View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 281

Which Azure Firewall Premium feature can inspect encrypted HTTPS traffic after decrypting it for security analysis?

1. DNAT
2. TLS inspection
3. Gateway transit
4. Route propagation

Correct Answer: 2
Explanation

Azure Firewall Premium supports TLS inspection for applicable encrypted traffic. The feature allows the firewall to decrypt supported HTTPS traffic, inspect it according to configured security policies, and then establish the encrypted connection toward the destination. This provides deeper visibility than filtering based only on destination IP addresses and ports. TLS inspection requires appropriate certificates and careful planning for trust relationships, application compatibility, privacy requirements, and performance. DNAT performs address translation, gateway transit enables shared gateway connectivity, and route propagation concerns network routing rather than encrypted application inspection.

Question 282

An organization wants a private Azure service to be consumed by customers in other virtual networks through Private Link. What should the service provider expose?

1. Service endpoint
2. Private Link service
3. Public IP prefix
4. Application Security Group

Correct Answer: 2
Explanation

A Private Link service allows a service provider to expose a supported application privately to consumers through Azure Private Link. Consumers can create private endpoints in their own virtual networks and request connections to the provider service. The provider can control connection approval and maintain private service exposure without requiring consumers to access the application through a public endpoint. Service endpoints use a different connectivity model, public IP prefixes reserve public addresses, and Application Security Groups organize network interfaces for NSG rules. Provider designs should include load balancing, approval workflows, DNS, authentication, and authorization.

Question 283

Which ExpressRoute option allows supported Azure resources to communicate with an on-premises network through a more direct data path?

1. Global Reach
2. FastPath
3. Microsoft peering
4. Traffic Manager

Correct Answer: 2
Explanation

ExpressRoute FastPath provides a more direct data path for supported traffic between an on-premises network and Azure virtual network resources. It can reduce certain gateway data-path processing and may improve latency or throughput for appropriate workloads. Global Reach connects on-premises networks through ExpressRoute, Microsoft peering provides access to supported Microsoft services, and Traffic Manager performs DNS-based endpoint routing. FastPath is subject to specific gateway, resource, and architecture requirements. Before deployment, administrators should verify feature support and ensure that the overall routing design remains consistent with the intended connectivity model.

Question 284

Which Application Gateway component contains the servers that can receive requests from clients?

1. Backend pool
2. Listener
3. SSL policy
4. Health probe

Correct Answer: 1
Explanation

An Application Gateway backend pool contains the supported backend targets that can receive application requests. The listener accepts incoming traffic on a configured frontend IP, port, and protocol, while routing rules determine how requests are forwarded. Health probes evaluate backend availability, and SSL policies control supported TLS behavior. Backend pools can be designed around application services, virtual machines, scale sets, or other supported targets. Administrators should combine backend pools with suitable HTTP settings, health probes, routing rules, and availability requirements so traffic reaches the intended application instances.

Question 285

Which Azure Traffic Manager routing method is specifically designed to provide ordered endpoint failover?

1. Weighted
2. Priority
3. Geographic
4. Multivalue

Correct Answer: 2
Explanation

Traffic Manager priority routing uses an ordered list of endpoints and directs DNS responses toward the highest-priority healthy endpoint. If that endpoint becomes unavailable according to the configured health-monitoring settings, Traffic Manager can select a lower-priority endpoint. This makes the method useful for active-passive application designs and controlled failover scenarios. Weighted routing distributes responses according to assigned weights, geographic routing uses geographic mappings, and multivalue routing can return multiple healthy endpoints. Administrators should also account for DNS caching and endpoint monitoring intervals when planning expected failover behavior.

Question 286

Which Azure networking feature allows an administrator to create a logical group of virtual networks and apply a common connectivity configuration to that group?

1. Azure Network Manager network group
2. Azure Firewall DNAT
3. Traffic Manager profile
4. ExpressRoute circuit

Correct Answer: 1
Explanation

Azure Virtual Network Manager network groups allow administrators to organize virtual networks into logical collections. Connectivity and security configurations can then be applied to appropriate groups rather than being configured individually for every virtual network. This can simplify administration in environments with many networks and subscriptions. Azure Firewall DNAT performs destination translation, Traffic Manager manages DNS-based traffic distribution, and ExpressRoute provides private hybrid connectivity. Network groups should be designed around meaningful organizational or application boundaries, with clear membership rules and appropriate controls to prevent unintended connectivity between unrelated environments.

Question 287

Which Azure Load Balancer feature allows a frontend port to map traffic to a different backend port?

1. Load-balancing rule
2. Private DNS link
3. Application rule
4. BGP session

Correct Answer: 1
Explanation

An Azure Load Balancer load-balancing rule defines how traffic arriving on a frontend IP configuration and port is distributed to a backend pool and backend port. This allows the frontend and backend port configurations to differ when required by the application architecture. Private DNS links associate DNS zones with virtual networks, application rules provide Azure Firewall application filtering, and BGP sessions exchange routing information. When creating a load-balancing rule, administrators should verify the protocol, frontend configuration, backend port, health probe, and backend pool so traffic is distributed correctly.

