View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 321

Which Azure service provides centralized routing and connectivity for branch offices connected through VPN or ExpressRoute?

1. Azure Bastion
2. Azure Virtual WAN
3. Azure DNS
4. Azure NAT Gateway

Correct Answer: 2
Explanation

Azure Virtual WAN provides a managed networking architecture for connecting branch offices, virtual networks, VPN connections, and ExpressRoute circuits through virtual hubs. It reduces the need to manually build and maintain complex point-to-point connectivity between every location. Virtual WAN can also support centralized routing and security inspection in supported configurations. Azure Bastion is designed for virtual machine administration, Azure DNS provides name resolution, and NAT Gateway manages outbound source translation. A Virtual WAN deployment should consider hub locations, routing requirements, bandwidth, security inspection, and expected branch growth.

Question 322

An administrator needs to determine whether a virtual machine’s traffic will be sent to a network virtual appliance. Which Network Watcher feature should be used?

1. Packet Capture
2. Connection Monitor
3. Next Hop
4. IP flow verify

Correct Answer: 3
Explanation

Network Watcher Next Hop determines the next hop that Azure will use for traffic from a virtual machine toward a specified destination. It can identify whether traffic will use a virtual network gateway, virtual appliance, Internet route, or another applicable next hop. Packet Capture records traffic, Connection Monitor evaluates connectivity over time, and IP flow verify evaluates whether traffic is allowed or denied by security rules. Next Hop is particularly useful when troubleshooting user-defined routes and verifying that traffic is being directed through the intended network virtual appliance.

Question 323

Which Azure networking service can provide global application delivery while allowing origins to remain protected from direct public access?

1. Azure Route Server
2. Azure Front Door
3. Azure NAT Gateway
4. Azure Network Watcher

Correct Answer: 2
Explanation

Azure Front Door provides a global entry point for HTTP and HTTPS applications and can be designed so that application origins accept traffic primarily from the Front Door service rather than directly from arbitrary Internet clients. This can help reduce direct exposure of backend applications while Front Door handles global client access, routing, health monitoring, and supported security features. Route Server manages BGP routing, NAT Gateway provides outbound connectivity, and Network Watcher provides diagnostics. Origin protection should include appropriate access restrictions, certificates, application authentication, and network security controls.

Question 324

Which Azure service provides a private connection to supported Azure resources through a private IP address without requiring the consumer to expose its virtual network to the service provider?

1. Traffic Manager
2. Private Link
3. Load Balancer
4. Network Watcher

Correct Answer: 2
Explanation

Azure Private Link enables private connectivity between a consumer virtual network and supported services through private endpoints. The consumer does not need to establish broad network connectivity or expose its entire virtual network to the service provider. Instead, traffic is directed through a private IP address associated with the private endpoint. Traffic Manager provides DNS-based endpoint selection, Load Balancer distributes network traffic, and Network Watcher provides diagnostics. Private Link deployments should include appropriate private DNS configuration, service approval, network policies, access controls, and careful endpoint placement.

Question 325

Which Application Gateway feature allows administrators to change the host name or URL information sent to a backend server?

1. HTTP settings
2. Public IP prefix
3. Route Server
4. Network Security Group

Correct Answer: 1
Explanation

Application Gateway HTTP settings control how the gateway communicates with backend servers and can include configuration affecting the host name used for backend requests. This is useful when the hostname expected by a backend application differs from the hostname used by clients. HTTP settings also contain other backend communication parameters such as protocol, port, cookie-based affinity, and connection-draining behavior where supported. Public IP prefixes manage addresses, Route Server exchanges routes, and NSGs control network traffic. Backend host configuration should be aligned with application routing and TLS certificate requirements.

Question 326

Which Azure networking capability can connect virtual networks across Azure regions using Microsoft’s backbone network?

1. Global VNet peering
2. Public IP prefix
3. DNS Private Resolver
4. NAT Gateway

Correct Answer: 1
Explanation

Global virtual network peering allows virtual networks in different Azure regions to communicate over Microsoft’s backbone infrastructure. This provides private connectivity between regional workloads without requiring the traffic to traverse the public Internet. Public IP prefixes reserve public address ranges, DNS Private Resolver provides DNS forwarding and resolution capabilities, and NAT Gateway manages outbound source translation. Global peering requires compatible address spaces and appropriate peering configuration. Administrators should also evaluate network latency, data transfer costs, security controls, route propagation, and whether the connected workloads should communicate directly.

Question 327

A network engineer wants to create a secure hub where Internet traffic is inspected by Azure Firewall before reaching connected networks. Which Azure architecture is appropriate?

1. Secured virtual hub
2. Public DNS zone
3. Internal Load Balancer
4. Point-to-site VPN

Correct Answer: 1
Explanation

A secured virtual hub is an Azure Virtual WAN architecture that integrates security capabilities such as Azure Firewall into the managed virtual hub. It can provide centralized inspection and routing for supported traffic from connected branches, virtual networks, and other resources. A public DNS zone handles public name resolution, an internal Load Balancer distributes private traffic, and point-to-site VPN provides individual client connectivity. A secured hub should be planned with routing intent, firewall policy, branch connectivity, virtual network connections, and security requirements so inspected traffic follows the intended path.

