View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 361

An organization uses Azure Virtual WAN and wants traffic between two virtual hubs to traverse the Microsoft-managed WAN backbone without requiring direct VNet peering. Which capability should be used?

1. Virtual hub-to-hub connectivity
2. VNet service endpoints
3. Azure Bastion
4. Application Gateway

Correct Answer: 1
Explanation

Virtual hub-to-hub connectivity allows Azure Virtual WAN hubs to communicate through the Microsoft-managed global network. This design is useful when organizations have multiple regional hubs and need connectivity between branches, VNets, or other connected resources across regions. It reduces the need to create and maintain individual peering relationships between networks. Virtual WAN provides centralized routing and connectivity management, allowing traffic to move between hubs according to the configured hub routing architecture. This approach is particularly useful for globally distributed enterprise networks requiring scalable inter-region connectivity.

Question 362

A company wants Azure Firewall to inspect outbound Internet traffic from a secured virtual hub while ensuring Internet-bound traffic is automatically directed through the security service. Which Virtual WAN feature should the administrator configure?

1. Branch-to-branch connectivity
2. Internet traffic routing intent
3. VNet peering
4. Service endpoint policy

Correct Answer: 2
Explanation

Virtual WAN routing intent can define how traffic should be routed through specific network security services. Internet traffic routing intent is designed for scenarios where Internet-bound traffic from connected networks must pass through a security solution such as Azure Firewall. After the appropriate security configuration is deployed, routing intent helps establish the required forwarding behavior within the virtual hub. This provides centralized inspection and policy enforcement rather than allowing every connected workload to independently access the Internet. It is useful for organizations implementing centralized security controls across multiple branches, VNets, and remote locations.

Question 363

You are deploying an Application Gateway that must serve several websites using the same frontend IP address. Each website has a different hostname. Which Application Gateway configuration is appropriate?

1. Separate VNets for each website
2. Multiple site listeners
3. Service endpoint policies
4. Network security groups only

Correct Answer: 2
Explanation

Multiple site listeners allow an Application Gateway to host multiple websites on the same frontend infrastructure while distinguishing requests by hostname. For example, requests for app1.contoso.com and app2.contoso.com can be associated with different listeners and routing configurations. The gateway examines the incoming request and determines which listener and routing rule should handle it. This approach avoids requiring a separate Application Gateway for every website and is especially useful for consolidated application delivery. Listener configuration can also be combined with appropriate TLS certificates and routing rules for secure multi-site deployments.

Question 364

A network administrator needs to connect an Azure virtual network to an on-premises network that uses an overlapping IP address range. The administrator wants to translate one network’s addresses before traffic crosses the VPN connection. Which Azure capability should be investigated?

1. Azure VPN Gateway NAT
2. Azure Traffic Manager
3. Azure Bastion
4. Application Gateway caching

Correct Answer: 1
Explanation

Azure VPN Gateway supports network address translation scenarios that can help establish connectivity when address spaces overlap between connected networks. NAT can translate source or destination addresses so that the two environments can communicate without requiring an immediate renumbering of the original networks. This is particularly valuable during mergers, migrations, or hybrid environments where changing existing addressing schemes may be difficult. The translation rules must be designed carefully so that both directions of traffic are handled correctly. Routing, VPN configuration, and translated address ranges should also be validated before production deployment.

Question 365

An enterprise wants to provide outbound Internet connectivity for thousands of Azure VMs while distributing SNAT usage across several public IP addresses. Which configuration provides additional SNAT capacity with NAT Gateway?

1. Multiple network security groups
2. Multiple public IP addresses attached to NAT Gateway
3. Multiple private DNS zones
4. Multiple service endpoints

Correct Answer: 2
Explanation

NAT Gateway can use multiple public IP addresses to provide scalable outbound connectivity for resources in a subnet. Adding public IP addresses increases the available SNAT port capacity and helps reduce the possibility of SNAT port exhaustion when many workloads establish simultaneous outbound connections. The resources continue to use the NAT Gateway rather than requiring individual public IP addresses on each virtual machine. This design is useful for large application environments with substantial outbound connection requirements. It also provides a predictable set of public source addresses that administrators can allowlist at external services.

