View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 201

Which Azure service can provide private connectivity between a virtual network and a supported Azure service by using a private IP address?

1. Azure Traffic Manager
2. Azure Private Link
3. Azure Bastion
4. Azure Route Server

Correct Answer: 2
Explanation

Azure Private Link provides private connectivity between a virtual network and supported Azure services through private endpoints. A private endpoint creates a network interface with a private IP address in the consumer virtual network. This allows applications to access the service through private networking rather than relying on a publicly reachable endpoint. Traffic Manager provides DNS-based routing, Bastion provides administrative access, and Route Server supports dynamic routing. Private Link deployments should also include appropriate DNS resolution, subnet planning, service permissions, and security controls.

Question 202

A company has several virtual networks that need to communicate with each other while maintaining centralized control over network connectivity. Which Azure service can help manage this architecture?

1. Azure Network Watcher
2. Azure DNS
3. Azure Virtual Network Manager
4. Azure Bastion

Correct Answer: 3
Explanation

Azure Virtual Network Manager provides centralized management of connectivity configurations across multiple virtual networks. Administrators can organize virtual networks into network groups and apply connectivity configurations to those groups. This can simplify network administration in environments with many subscriptions, regions, or application teams. Network Watcher focuses on diagnostics, Azure DNS provides name resolution, and Bastion provides secure administrative connectivity. Virtual Network Manager should be designed with clear network group membership, connectivity requirements, security boundaries, address planning, and organizational ownership.

Question 203

Which Azure Load Balancer feature can be used to monitor backend instances and determine whether they should receive new connections?

1. Health probe
2. Public IP prefix
3. Route table
4. Private DNS zone

Correct Answer: 1
Explanation

A Load Balancer health probe checks the availability of backend instances using a configured protocol, port, and probe path where applicable. The load balancer uses the probe status to determine which backend instances are eligible to receive new traffic. Public IP prefixes manage public address ranges, route tables control IP routing, and private DNS zones provide name resolution. Health probes should test a meaningful service endpoint and be configured with appropriate intervals and thresholds. Incorrect probe settings can cause healthy resources to be removed from service unnecessarily.

Question 204

Which Azure networking architecture can centralize Internet traffic inspection for multiple spoke virtual networks?

1. Single-subnet architecture
2. Public-only architecture
3. Hub-and-spoke with Azure Firewall
4. Independent Internet connections

Correct Answer: 3
Explanation

A hub-and-spoke architecture with Azure Firewall in the hub can centralize inspection of Internet-bound traffic from multiple spoke networks. User-defined routes can direct selected traffic from the spokes toward the firewall for policy enforcement and monitoring. This approach can provide stronger centralized governance than allowing each workload to connect directly to the Internet. The design should account for routing symmetry, firewall policies, DNS resolution, availability, and return traffic. Spoke networks can remain logically separated while still using approved centralized security services.

Question 205

Which Azure VPN connectivity option is designed to connect an entire on-premises network to an Azure virtual network through an encrypted tunnel?

1. Point-to-site VPN
2. Site-to-site VPN
3. Azure Front Door
4. ExpressRoute Global Reach

Correct Answer: 2
Explanation

A site-to-site VPN creates an encrypted connection between an on-premises network and an Azure virtual network through VPN gateways. It is commonly used when multiple systems in a branch or corporate network need access to Azure resources without configuring individual VPN clients on every device. Point-to-site VPN is intended for individual client devices, Front Door provides global web delivery, and ExpressRoute Global Reach serves different private connectivity scenarios. Site-to-site VPN design should include address spaces, gateway configuration, routing, authentication, redundancy, and appropriate security controls.

Question 206

Which Azure Firewall policy rule category is designed to control traffic using source and destination IP addresses, ports, and protocols?

1. Application rule
2. DNAT rule
3. Network rule
4. DNS forwarding rule

Correct Answer: 3
Explanation

Azure Firewall network rules control traffic using network-level attributes such as source addresses, destination addresses, ports, and protocols. They are useful when administrators need to permit or deny network flows without relying on application-layer FQDN matching. Application rules provide application-aware filtering for supported protocols, DNAT rules translate incoming destination addresses, and DNS forwarding is a name-resolution function. Network rules should be narrowly scoped to required communication and reviewed regularly. Logging and monitoring can help administrators identify unused or unexpectedly broad rules.

Question 207

Which Azure networking service provides a global Layer 7 entry point for HTTP and HTTPS applications?

1. Azure Front Door
2. Azure Route Server
3. Azure NAT Gateway
4. Azure Network Watcher

Correct Answer: 1
Explanation

Azure Front Door provides global Layer 7 application delivery for HTTP and HTTPS workloads. It can route client requests to configured origins and use health information to avoid unavailable backends. Depending on the configuration, Front Door can also provide caching, TLS termination, rules processing, and web application security capabilities. Route Server manages BGP route exchange, NAT Gateway provides outbound source translation, and Network Watcher provides diagnostics. Front Door deployments should consider origin security, health probes, routing behavior, custom domains, certificates, caching, and regional availability requirements.

