Medium — AZ-700 Practice Quiz

Question 1

Your company runs a web application behind an Azure Application Gateway v2 (Standard_v2). Traffic is highly variable, spiking during business hours and dropping to almost nothing overnight. Management requires that the gateway automatically add and remove capacity based on load to minimize cost, while guaranteeing that at least a baseline amount of compute is always available to handle a sudden burst without a cold-start delay. You are configuring the autoscaling settings. Which configuration meets these requirements?

Accepted Answer

Enable autoscaling and set a minimum instance count greater than zero along with a maximum instance count.

Answer

Disable autoscaling and manually configure a fixed instance count sized for peak load.

Answer

Enable autoscaling and set the minimum instance count to 0 so no capacity is provisioned when idle.

Answer

Migrate to the Standard (v1) SKU and configure a manual capacity unit for the baseline.

Question 2

Your company runs a web tier across a VM Scale Set and a set of on-premises IIS servers reachable over an ExpressRoute private connection. You must front both groups with a single Azure Application Gateway v2 so requests can be distributed to either the cloud or on-premises servers. When configuring the backend pool for this deployment, which approach correctly targets both sets of servers?

Accepted Answer

Create one backend pool that combines the VM Scale Set reference and the on-premises servers added as IP addresses or FQDNs, then associate it with the routing rule.

Answer

Application Gateway backend pools can only contain resources within the same virtual network, so the on-premises servers must be migrated to Azure first.

Answer

Create two separate Application Gateways, one for the VM Scale Set and one for the on-premises IIS servers, because a pool cannot mix target types.

Answer

Add the on-premises servers to the backend pool using their public IP addresses only, since private IPs from on-premises are not routable to Application Gateway.

Question 3

Your company hosts a legacy web application behind an Azure Application Gateway v2. The application stores session state locally in memory on each backend VM rather than in a shared store. Users report that they are intermittently logged out and their shopping carts are lost as they navigate the site. You confirm the backend pool has three healthy VMs and that health probes are passing. You must ensure a user's requests are consistently sent to the same backend VM for the duration of their session, with minimal changes to the application. What should you configure?

Accepted Answer

Enable cookie-based session affinity on the HTTP settings associated with the routing rule

Answer

Configure a custom health probe with a longer interval so backend VMs are not marked unhealthy

Answer

Add a rewrite rule set that inserts an X-Forwarded-For header on all inbound requests

Answer

Change the listener from multi-site to basic so all traffic uses a single backend pool

Question 4

Your company runs a web application behind an Azure Application Gateway v2. The backend pool contains three VMs that host an API. The application's health endpoint at /api/health returns an HTTP 200 status but includes a JSON body, and under a partial failure it returns HTTP 503. Recently, the Application Gateway marked all backend servers as unhealthy even though the site returned HTTP 200, because the health endpoint responded with a 200 status but a body of '{"status":"degraded"}'. You need the probe to consider a backend healthy ONLY when it returns HTTP 200 and the response body contains the text 'healthy'. What should you configure?

Accepted Answer

Create a custom health probe and configure match conditions for the accepted HTTP status codes and a matching response body string.

Answer

Change the HTTP setting to use the default probe and set the request timeout to a higher value.

Answer

Add a rewrite rule set to modify the response body returned by the backend so it always contains 'healthy'.

Answer

Configure a listener with a custom error page that maps HTTP 503 responses to HTTP 200.

Question 5

Your company runs a stateful web application behind an Azure Application Gateway v2. During deployments, backend VMs in the pool are removed and replaced, and users report that in-flight requests fail with connection errors whenever a backend instance is deregistered. You must ensure that existing requests to a backend server are allowed to complete gracefully before the server is removed from rotation, without dropping active sessions. Which Application Gateway configuration should you enable?

Accepted Answer

Enable connection draining on the backend HTTP settings and specify a drain timeout.

Answer

Enable cookie-based session affinity on the backend HTTP settings.

Answer

Configure a custom health probe with a lower unhealthy threshold interval.

Answer

Increase the request timeout value in the backend HTTP settings.