Question 366

A team needs to determine whether an Azure Load Balancer should send traffic to a backend instance by using an HTTP-based health check. What should the team configure?

1. An HTTP health probe
2. A DNS forwarding rule
3. A NAT Gateway
4. A service endpoint

Correct Answer: 1
Explanation

An HTTP health probe allows Azure Load Balancer to determine whether a backend instance is responding to an HTTP request on the configured port and path. The load balancer uses the probe result when deciding which backend instances are eligible to receive new connections. If an instance fails the configured health checks, traffic can be removed from that unhealthy backend until the probe reports a healthy state again. This helps prevent requests from being distributed to failed application instances. Probe settings should match the application’s actual listening port and expected health-check response behavior.

Question 367

A company wants Azure Network Manager to automatically establish connectivity between VNets that are added to a centrally managed group. Which connectivity configuration should be used for a full-mesh topology?

1. Hub-and-spoke connectivity configuration
2. Mesh connectivity configuration
3. Private endpoint configuration
4. DNS forwarding configuration

Correct Answer: 2
Explanation

A mesh connectivity configuration in Azure Virtual Network Manager enables participating virtual networks to communicate with one another through a centrally managed connectivity configuration. This differs from a hub-and-spoke model, where spoke networks communicate through a designated hub. Mesh is useful when multiple VNets require direct connectivity and the organization wants to manage those relationships centrally instead of manually configuring each peering connection. Network groups can be used to define which VNets participate. Administrators should still consider address-space planning, routing requirements, security controls, and operational complexity before applying the configuration.

Question 368

A company wants a Traffic Manager profile to return several healthy endpoints to a client so that the client can select one of them. Which routing method is designed for this scenario?

1. Priority routing
2. Weighted routing
3. Multivalue routing
4. Performance routing

Correct Answer: 3
Explanation

Traffic Manager multivalue routing can return multiple healthy endpoint addresses in the DNS response. This allows the client to receive several possible destinations rather than a single endpoint selected by Traffic Manager. It can be useful when an application has multiple endpoints and the client is capable of choosing among the returned addresses. Health monitoring still plays an important role because unhealthy endpoints are excluded from the response. Multivalue routing differs from priority routing, which is primarily designed for ordered failover, and performance routing, which directs users according to network latency considerations.

Question 369

An administrator is designing an Azure Firewall deployment and wants all Internet-bound traffic from a subnet to pass through the firewall before reaching public destinations. Which networking component is commonly used to direct the traffic to Azure Firewall?

1. User-defined route
2. Private DNS zone
3. Service endpoint
4. Public IP prefix

Correct Answer: 1
Explanation

A user-defined route can specify Azure Firewall as the next hop for traffic that must be inspected before reaching an external destination. For example, a route with an Internet address prefix can direct outbound traffic toward the firewall’s private IP address. The firewall can then apply its configured network, application, and other security policies before forwarding permitted traffic. This pattern is commonly used in centralized inspection architectures. Route tables must be associated with the appropriate subnets, and administrators should verify that routing does not create unintended loops or prevent required management traffic.

Question 370

A security team wants Azure Firewall to inspect HTTPS traffic and identify malicious content within encrypted connections. Which Azure Firewall Premium capability is designed for this requirement?

1. DNS forwarding
2. TLS inspection
3. Load balancing
4. Public IP prefix

Correct Answer: 2
Explanation

Azure Firewall Premium provides TLS inspection capabilities that allow encrypted traffic to be decrypted, inspected according to security policies, and then re-encrypted before continuing toward its destination. This can provide deeper visibility into HTTPS traffic than simple network-level filtering. TLS inspection requires appropriate certificate configuration and careful planning because the firewall effectively participates in the encrypted connection. Organizations should also consider application compatibility, certificate trust, privacy requirements, and performance implications. The feature is useful when security policies require inspection of encrypted traffic rather than relying only on destination addresses, ports, or other metadata.