Question 208

Which Azure networking capability can reserve multiple contiguous public IP addresses for use by supported resources?

1. Network Security Group
2. Public IP prefix
3. Application Security Group
4. Private DNS zone

Correct Answer: 2
Explanation

A public IP prefix reserves a contiguous range of public IP addresses that can be allocated to supported Azure resources. This makes public IP planning more predictable when an organization expects to deploy multiple Internet-facing endpoints. Network Security Groups control network traffic, Application Security Groups organize workload interfaces for security rules, and private DNS zones provide internal name resolution. Public addresses should be assigned only where required and protected using appropriate security controls. Administrators should document address ownership and allocation to avoid unnecessary exposure or inefficient address management.

Question 209

An administrator wants to determine whether a TCP connection is being blocked by an effective NSG rule. Which Network Watcher feature should be used?

1. Next hop
2. Packet capture
3. IP flow verify
4. Topology

Correct Answer: 3
Explanation

Network Watcher IP flow verify evaluates whether a specific traffic flow is allowed or denied by the effective network security configuration. Administrators can specify the source, destination, protocol, and port to investigate a particular connection. Next hop identifies routing behavior, Packet Capture records network traffic for deeper analysis, and Topology provides a visual representation of network resources. IP flow verify is useful for quickly determining whether an NSG rule is responsible for a connectivity problem before making changes to production security configurations.

Question 210

Which Azure service can provide managed outbound connectivity for resources in a subnet while allowing multiple public IP addresses to be used for SNAT?

1. Azure Bastion
2. Azure Route Server
3. Azure NAT Gateway
4. Azure DNS Private Resolver

Correct Answer: 3
Explanation

Azure NAT Gateway provides managed outbound Internet connectivity for resources in an associated subnet. Multiple public IP addresses or a public IP prefix can be associated with a NAT Gateway, providing scalable source network address translation for outbound connections. Bastion provides secure administrative access, Route Server handles dynamic routing, and DNS Private Resolver handles DNS resolution. NAT Gateway is useful for workloads that need predictable outbound addresses and substantial outbound connection capacity. It does not provide unsolicited inbound Internet connectivity to the private resources in the subnet.

Question 211

Which Azure feature allows a service provider to make its own application available privately to approved consumers through Azure Private Link?

1. Private Link service
2. Azure Traffic Manager
3. Azure Bastion
4. Azure DNS

Correct Answer: 1
Explanation

Private Link service allows a service provider to expose a supported service privately to consumers through Azure Private Link. Consumers can create private endpoints in their own virtual networks and request connections to the provider service. The provider can manage connection approvals and control which consumers are allowed to connect. Traffic Manager provides DNS-based application routing, Bastion provides administrative access, and Azure DNS handles name resolution. Provider architectures should consider load balancing, private IP addressing, connection approval, DNS integration, authentication, authorization, and monitoring.

Question 212

Which Azure service can exchange routes dynamically with a supported network virtual appliance by using BGP?

1. Azure Front Door
2. Azure Route Server
3. Azure Load Balancer
4. Azure Private DNS

Correct Answer: 2
Explanation

Azure Route Server provides managed BGP route exchange between Azure virtual networks and supported network virtual appliances. It allows appliances to advertise routes dynamically and learn applicable Azure routes, reducing dependence on manually maintained static routes in supported architectures. Front Door provides global application delivery, Load Balancer distributes network traffic, and Private DNS handles name resolution. Route Server deployments require careful planning of BGP peer configuration, advertised prefixes, route selection, appliance behavior, redundancy, and security inspection paths to ensure that dynamic routing produces the intended traffic flow.

Question 213

Which Azure DNS Private Resolver endpoint is intended to receive DNS queries from clients such as on-premises DNS servers?

1. Outbound endpoint
2. Inbound endpoint
3. Frontend endpoint
4. Gateway endpoint

Correct Answer: 2
Explanation

An inbound endpoint for Azure DNS Private Resolver receives DNS queries from external DNS infrastructure, such as on-premises DNS servers, allowing those queries to be resolved using Azure’s private DNS architecture. An outbound endpoint is used when Azure DNS queries need to be forwarded to external DNS servers. Frontend and gateway endpoint are not the relevant Private Resolver endpoint types. Hybrid DNS designs should define which systems initiate queries, how networks reach the endpoints, which forwarding rulesets are used, and which private zones contain the required records.

Question 214

Which Azure Application Gateway capability allows traffic for different URL paths to be sent to different backend pools?