Question 6

Your company hosts an e-commerce site behind an Azure Application Gateway v2. Security requires that all client traffic use HTTPS. Currently the gateway has an HTTPS listener on port 443 with a valid certificate and a routing rule pointing to the backend pool. However, users who type the site name in a browser arrive on HTTP port 80 and receive an error because no listener handles that traffic. You must ensure that any request arriving on HTTP is automatically sent to the HTTPS version of the same URL, without changing the backend. What should you configure?

Accepted Answer

Add an HTTP listener on port 80 and create a redirection configuration in a routing rule that targets the existing HTTPS listener with permanent redirect and 'Include query string' and 'Include path' enabled.

Answer

Add a health probe on port 80 that returns a 301 status code so unhealthy HTTP requests are redirected to HTTPS.

Answer

Configure an HTTP-to-HTTPS rewrite rule set on the existing HTTPS listener to modify the request scheme before it reaches the backend pool.

Answer

Enable end-to-end TLS on the HTTP settings so that requests on port 80 are re-encrypted and forwarded to the backend over 443.

Question 7

Your company runs Azure Application Gateway v2 with a single public frontend IP on port 443. You have configured three multi-site listeners that use overlapping host name patterns: one listener matches 'shop.contoso.com', another matches '*.contoso.com', and a third matches '*.com'. During testing, requests to 'shop.contoso.com' are intermittently routed to the wrong backend pool. You must ensure requests to 'shop.contoso.com' are always handled by its dedicated listener without removing the wildcard listeners. What should you do?

Accepted Answer

Assign explicit routing rule priority values so the 'shop.contoso.com' rule has a lower (higher-precedence) priority number than the wildcard rules.

Answer

Move the wildcard listeners to a separate Application Gateway to avoid host name conflicts.

Answer

Change the 'shop.contoso.com' listener to a basic listener so it is evaluated first.

Answer

Enable cookie-based session affinity on the 'shop.contoso.com' HTTP setting to pin requests to the correct backend.

Question 8

Your company hosts two web applications, shop.contoso.com and portal.contoso.com, behind a single Azure Application Gateway v2. Both applications share the same public IP and port 443 but must route to different backend pools based on the requested domain name. Traffic for shop.contoso.com must go to the retail backend pool and traffic for portal.contoso.com must go to the internal-services backend pool. Which Application Gateway configuration achieves this?

Accepted Answer

Configure two multi-site listeners, each with its own host name, and associate each with a routing rule pointing to the appropriate backend pool.

Answer

Configure a single basic listener on port 443 and use path-based routing rules to separate the two applications.

Answer

Deploy two separate Application Gateways, one for each host name, sharing the same public IP address.

Answer

Configure a single multi-site listener and use a custom health probe to direct traffic to the correct backend pool.

Question 9

Your company hosts two public web applications, shop.contoso.com and portal.contoso.com, behind a single Azure Application Gateway v2. Both must be reachable over HTTPS on TCP port 443 using the same public frontend IP, and each site must present its own dedicated TLS certificate to clients. What is the minimum configuration you must implement to satisfy this requirement?

Accepted Answer

Create two multi-site HTTPS listeners on port 443, each with a host name and its own uploaded TLS certificate, then associate each listener with a routing rule.

Answer

Create a single basic HTTPS listener on port 443 with both certificates uploaded, and use a path-based rule to select the correct certificate per site.

Answer

Create two separate frontend public IP addresses, one per site, each with a basic HTTPS listener bound to a single certificate.

Answer

Create one HTTPS listener on port 443 using a wildcard *.contoso.com certificate and rely on host header rewrite rules to differentiate the sites.

Question 10

A financial services company runs an Azure Application Gateway v2 in front of a REST API used by partner organizations. Compliance requires that only partner client applications presenting a valid client certificate issued by an approved certificate authority be allowed to connect; any request without a trusted client certificate must be rejected at the gateway. Which Application Gateway configuration meets this requirement?

Accepted Answer

Configure mutual TLS (mTLS) authentication on the listener by uploading the client CA certificate chain to an SSL profile and associating that profile with the listener.

Answer

Enable end-to-end TLS by uploading the backend server's root certificate to the HTTP settings so the gateway validates the backend.

Answer

Add a rewrite rule set that inspects the X-ARR-ClientCert request header and drops requests where the header is missing.