Question 288

A company wants Azure workloads to resolve internal names hosted on its corporate DNS servers. Which Azure DNS Private Resolver configuration supports this requirement?

1. Outbound endpoint with forwarding rules
2. Inbound endpoint only
3. Public IP prefix
4. Application Gateway listener

Correct Answer: 1
Explanation

An Azure DNS Private Resolver outbound endpoint can forward DNS queries toward corporate or other external DNS servers when appropriate forwarding rules are configured. This supports hybrid name-resolution architectures where Azure workloads need to resolve names hosted outside Azure. An inbound endpoint is primarily used to receive DNS queries from external clients into the Azure DNS resolution environment. Public IP prefixes manage public addresses, while Application Gateway listeners process application requests. A reliable hybrid DNS design should include network reachability, forwarding rules, DNS server availability, and clear ownership of each namespace.

Question 289

Which Azure VPN Gateway capability allows dynamic route exchange with an on-premises VPN device?

1. BGP
2. NAT
3. DNS proxy
4. Connection draining

Correct Answer: 1
Explanation

Border Gateway Protocol, or BGP, can be enabled with supported Azure VPN Gateway configurations to exchange routes dynamically with compatible on-premises devices. Dynamic routing can reduce the need to maintain static routes manually and can help propagate changes as network prefixes are added or removed. NAT performs address translation, DNS proxy manages DNS forwarding through supported firewall configurations, and connection draining is an Application Gateway capability. BGP deployments should use carefully planned autonomous system numbers, advertised prefixes, peer addresses, route policies, and redundancy mechanisms.

Question 290

Which Azure service provides global HTTP and HTTPS traffic distribution while operating at the application layer?

1. Azure Load Balancer
2. Azure Front Door
3. Azure Route Server
4. Azure NAT Gateway

Correct Answer: 2
Explanation

Azure Front Door provides global application delivery for HTTP and HTTPS workloads and operates at Layer 7. It can route client requests to origins according to configured routing and health information and can provide additional capabilities such as caching, TLS termination, and supported security features. Azure Load Balancer primarily distributes Layer 4 TCP and UDP traffic, Route Server provides dynamic route exchange, and NAT Gateway manages outbound source translation. Front Door deployments should protect origins appropriately and consider routing, certificates, health probes, caching, and application security requirements.

Question 291

Which Azure service can monitor the availability of a backend endpoint and use the result when selecting an origin for application traffic?

1. Azure Front Door
2. Azure Route Server
3. Azure NAT Gateway
4. Azure Bastion

Correct Answer: 1
Explanation

Azure Front Door uses health probes to determine the availability of configured origins within an origin group. The health information can influence which origin receives application traffic, helping Front Door avoid routing requests toward unavailable backends. Route Server manages BGP route exchange, NAT Gateway provides outbound connectivity, and Bastion provides administrative access to virtual machines. Health probes should use an endpoint that accurately represents application availability rather than simply confirming that a server responds at the network level. Probe frequency, protocol, path, and expected status should be selected carefully.

Question 292

Which Azure Firewall rule type is used to translate an incoming public destination address and port to a private backend resource?

1. Application rule
2. Network rule
3. DNAT rule
4. Security admin rule

Correct Answer: 3
Explanation

Azure Firewall DNAT rules translate incoming destination addresses and ports so that traffic received through a public firewall address can be forwarded toward a private backend resource. This is useful when controlled inbound access to an internal service is required. Application rules provide application-layer filtering, network rules control network traffic based on addresses and ports, and security admin rules belong to Azure Virtual Network Manager. DNAT should be tightly restricted by source, destination, and port requirements. Administrators should also ensure that backend NSGs, routing, logging, and application authentication provide additional protection.

Question 293

Which Azure service provides a dedicated private IP address for a supported PaaS resource inside a consumer virtual network?

1. Private endpoint
2. Traffic Manager
3. Public IP prefix
4. Route Server

Correct Answer: 1
Explanation

An Azure private endpoint creates a network interface with a private IP address inside the consumer virtual network and connects it to a supported service through Azure Private Link. Applications can use the private address while maintaining private connectivity to the service. Traffic Manager performs DNS-based endpoint selection, public IP prefixes reserve public address ranges, and Route Server manages BGP route exchange. Private endpoint deployments require appropriate DNS resolution because applications generally continue using the service’s hostname while DNS maps that hostname to the private endpoint address. Access controls and service approval should also be configured.

Question 294

Which Azure Network Watcher feature captures network traffic from a virtual machine network interface for troubleshooting?

