View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 181

Which Azure service can provide secure connectivity from an individual client computer to an Azure virtual network over an encrypted VPN connection?

1. ExpressRoute
2. Azure Front Door
3. Point-to-site VPN
4. Azure Load Balancer

Correct Answer: 3
Explanation

Point-to-site VPN provides an encrypted connection between an individual client device and an Azure virtual network. It is useful for remote employees, administrators, and other users who need secure access to Azure resources without connecting an entire office network. ExpressRoute provides private connectivity through a provider, Front Door handles global application delivery, and Load Balancer distributes network traffic. A point-to-site design should include an appropriate authentication method, client address pool, routing configuration, authorization controls, and access restrictions so that remote users can reach only the resources required for their work.

Question 182

Which Azure networking feature can allow an administrator to inspect the effective security rules applied to a network interface?

1. Effective security rules
2. Public IP prefix
3. Traffic Manager profile
4. Private DNS zone

Correct Answer: 1
Explanation

Effective security rules show the Network Security Group rules that apply to a network interface, including rules inherited through associated configurations. They are useful when administrators need to understand why traffic is being permitted or denied. Public IP prefixes manage public address ranges, Traffic Manager provides DNS-based application routing, and private DNS zones provide internal name resolution. Effective security rules should be reviewed alongside effective routes and IP flow diagnostics because a connectivity problem may involve both routing and security filtering rather than an NSG rule alone.

Question 183

A company needs to distribute web traffic between backend servers while performing TLS termination and URL-based routing. Which Azure service should be selected?

1. Azure Load Balancer
2. Azure Application Gateway
3. Azure Route Server
4. Azure NAT Gateway

Correct Answer: 2
Explanation

Azure Application Gateway provides Layer 7 application delivery capabilities, including TLS termination and URL path-based routing. It can distribute HTTP and HTTPS requests across backend pools while applying application-aware routing decisions. Azure Load Balancer operates primarily at Layer 4, Route Server provides dynamic BGP route exchange, and NAT Gateway manages outbound source translation. Application Gateway can also integrate with Web Application Firewall for additional web security. Its configuration should include appropriate listeners, certificates, backend health probes, routing rules, and security policies.

Question 184

Which Azure feature can provide a centralized collection of virtual networks to which the same Virtual Network Manager configuration can be applied?

1. Network Security Group
2. Network group
3. Private endpoint
4. Public IP prefix

Correct Answer: 2
Explanation

A network group in Azure Virtual Network Manager is a logical collection of virtual networks that can be targeted by centralized configurations. Administrators can use network groups with connectivity and security configurations to apply consistent policies across selected networks. Network Security Groups filter network traffic, private endpoints provide private service connectivity, and public IP prefixes reserve public address ranges. Network groups can simplify management in large environments, but membership should be governed carefully so that configurations are not unintentionally applied to networks belonging to different workloads, teams, or security boundaries.

Question 185

Which Azure Firewall capability can identify potentially malicious destinations based on Microsoft’s threat intelligence data?

1. Threat intelligence
2. Gateway transit
3. Health probes
4. Connection draining

Correct Answer: 1
Explanation

Azure Firewall threat intelligence filtering can identify traffic associated with known malicious IP addresses and domains based on Microsoft’s threat intelligence information. This provides an additional security layer that can complement manually defined network and application rules. Gateway transit supports shared gateway access across peered networks, health probes determine backend availability, and connection draining manages existing backend connections during removal. Threat intelligence should be considered part of a layered security strategy that also includes least-privilege rules, monitoring, logging, identity controls, vulnerability management, and appropriate application protection.

Question 186

Which Azure networking option provides a dedicated private connection between a customer’s network and Microsoft cloud services through a connectivity provider?

1. Point-to-site VPN
2. Azure Bastion
3. ExpressRoute
4. Traffic Manager

Correct Answer: 3
Explanation

ExpressRoute provides private connectivity between an organization’s network and Microsoft cloud services through an ExpressRoute provider or supported network exchange. It can provide more predictable connectivity characteristics than Internet-based VPN solutions. Point-to-site VPN is intended for individual clients, Bastion provides secure virtual machine administration, and Traffic Manager performs DNS-based traffic routing. ExpressRoute planning includes circuit bandwidth, peering, gateway configuration, provider redundancy, routing, geographic requirements, and failover. Organizations should also consider whether multiple circuits or providers are necessary for their availability objectives.

Question 187

Which Azure networking service can translate private source addresses to a public IP address for outbound Internet connections from a subnet?