Answer

Configure a custom health probe with a match condition that requires the client certificate thumbprint in the response body.

Question 11

Your company runs a web application behind an Azure Application Gateway v2 (Standard_v2). During a security audit, penetration testers report that backend responses expose a 'Server' HTTP response header that reveals the underlying web server product and version. Developers cannot modify the backend application in the near term. Security requires that this header be stripped before responses reach clients, with no impact to existing listeners or routing. What should you configure on the Application Gateway?

Accepted Answer

Create a rewrite rule set that deletes the 'Server' response header by setting its header value to empty, and associate the rule set with the routing rule.

Answer

Enable a custom health probe that matches on the 'Server' header so the gateway filters it out of responses.

Answer

Modify the HTTP setting to use 'Pick host name from backend address' so the backend server identity is hidden.

Answer

Configure end-to-end TLS on the backend pool so the encrypted response prevents the 'Server' header from being read.

Question 12

Your company runs a web application behind Azure Application Gateway v2. The backend application generates absolute redirect URLs (HTTP 302 responses with a Location header) using its internal hostname 'app-internal.contoso.local', which is what it receives in the incoming Host header because the HTTP settings override the hostname to the backend pool member's name. Users report that after login, they are redirected to a broken internal URL instead of the public site 'www.contoso.com'. You must ensure redirects point to the correct public hostname without modifying the backend application. What should you configure on the Application Gateway?

Accepted Answer

Create a rewrite rule set that rewrites the Location header in the response, replacing the internal hostname with 'www.contoso.com', and associate it with the routing rule.

Answer

Enable 'Pick host name from backend target' in the HTTP settings so the backend receives the public hostname.

Answer

Add a health probe with a custom host header set to 'www.contoso.com' and associate it with the HTTP settings.

Answer

Configure a multi-site listener with the host name 'www.contoso.com' and enable end-to-end TLS.

Question 13

Your company runs a web application behind an Azure Application Gateway v2. Compliance requires that traffic remain encrypted from the client all the way to the backend servers (end-to-end TLS), not just to the Application Gateway. The backend pool consists of two VMs presenting certificates signed by your organization's private (internal) certificate authority. After configuring an HTTPS backend HTTP setting, the backend health shows 'Unknown' and requests fail. What must you configure so that the Application Gateway can establish trusted TLS connections to the backends?

Accepted Answer

Upload the backend server's root CA certificate as a Trusted Root Certificate in the backend HTTP setting

Answer

Upload the client-facing PFX certificate to the HTTPS listener and enable TLS termination

Answer

Disable the health probe and set the backend HTTP setting protocol to HTTP

Answer

Add the backend VMs' private IP addresses to the Application Gateway's public IP allow list

Question 14

Contoso hosts a single web application behind Azure Application Gateway v2. The application serves static images from URLs beginning with /images/* and API calls from URLs beginning with /api/*. The team wants requests to /images/* to be sent to a backend pool of storage-optimized VMs, requests to /api/* to be sent to a backend pool of compute-optimized VMs, and all other requests to a default backend pool. All requests arrive on the same listener (HTTPS, same hostname). What should you configure to route the traffic correctly?

Accepted Answer

Create a path-based routing rule with URL path maps that match /images/* and /api/* to their respective backend pools, and set the default backend pool for unmatched paths.

Answer

Create three separate multi-site listeners, each bound to a different host header, and associate each with its own basic routing rule.

Answer

Create a rewrite rule set that inspects the request URI and rewrites the backend target based on the path prefix.

Answer

Create a custom health probe for each backend pool so the gateway automatically directs traffic to the matching path.

Question 15

Contoso runs a three-tier application in a single subnet: 6 web VMs, 4 application VMs, and 3 database VMs. Security requires that only web VMs can reach the application VMs on TCP 8080, and only application VMs can reach the database VMs on TCP 1433. The subnet may grow with additional VMs of each tier over time. You must minimize the number of NSG rules and avoid maintaining explicit IP address lists as VMs are added. What should you implement?

Accepted Answer

Create three Application Security Groups (asg-web, asg-app, asg-db), assign each VM's NIC to the appropriate ASG, and write NSG rules that reference the ASGs as source and destination.

Answer

Create separate subnets for each tier and write NSG rules using each subnet's address prefix as source and destination.