Question 328

Which Azure Load Balancer feature can provide a single frontend configuration for distributing traffic to multiple backend instances?

1. Backend pool
2. DNS forwarding
3. Security admin rule
4. BGP peering

Correct Answer: 1
Explanation

A Load Balancer backend pool defines the collection of backend resources that can receive traffic through associated load-balancing rules. Multiple supported instances can be placed in the pool so that incoming connections are distributed among healthy resources. DNS forwarding handles name resolution, security admin rules provide centralized network security governance, and BGP peering exchanges routing information. Backend pool design should account for application architecture, health probes, frontend and backend ports, availability requirements, and scaling behavior. Only appropriate resources should be included in the pool to prevent unintended traffic distribution.

Question 329

Which Azure DNS capability can automatically register virtual machine records in a private DNS zone when supported by the configuration?

1. Virtual network link with registration enabled
2. Public IP prefix
3. Route Server peer
4. Traffic Manager profile

Correct Answer: 1
Explanation

Azure Private DNS supports virtual network links, and a link can be configured with virtual network registration enabled for supported scenarios. This allows eligible resources to have their private DNS records registered automatically rather than requiring every record to be created manually. Public IP prefixes manage public addresses, Route Server peers exchange routing information, and Traffic Manager manages DNS-based endpoint routing. Automatic registration should be enabled only where appropriate because it can affect the contents of the private DNS zone. Administrators should also establish clear naming and lifecycle management practices.

Question 330

Which Azure networking service can provide a dedicated private connection from an on-premises location to Microsoft cloud resources using a connectivity provider?

1. ExpressRoute
2. Traffic Manager
3. Azure Bastion
4. Azure Firewall Manager

Correct Answer: 1
Explanation

ExpressRoute provides private connectivity between an organization’s on-premises network and Microsoft cloud services through an ExpressRoute circuit delivered through supported connectivity providers or exchange facilities. It avoids using the public Internet for the primary connection and is commonly used for enterprise hybrid networking. Traffic Manager provides DNS-based endpoint routing, Bastion provides virtual machine administration, and Firewall Manager provides centralized firewall management. ExpressRoute designs should include circuit redundancy, private peering, gateway configuration, route advertisement, provider availability, and appropriate monitoring to support business-critical workloads.

Question 331

Which Azure Application Gateway capability allows requests for different URL paths to be directed to separate backend pools?

1. Path-based routing
2. BGP routing
3. Gateway transit
4. NAT translation

Correct Answer: 1
Explanation

Application Gateway path-based routing evaluates the URL path of incoming HTTP or HTTPS requests and can direct different paths to different backend pools. This is useful when multiple application services share one public or private gateway but need separate routing destinations. BGP routing manages dynamic network routes, gateway transit allows supported use of a shared gateway across peered virtual networks, and NAT translation changes network addresses. Path-based rules should be ordered and configured carefully so specific paths are matched correctly. Backend health probes and HTTP settings should also match each application service.

Question 332

Which Azure feature can allow a private endpoint connection request to be manually approved by the service provider?

1. Private Link service connection approval
2. Traffic Manager health probe
3. NSG flow rule
4. ExpressRoute peering

Correct Answer: 1
Explanation

When a service is exposed through an Azure Private Link service, the provider can control private endpoint connection requests and approve or reject them according to the service’s access requirements. This gives service providers greater control over which consumer networks can establish private connectivity. Traffic Manager health probes monitor endpoint availability, NSG rules control network traffic, and ExpressRoute peering supports private hybrid connectivity. Private Link approval workflows should be combined with identity, authorization, service ownership, DNS, and network controls so that only intended consumers can access the privately exposed service.

Question 333

Which Azure service can distribute TCP or UDP traffic across healthy backend instances without interpreting HTTP URLs?

1. Azure Load Balancer
2. Azure Front Door
3. Azure Application Gateway
4. Azure DNS Private Resolver

Correct Answer: 1
Explanation

Azure Load Balancer provides Layer 4 distribution for TCP and UDP traffic across healthy backend resources. It does not require knowledge of HTTP hostnames or URL paths to perform its basic load-balancing function. Azure Front Door and Application Gateway provide Layer 7 capabilities for web applications, while DNS Private Resolver focuses on DNS resolution. Load Balancer is appropriate when the requirement is network-level traffic distribution rather than application-aware routing. Administrators should select suitable frontend configurations, backend pools, health probes, rules, and availability options according to the workload.

Question 334

Which Azure service can help an organization centralize security policies across multiple Azure Firewall deployments?

