View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 301

Which Azure Firewall feature allows DNS queries from clients to be forwarded through the firewall to configured DNS servers?

1. DNS proxy
2. DNAT
3. FastPath
4. Gateway transit

Correct Answer: 1
Explanation

Azure Firewall DNS proxy can receive DNS requests from workloads and forward them to the configured DNS servers. This can help centralize DNS processing and provide more consistent name resolution for workloads that use firewall-based application rules. DNS proxy is different from DNAT, which translates destination addresses, and from FastPath or gateway transit, which address network connectivity and routing. When enabling DNS proxy, administrators should ensure that clients use the firewall as their DNS server and that the configured upstream DNS infrastructure can resolve the required public and private namespaces.

Question 302

An administrator wants to allow an NSG rule to reference several IP addresses without creating a separate rule for every address. Which capability can simplify the rule?

1. Gateway transit
2. Augmented security rules
3. Traffic Manager priority
4. ExpressRoute FastPath

Correct Answer: 2
Explanation

NSG augmented security rules allow supported rules to include multiple IP addresses, address ranges, ports, and related criteria in a more consolidated configuration. This can reduce the number of individual rules required for common security scenarios and make administration easier. Gateway transit provides shared gateway connectivity, Traffic Manager priority controls DNS endpoint selection, and ExpressRoute FastPath improves supported network data paths. Augmented rules should still follow least-privilege principles. Administrators should avoid using broad address ranges when narrower source and destination definitions can provide the required application access.

Question 303

Which Azure service can provide a managed Layer 7 reverse proxy for web applications while supporting features such as SSL termination?

1. Azure Load Balancer
2. Azure Application Gateway
3. Azure Route Server
4. Azure NAT Gateway

Correct Answer: 2
Explanation

Azure Application Gateway is a managed Layer 7 application delivery service that can act as a reverse proxy for web applications. It supports features such as SSL/TLS termination, host-based routing, path-based routing, backend health monitoring, and Web Application Firewall integration. Azure Load Balancer primarily operates at Layer 4, Route Server provides dynamic routing, and NAT Gateway manages outbound connectivity. Application Gateway should be selected when traffic decisions depend on HTTP or HTTPS information. Administrators should plan listeners, certificates, backend settings, health probes, routing rules, and security policies together.

Question 304

Which Azure VPN design can use two separate VPN gateways or connections to reduce dependency on a single connectivity path?

1. Redundant VPN architecture
2. Single-tunnel architecture
3. Public DNS architecture
4. Weighted Traffic Manager architecture

Correct Answer: 1
Explanation

A redundant VPN architecture uses multiple supported connectivity paths to reduce the impact of a single tunnel, gateway, device, or network failure. Depending on the design, organizations can use multiple tunnels, redundant on-premises devices, active-active gateways, or additional connections. This improves resilience when compared with relying on one connectivity path. Public DNS and Traffic Manager solve different problems and do not create VPN redundancy. Redundant designs should include appropriate routing, BGP where applicable, health monitoring, failure detection, and regular failover testing to verify that the backup path operates as expected.

Question 305

Which Azure Front Door feature allows traffic to be sent to different origins according to configured URL routes?

1. Route configuration
2. BGP peering
3. NAT rule
4. NSG priority

Correct Answer: 1
Explanation

Azure Front Door route configuration determines how incoming requests are matched and forwarded to configured origins or origin groups. Routing can use domains and URL paths to direct requests toward the appropriate backend application. This allows a single Front Door profile to support multiple application routes while maintaining a global entry point. BGP peering manages network route exchange, NAT rules translate addresses, and NSG priority controls security-rule evaluation. Administrators should ensure that domains, paths, origins, forwarding protocols, caching behavior, and health monitoring are configured consistently.

Question 306

A company wants Azure Firewall to send traffic through a separate network virtual appliance for additional inspection. Which Azure routing mechanism can direct traffic toward that appliance?

1. User-defined route
2. Traffic Manager
3. Private DNS link
4. Public IP prefix

Correct Answer: 1
Explanation

A user-defined route can specify a network virtual appliance as the next hop for traffic from a subnet. This allows administrators to create controlled traffic paths through an NVA for inspection, filtering, or other network functions. Traffic Manager provides DNS-based endpoint selection, Private DNS links associate DNS zones with virtual networks, and public IP prefixes reserve public address ranges. When routing through an appliance, administrators should verify return routes, IP forwarding, appliance configuration, and network security rules. Asymmetric routing can cause connectivity problems if both directions are not planned correctly.

Question 307

Which Azure service can connect multiple branch locations through a Microsoft-managed WAN architecture instead of requiring a full mesh of individual tunnels?

