Microsoft Designing and Implementing Microsoft Azure Networking Solutions - AZ-700 FREE EXAM DUMPS QUESTIONS & ANSWERS
Drag and Drop Question
You plan to integrate your local network resources to Azure via an S2S VPN tunnel. You have already configured the Virtual Network Gateway, the Local Network Gateway and the GatewaySubnet on the Azure portal.
You need to configure the on-site VPN device so the VPN connection can be established.
Which three of the following configuration items should you use? To answer, move the appropriate configuration item from the list of Configuration entities to the answer area and arrange them in any order.
You plan to integrate your local network resources to Azure via an S2S VPN tunnel. You have already configured the Virtual Network Gateway, the Local Network Gateway and the GatewaySubnet on the Azure portal.
You need to configure the on-site VPN device so the VPN connection can be established.
Which three of the following configuration items should you use? To answer, move the appropriate configuration item from the list of Configuration entities to the answer area and arrange them in any order.
Correct Answer:
Explanation:
The VPN shared key is the same key that you configured on the Virtual Network Gateway. First, you must ensure the same shared key is configured on the on-site VPN device and the Azure Virtual Network Gateway or the connection will not establish. Then, you need to get the Azure Virtual Network Gateway Public IP and configure the same on the on-site VPN device for the remote gateway. Lastly, you will need to download the VPN device configuration script. Azure provides device specific configuration for different vendors, which you can use to configure the local VPN device.
You should not use the Virtual Network Gateway item. The Virtual Network Gateway entity is needed on the Azure portal to configure a virtual VPN gateway that connects to your local VPN device. The Virtual Network Gateway is created inside the GatewaySubnet and there you can define the VPN type, the Gateway type and VPN SKU you are planning to use.
You should not identify the Local Network Gateway item. The Local Network Gateway is a representation of the on-premises network and defines the VPN device access IP or FQDN and the private address space you would like to route from Azure to the local VPN device.
https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal
https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-download-vpndevicescript
Hotspot Question
You have an Azure private DNS zone named contoso.com that is linked to the virtual networks shown in the following table.
The links have auto registration enabled.
You create the virtual machines shown in the following table.
You manually add the following entry to the contoso.com zone:
- Name: VM1
- IP address: 10.1.10.9
For each of the following statements, select Yes of the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You have an Azure private DNS zone named contoso.com that is linked to the virtual networks shown in the following table.
The links have auto registration enabled.
You create the virtual machines shown in the following table.
You manually add the following entry to the contoso.com zone:
- Name: VM1
- IP address: 10.1.10.9
For each of the following statements, select Yes of the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: No
The manual DNS record will overwrite the auto-registered DNS record so VM1 will resolve to
10.1.10.9.
Box 2: No
The DNS record for VM1 is now a manually created record rather than an auto-registered record.
Only auto-registered DNS records are deleted when a VM is deleted.
Box 3: No
This answer depends on how the IP address is changed. To change the IP address of a VM manually, you would need to select `Static' as the IP address assignment. In this case, the DNS record will not be updated because only DHCP assigned IP addresses are auto-registered.
Reference:
https://docs.microsoft.com/en-us/azure/dns/dns-faq-private
Hotspot Question
You plan to implement an Azure Virtual WAN named VWAN1 that will contain a hub named Hub1. VWAN1 will include the virtual networks shown in the following table.
You need to ensure that hosts connected to VNet1 can communicate with hosts connected to VNet3.
How should you configure the routing tables for VWAN1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You plan to implement an Azure Virtual WAN named VWAN1 that will contain a hub named Hub1. VWAN1 will include the virtual networks shown in the following table.
You need to ensure that hosts connected to VNet1 can communicate with hosts connected to VNet3.
How should you configure the routing tables for VWAN1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Hotspot Question
You have an Azure virtual network that contains the subnets shown in the following table.
In NSG1, you create inbound rules as shown in the following table.
NSG2 has only the default rules configured.
You have the Azure virtual machines shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You have an Azure virtual network that contains the subnets shown in the following table.
In NSG1, you create inbound rules as shown in the following table.
NSG2 has only the default rules configured.