Question 371

An organization exposes an Azure Storage account through a private endpoint. The administrator wants to prevent a virtual network’s routing policies from unintentionally overriding the private endpoint’s network behavior. Which setting should be reviewed?

1. Private endpoint network policies
2. Traffic Manager priority
3. ExpressRoute FastPath
4. Application Gateway listener

Correct Answer: 1
Explanation

Private endpoint network policies determine whether certain network policies, including network security groups and user-defined routes, can be applied to private endpoint network interfaces. Reviewing this setting is important when administrators need precise control over how traffic to private endpoints behaves within a virtual network. The configuration can affect how routing and security controls interact with the private endpoint. Administrators should verify the requirements of the private endpoint architecture before changing the setting. This is particularly important in environments that use centralized inspection, custom routing, or tightly controlled subnet security policies.

Question 372

A company has a Storage account accessed by workloads in a VNet and wants access to remain on the Azure backbone without creating a private endpoint for the service. Which Azure feature can provide this type of connectivity?

1. Service endpoint
2. Traffic Manager
3. Azure Bastion
4. Public IP prefix

Correct Answer: 1
Explanation

A service endpoint extends the identity of a virtual network subnet to supported Azure services and allows traffic to those services to use the Azure backbone rather than traversing the public Internet. The service can then be configured to allow access from selected virtual networks. Unlike Private Link, a service endpoint does not provide a private IP address for the Azure service inside the VNet. This distinction is important when selecting an architecture. Administrators should evaluate service support, security requirements, DNS behavior, and whether private endpoint isolation is required before choosing between the two approaches.

Question 373

A network administrator needs to allow a spoke VNet to use the VPN gateway located in a hub VNet. The VNets are already peered. Which peering capability should be configured?

1. Allow gateway transit and use remote gateways
2. Allow forwarded traffic only
3. Service endpoint policies
4. Traffic Manager multivalue routing

Correct Answer: 1
Explanation

Gateway transit allows a peered VNet to use a VPN or ExpressRoute gateway deployed in another VNet, typically a centralized hub. The hub-side peering is configured to allow gateway transit, while the spoke-side peering is configured to use remote gateways. This architecture avoids deploying separate gateways in every spoke and supports centralized hybrid connectivity. The VNets must be appropriately peered, and routing and gateway configuration must be compatible. Gateway transit is commonly used in hub-and-spoke designs where several spoke networks need access to shared on-premises connectivity through a central network.

Question 374

An organization needs to provide secure browser-based management access to virtual machines without assigning public IP addresses to those VMs. Which Azure service is designed for this purpose?

1. Azure Bastion
2. Traffic Manager
3. NAT Gateway
4. Azure Firewall

Correct Answer: 1
Explanation

Azure Bastion provides secure management connectivity to virtual machines through the Azure portal without requiring public IP addresses on the individual VMs. It supports management access such as RDP and SSH through the Azure platform, reducing the need to expose management ports directly to the Internet. This can simplify secure administrative access in environments where virtual machines are intentionally kept private. Bastion is deployed into a dedicated subnet within the virtual network and can work with VMs that use private IP addresses. Network security and administrative access policies should still be applied appropriately.

Question 375

An organization wants a Front Door deployment to route requests to different backend origins based on the requested hostname, such as sales.contoso.com and support.contoso.com. Which configuration should be used?

1. Separate Front Door routes and domains
2. NAT Gateway rules
3. ExpressRoute private peering
4. Network Watcher packet capture

Correct Answer: 1
Explanation

Azure Front Door can associate multiple domains with routing configurations so that requests for different hostnames can be directed to the appropriate origins. Separate routes can define how each domain’s traffic is processed, including supported patterns and origin groups. This is useful for organizations operating several applications or websites through a common global entry point. The configuration can also incorporate HTTPS certificates, caching behavior, and other Front Door features. Administrators should ensure that each domain is correctly associated with its route and that the corresponding origins are healthy and properly configured.

