View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 261

Which Azure Virtual WAN feature allows Internet-bound traffic to be inspected by a security solution deployed in a secured virtual hub?

1. Routing intent
2. Private DNS linking
3. Public IP prefix
4. Service endpoint

Correct Answer: 1
Explanation

Azure Virtual WAN routing intent can direct Internet-bound traffic through a security solution associated with a secured virtual hub. This provides a centralized approach for inspecting and controlling Internet traffic from connected branches, virtual networks, or other supported connections. Private DNS linking manages name resolution, public IP prefixes reserve public addresses, and service endpoints provide optimized connectivity to supported Azure services. Routing intent should be configured together with the secured virtual hub, firewall policies, route propagation, and connectivity requirements so that traffic follows the intended inspection path without creating routing conflicts.

Question 262

A web application uses several domains, such as contoso.com and fabrikam.com, on the same Application Gateway. Which configuration allows the gateway to distinguish requests by hostname?

1. Multi-site listeners
2. NAT rules
3. Route Server peers
4. Service endpoints

Correct Answer: 1
Explanation

Application Gateway multi-site listeners allow multiple websites with different hostnames to share an Application Gateway. The listener can identify the hostname in an incoming HTTP or HTTPS request and associate it with the appropriate routing configuration. This is useful when several web applications share gateway infrastructure while requiring separate domain names. NAT rules perform address translation, Route Server peers exchange routing information, and service endpoints provide optimized access to supported Azure services. Each hostname should have suitable DNS records, listener settings, certificates, and backend routing configuration.

Question 263

Which Azure Firewall Premium capability can detect suspicious network activity using an intrusion detection and prevention system?

1. IDPS
2. Gateway transit
3. Load balancing
4. Private DNS

Correct Answer: 1
Explanation

Azure Firewall Premium includes an intrusion detection and prevention system capability that can inspect network traffic for known malicious patterns and suspicious activity. IDPS can provide an additional layer of protection beyond traditional firewall allow and deny rules. Gateway transit supports shared gateway connectivity, load balancing distributes traffic across backend resources, and Private DNS handles private name resolution. IDPS configuration should be considered alongside threat intelligence, network rules, application rules, logging, and incident response procedures. Administrators should also evaluate potential performance and false-positive considerations.

Question 264

Which Azure Load Balancer component identifies the collection of virtual machines or other supported resources that can receive traffic from a load-balancing rule?

1. Backend pool
2. DNS zone
3. Route table
4. Firewall policy

Correct Answer: 1
Explanation

An Azure Load Balancer backend pool contains the supported resources that can receive traffic from configured load-balancing rules. The load balancer uses the backend pool together with frontend IP configurations, rules, and health probes to distribute connections. DNS zones provide name resolution, route tables determine network paths, and firewall policies control permitted traffic. A backend pool should contain the resources intended to serve the application or network service. Administrators should also ensure that health probes accurately represent service availability so unhealthy instances do not continue receiving new connections.

Question 265

Which Azure networking option is specifically intended to provide direct private access to a supported Azure service through a private IP address in a virtual network?

1. Private endpoint
2. Traffic Manager
3. Public IP prefix
4. Azure Bastion

Correct Answer: 1
Explanation

A private endpoint creates a private IP address within a virtual network and connects that interface to a supported Azure service through Azure Private Link. Applications can therefore access the service using private addressing rather than depending on public service exposure. Traffic Manager performs DNS-based endpoint routing, public IP prefixes reserve public addresses, and Bastion provides secure virtual machine administration. Private endpoint deployments require careful DNS planning because clients must resolve the service hostname to the private endpoint address. Network access policies and service permissions should also be reviewed.

Question 266

Which Azure DNS Private Resolver component forwards DNS queries from Azure toward external DNS servers such as on-premises DNS infrastructure?

1. Outbound endpoint
2. Inbound endpoint
3. Frontend listener
4. Backend pool

Correct Answer: 1
Explanation

An outbound endpoint is used by Azure DNS Private Resolver to send DNS queries toward external DNS infrastructure according to configured forwarding rules. This is useful in hybrid environments where Azure workloads need to resolve names hosted by on-premises or other external DNS servers. An inbound endpoint performs the opposite direction by receiving queries from external clients. Frontend listeners and backend pools belong to application delivery services. A hybrid DNS architecture should clearly define forwarding rules, DNS zones, network connectivity, and which DNS servers are authoritative for each namespace.

Question 267

An administrator needs to permit HTTPS traffic from a web-tier ASG to a database-related application tier while denying other unnecessary ports. Which Azure feature provides the required rule structure?

1. Network Security Group with Application Security Groups
2. Traffic Manager with priority routing
3. Public IP prefix with NAT
4. Route Server with BGP

Correct Answer: 1
Explanation

Network Security Groups can use Application Security Groups as sources or destinations in security rules. This allows administrators to create rules based on logical application roles rather than maintaining individual IP address lists. For example, an NSG can permit TCP 443 from a web-tier ASG to an application-tier ASG while leaving unrelated ports denied. Traffic Manager manages DNS routing, public IP prefixes reserve addresses, and Route Server exchanges routes. Security rules should follow least privilege by allowing only the protocols, ports, sources, and destinations required by the application.

