subnets.

Answer

Deploy a single NAT Gateway and associate it with all three subnets, relying on Azure to automatically distribute it across all zones for resilience.

Answer

Associate the same zonal NAT Gateway with subnets in all three zones so the static IPs remain consistent across the region.

Question 7

A VM in the subnet 'AppSubnet' can no longer reach an external HTTPS endpoint (port 443), and the application team reports intermittent failures. You need to identify whether the traffic is being blocked and, if so, precisely which network security rule or user-defined route is responsible for dropping the packets between the VM and the destination. Which Azure Network Watcher capability should you use?

Accepted Answer

Connection troubleshoot

Answer

NSG flow logs sent to a Log Analytics workspace

Answer

IP flow verify

Answer

Connection monitor

Question 8

You deploy Azure Bastion into a dedicated AzureBastionSubnet to provide secure RDP/SSH access to VMs in a hub VNet. Your security team requires an NSG on AzureBastionSubnet to satisfy compliance. After associating the NSG, users can no longer connect through Bastion. Which set of outbound rules must the NSG allow to restore Bastion functionality while keeping the NSG in place?

Accepted Answer

Outbound to the VirtualNetwork service tag on ports 3389 and 22, to AzureCloud on port 443, to the VirtualNetwork tag on port 8080/5701, and to Internet on port 80

Answer

Outbound to Internet on port 443 only, since Bastion is a fully managed PaaS service that proxies all traffic through the public endpoint

Answer

Outbound to the GatewayManager service tag on ports 443 and 4443, and inbound from the Internet on port 3389

Answer

No outbound rules are needed because AzureBastionSubnet ignores NSG outbound rules by design

Question 9

Contoso hosts an internal application that must reach an Azure Storage account exclusively over a private connection. They have created a private endpoint for the storage account (blob subresource) in a hub VNet. On-premises servers connect to Azure through an ExpressRoute private peering circuit. From on-premises, application servers currently fail to connect to the storage account, and nslookup for the storage FQDN still returns a public IP address. What must Contoso do so that on-premises servers resolve the storage FQDN to the private endpoint's private IP?

Accepted Answer

Deploy a DNS forwarder VM in the hub VNet and configure on-premises DNS to conditionally forward the storage private DNS zone namespace to it, ensuring the forwarder queries Azure-provided DNS (168.63.129.16).

Answer

Add a virtual network link between the privatelink.blob.core.windows.net private DNS zone and the on-premises Active Directory domain.

Answer

Enable Microsoft peering on the ExpressRoute circuit so that on-premises servers can resolve Azure public DNS records privately.

Answer

Create a service endpoint for Microsoft.Storage on the hub VNet subnet and add the on-premises IP range to the storage account firewall.

Question 10

Your company hosts a general-purpose v2 storage account named 'salesdata'. You create a private endpoint for the blob sub-resource in a spoke VNet, approve the connection, and configure the private DNS zone integration correctly. Application VMs in the spoke VNet can resolve the storage account FQDN to the private IP address, but they still receive '403 Authorization Failure' errors when accessing blobs. The storage account's networking firewall is set to 'Enabled from selected virtual networks and IP addresses' with no networks or IPs added. What should you do to allow access while keeping the account private?

Accepted Answer

On the storage account firewall, ensure the 'Disable' public network access setting is selected, or leave the firewall in place — private endpoint traffic is not affected by the storage account firewall rules.

Answer

Add the spoke VNet subnet as a service endpoint entry under the storage account firewall's virtual network rules.

Answer

Add the private endpoint's private IP address to the storage account firewall's IP address range allow list.

Answer

Change the storage account firewall to 'Enabled from all networks' so the private endpoint traffic is permitted.

Question 11

Your company operates a SaaS platform behind an Azure Standard internal Load Balancer. You publish it through a Private Link service so that customer tenants can connect via private endpoints. As the number of customer connections grows, some new private endpoint connections begin to fail while existing ones remain healthy. You confirm the Private Link service is configured with a single subnet for NAT IP allocation. What is the most likely cause and the correct remediation?

Accepted Answer

The NAT subnet has exhausted its available private IP addresses; add additional subnets or a larger subnet to the Private Link service NAT IP configuration to provide more SNAT capacity.

Answer

The Private Link service has reached its hard limit of 8 private endpoint connections; deploy a second Private Link service to serve additional consumers.

Answer

The internal Load Balancer must be upgraded to a cross-region Load Balancer to support more than 100 private endpoint connections.

Answer

Auto-approval is disabled, so connections beyond the approved list are rejected; enable auto-approval for all subscriptions.

Question 12

Your company hosts a multi-tier application behind a Standard internal Load Balancer in a VNet. You want to offer this application privately to several customer Azure tenants using Azure Private Link Service so that consumers connect via private endpoints without VNet peering. During setup, you must specify a NAT IP configuration for the Private Link service. What is the primary purpose of the NAT subnet you designate for the Private Link service?