You have the Azure virtual machines shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: No
VM3 will be allowed to access VM1 on any port outbound on NSG2. VM3 will be blocked by NSG1 inbound since it is trying to access port 8080.
Box 2: No
VM1 and VM2 belongs to the same subnet 1 and each of them has default Outbound policy rule that will allow the traffic but Inbound is restricted for any port except 80 and 443.
Box 3: Yes
NSG2 has the default rules applied, it means that Subnet2 can accept traffic from any subnet within the VNET.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
Hotspot Question
You have an Azure subscription.
You plan to use Azure Virtual WAN.
You need to deploy a virtual WAN hub that meets the following requirements:
- Supports 4 Gbps of Site-to-Site (S2S) VPN traffic
- Supports 8 Gbps of ExpressRoute traffic
- Minimizes costs
How many scale units should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have an Azure subscription.
You plan to use Azure Virtual WAN.
You need to deploy a virtual WAN hub that meets the following requirements:
- Supports 4 Gbps of Site-to-Site (S2S) VPN traffic
- Supports 8 Gbps of ExpressRoute traffic
- Minimizes costs
How many scale units should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
For S2S 1 scale unit = 500 Mbps
4000/500 = 8 scale units
https://learn.microsoft.com/en-us/azure/virtual-wan/gateway-settings#s2s For ExpressRoute 1 scale unit = 2Gbps
8/2 = 4
https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-expressroute-about#expressroute-performance
Hotspot Question
You have an Azure subscription. The subscription contains virtual machines that host websites as shown in the following table.
You have the Azure Traffic Manager profiles shown in the following table.
You have the endpoints shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You have an Azure subscription. The subscription contains virtual machines that host websites as shown in the following table.
You have the Azure Traffic Manager profiles shown in the following table.
You have the endpoints shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Box 1: No
VM1, which is hosting site1.contoso.com, is located in East US. The VM1 endpoint status is degraded. Endpoint monitoring health checks are failing. The endpoint isn't included in DNS responses and doesn't receive traffic.
When an endpoint has a Degraded status, it's no longer returned in response to DNS queries.
Instead, an alternative endpoint is chosen and returned. The traffic- routing method configured in the profile determines how the alternative endpoint is chosen.
Priority. Endpoints form a prioritized list. The first available endpoint on the list is always returned.
If an endpoint status is Degraded, then the next available endpoint is returned.
The user will connect to site2.us.contoso.com instead.
Box 2: No
VM3, which is hosting site2.contoso.com, is located in in East US. The VM3 endpoint status is CheckingEndpoint. The endpoint is monitored, but the results of the first probe haven't been received yet. CheckingEndpoint is a temporary state that usually occurs immediately after adding or enabling an endpoint in the profile. An endpoint in this state is included in DNS responses and can receive traffic.
User will connect to site2.contoso.com, not to site2.uk.contoso.com
Box 3: No
VM3, which is hosting site2.contoso.com, is located in in East US. The VM1 endpoint status is CheckingEndpoint, which is OK (see above).
User will connect to site2.contoso.com, not to site2.japan.contoso.com
Reference:
https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoring
You plan to implement an Azure virtual network that will contain 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.
You need to recommend a load balancing solution for the virtual network. The solution must meet the following requirements:
- The virtual machines and the load balancer must be accessible only from the virtual network.
- Costs must be minimized.
What should you include in the recommendation?
You need to recommend a load balancing solution for the virtual network. The solution must meet the following requirements:
- The virtual machines and the load balancer must be accessible only from the virtual network.
- Costs must be minimized.
What should you include in the recommendation?
Correct Answer: A
Vote an answer
Hotspot Question
You have an Azure subscription that contains the resources shown in the following table.
You need to restrict access to storage1 and sql1 by using service endpoints. The solution must meet the following requirements:
- Allow access from Subnet1 to SQLDB1.
- Implement service endpoint policies to restrict access to supported
resources.
- Allow access from Subnet1 to storage1 and the read-only replica of
storage1 in the paired Azure region.
What is the minimum number of service endpoints and service endpoint policies you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have an Azure subscription that contains the resources shown in the following table.