1. Azure Virtual WAN
2. Azure Bastion
3. Azure Load Balancer
4. Azure Private DNS

Correct Answer: 1
Explanation

Azure Virtual WAN provides a managed networking architecture for connecting branches, virtual networks, VPN connections, and other supported network resources. Its virtual hubs can simplify large-scale branch connectivity by providing managed routing instead of requiring administrators to manually create a direct tunnel between every branch. Bastion provides virtual machine administration, Load Balancer distributes network traffic, and Private DNS handles name resolution. Virtual WAN planning should include hub placement, branch connectivity, routing policies, security inspection, bandwidth requirements, and the expected number of connected sites.

Question 308

Which Azure service can provide private connectivity to a supported PaaS service while allowing the service’s DNS name to resolve to a private address?

1. Private endpoint with private DNS
2. Traffic Manager with weighted routing
3. Public IP prefix with NAT
4. Route Server with BGP

Correct Answer: 1
Explanation

A private endpoint provides a private IP address for supported Azure services, while Azure Private DNS can ensure that the service hostname resolves to that private address from appropriate virtual networks. This combination is common when organizations want applications to continue using familiar service hostnames while keeping network traffic private. Traffic Manager provides DNS-based endpoint distribution, public IP prefixes reserve public addresses, and Route Server supports dynamic routing. The DNS zone must be correctly linked and records must resolve to the intended private endpoint so applications can establish connectivity successfully.

Question 309

Which Azure networking service is designed to analyze the network topology and relationships between Azure resources?

1. Network Watcher
2. NAT Gateway
3. Traffic Manager
4. Azure Firewall Manager

Correct Answer: 1
Explanation

Azure Network Watcher provides network monitoring and diagnostic capabilities, including topology visualization that can help administrators understand relationships between network resources. This can be useful when investigating complex virtual networks, peering relationships, network interfaces, gateways, and other connectivity components. NAT Gateway manages outbound translation, Traffic Manager performs DNS-based traffic routing, and Firewall Manager provides centralized firewall management. Topology information can help validate whether deployed resources match the intended architecture and can reveal unexpected relationships that may contribute to routing or connectivity issues.

Question 310

Which Azure Load Balancer deployment type provides internal access to applications without requiring a public frontend IP address?

1. Internal Load Balancer
2. Public Load Balancer
3. Traffic Manager
4. Front Door

Correct Answer: 1
Explanation

An internal Azure Load Balancer uses a private frontend IP address and distributes traffic to backend resources within private network environments. It is appropriate for applications that should remain accessible only through internal connectivity rather than directly from the public Internet. A public Load Balancer uses a public frontend, while Traffic Manager provides DNS-based endpoint selection and Front Door provides global Layer 7 application delivery. Internal Load Balancers are commonly used for application tiers, internal services, and private architectures. Network security rules and routing should still restrict access to authorized clients.

Question 311

Which Azure VPN Gateway capability can allow supported connections to use two active gateway instances simultaneously?

1. Active-active mode
2. Priority routing
3. Multivalue routing
4. Path-based routing

Correct Answer: 1
Explanation

VPN Gateway active-active mode allows both gateway instances to operate simultaneously for supported configurations. This can improve resilience because connectivity does not depend exclusively on one active gateway instance. It can be particularly useful when paired with redundant on-premises VPN devices and multiple tunnels. Priority routing and multivalue routing are Traffic Manager methods, while path-based routing is associated with application-layer services such as Application Gateway. Administrators should verify compatible gateway SKUs, tunnel configuration, routing behavior, and remote-device support before deploying an active-active architecture.

Question 312

Which Azure Firewall capability can use fully qualified domain names to control outbound access for supported application traffic?

1. Application rules
2. Inbound NAT rules
3. Gateway transit
4. Load-balancing rules

Correct Answer: 1
Explanation

Azure Firewall application rules can use fully qualified domain names and application-level criteria to control supported outbound traffic. This allows administrators to create policies based on destinations such as specific web domains rather than relying solely on destination IP addresses. Inbound NAT rules translate incoming traffic, gateway transit supports shared gateway access, and load-balancing rules distribute connections among backend resources. FQDN-based rules should be carefully scoped to the domains required by applications. DNS architecture, firewall DNS proxy settings, logging, and threat intelligence should also be considered.

Question 313

Which Azure ExpressRoute feature provides a private connection between an on-premises network and supported Microsoft cloud services?

1. Microsoft peering
2. Public DNS
3. Traffic Manager
4. Application Gateway

Correct Answer: 1
Explanation

ExpressRoute Microsoft peering provides private connectivity over an ExpressRoute circuit to supported Microsoft services and destinations. It allows organizations to use an ExpressRoute connection for applicable Microsoft service traffic instead of relying on public Internet connectivity. Application Gateway provides Layer 7 application delivery, Traffic Manager manages DNS-based endpoint selection, and public DNS provides public name resolution. Microsoft peering requires appropriate route advertisements and service configuration. Administrators should review the supported services, routing requirements, security controls, and circuit architecture before enabling Microsoft peering.

Question 314

Which Azure Application Gateway feature allows administrators to configure the TLS versions and cipher suites accepted by the gateway?

