View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 341

Which Azure service allows a network administrator to create centralized connectivity configurations for multiple virtual networks?

1. Azure Network Watcher
2. Azure Virtual Network Manager
3. Azure Bastion
4. Azure Traffic Manager

Correct Answer: 2
Explanation

Azure Virtual Network Manager provides centralized management for connectivity configurations across multiple virtual networks. Administrators can organize networks into network groups and apply connectivity configurations according to business or architectural requirements. This can reduce the need to configure individual peering relationships manually across a large environment. Network Watcher focuses on diagnostics, Bastion provides virtual machine administration, and Traffic Manager provides DNS-based traffic distribution. Network Manager should be designed with clear network group membership, address planning, connectivity boundaries, and security requirements so that centralized configurations do not unintentionally connect unrelated workloads.

Question 342

Which Azure Firewall Premium capability is intended to identify known malicious traffic patterns and generate security alerts?

1. DNAT
2. DNS proxy
3. IDPS
4. Gateway transit

Correct Answer: 3
Explanation

Azure Firewall Premium includes intrusion detection and prevention capabilities that can inspect traffic for known malicious patterns and suspicious activity. IDPS can provide deeper security inspection beyond basic allow and deny rules and can generate alerts or take configured actions for detected threats. DNAT translates destination addresses, DNS proxy handles DNS forwarding, and gateway transit enables supported shared gateway connectivity. IDPS should be used as part of a layered security architecture that also includes firewall rules, threat intelligence, logging, monitoring, and appropriate incident-response procedures.

Question 343

A company wants users to access a private Azure service by its normal hostname while DNS resolves that hostname to a private endpoint address. Which solution should be implemented?

1. Private DNS zone with private endpoint integration
2. Traffic Manager priority routing
3. Public IP prefix
4. ExpressRoute FastPath

Correct Answer: 1
Explanation

A private DNS zone can be integrated with a private endpoint so that the service’s normal hostname resolves to the private IP address associated with the endpoint. This allows applications to continue using familiar service names while traffic remains on private connectivity. Traffic Manager provides DNS-based endpoint routing, public IP prefixes reserve public addresses, and ExpressRoute FastPath concerns supported hybrid data paths. Correct DNS configuration is critical because a private endpoint can be healthy while applications still fail if they resolve the service name to an inappropriate public address.

Question 344

Which Azure ExpressRoute concept identifies the logical relationship used to exchange routes for Azure virtual network connectivity?

1. Microsoft peering
2. Private peering
3. Traffic Manager profile
4. NAT Gateway

Correct Answer: 2
Explanation

ExpressRoute private peering is used for private connectivity between an on-premises network and Azure virtual networks. It provides the routing relationship needed for supported Azure virtual network connectivity through an ExpressRoute circuit. Microsoft peering serves supported Microsoft services and destinations, while Traffic Manager and NAT Gateway perform unrelated traffic-management functions. Private peering requires appropriate circuit configuration, BGP routing, IP addressing, and an ExpressRoute virtual network gateway. Organizations should also consider redundant circuits or connectivity paths when private hybrid connectivity is critical to application availability.

Question 345

Which Azure Load Balancer capability can provide outbound connectivity rules for backend instances using a specific frontend IP address?

1. Health probe
2. Inbound NAT rule
3. Outbound rule
4. Backend pool

Correct Answer: 3
Explanation

Azure Load Balancer outbound rules allow administrators to explicitly configure how backend instances establish outbound connections through a load balancer frontend. They can define the frontend public IP configuration, backend pool, ports, and related outbound behavior. Health probes determine backend availability, inbound NAT rules map inbound connections to specific resources, and backend pools contain resources participating in load balancing. Outbound rules can be useful when predictable outbound connectivity is required from workloads behind a public Load Balancer. Administrators should evaluate whether NAT Gateway would provide a more appropriate outbound architecture.

Question 346

Which Azure service is designed to provide DNS-based traffic distribution between multiple application endpoints?

1. Azure Application Gateway
2. Azure Traffic Manager
3. Azure Load Balancer
4. Azure Firewall

Correct Answer: 2
Explanation

Azure Traffic Manager uses DNS responses to direct clients toward application endpoints according to the selected routing method and endpoint health. It can support priority, weighted, performance, geographic, multivalue, and other routing scenarios. Application Gateway operates as a Layer 7 reverse proxy, Load Balancer distributes network traffic at Layer 4, and Azure Firewall provides network security and traffic filtering. Traffic Manager is particularly useful when endpoints are distributed across regions or providers. DNS caching should be considered because changes in endpoint selection are affected by resolver and client caching behavior.

Question 347

Which Azure VPN Gateway feature allows administrators to define encryption and integrity settings required by a specific on-premises VPN device?

1. Custom IPsec/IKE policy
2. Application Gateway listener
3. Traffic Manager endpoint
4. Private DNS link

Correct Answer: 1
Explanation

A custom IPsec/IKE policy allows supported VPN Gateway configurations to specify cryptographic parameters used during tunnel negotiation. This can be necessary when an on-premises VPN device requires particular encryption, integrity, Diffie-Hellman, or related settings. Application Gateway listeners handle application traffic, Traffic Manager endpoints participate in DNS-based routing, and Private DNS links associate private DNS zones with virtual networks. Before applying a custom policy, administrators should verify compatibility with the remote VPN device and ensure that both sides use matching parameters. Unsupported combinations can prevent successful tunnel establishment.