Question 268

Which ExpressRoute component provides the logical Layer 3 connection used to exchange routes between an ExpressRoute circuit and an Azure virtual network?

1. ExpressRoute virtual network gateway
2. Azure Bastion
3. NAT Gateway
4. Application Gateway

Correct Answer: 1
Explanation

The ExpressRoute virtual network gateway connects an Azure virtual network to an ExpressRoute circuit and participates in the routing architecture required for private connectivity. It works with the ExpressRoute circuit and private peering to establish communication between Azure resources and connected networks. Bastion provides administrative access, NAT Gateway manages outbound source translation, and Application Gateway provides Layer 7 application delivery. Gateway sizing and supported features should be reviewed according to expected traffic, connectivity requirements, redundancy needs, and the broader hybrid network design.

Question 269

Which Azure Traffic Manager routing method can distribute DNS responses according to configured traffic percentages among healthy endpoints?

1. Weighted
2. Priority
3. Multivalue
4. Geographic

Correct Answer: 1
Explanation

Traffic Manager weighted routing distributes DNS responses among healthy endpoints according to configured weights. It can be useful for controlled traffic distribution, gradual migrations, testing, or allocating different proportions of requests to multiple application environments. Priority routing focuses on ordered failover, multivalue routing returns multiple healthy endpoints, and geographic routing uses geographic mappings. Weighted routing still depends on DNS behavior and endpoint health monitoring, so actual client traffic may not exactly match configured percentages. Administrators should monitor the resulting traffic distribution and adjust weights when necessary.

Question 270

Which Azure service provides centralized policy management for Azure Firewall deployments and can also work with supported security partner providers?

1. Azure Firewall Manager
2. Azure Network Watcher
3. Azure DNS Private Resolver
4. Azure Load Balancer

Correct Answer: 1
Explanation

Azure Firewall Manager provides centralized management for Azure Firewall deployments and supports supported security partner provider integrations in applicable network architectures. It can help organizations establish consistent security policies across distributed environments while coordinating security controls across multiple network locations. Network Watcher focuses on diagnostics, DNS Private Resolver handles DNS forwarding and resolution, and Load Balancer distributes network traffic. Centralized policy management is particularly useful in large environments where multiple teams operate separate networks. Governance should define policy ownership, delegated administration, inheritance, and monitoring responsibilities.

Question 271

Which Azure Application Gateway feature can temporarily stop sending new connections to a backend server while allowing existing connections to complete?

1. Connection draining
2. Priority routing
3. Gateway transit
4. IP forwarding

Correct Answer: 1
Explanation

Application Gateway connection draining allows existing connections to a backend server to continue while new requests are prevented from being sent to that backend during supported backend changes. This can help reduce disruption during maintenance, removal, or other backend pool changes. Priority routing is associated with Traffic Manager, gateway transit is used with virtual network peering and shared gateways, and IP forwarding is a network interface capability. Connection draining should be configured with an appropriate timeout based on application behavior so that long-running requests receive sufficient time to complete.

Question 272

Which Azure networking feature allows a virtual network to use a gateway located in another peered virtual network?

1. Gateway transit
2. DNS proxy
3. Service endpoint
4. Public IP prefix

Correct Answer: 1
Explanation

Gateway transit allows a peered virtual network to use a supported VPN or ExpressRoute gateway located in another virtual network. This is commonly used in hub-and-spoke architectures where the hub contains centralized hybrid connectivity while spokes consume that connectivity. DNS proxy handles DNS requests through Azure Firewall, service endpoints provide optimized access to supported Azure services, and public IP prefixes reserve public address ranges. Gateway transit requires appropriate peering configuration and should be planned with route propagation, address spaces, gateway settings, and security policies to ensure the intended connectivity is available.

Question 273

Which Azure Firewall design feature can help prevent unnecessary SNAT for traffic destined for private address ranges?

1. Private IP address ranges configuration
2. Traffic Manager priority
3. Application Gateway listener
4. DNS zone linking

Correct Answer: 1
Explanation

Azure Firewall uses private IP address range configuration to determine which destinations should be treated as private traffic for SNAT behavior. Correctly defining private ranges can help ensure that traffic intended for internal destinations is not unnecessarily source-translated. Traffic Manager priority controls endpoint failover, Application Gateway listeners accept application requests, and DNS zone links associate private DNS zones with virtual networks. Private range configuration is especially important in complex environments containing custom address spaces or nonstandard private ranges. Administrators should review routing and firewall logs when troubleshooting unexpected source address translation.

Question 274

Which Azure service can provide a private, managed connection from a consumer virtual network to a service exposed through a Private Link service?