You need to restrict access to storage1 and sql1 by using service endpoints. The solution must meet the following requirements:
- Allow access from Subnet1 to SQLDB1.
- Implement service endpoint policies to restrict access to supported
resources.
- Allow access from Subnet1 to storage1 and the read-only replica of
storage1 in the paired Azure region.
What is the minimum number of service endpoints and service endpoint policies you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Case Study 1 - Litware. Inc
Overview
Litware. Inc. is a financial company that has a main datacenter in Boston and 20 branch offices across the United States. Users have Android, iOS, and Windows 10 devices.
Existing Environment:
Hybrid Environment
The on-prernises network contains an Active Directory forest named litwareinc.com that syncs to an Azure Active Directory (Azure AD) tenant named litwareinc.com by usinq Azure AD Connect.
All the offices connect to a virtual network named Vnetl by using a Site-to-Site VPN connection.
Azure Environment
Litware has an Azure subscription named Sub1 that is linked to the litwareinc.com Azure AD tenant. Sub1 contains resources in the East US Azure region as shown in the following table.
A diagram of the resource in the East US Azure region is shown in the Network Diagram exhibit.
There is bidirectional peering between Vnet1 and Vnet2. There is bidirectional peering between Vnet1 and Vnet3. Currently, Vnet2 and Vnet3 cannot communicate directly.
Azure Environment Diagram
Requirements:
Business Requirements
Litware wants to minimize costs whenever possible, as long as all other requirements are met.
Virtual Networking Requirements
Litware identifies the following virtual networking requirements:
- Direct the default route of 0.0.0.0/0 on Vnet2 and Vnet3 to the
Boston datacenter over an ExpressRoute circuit.
- Ensure that the records in the cloud.litwareinc.com zone can be
resolved from the on-premises locations.
- Automatically register the DNS names of Azure virtual machines to the cloud.litwareinc.com zone.
- Minimize the size of the subnets allocated to platform-managed
services.
- Allow traffic from VMScaleSet1 to VMScaleSet2 on the TCP port 443
only.
Hybrid Networking Requirements
Litware identifies the following hybrid networking requirements:
- Users must be able to connect to Vnet1 by using a Point-to-Site (P2S) VPN when working remotely. Connections must be authenticated by Azure AD.
- Latency of the traffic between the Boston datacenter and all the
virtual networks must be minimized.
- The Boston datacenter must connect to the Azure virtual networks by
using an ExpressRoute FastPath connection.
- Traffic between Vnet2 and Vnet3 must be routed through Vnet1.
PaaS Networking Requirements
Litware identifies the following networking requirements for platform as a service (PaaS):
- The storage1 account must be accessible from all on-premises
locations without exposing the public endpoint of storage1.
- The storage2 account must be accessible from Vnet2 and Vnet3 without
exposing the public endpoint of storage2.
Drag and Drop Question
You need to prepare Vnet1 for the deployment of an ExpressRoute gateway.
The solution must meet the hybrid connectivity requirements and the business requirements.
Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Overview
Litware. Inc. is a financial company that has a main datacenter in Boston and 20 branch offices across the United States. Users have Android, iOS, and Windows 10 devices.
Existing Environment:
Hybrid Environment
The on-prernises network contains an Active Directory forest named litwareinc.com that syncs to an Azure Active Directory (Azure AD) tenant named litwareinc.com by usinq Azure AD Connect.
All the offices connect to a virtual network named Vnetl by using a Site-to-Site VPN connection.
Azure Environment
Litware has an Azure subscription named Sub1 that is linked to the litwareinc.com Azure AD tenant. Sub1 contains resources in the East US Azure region as shown in the following table.
A diagram of the resource in the East US Azure region is shown in the Network Diagram exhibit.
There is bidirectional peering between Vnet1 and Vnet2. There is bidirectional peering between Vnet1 and Vnet3. Currently, Vnet2 and Vnet3 cannot communicate directly.
Azure Environment Diagram
Requirements:
Business Requirements
Litware wants to minimize costs whenever possible, as long as all other requirements are met.