Question 348

Which Azure Front Door configuration determines the backend destination associated with a specific application route?

1. Origin group
2. NSG rule
3. Route table
4. BGP peer

Correct Answer: 1
Explanation

An Azure Front Door origin group contains the backend origins that can serve requests for a configured route. Front Door uses routing configuration to associate incoming requests with the appropriate origin group and then selects a suitable healthy origin according to the configured behavior. NSG rules control network traffic, route tables determine network paths, and BGP peers exchange routing information. Origin groups should contain compatible backend services and appropriate health probes. Administrators should also consider origin host headers, certificates, routing paths, caching behavior, and origin protection when designing the application delivery architecture.

Question 349

Which Azure networking option is useful when a workload requires a stable outbound public IP but should not receive direct inbound connections from the Internet?

1. Public Load Balancer
2. Azure Front Door
3. NAT Gateway
4. Traffic Manager

Correct Answer: 3
Explanation

Azure NAT Gateway provides managed outbound Internet connectivity while allowing resources in the associated subnet to retain private IP addresses. The configured public IP address or public IP prefix is used for source network address translation. NAT Gateway does not by itself create unsolicited inbound connectivity to the private workloads. A Public Load Balancer can expose inbound services, Front Door provides global web delivery, and Traffic Manager provides DNS-based endpoint selection. NAT Gateway is especially useful when external services require predictable source IP allowlisting or when applications generate substantial outbound connections.

Question 350

Which Azure service can provide secure administrative access to a virtual machine without assigning the VM its own public IP address?

1. Azure Bastion
2. Azure Traffic Manager
3. Azure Route Server
4. Azure DNS

Correct Answer: 1
Explanation

Azure Bastion provides managed RDP and SSH connectivity to supported virtual machines through the Azure portal without requiring public IP addresses directly on those virtual machines. This reduces the need to expose management ports such as RDP or SSH to the public Internet. Traffic Manager handles DNS-based endpoint routing, Route Server provides dynamic route exchange, and Azure DNS provides name-resolution services. Bastion should be protected with appropriate identity controls and network security policies. Administrators should also restrict which users can access management resources and regularly review privileged access.

Question 351

Which Azure service can distribute HTTP requests according to URL paths while also providing Web Application Firewall integration?

1. Azure Load Balancer
2. Azure Application Gateway
3. Azure Route Server
4. Azure NAT Gateway

Correct Answer: 2
Explanation

Azure Application Gateway provides Layer 7 application delivery and supports URL path-based routing as well as integration with Web Application Firewall. This allows administrators to direct requests to different backend services based on application-layer information while applying web security controls. Load Balancer primarily operates at Layer 4, Route Server manages dynamic routes, and NAT Gateway handles outbound source translation. Application Gateway should be configured with appropriate listeners, backend pools, HTTP settings, health probes, routing rules, certificates, and WAF policies to ensure both application delivery and security requirements are met.

Question 352

Which Azure feature allows a virtual network to use an ExpressRoute or VPN gateway located in a peered hub virtual network?

1. Gateway transit
2. DNS proxy
3. Public IP prefix
4. Service endpoint

Correct Answer: 1
Explanation

Gateway transit allows a peered spoke virtual network to use a supported VPN or ExpressRoute gateway located in a hub virtual network. This is commonly used in hub-and-spoke architectures where hybrid connectivity is centralized. The spoke can avoid deploying its own gateway while using the shared hub connectivity according to the configured peering settings. DNS proxy handles DNS forwarding, public IP prefixes reserve public address ranges, and service endpoints provide optimized connectivity to supported Azure services. Gateway transit requires correct settings on the relevant peerings and appropriate route propagation.

Question 353

Which Azure DNS Private Resolver component receives DNS requests from on-premises clients that need to resolve Azure private names?

1. Outbound endpoint
2. Inbound endpoint
3. Traffic Manager endpoint
4. Application Gateway listener

Correct Answer: 2
Explanation

The inbound endpoint of Azure DNS Private Resolver receives DNS queries from clients outside Azure, including on-premises DNS infrastructure, and allows those queries to be resolved through the Azure private DNS architecture. An outbound endpoint performs forwarding from Azure toward external DNS servers. Traffic Manager endpoints and Application Gateway listeners perform application-related functions rather than DNS resolver functions. Hybrid DNS deployments should establish appropriate network connectivity to the inbound endpoint and ensure that private DNS zones are correctly linked. DNS forwarding and namespace ownership should also be clearly documented.

Question 354

Which Azure networking service provides a private, dedicated connection from an on-premises network to Azure through an ExpressRoute circuit?

