View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 121

Which Azure service can provide centralized connectivity and routing between multiple Azure virtual networks, branches, and remote users?

1. Azure Virtual WAN
2. Azure DNS
3. Azure Bastion
4. Azure Load Balancer

Correct Answer: 1
Explanation

Azure Virtual WAN provides a managed networking architecture for connecting Azure virtual networks, branch locations, and remote users through virtual hubs. It can simplify large-scale connectivity by providing centralized routing and connectivity management. Organizations can also integrate supported security solutions with Virtual WAN to create secured hub architectures. Azure DNS handles name resolution, Bastion provides administrative access, and Load Balancer distributes traffic. When designing Virtual WAN, administrators should consider hub placement, routing requirements, branch connectivity, security inspection, regional coverage, and expected network growth.

Question 122

An organization wants traffic entering a Virtual WAN hub to be inspected by Azure Firewall before reaching connected networks. Which architecture should be considered?

1. Flat virtual network
2. Secured virtual hub
3. Public DNS zone
4. Standalone subnet

Correct Answer: 2
Explanation

A secured virtual hub integrates Azure Firewall with an Azure Virtual WAN hub to provide centralized security inspection and traffic control. This architecture can help organizations apply consistent security policies to traffic flowing through the hub and connected networks. A flat network does not provide the same centralized structure, while DNS zones and standalone subnets serve different purposes. A secured virtual hub should be designed with appropriate routing intent, firewall policies, connectivity requirements, and regional considerations to ensure traffic follows the intended inspection path.

Question 123

Which Azure networking service is primarily responsible for resolving names for resources that are accessible only through private network addresses?

1. Azure Front Door
2. Azure Private DNS
3. Azure Traffic Manager
4. Azure Load Balancer

Correct Answer: 2
Explanation

Azure Private DNS provides name resolution for private resources within Azure virtual networks. It allows organizations to create private DNS zones and associate them with virtual networks so that workloads can resolve internal names without depending on publicly accessible DNS records. Front Door provides global application delivery, Traffic Manager performs DNS-based endpoint routing, and Load Balancer distributes network traffic. Private DNS should be planned together with private endpoints, virtual network links, hybrid DNS, and record management to ensure that applications consistently resolve the correct private addresses.

Question 124

Which Application Gateway feature can keep existing connections active for a short period when a backend server is being removed from service?

1. Connection draining
2. BGP propagation
3. DNS forwarding
4. SNAT

Correct Answer: 1
Explanation

Connection draining allows Application Gateway to stop sending new connections to a backend instance while allowing existing connections to complete for a configured period. This is useful during maintenance, scaling, or backend replacement because active users can have their existing sessions completed more gracefully. BGP propagation concerns routing, DNS forwarding concerns name resolution, and SNAT translates source addresses. Connection draining should be considered when applications maintain long-lived connections or sessions, particularly during planned deployments where abrupt termination could interrupt active users.

Question 125

Which Azure networking feature allows administrators to associate a security rule with a group of virtual machines based on their application role?

1. Application Security Groups
2. Public IP prefixes
3. Route Server
4. NAT Gateway

Correct Answer: 1
Explanation

Application Security Groups, or ASGs, allow administrators to group virtual machine network interfaces according to application roles and then reference those groups in Network Security Group rules. This can make security policies easier to manage because rules can describe application relationships rather than relying only on individual IP addresses. Public IP prefixes manage public addressing, Route Server supports dynamic routing, and NAT Gateway provides outbound connectivity. ASGs are especially useful in environments where application tiers change over time and security rules should remain aligned with logical workload roles.

Question 126

Which Azure feature can simplify Network Security Group rules by representing groups of Azure service IP addresses with predefined identifiers?

1. Service tags
2. Private endpoints
3. DNS zones
4. Route tables

Correct Answer: 1
Explanation

Service tags represent groups of IP address prefixes associated with Azure services and can be used in supported Network Security Group rules. They reduce the need to manually maintain large lists of service IP addresses when controlling traffic to or from supported Azure services. Private endpoints provide private connectivity, DNS zones manage name resolution, and route tables control network paths. Service tags should still be used carefully because each tag has a defined scope, and administrators should verify that the selected tag represents exactly the traffic that the security policy intends to permit.

Question 127

A security administrator creates two NSG rules with the same direction and matching traffic criteria. One has priority 200 and the other has priority 400. Which rule is evaluated first?

1. Priority 400
2. Priority 600
3. Priority 200
4. Both rules simultaneously

Correct Answer: 3
Explanation

Network Security Group rules are processed according to priority, with lower numerical values evaluated before higher numerical values. Therefore, a rule with priority 200 is evaluated before a rule with priority 400 when both apply to the same traffic direction and conditions. If an applicable rule allows or denies the traffic, later rules may not be reached. Administrators should assign priorities deliberately and maintain clear documentation to avoid accidental access. Default NSG rules are evaluated after custom rules because their priorities are lower in precedence.