Question 376

A company has two VNets in different Azure regions and wants direct private connectivity between them. Both VNets have non-overlapping address spaces. Which feature should be used?

1. Global VNet peering
2. Service endpoint
3. Traffic Manager
4. Azure Bastion

Correct Answer: 1
Explanation

Global VNet peering provides private connectivity between Azure virtual networks located in different regions. Once the peering relationships are configured correctly, resources in the connected VNets can communicate using private IP addressing across the Microsoft backbone. Non-overlapping address spaces are important because conflicting routes can prevent reliable communication. Global peering is different from application-level services such as Traffic Manager, which uses DNS-based traffic distribution rather than providing network-level connectivity. Administrators should also review peering settings, routing requirements, security rules, and any relevant gateway or forwarded-traffic requirements.

Question 377

A network team wants a public IP address range to be reserved as a contiguous block so that several Azure resources can use addresses from a predictable allocation. Which Azure resource should be used?

1. Public IP prefix
2. NAT Gateway
3. Private DNS zone
4. Network security group

Correct Answer: 1
Explanation

A public IP prefix reserves a contiguous range of public IP addresses that can be allocated to supported Azure resources. This is useful when an organization needs predictable public addresses for allowlisting, firewall policies, or operational management. Instead of requesting unrelated individual addresses, the organization can manage a defined address range. Administrators can then create public IP resources from the prefix according to their deployment requirements. Public IP prefixes do not themselves provide routing or security inspection; they primarily help organize and reserve public addressing in a predictable and centrally managed manner.

Question 378

A company uses ExpressRoute and wants to connect multiple VNets through an ExpressRoute circuit while keeping the network design centralized. Which Azure component provides the gateway connection between the VNet and the ExpressRoute circuit?

1. ExpressRoute virtual network gateway
2. Application Gateway
3. Traffic Manager
4. NAT Gateway

Correct Answer: 1
Explanation

An ExpressRoute virtual network gateway provides the connection between an Azure virtual network and an ExpressRoute circuit. It enables private connectivity between Azure resources and networks connected through the ExpressRoute provider. The gateway is deployed in the virtual network and participates in the required routing architecture. Organizations can use appropriate gateway configurations and peering arrangements to support hybrid connectivity across their environments. The ExpressRoute circuit itself represents the connectivity service, while the virtual network gateway is the Azure-side component that connects the VNet to that circuit.

Question 379

A company needs to determine whether a specific Azure VM can reach a particular destination and wants a diagnostic tool that analyzes the network path and connectivity configuration. Which Network Watcher capability should be used?

1. Connection troubleshoot
2. Topology
3. IP flow verify
4. Packet capture

Correct Answer: 1
Explanation

Network Watcher Connection Troubleshoot is designed to analyze connectivity between an Azure resource and a specified destination. It can help identify whether communication succeeds and provide information about the network path and potential connectivity problems. This is useful when diagnosing issues involving routing, network security groups, firewalls, or other network components. IP flow verify is more focused on determining whether traffic is allowed or denied by security rules, while packet capture collects traffic for deeper analysis. Connection Troubleshoot is therefore appropriate when the primary requirement is understanding end-to-end network connectivity.

Question 380

An enterprise is designing a hybrid Azure network and wants a dedicated private connection with predictable performance between its on-premises environment and Microsoft cloud services. Which service provides this connectivity without traversing the public Internet?

1. Azure Traffic Manager
2. ExpressRoute
3. Azure Bastion
4. Azure Load Balancer

Correct Answer: 2
Explanation

ExpressRoute provides private connectivity between an organization’s on-premises network and Microsoft cloud services through a connectivity provider. Unlike site-to-site VPN connectivity that uses encrypted tunnels over the Internet, ExpressRoute uses a dedicated connection and can provide more predictable network performance and latency characteristics. It is commonly used for enterprise hybrid architectures where consistent private connectivity is important. The design can incorporate redundant circuits, appropriate routing, and different ExpressRoute peering options depending on the required services. Organizations should select the appropriate circuit and gateway architecture based on bandwidth, resiliency, and connectivity requirements.