1. Connection Monitor
2. Packet Capture
3. Next Hop
4. IP flow verify

Correct Answer: 2
Explanation

Network Watcher Packet Capture records network traffic associated with a virtual machine network interface so administrators can analyze communication behavior during troubleshooting. It can help investigate unexpected packets, application connectivity issues, protocol behavior, or suspected network problems. Connection Monitor focuses on ongoing connectivity monitoring, Next Hop evaluates routing decisions, and IP flow verify determines whether traffic is allowed or denied by effective security rules. Packet captures should be collected for a defined troubleshooting purpose and managed carefully because captured traffic may contain sensitive information.

Question 295

Which Azure security capability can apply organization-wide network security rules that take precedence over certain workload-level NSG configurations?

1. Azure Virtual Network Manager security admin rules
2. Traffic Manager priority
3. Private DNS zone links
4. ExpressRoute FastPath

Correct Answer: 1
Explanation

Azure Virtual Network Manager security administration capabilities can provide centrally managed security rules that apply across selected virtual networks and can help enforce organizational security requirements. Security administration rules are designed for centralized governance and can complement workload-level Network Security Groups. Traffic Manager priority controls endpoint selection, Private DNS links provide DNS zone association, and ExpressRoute FastPath concerns network data-path optimization. Centralized security rules should be designed carefully because administrators need to understand their precedence and interaction with NSGs. Clear ownership and change-management processes are important for preventing unexpected connectivity restrictions.

Question 296

Which Azure Load Balancer feature allows administrators to define a specific frontend IP address that receives client connections?

1. Frontend IP configuration
2. Backend health probe
3. Application rule
4. BGP peer

Correct Answer: 1
Explanation

A Load Balancer frontend IP configuration defines the IP address through which clients or other network resources access the load-balanced service. Depending on the deployment, the frontend can use a public or private IP configuration. The load-balancing rules then associate the frontend with backend pools and ports, while health probes determine backend availability. Backend health probes do not provide the client-facing address, application rules belong to firewall filtering, and BGP peers exchange routes. Administrators should choose frontend configurations according to whether the service requires internal access, public access, or both.

Question 297

Which Azure network architecture uses a central virtual network for shared connectivity and separate virtual networks for application workloads?

1. Hub-and-spoke
2. Full mesh Internet
3. Single flat network
4. Public endpoint architecture

Correct Answer: 1
Explanation

A hub-and-spoke architecture uses a central hub virtual network for shared services and connectivity while placing application workloads into separate spoke virtual networks. The hub can host services such as Azure Firewall, VPN Gateway, ExpressRoute Gateway, DNS infrastructure, and other shared components. Spokes can be isolated according to application or organizational requirements while still receiving approved connectivity through the hub. The architecture requires careful address planning, routing, security controls, gateway configuration, and availability design. It is especially useful when centralized governance and reusable network services are important.

Question 298

Which Azure service can reserve a contiguous range of public IPv4 addresses for an organization?

1. Public IP prefix
2. Private endpoint
3. Application Security Group
4. Route Server

Correct Answer: 1
Explanation

A public IP prefix reserves a contiguous range of public IP addresses that can be allocated to supported Azure resources. Using a prefix can simplify public address management when multiple resources need predictable addresses from the same range. Private endpoints provide private connectivity to supported services, Application Security Groups organize network interfaces for NSG rules, and Route Server provides dynamic route exchange. Public IP resources should be assigned only where necessary and protected through appropriate network security controls. Address allocation should also be documented so administrators can track which services use each reserved address.

Question 299

Which Azure networking service can provide private connectivity to Microsoft services through an ExpressRoute circuit using Microsoft peering?

1. ExpressRoute
2. Azure Bastion
3. Azure Load Balancer
4. Network Watcher

Correct Answer: 1
Explanation

ExpressRoute supports Microsoft peering for supported Microsoft services and destinations over an ExpressRoute circuit. This provides private connectivity without relying on the public Internet for the applicable traffic. ExpressRoute also supports private peering for Azure virtual network connectivity, while Bastion provides virtual machine administration, Load Balancer distributes network traffic, and Network Watcher provides diagnostics. Microsoft peering requires appropriate route advertisement and service configuration. Organizations should carefully review supported services, routing requirements, security policies, and circuit design before using Microsoft peering for production connectivity.

Question 300

A company is designing a hybrid network and wants private connectivity, dynamic routing, centralized security inspection, and resilient connectivity. Which combination best addresses these requirements?

1. Public IPs on every workload with no firewall
2. ExpressRoute or VPN with BGP, centralized firewall inspection, and redundant paths
3. Traffic Manager with only one regional endpoint
4. Private DNS without any routing infrastructure

Correct Answer: 2
Explanation

A resilient hybrid architecture can combine ExpressRoute or VPN connectivity with BGP for dynamic route exchange, centralized firewall inspection for security enforcement, and redundant connectivity paths for improved availability. ExpressRoute can provide private connectivity, while VPN can provide encrypted connectivity and serve as an alternative or backup path in appropriate designs. Centralized firewall inspection adds policy control, and redundancy reduces dependence on a single connection or component. Traffic Manager and Private DNS address different requirements and cannot independently provide the complete hybrid routing, security, and resilience architecture described.