1. Azure Firewall Manager
2. Azure Traffic Manager
3. Azure DNS Private Resolver
4. Azure Route Server

Correct Answer: 1
Explanation

Azure Firewall Manager provides centralized management capabilities for Azure Firewall policies across supported deployments. It can help organizations establish consistent security governance across multiple networks and environments while reducing the need to manage each firewall independently. Traffic Manager provides DNS-based traffic routing, DNS Private Resolver handles private DNS forwarding, and Route Server manages BGP route exchange. Centralized firewall management should include clear policy ownership, inheritance where applicable, delegated administration, logging, monitoring, and change control. These practices help prevent inconsistent security configurations across distributed network environments.

Question 335

Which Azure networking option is most appropriate when a workload needs outbound Internet access from a private subnet but inbound Internet connections should not be initiated directly to the workload?

1. NAT Gateway
2. Public Load Balancer
3. Traffic Manager
4. Public IP prefix alone

Correct Answer: 1
Explanation

Azure NAT Gateway provides managed outbound Internet connectivity for resources in a subnet while not creating unsolicited inbound connectivity to those private resources. It uses configured public IP addresses or a public IP prefix for source NAT. A public Load Balancer can provide inbound exposure, Traffic Manager performs DNS-based endpoint selection, and a public IP prefix alone only reserves public addresses without providing the required outbound translation behavior. NAT Gateway is useful for workloads that need predictable outbound source addresses while remaining privately addressed within the virtual network.

Question 336

Which Azure Network Watcher capability continuously evaluates connectivity between configured endpoints instead of performing only a single point-in-time test?

1. Connection Monitor
2. Next Hop
3. IP flow verify
4. Packet Capture

Correct Answer: 1
Explanation

Network Watcher Connection Monitor provides ongoing monitoring of connectivity between configured source and destination endpoints. It can help detect availability or performance problems over time rather than only when an administrator manually performs a troubleshooting operation. Next Hop evaluates routing decisions, IP flow verify checks whether specific traffic is allowed or denied, and Packet Capture records network traffic for analysis. Connection Monitor is particularly useful for important application dependencies and hybrid paths. Monitoring should be combined with meaningful test configurations, alerting, and operational procedures for investigating detected failures.

Question 337

Which Azure VPN Gateway configuration can distribute VPN tunnels across multiple gateway instances for improved resilience?

1. Active-active
2. Priority routing
3. Weighted routing
4. Multivalue routing

Correct Answer: 1
Explanation

An active-active VPN Gateway configuration allows both gateway instances to participate in supported VPN connectivity, improving resilience compared with a design that depends on one active gateway instance. This can be combined with redundant on-premises devices and multiple tunnels for greater availability. Priority, weighted, and multivalue routing are Traffic Manager routing methods and do not configure VPN gateway redundancy. Administrators should verify that the selected gateway SKU and remote VPN devices support the desired active-active configuration and should test tunnel establishment, route propagation, failure detection, and recovery.

Question 338

Which Azure security feature allows a centralized administrator to define rules that can apply across multiple virtual networks managed through Virtual Network Manager?

1. Security admin rules
2. Application Gateway listeners
3. Traffic Manager endpoints
4. NAT Gateway rules

Correct Answer: 1
Explanation

Azure Virtual Network Manager security admin rules allow centralized administrators to define security requirements for selected virtual networks. These rules provide an additional governance layer that can complement workload-level Network Security Groups. Application Gateway listeners accept web traffic, Traffic Manager endpoints participate in DNS-based routing, and NAT Gateway provides outbound source translation. Security admin rules should be designed with carefully defined scopes, priorities, and allowed communication patterns. Because centralized rules can affect many workloads simultaneously, administrators should validate their interaction with existing NSGs and conduct controlled testing before broad production deployment.

Question 339

Which Azure Front Door capability can keep frequently requested content closer to users and reduce repeated requests to the origin?

1. Caching
2. BGP routing
3. NAT translation
4. Private peering

Correct Answer: 1
Explanation

Azure Front Door caching can store eligible content at edge locations closer to users, reducing repeated requests to the origin for content that can be cached. This can improve response times and reduce origin workload for suitable applications. BGP routing handles dynamic route exchange, NAT translation modifies network addresses, and private peering is associated with private connectivity architectures. Caching behavior depends on route configuration, cache-control information, rules, and content characteristics. Administrators should carefully evaluate which content can safely be cached, particularly when responses contain personalized or sensitive information.

Question 340

A company needs to connect two Azure virtual networks in different regions privately and does not want to deploy VPN tunnels between them. Which option is appropriate?

1. Global VNet peering
2. Point-to-site VPN
3. Public Load Balancer
4. Traffic Manager

Correct Answer: 1
Explanation

Global virtual network peering provides private connectivity between Azure virtual networks located in different regions over Microsoft’s backbone network. It avoids the need to establish VPN tunnels between the virtual networks for supported peering scenarios. Point-to-site VPN is intended for individual client devices, Public Load Balancer distributes network traffic, and Traffic Manager provides DNS-based endpoint routing. Global peering requires compatible address spaces and appropriate peering settings. Administrators should also evaluate routing, security rules, regional latency, data transfer costs, and whether the workloads require direct cross-region communication.