Question 128

Which Azure networking capability can provide a visual representation of network resources and their relationships for troubleshooting?

1. Network Watcher topology
2. Traffic Manager
3. Azure DNS
4. NAT Gateway

Correct Answer: 1
Explanation

Network Watcher topology provides a visual representation of resources and network relationships within an Azure subscription or resource group context. It can help administrators understand connections between virtual networks, subnets, network interfaces, virtual machines, and other supported resources. Traffic Manager provides DNS-based routing, Azure DNS manages name resolution, and NAT Gateway provides outbound translation. Topology information is useful during troubleshooting because it can reveal unexpected relationships or missing connectivity components. It should be combined with route, security, and connection diagnostics for deeper investigation.

Question 129

Which Azure networking service can provide a private connection between a consumer virtual network and a privately exposed service owned by another organization?

1. Private Link
2. Azure Bastion
3. Azure Traffic Manager
4. Azure DNS

Correct Answer: 1
Explanation

Azure Private Link allows consumers to privately access supported services through private endpoints. This includes scenarios where a service provider exposes its own service through a Private Link service. The consumer accesses the service using a private IP address from its virtual network rather than depending on public Internet connectivity. Bastion provides virtual machine administration, Traffic Manager provides DNS-based routing, and Azure DNS handles name resolution. Private Link designs should address approval workflows, DNS resolution, access permissions, IP address allocation, and provider-consumer connectivity requirements.

Question 130

Which Azure service provides a managed network address translation function for outbound traffic from a subnet without requiring a public IP on each virtual machine?

1. Azure NAT Gateway
2. Azure Firewall Manager
3. Azure Route Server
4. Azure Bastion

Correct Answer: 1
Explanation

Azure NAT Gateway provides managed source network address translation for outbound Internet traffic from resources in an associated subnet. Virtual machines can use the NAT Gateway’s public IP addresses for outbound connections without requiring individual public IP assignments. Firewall Manager manages security policies and supported firewall deployments, Route Server handles dynamic routing, and Bastion provides administrative access. NAT Gateway is useful when predictable outbound IP addresses and scalable SNAT capacity are needed. Administrators should still control inbound access separately because NAT Gateway does not provide inbound Internet connectivity.

Question 131

Which ExpressRoute component provides the Layer 3 connectivity between an Azure virtual network and an ExpressRoute circuit?

1. ExpressRoute virtual network gateway
2. Application Gateway
3. Azure Bastion
4. Network Watcher

Correct Answer: 1
Explanation

An ExpressRoute virtual network gateway connects an Azure virtual network to an ExpressRoute circuit and enables private connectivity through the ExpressRoute architecture. The gateway participates in the routing process required to exchange network traffic between Azure and the connected private network. Application Gateway provides application-layer traffic distribution, Bastion provides administrative connectivity, and Network Watcher supplies diagnostics. ExpressRoute gateway planning should account for supported gateway SKUs, circuit bandwidth, regional architecture, redundancy, routing requirements, and the number of virtual networks that need connectivity.

Question 132

Which Azure VPN Gateway capability allows an administrator to use BGP to dynamically exchange routes with an on-premises VPN device?

1. BGP
2. DNS forwarding
3. WAF policy
4. Connection draining

Correct Answer: 1
Explanation

VPN Gateway supports Border Gateway Protocol, or BGP, for dynamic route exchange in supported VPN configurations. Instead of relying entirely on manually configured static routes, BGP can advertise and learn routes between Azure and compatible on-premises devices. This can simplify route management in larger hybrid environments and improve adaptability when network prefixes change. DNS forwarding handles name resolution, WAF policies protect web applications, and connection draining manages backend connections. BGP deployments require compatible autonomous system configurations, appropriate peering addresses, and careful route advertisement planning.

Question 133

Which Azure Virtual Network Manager configuration is intended to create connectivity between selected virtual networks?

1. Connectivity configuration
2. Rewrite configuration
3. WAF configuration
4. NAT configuration

Correct Answer: 1
Explanation

Azure Virtual Network Manager connectivity configurations define how selected virtual networks should connect within a managed network architecture. Administrators can use network groups as the scope for applying connectivity configurations, helping standardize network relationships across large environments. Rewrite configurations are associated with application traffic manipulation, WAF configurations protect web applications, and NAT configurations are not the primary Virtual Network Manager connectivity mechanism. Connectivity designs should consider network groups, topology requirements, address spaces, security boundaries, regional scope, and whether networks require full or limited communication.

Question 134

Which Azure Front Door capability can reduce repeated requests to an origin by serving eligible content from edge locations?