Answer

Create NSG rules that list the individual private IP addresses of the VMs in each tier as source and destination, updating the lists whenever a VM is added.

Answer

Assign a service tag to each tier of VMs and reference the service tags in the NSG inbound rules.

Question 16

Your company deploys Azure Bastion in a hub VNet to provide secure RDP/SSH access to VMs across peered spoke VNets. Administrators complain that they cannot connect to VMs from their local machines using the native Windows RDP client (mstsc), and they also cannot upload or download files during Bastion sessions. Your current deployment uses the Bastion Basic SKU. What must you do to enable both native client connectivity and file transfer?

Accepted Answer

Upgrade the Bastion deployment to the Standard SKU and enable the native client support feature

Answer

Add a user-defined route in the AzureBastionSubnet pointing to the VMs' subnets

Answer

Enlarge the AzureBastionSubnet to at least a /24 and enable auto-scaling

Answer

Assign a second public IP to the Bastion host and enable IP-based connection

Question 17

Contoso runs an on-premises data center connected to an Azure hub VNet via ExpressRoute. On-premises servers must resolve records hosted in an Azure private DNS zone (contoso-internal.com) that is linked to the hub VNet. Contoso does not want to deploy and manage DNS server VMs in Azure. Which Azure DNS Private Resolver component must you deploy and reference so that on-premises DNS servers can forward queries into Azure and receive answers from the linked private DNS zone?

Accepted Answer

An inbound endpoint in a dedicated delegated subnet of the hub VNet, targeted by an on-premises conditional forwarder

Answer

An outbound endpoint with a DNS forwarding ruleset linked to the hub VNet

Answer

A private DNS zone virtual network link with auto-registration enabled on the hub VNet

Answer

A custom DNS server IP configured on the hub VNet pointing to 168.63.129.16

Question 18

Contoso runs several VNets in Azure that must resolve names hosted on an on-premises Active Directory DNS server (contoso.local) reachable over an ExpressRoute circuit. You deploy an Azure DNS Private Resolver. You need Azure workloads to forward only queries for contoso.local to the on-premises DNS servers while all other queries continue to use Azure-provided DNS. What should you configure?

Accepted Answer

Create an outbound endpoint, then create a DNS forwarding ruleset with a rule for contoso.local pointing to the on-premises DNS IPs, and link the ruleset to the VNets

Answer

Create an inbound endpoint and set the on-premises DNS server to conditionally forward contoso.local to the inbound endpoint IP

Answer

Create a private DNS zone named contoso.local, link it to the VNets with autoregistration, and add A records manually

Answer

Set the custom DNS servers on each VNet to the on-premises DNS server IP addresses

Question 19

Your company deploys Azure Firewall Standard to control outbound traffic from a spoke virtual network. Server administrators report that Windows Update fails on all VMs because outbound HTTP/HTTPS is denied by default. The Microsoft-hosted update endpoints span many changing FQDNs and CDNs. You must allow Windows Update traffic with the least administrative effort and without manually maintaining a list of URLs. What should you configure?

Accepted Answer

Create an application rule that uses the WindowsUpdate FQDN tag

Answer

Create a network rule allowing TCP 80 and 443 to the Internet service tag

Answer

Create an application rule listing each *.windowsupdate.com and CDN wildcard FQDN manually

Answer

Create a DNAT rule to redirect update traffic to an internal WSUS server

Question 20

Your company is deploying Azure Firewall to protect a small branch-office virtual network that expects a peak throughput of roughly 200 Mbps and around 40 concurrent users. Management wants the lowest-cost firewall SKU that still supports built-in threat intelligence in alert mode. However, the security team notes that the deployment must include a specific companion component for the control plane to function. Which SKU should you choose, and what additional resource is mandatory for it?