1. Private endpoint
2. Traffic Manager
3. Azure Bastion
4. Network Watcher

Correct Answer: 1
Explanation

A private endpoint provides the consumer side of an Azure Private Link connection. It creates a network interface with a private IP address in the consumer’s virtual network and connects it to the service exposed by the provider through a Private Link service. Traffic Manager provides DNS-based routing, Bastion provides administrative access, and Network Watcher provides network diagnostics. Private Link deployments require coordination between the service provider and consumer, including connection approval, DNS configuration, access control, and network reachability. This model allows services to be consumed privately without exposing them through public endpoints.

Question 275

Which Azure Load Balancer configuration can distribute inbound traffic using a frontend IP address while using a health probe to exclude unhealthy backend instances?

1. Load-balancing rule
2. DNS forwarding rule
3. Firewall application rule
4. BGP route

Correct Answer: 1
Explanation

An Azure Load Balancer load-balancing rule connects a frontend IP configuration and frontend port to a backend pool and backend port. The rule works with health probes so that unhealthy backend instances can be excluded from receiving new traffic. DNS forwarding rules manage name resolution, firewall application rules control application-level traffic, and BGP routes exchange routing information. A correct load-balancing design should align the frontend and backend ports, protocol, health probe configuration, and backend resources. Administrators should test both healthy and failed backend scenarios before production deployment.

Question 276

Which Azure Virtual WAN architecture provides a Microsoft-managed routing hub that can connect branches, virtual networks, and other supported network resources?

1. Virtual hub
2. Private DNS zone
3. Public IP prefix
4. Application Security Group

Correct Answer: 1
Explanation

An Azure Virtual WAN virtual hub is a Microsoft-managed network hub that provides centralized connectivity and routing for supported connections. It can connect branch sites, virtual networks, VPN connections, ExpressRoute connections, and other supported resources according to the configured architecture. Private DNS zones provide name resolution, public IP prefixes reserve public address ranges, and Application Security Groups organize network interfaces for security rules. Virtual hub planning should consider region placement, routing policies, security inspection, connectivity requirements, address planning, and the expected growth of connected branches and workloads.

Question 277

Which Application Gateway configuration determines the servers to which requests are forwarded after the listener and routing rules are evaluated?

1. Backend pool
2. Public IP prefix
3. Service endpoint
4. Route Server peer

Correct Answer: 1
Explanation

The Application Gateway backend pool defines the backend targets that can receive client requests after the gateway evaluates its listener and routing configuration. Backend pools can contain supported IP addresses, virtual machines, virtual machine scale sets, or other supported targets depending on the deployment. Public IP prefixes reserve public addresses, service endpoints provide Azure service connectivity, and Route Server peers exchange BGP routes. Backend pool design should account for application architecture, health probes, backend settings, TLS requirements, scaling, and availability so requests are sent only to appropriate and healthy application resources.

Question 278

Which Azure VPN architecture can provide connectivity from individual remote users or devices to an Azure virtual network without requiring a site-to-site tunnel for the entire office network?

1. Point-to-site VPN
2. ExpressRoute private peering
3. Traffic Manager
4. Azure Load Balancer

Correct Answer: 1
Explanation

Point-to-site VPN provides encrypted connectivity from individual client devices to an Azure virtual network. It is useful for remote employees, administrators, developers, or other users who need access to Azure resources without connecting an entire physical network through a site-to-site VPN. ExpressRoute private peering serves enterprise private connectivity through an ExpressRoute circuit, while Traffic Manager and Load Balancer provide traffic distribution functions. Point-to-site deployments should include suitable authentication, client configuration, address pools, routing, DNS resolution, and access controls to ensure users receive only the connectivity they require.

Question 279

Which Azure network security mechanism has a default rule set that can be overridden by higher-priority custom rules?

1. Network Security Group
2. Traffic Manager
3. Private DNS
4. ExpressRoute circuit

Correct Answer: 1
Explanation

Network Security Groups contain default security rules, while administrators can create custom rules with higher priority values that are evaluated before those default rules. NSG rules are processed according to priority, with the lowest numerical priority value evaluated first. This allows organizations to create more specific allow or deny rules while retaining default protections where no custom rule applies. Traffic Manager manages DNS traffic distribution, Private DNS provides name resolution, and ExpressRoute provides private connectivity. Administrators should avoid overly broad custom rules and regularly review effective security behavior.

Question 280

A company has an Azure application deployed in two regions and wants DNS-based failover when the primary endpoint becomes unavailable. Which Traffic Manager configuration is suitable?

1. Priority routing with endpoint monitoring
2. Multivalue routing without health checks
3. Weighted routing with equal weights only
4. Geographic routing without endpoint monitoring

Correct Answer: 1
Explanation

Traffic Manager priority routing with endpoint monitoring can provide DNS-based failover between regional application endpoints. The primary endpoint is assigned the highest priority, while another healthy endpoint can serve traffic when the primary becomes unavailable. Endpoint monitoring is important because Traffic Manager needs health information before selecting an available destination. Multivalue routing serves multiple endpoints, weighted routing distributes responses according to weights, and geographic routing maps users to regions. DNS caching can affect failover timing, so administrators should also consider the configured TTL and client resolver behavior.