Accepted Answer

It provides source NAT for consumer traffic so that connections from private endpoints appear to originate from IPs in that subnet, avoiding IP overlap with consumer VNets

Answer

It hosts the private endpoint network interfaces created in the provider VNet for each consumer connection

Answer

It is used to assign public IP addresses to the Private Link service frontend for internet-facing access

Answer

It stores the private DNS zone records that resolve the Private Link service alias for consumers

Question 13

Your company operates a multi-tenant SaaS platform behind a Standard internal Load Balancer. You expose it to customers through an Azure Private Link service. The application team reports that all incoming requests appear to originate from the Private Link service NAT IP addresses, but they need to capture the true source IP of each consumer connection for per-tenant auditing. What should you do on the Private Link service to make the original consumer source information available to the backend application?

Accepted Answer

Enable the TCP Proxy Protocol v2 setting on the Private Link service and update the backend application to parse the PROXY protocol header.

Answer

Add a service endpoint policy on the load balancer's subnet to preserve the consumer source IP.

Answer

Disable NAT on the Private Link service NAT IP configuration so the consumer IP passes through unchanged.

Answer

Configure the internal Load Balancer with Direct Server Return (Floating IP) to retain the client source IP.

Question 14

Your company deploys an Azure Route Server in a hub VNet to exchange routes dynamically with two SD-WAN NVAs, each connected to a different on-premises branch via BGP. You notice that traffic from Branch A is being routed through Azure to reach Branch B, consuming hub bandwidth. Security policy requires branches to communicate only over their private WAN, never transiting Azure. What should you configure on the Azure Route Server to prevent this transit behavior?

Accepted Answer

Disable the branch-to-branch connectivity setting on the Route Server

Answer

Enable BGP route filtering on each NVA to drop the other branch's prefixes

Answer

Add a user-defined route in the GatewaySubnet blackholing the remote branch prefixes

Answer

Set the Route Server to a lower BGP AS path priority than the NVAs

Question 15

Your company runs a business-critical workload in Azure that requires a highly available site-to-site VPN connection to the on-premises data center. The on-premises edge consists of two independent VPN devices, each with its own public IP address. You must design the Azure VPN gateway so that a failure of a single Azure gateway instance OR a single on-premises VPN device does not interrupt connectivity. Which design should you implement?

Accepted Answer

Deploy an active-active Azure VPN gateway with two gateway public IPs, and create a separate connection from each Azure gateway instance to each of the two on-premises VPN devices (dual-redundancy).

Answer

Deploy an active-standby Azure VPN gateway with a single public IP and configure a single connection to a load balancer that fronts both on-premises VPN devices.

Answer

Deploy two separate active-standby VPN gateways in the same virtual network, each connected to one on-premises VPN device.

Answer

Deploy an active-active Azure VPN gateway with a single public IP and one local network gateway pointing to both on-premises device IPs.

Question 16

Your company establishes a site-to-site VPN between an Azure route-based VPN gateway (VpnGw2) and an on-premises firewall. The connection reaches the 'Connecting' state but never becomes 'Connected'. Azure diagnostic logs show that IKE Phase 1 negotiation repeatedly fails. You confirm the shared key matches on both sides and the on-premises public IP is correctly set in the local network gateway. The on-premises firewall administrator reports the tunnel is configured for IKEv1 with a policy-based (all-or-nothing) traffic selector. What is the MOST likely cause of the failure?

Accepted Answer

The route-based Azure gateway defaults to IKEv2, which is incompatible with the on-premises IKEv1 policy-based configuration unless a matching custom IPsec/IKE policy is applied.

Answer

The VpnGw2 SKU does not support site-to-site connections and must be upgraded to VpnGw3.

Answer

The local network gateway address space overlaps with the Azure VNet address space, blocking Phase 1.

Answer

BGP must be enabled on the Azure gateway before any IKE Phase 1 negotiation can complete.

Question 17

Contoso runs three VNets (Prod-A, Prod-B, Prod-C) that must all communicate directly with each other. A network engineer configures a mesh network group in Azure Virtual Network Manager and deploys the connectivity configuration. Afterward, VMs in Prod-A can reach Prod-B and Prod-C, but a subnet named 'AzureFirewallSubnet' in Prod-C is unexpectedly participating in the mesh. The engineer wants the mesh to apply to all current and future VNets added to the group, without manually editing membership each time. Which combination best meets these requirements?

Accepted Answer

Use a dynamic network group membership defined with Azure Policy conditions; subnet-level exclusions are not controlled by the connectivity configuration, so no special mesh setting removes AzureFirewallSubnet

Answer

Use a dynamic network group membership defined with Azure Policy conditions, and rely on the fact that mesh connectivity automatically excludes reserved subnets like AzureFirewallSubnet

Answer

Use a static network group and add each VNet manually, then create user-defined routes to block traffic to AzureFirewallSubnet

Answer

Convert the mesh to a hub-and-spoke topology so that spoke subnets are automatically isolated from one another