1. SSL policy
2. Backend pool
3. Health probe
4. Connection draining

Correct Answer: 1
Explanation

Application Gateway SSL policy controls supported TLS protocol versions and cipher suites for applicable HTTPS listeners. This allows organizations to align gateway encryption settings with security and application compatibility requirements. Backend pools identify destination servers, health probes evaluate backend availability, and connection draining supports graceful backend changes. Administrators should select an SSL policy that provides appropriate security while maintaining compatibility with legitimate clients. Changes should be tested carefully because disabling older protocols or cipher suites can prevent older clients from establishing connections.

Question 315

Which Azure networking service can provide secure connectivity from an individual user’s computer to an Azure virtual network?

1. Point-to-site VPN
2. Public IP prefix
3. Traffic Manager
4. Load Balancer

Correct Answer: 1
Explanation

Point-to-site VPN provides encrypted connectivity from an individual client device to an Azure virtual network. It is commonly used by remote users who need access to private Azure resources without connecting an entire office network. The solution can use supported authentication mechanisms and client VPN configuration. Public IP prefixes manage address ranges, Traffic Manager distributes DNS responses, and Load Balancer distributes network traffic. A point-to-site deployment should include an appropriate client address pool, authentication method, routing, DNS configuration, and NSG policies that restrict users to the resources they actually need.

Question 316

Which Azure Virtual Network Manager security rule type is designed to enforce centrally defined security requirements across selected network resources?

1. Security admin rule
2. Load-balancing rule
3. DNS forwarding rule
4. DNAT rule

Correct Answer: 1
Explanation

Azure Virtual Network Manager security administration rules provide centralized network security governance across selected virtual networks and resources. They can be used to establish organization-wide requirements that complement or govern workload-level NSG configurations. Load-balancing rules distribute network connections, DNS forwarding rules direct name-resolution queries, and DNAT rules translate destination addresses. Security administration rules should be designed with clear priorities and scopes because centralized policies can affect many workloads simultaneously. Administrators should test policy interactions carefully before applying broad security changes to production networks.

Question 317

Which Azure service is designed to provide DNS-based routing between application endpoints rather than directly proxying application traffic?

1. Azure Traffic Manager
2. Azure Application Gateway
3. Azure Front Door
4. Azure Load Balancer

Correct Answer: 1
Explanation

Azure Traffic Manager is a DNS-based traffic distribution service. It responds to DNS queries with endpoint information according to the selected routing method and endpoint health status. Unlike Application Gateway or Front Door, Traffic Manager does not act as a direct application proxy for the subsequent client connection. Application Gateway operates at Layer 7 within Azure, Front Door provides global Layer 7 delivery, and Load Balancer primarily handles Layer 4 traffic. Traffic Manager designs should consider DNS TTL values, resolver caching, endpoint monitoring, routing method, and regional application architecture.

Question 318

Which Azure networking option can provide a private frontend IP address for an Application Gateway that is intended to serve internal clients?

1. Private frontend IP configuration
2. Public IP prefix
3. Traffic Manager endpoint
4. ExpressRoute peering

Correct Answer: 1
Explanation

Application Gateway can use a private frontend IP configuration when the application should be accessed through private network connectivity. This allows internal clients to connect to the gateway without requiring a public frontend address. A public IP prefix reserves public addresses, Traffic Manager provides DNS-based endpoint selection, and ExpressRoute peering establishes private hybrid connectivity. A private Application Gateway design should include appropriate DNS records, routing, NSGs, backend configuration, and client access controls. The frontend address should be selected from the virtual network address space according to subnet and deployment requirements.

Question 319

Which Azure service can provide a managed outbound source NAT solution for an entire subnet?

1. Azure NAT Gateway
2. Azure Bastion
3. Azure Route Server
4. Azure Front Door

Correct Answer: 1
Explanation

Azure NAT Gateway provides managed source network address translation for resources in an associated subnet that require outbound Internet connectivity. It allows administrators to use configured public IP addresses or a public IP prefix for predictable outbound source addressing. Bastion provides administrative access, Route Server manages BGP route exchange, and Front Door provides global application delivery. NAT Gateway is useful when external services require allowlisting of stable source addresses or when applications need scalable outbound connectivity. Inbound connectivity is not automatically created simply by associating a NAT Gateway.

Question 320

A company has two Azure regions hosting the same web application and wants users to be directed to the endpoint with the lowest network latency. Which Traffic Manager method is appropriate?

1. Priority
2. Performance
3. Multivalue
4. Weighted

Correct Answer: 2
Explanation

Traffic Manager performance routing directs DNS responses toward the endpoint associated with the lowest network latency from the user’s DNS query location, based on Microsoft’s network intelligence and configured endpoints. This is useful for applications deployed across multiple regions where reducing user-to-application latency is an important requirement. Priority routing provides ordered failover, multivalue routing can return multiple healthy endpoints, and weighted routing distributes responses according to configured weights. Administrators should still configure endpoint health monitoring and consider DNS caching because clients may continue using previously resolved endpoint information.