1. Path-based routing
2. BGP routing
3. Gateway transit
4. SNAT

Correct Answer: 1
Explanation

Application Gateway path-based routing allows requests with different URL paths to be directed to separate backend pools. For example, requests to one application path can be sent to one backend service while another path is handled by a different service. This capability is useful for applications that expose multiple services through a common entry point. BGP routing belongs to dynamic network routing, gateway transit supports shared gateways across peered networks, and SNAT changes source addresses. Path rules should be ordered and tested carefully to prevent unexpected routing.

Question 215

Which Azure networking option allows a peered spoke virtual network to use a VPN gateway deployed in a central hub?

1. Service endpoint
2. Gateway transit
3. Private endpoint
4. NAT Gateway

Correct Answer: 2
Explanation

Gateway transit allows a virtual network that is peered with a hub to use the hub’s VPN or ExpressRoute gateway for supported connectivity scenarios. This is commonly used in hub-and-spoke architectures where hybrid connectivity is centralized. Service endpoints provide optimized access to supported Azure services, private endpoints provide private service connectivity, and NAT Gateway provides outbound Internet translation. Gateway transit requires appropriate peering settings on both virtual networks and should be combined with correct route propagation, address planning, and security rules to ensure the spoke can reach the intended external networks.

Question 216

Which Azure security feature can represent a logical application tier in an NSG rule without requiring individual VM IP addresses?

1. Public IP prefix
2. Application Security Group
3. Route table
4. Traffic Manager

Correct Answer: 2
Explanation

Application Security Groups allow administrators to group network interfaces according to application roles and reference those groups in Network Security Group rules. For example, an application-tier ASG can be permitted to communicate with a database-tier ASG on a specific port. This approach makes security rules easier to maintain when virtual machines are added, removed, or reassigned. Public IP prefixes manage public addresses, route tables control routing, and Traffic Manager provides DNS-based traffic distribution. ASGs should be combined with narrowly scoped ports, protocols, and appropriate security boundaries.

Question 217

Which Azure networking service provides a managed way to monitor connectivity between application endpoints over time?

1. Network Watcher Connection Monitor
2. Azure Bastion
3. Azure Firewall Manager
4. Azure Traffic Manager

Correct Answer: 1
Explanation

Network Watcher Connection Monitor provides ongoing connectivity monitoring between supported source and destination endpoints. It can help identify reachability problems and performance changes across network paths. This is useful for monitoring important application dependencies after deployment rather than relying only on one-time troubleshooting tests. Bastion provides administrative connectivity, Firewall Manager manages security policies, and Traffic Manager provides DNS-based application routing. Connection Monitor should be configured around meaningful application paths and combined with alerting and operational procedures so that detected connectivity issues can be investigated promptly.

Question 218

Which Azure networking feature can modify HTTP request or response headers as part of Front Door edge processing?

1. Rules engine
2. Network Security Group
3. Route Server
4. NAT Gateway

Correct Answer: 1
Explanation

Azure Front Door rules engine functionality can apply configured actions to requests and responses at the edge, including supported header modifications. This can help organizations implement certain request transformation, redirect, or routing behaviors without changing backend application code. Network Security Groups control network traffic, Route Server exchanges network routes, and NAT Gateway provides outbound source translation. Rules should be designed carefully because multiple actions can interact with one another. Administrators should test changes against production-like requests to ensure headers and URLs are modified as intended.

Question 219

Which Azure networking service provides a private DNS resolution mechanism that can be linked to multiple virtual networks?

1. Azure Private DNS
2. Azure Load Balancer
3. Azure Route Server
4. Azure Firewall Manager

Correct Answer: 1
Explanation

Azure Private DNS provides private DNS zones that can be linked to virtual networks, allowing resources in those networks to resolve internal host names. This is useful for private applications, internal services, and private endpoint architectures. Load Balancer distributes network traffic, Route Server supports dynamic routing, and Firewall Manager provides centralized firewall policy management. Private DNS designs should consider zone naming, virtual network links, record management, hybrid DNS requirements, and private endpoint integration. Correct DNS configuration is essential because applications may fail even when network routing and security rules are configured correctly.

Question 220

A company wants to improve network availability between Azure and its on-premises environment. Which approach provides a stronger foundation for resilience?

1. Use one VPN connection without failover
2. Use redundant connectivity paths and test failover behavior
3. Assign public IP addresses to all internal servers
4. Disable route monitoring

Correct Answer: 2
Explanation

Redundant connectivity paths can reduce the impact of failures affecting a single circuit, gateway, provider, or network device. Depending on requirements, organizations can combine redundant VPN connections, ExpressRoute circuits, gateways, providers, or regional connectivity paths. Simply assigning public IP addresses does not create resilient private connectivity, and disabling monitoring reduces operational visibility. A resilient hybrid design should include appropriate routing, redundancy, health monitoring, documented failover procedures, and regular testing. Failover testing is particularly important because theoretical redundancy does not guarantee that recovery will work correctly during an actual outage.