Accepted Answer

Azure Firewall Basic SKU, which requires a Firewall Management (Basic Management) public IP in addition to the data-plane public IP

Answer

Azure Firewall Standard SKU, which requires an Azure Firewall Premium policy to enable threat intelligence

Answer

Azure Firewall Basic SKU, which requires an Azure DDoS Network Protection plan on the VNet

Answer

Azure Firewall Premium SKU, which requires a dedicated AzureFirewallManagementSubnet only when forced tunneling is enabled

Question 21

Your company deploys an Azure Firewall (Standard SKU) in a hub virtual network. A web server running on a VM in a spoke VNet has the private IP 10.1.2.10 and listens on TCP 8080. You need to publish this server to the internet so that external clients can reach it via the firewall's public IP on TCP 443, with the firewall translating the traffic to the internal address and port. Which type of Azure Firewall rule should you configure?

Accepted Answer

A DNAT rule that translates the firewall public IP:443 to 10.1.2.10:8080

Answer

A network rule allowing inbound traffic from the internet to 10.1.2.10 on TCP 443

Answer

An application rule with a target FQDN pointing to the web server on port 8080

Answer

An SNAT rule that translates the source of inbound traffic to the firewall public IP

Question 22

Your company runs an Azure Firewall Premium with a firewall policy that contains dozens of network and application rules. Several rules reference the same set of 40 on-premises subnet CIDRs as their source, and this list changes about twice a month. Each time it changes, an engineer must manually edit every affected rule, which is error-prone. You need to centralize this address list so a single update propagates to all rules that use it, while keeping the change scoped to the firewall configuration. What should you implement?

Accepted Answer

Create an IP Group containing the 40 CIDRs and reference it as the source in each rule

Answer

Create a custom service tag in Azure Virtual Network Manager and reference it in the rules

Answer

Add the 40 CIDRs to an Application Security Group and use it as the rule source

Answer

Store the CIDRs in an Azure DNS zone and reference the FQDNs in application rules

Question 23

Contoso manages security for multiple Azure Firewall instances using Azure Firewall Manager. The security team creates a parent firewall policy named 'Corp-Base' that contains rule collection groups blocking known malicious FQDNs and enforcing threat intelligence. Regional teams need their own policies that add region-specific application rules but must not be able to remove or override the corporate blocking rules. You need to design the policy structure so that regional policies automatically include all Corp-Base rules while allowing regional additions. What should you do?

Accepted Answer

Create each regional policy as a child policy that inherits from Corp-Base, then add region-specific rule collection groups to the child policy.

Answer

Copy the Corp-Base rule collection groups into each regional policy manually and add the region-specific rules alongside them.

Answer

Associate Corp-Base and each regional policy to the same firewall, letting Firewall Manager merge the rules automatically.

Answer

Create the regional policies as standalone policies and use an Azure Policy definition to enforce that they contain the Corp-Base rules.

Question 24

Your company runs a secured hub in Azure Virtual WAN protected by Azure Firewall Premium. The security team wants to consolidate all firewall configuration for five regional hubs into a single, centrally managed policy while still allowing each hub to have region-specific network rules that override the shared baseline. Which Firewall Manager configuration approach meets these requirements with the least administrative effort?

Accepted Answer

Create one parent Azure Firewall Policy containing shared rules, then create a child policy per region that inherits the parent and adds region-specific rule collection groups with lower priority numbers.

Answer

Create a separate standalone Azure Firewall Policy for each hub and manually duplicate the shared baseline rules into every policy.

Answer

Create one Azure Firewall Policy and associate it with all five firewalls, adding region-specific rules as classic rules directly on each firewall instance.

Answer

Create one parent policy and configure DNAT rules in the parent so each region inherits identical destination translation without child policies.

Question 25

Your company uses Azure Firewall Premium managed by a single Azure Firewall Policy. Within that policy you have two rule collection groups: 'BaselineRules' (priority 200) containing a network rule collection that denies all traffic to 10.50.0.0/16, and 'AppRules' (priority 300) containing a network rule collection that allows TCP 443 from the workload subnet to 10.50.10.5. Users report that HTTPS connections to 10.50.10.5 are being dropped. You must allow this specific traffic while keeping the broad deny in place for the rest of the range. What should you do?

Accepted Answer

Change the priority of the 'AppRules' rule collection group to a lower number than 'BaselineRules' (for example 100).

Answer

Move the allow rule into an application rule collection instead of a network rule collection.

Answer

Increase the priority number of 'BaselineRules' to 400 so it is evaluated last.

Answer

Add a DNAT rule collection to 'AppRules' to translate the destination address.