1. Caching
2. BGP
3. DNAT
4. Route propagation

Correct Answer: 1
Explanation

Azure Front Door caching allows eligible content to be served from edge locations instead of requiring every request to reach the backend origin. This can reduce origin load and improve response times for cached content distributed across geographically separated users. BGP handles route exchange, DNAT translates destination addresses, and route propagation concerns network routing. Caching behavior depends on request and response characteristics, cache-control settings, and Front Door configuration. Administrators should ensure that only suitable content is cached and that dynamic or sensitive content is handled appropriately.

Question 135

Which Azure Firewall feature allows administrators to organize security policies so that common settings can be inherited by multiple child policies?

1. Policy inheritance
2. DNS autoregistration
3. Connection draining
4. Gateway transit

Correct Answer: 1
Explanation

Azure Firewall Policy supports inheritance, allowing child policies to inherit relevant configurations from a parent policy. This can help organizations establish common security requirements while allowing individual environments or business units to maintain additional rules appropriate to their workloads. DNS autoregistration manages DNS records, connection draining controls backend connection behavior, and gateway transit enables shared gateway access across peered virtual networks. Policy inheritance can improve consistency, but administrators should clearly define ownership, precedence, exceptions, and change-management procedures to prevent unintended security behavior.

Question 136

Which Azure networking design consideration is most important when creating address spaces for several interconnected virtual networks?

1. Use overlapping address ranges whenever possible
2. Ensure address spaces are planned to avoid overlap
3. Assign the same subnet to every workload
4. Avoid documenting IP allocations

Correct Answer: 2
Explanation

Non-overlapping address spaces are essential when designing interconnected Azure virtual networks. Overlapping IP ranges can create routing ambiguity and prevent or complicate connectivity between networks, particularly when using peering, VPN, or ExpressRoute. Address planning should account for current workloads as well as future expansion, hybrid connectivity, subnet requirements, and organizational boundaries. Using identical subnet ranges everywhere can create significant integration problems. A documented IP addressing strategy provides a foundation for scalable routing, security policies, DNS design, and future network expansion.

Question 137

Which Azure Load Balancer option can preserve the original destination IP and port information when forwarding traffic to a backend instance in supported scenarios?

1. Floating IP
2. Weighted routing
3. DNS forwarding
4. Service tagging

Correct Answer: 1
Explanation

Floating IP is an Azure Load Balancer capability that can preserve or provide the frontend IP configuration to the backend in supported scenarios, such as certain network virtual appliance architectures. This can be useful when applications or appliances need to process traffic using the frontend address rather than a translated destination address. Weighted routing is associated with Traffic Manager, DNS forwarding manages name resolution, and service tags simplify NSG rules. Floating IP configurations require careful consideration of backend behavior, health probes, application requirements, and network appliance design.

Question 138

Which Azure networking feature allows a virtual network to use the gateway of a peered virtual network for connectivity to another network?

1. Gateway transit
2. DNS caching
3. WAF prevention
4. Connection monitoring

Correct Answer: 1
Explanation

Gateway transit allows a virtual network that is peered with another virtual network to use the remote network’s VPN or ExpressRoute gateway for supported connectivity scenarios. This can reduce the need to deploy separate gateways in every connected virtual network. The configuration involves appropriate peering settings on both sides and must match the desired gateway architecture. DNS caching, WAF prevention, and connection monitoring address different networking requirements. Gateway transit is particularly useful in hub-and-spoke environments where centralized hybrid connectivity is provided from the hub.

Question 139

Which Azure Front Door feature determines whether an origin is available before directing application traffic to it?

1. Health probes
2. NSG priorities
3. UDRs
4. BGP communities

Correct Answer: 1
Explanation

Azure Front Door uses health probes to evaluate the availability of configured origins. The results help Front Door determine which origins are healthy and eligible to receive traffic according to the configured routing behavior. This supports resilient application delivery when multiple backend origins are available. NSG priorities control network security rule processing, UDRs influence IP routing, and BGP communities are routing attributes rather than Front Door health mechanisms. Health probe paths, intervals, protocols, and expected responses should be configured carefully so that unhealthy origins are detected without creating unnecessary monitoring traffic.

Question 140

A company is designing a hybrid Azure network and needs predictable private connectivity, dynamic routing, and redundant network paths. Which planning approach is most appropriate?

1. Use public IP addresses for all hybrid connections
2. Design ExpressRoute or VPN connectivity with appropriate routing and redundancy
3. Disable route exchange to simplify troubleshooting
4. Place every workload in one subnet

Correct Answer: 2
Explanation

Hybrid network design should account for private connectivity, routing behavior, redundancy, security, and operational requirements. ExpressRoute can provide private connectivity through a provider, while VPN Gateway can provide encrypted connectivity over the Internet. Depending on the architecture, BGP can provide dynamic route exchange and redundant paths can improve resilience. Public IP addresses should not be used as a substitute for appropriate private connectivity, and placing every workload in one subnet reduces segmentation. A well-planned hybrid design should also include DNS, monitoring, failover testing, address planning, and security controls.