1. Azure Bastion
2. ExpressRoute
3. Azure Traffic Manager
4. Network Watcher

Correct Answer: 2
Explanation

ExpressRoute provides private connectivity between an on-premises network and Microsoft cloud environments through an ExpressRoute circuit. It is designed for organizations that require private hybrid connectivity and may need predictable network characteristics. ExpressRoute can use private peering for Azure virtual network connectivity and other supported peering types for applicable Microsoft services. Bastion provides administrative access, Traffic Manager performs DNS-based endpoint routing, and Network Watcher provides diagnostics. ExpressRoute deployments should consider circuit redundancy, gateway configuration, BGP routing, provider availability, bandwidth requirements, and failover procedures.

Question 355

Which Azure Firewall capability translates an incoming public destination address to a private destination resource?

1. Application rule
2. Network rule
3. DNAT rule
4. Threat intelligence

Correct Answer: 3
Explanation

Azure Firewall DNAT rules perform destination network address translation for supported inbound traffic. A DNAT rule can translate the public destination address and port received by the firewall to a private destination address and port. Application rules provide application-layer filtering, network rules control network traffic according to addresses and ports, and threat intelligence can identify known malicious destinations or sources. DNAT should be narrowly configured and combined with appropriate NSGs, authentication, logging, monitoring, and source restrictions. Exposing an internal service through DNAT should always be treated as a controlled inbound access requirement.

Question 356

Which Azure Network Watcher capability can determine whether a specific source and destination traffic flow is allowed by effective NSG rules?

1. Next Hop
2. IP flow verify
3. Connection Monitor
4. Packet Capture

Correct Answer: 2
Explanation

Network Watcher IP flow verify evaluates a specified network flow and determines whether it is allowed or denied according to the effective security rules. Administrators can specify source and destination information, protocol, and port to investigate connectivity problems. Next Hop focuses on routing, Connection Monitor provides ongoing connectivity monitoring, and Packet Capture records network traffic. IP flow verify is useful for quickly identifying whether an NSG is blocking required communication before modifying security rules. Administrators should use the result together with effective security rules and routing information when troubleshooting.

Question 357

Which Azure service can reserve a contiguous block of public IP addresses for resources that require predictable public addressing?

1. Public IP prefix
2. Private endpoint
3. Application Security Group
4. Azure Bastion

Correct Answer: 1
Explanation

A public IP prefix reserves a contiguous range of public IP addresses that can be allocated to supported Azure resources. This can simplify public IP planning when multiple services need addresses from a predictable range. Private endpoints provide private connectivity to supported services, Application Security Groups organize network interfaces for security rules, and Bastion provides secure administrative access. Public IP prefixes do not themselves provide application security or traffic filtering. Organizations should allocate public addresses only where required and use appropriate NSGs, firewall policies, access controls, and monitoring to protect exposed resources.

Question 358

Which Azure networking service can continuously test connectivity between a virtual machine and another endpoint to identify availability or performance problems?

1. Azure Firewall Manager
2. Network Watcher Connection Monitor
3. Azure Traffic Manager
4. Azure Bastion

Correct Answer: 2
Explanation

Network Watcher Connection Monitor provides continuous connectivity monitoring between configured endpoints. It can help identify changes in reachability, latency, packet loss, and other supported connectivity characteristics depending on the monitoring configuration. Firewall Manager centrally manages firewall policies, Traffic Manager performs DNS-based traffic routing, and Bastion provides administrative access. Connection Monitor is useful for important application paths, hybrid connections, and service dependencies. Administrators should define meaningful source and destination endpoints, configure appropriate monitoring frequency, and establish alerts and response procedures for detected connectivity degradation.

Question 359

Which Azure Virtual WAN feature can connect a branch site to a Microsoft-managed virtual hub through an encrypted VPN connection?

1. Branch VPN connectivity
2. Private DNS linking
3. Application Gateway routing
4. NAT Gateway association

Correct Answer: 1
Explanation

Azure Virtual WAN supports branch connectivity through VPN connections to Microsoft-managed virtual hubs. This allows branch locations to participate in the broader Virtual WAN architecture and communicate with other connected resources according to configured routing and security policies. Private DNS linking handles name resolution, Application Gateway provides Layer 7 application delivery, and NAT Gateway provides outbound source translation. Branch connectivity should consider tunnel redundancy, routing, address spaces, authentication, bandwidth, hub placement, security inspection, and failover requirements. These factors become increasingly important as the number of connected branches grows.

Question 360

Which Azure networking service should be selected when an application requires host-based routing, TLS termination, and HTTP-aware traffic processing?

1. Azure Load Balancer
2. Azure NAT Gateway
3. Azure Application Gateway
4. Azure Route Server

Correct Answer: 3
Explanation

Azure Application Gateway is designed for Layer 7 application delivery and supports host-based routing, TLS termination, HTTP-aware routing, health probes, and other web application capabilities. These features make it appropriate when traffic decisions depend on HTTP or HTTPS information. Load Balancer primarily operates at Layer 4, NAT Gateway manages outbound source translation, and Route Server handles dynamic routing. Application Gateway deployments should include suitable listeners, certificates, backend pools, HTTP settings, health probes, and routing rules. WAF can also be integrated when web application security inspection is required.