Virtual Networking Requirements
Litware identifies the following virtual networking requirements:
- Direct the default route of 0.0.0.0/0 on Vnet2 and Vnet3 to the
Boston datacenter over an ExpressRoute circuit.
- Ensure that the records in the cloud.litwareinc.com zone can be
resolved from the on-premises locations.
- Automatically register the DNS names of Azure virtual machines to the cloud.litwareinc.com zone.
- Minimize the size of the subnets allocated to platform-managed
services.
- Allow traffic from VMScaleSet1 to VMScaleSet2 on the TCP port 443
only.
Hybrid Networking Requirements
Litware identifies the following hybrid networking requirements:
- Users must be able to connect to Vnet1 by using a Point-to-Site (P2S) VPN when working remotely. Connections must be authenticated by Azure AD.
- Latency of the traffic between the Boston datacenter and all the
virtual networks must be minimized.
- The Boston datacenter must connect to the Azure virtual networks by
using an ExpressRoute FastPath connection.
- Traffic between Vnet2 and Vnet3 must be routed through Vnet1.
PaaS Networking Requirements
Litware identifies the following networking requirements for platform as a service (PaaS):
- The storage1 account must be accessible from all on-premises
locations without exposing the public endpoint of storage1.
- The storage2 account must be accessible from Vnet2 and Vnet3 without
exposing the public endpoint of storage2.
Drag and Drop Question
You need to prepare Vnet1 for the deployment of an ExpressRoute gateway.
The solution must meet the hybrid connectivity requirements and the business requirements.
Which three actions should you perform in sequence for Vnet1? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Correct Answer:
Explanation:
Step 1: Delete the VPN GW1.
The existing VPN GW1 GatewaySubnet is too small with /29.
Users must be able to connect to Vnet1 by using a Point-to-Site (P2S) VPN when working remotely. Connections must be authenticated by Azure AD.
Litware wants to minimize costs whenever possible, as long as all other requirements are met.
Step 2: Set the subnet mask of Gateway Subnet to /27.
When you create the gateway subnet, you specify the number of IP addresses that the subnet contains. The number of IP addresses needed depends on the VPN gateway configuration that you want to create. Some configurations require more IP addresses than others. We [Microsoft] recommend that you create a gateway subnet that uses a /27 or /28.
It's best to specify /27 or larger (/26,/25 etc.). This allows enough IP addresses for future changes, such as adding an ExpressRoute gateway.
Step 3: Create a VPN gateway by using Basic SKU.
Basic SKU is good enough.
Note:
The Basic gateway SKU does not support IKEv2 or RADIUS authentication. If you plan on having Mac clients connect to your virtual network, do not use the Basic SKU.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal
Hotspot Question
You have two on-premises networks named Network1 and Network2. Network1 is assigned an IP address space of 10.0.0.0/23. Network2 is assigned an IP address space of 10.10.0.0/24. Each on-premises network contains a policy-based VPN device.
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.
VNet1 is assigned an IP address space of 192.168.0.0/22. VNet2 is assigned an IP address space of 172.16.0.0/24. VNet1 peers with VNet2.
You need to configure connectivity to meet the following requirements:
- Ensure that packets from Network1 can be routed to VNet1 and VNet2.
- Ensure that packets from Network2 can be routed to VNet1 and VNet2.
- Minimize administrative effort.
- Minimize costs.
What is the minimum number of Azure VPN gateways and traffic selectors you should deploy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have two on-premises networks named Network1 and Network2. Network1 is assigned an IP address space of 10.0.0.0/23. Network2 is assigned an IP address space of 10.10.0.0/24. Each on-premises network contains a policy-based VPN device.
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.
VNet1 is assigned an IP address space of 192.168.0.0/22. VNet2 is assigned an IP address space of 172.16.0.0/24. VNet1 peers with VNet2.
You need to configure connectivity to meet the following requirements:
- Ensure that packets from Network1 can be routed to VNet1 and VNet2.
- Ensure that packets from Network2 can be routed to VNet1 and VNet2.
- Minimize administrative effort.
- Minimize costs.
What is the minimum number of Azure VPN gateways and traffic selectors you should deploy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