1. Azure NAT Gateway
2. Azure Route Server
3. Azure DNS Private Resolver
4. Azure Bastion

Correct Answer: 1
Explanation

Azure NAT Gateway provides source network address translation for outbound Internet traffic originating from resources in an associated subnet. It allows private resources to use configured public IP addresses for outbound connections without assigning a public IP address directly to each virtual machine. Route Server supports dynamic routing, DNS Private Resolver handles DNS resolution, and Bastion provides administrative connectivity. NAT Gateway is useful when applications require predictable outbound public IP addresses and scalable SNAT capacity. Inbound Internet access is not provided by NAT Gateway and must be designed separately.

Question 188

Which Application Gateway capability allows different host names to be handled by separate listeners and routing configurations?

1. Host-based routing
2. BGP routing
3. Gateway transit
4. SNAT routing

Correct Answer: 1
Explanation

Application Gateway supports host-based routing, allowing requests for different host names to be handled according to separate listener and routing configurations. This is useful when multiple websites or application domains share the same Application Gateway infrastructure. BGP routing is used for dynamic network route exchange, gateway transit enables shared gateway access, and SNAT changes source addresses. Host-based routing should be configured with the correct DNS records, listeners, TLS certificates, backend pools, and routing rules so that each requested hostname reaches the intended application.

Question 189

Which Azure service can provide a managed DNS resolution path between Azure virtual networks and on-premises DNS servers without requiring DNS forwarding virtual machines?

1. Azure Traffic Manager
2. Azure DNS Private Resolver
3. Azure Load Balancer
4. Azure Firewall Manager

Correct Answer: 2
Explanation

Azure DNS Private Resolver provides managed DNS resolution and forwarding capabilities for hybrid environments without requiring administrators to maintain dedicated DNS forwarding virtual machines. Its inbound endpoints can receive queries from on-premises networks, while outbound endpoints can forward selected Azure DNS queries toward external DNS servers. Traffic Manager manages application endpoint routing, Load Balancer distributes network traffic, and Firewall Manager manages firewall policies. A Private Resolver architecture should include appropriate virtual network connectivity, forwarding rulesets, DNS server addresses, and clear ownership of private DNS zones.

Question 190

Which Azure Load Balancer capability can distribute traffic across backend resources while supporting TCP and UDP protocols?

1. Application Gateway
2. Azure Load Balancer
3. Azure Front Door
4. Azure DNS

Correct Answer: 2
Explanation

Azure Load Balancer provides Layer 4 traffic distribution and supports TCP and UDP workloads. It can distribute connections across healthy backend instances according to configured rules and health probes. Application Gateway is designed for application-layer HTTP and HTTPS traffic, Front Door provides global web application delivery, and Azure DNS handles name resolution. Load Balancer architecture should consider frontend IP configuration, backend pools, health probes, inbound rules, availability zones, outbound connectivity, and application connection patterns to ensure the selected configuration meets performance and availability requirements.

Question 191

Which Azure routing capability allows a network virtual appliance to advertise routes dynamically to Azure using BGP?

1. Azure Route Server
2. Azure Bastion
3. Azure Traffic Manager
4. Azure DNS

Correct Answer: 1
Explanation

Azure Route Server provides managed BGP route exchange between Azure virtual networks and supported network virtual appliances. A network appliance can advertise routes to Azure, while Azure can provide applicable routes back to the appliance. This reduces dependence on manually maintained static routes in supported architectures. Bastion provides administrative access, Traffic Manager manages DNS-based application routing, and Azure DNS handles name resolution. Route Server deployments should consider BGP peer configuration, advertised prefixes, route selection, appliance behavior, redundancy, and whether traffic inspection requires specific forwarding paths.

Question 192

Which Azure feature can reserve a contiguous range of public IPv4 addresses for an organization’s Azure resources?

1. Azure Firewall policy
2. Public IP prefix
3. Private DNS zone
4. Application Security Group

Correct Answer: 2
Explanation

A public IP prefix reserves a contiguous range of public IP addresses that can be allocated to supported Azure resources. This can simplify public IP planning for organizations that need multiple predictable public endpoints. Azure Firewall policies define security rules, private DNS zones provide private name resolution, and Application Security Groups organize network interfaces for NSG rules. Public IP addresses should be allocated only when necessary because public exposure increases the attack surface. Organizations should also document ownership, intended use, security controls, and lifecycle requirements for reserved public addresses.

Question 193

A network administrator wants to determine which route Azure will use from a virtual machine toward a specified destination. Which Network Watcher capability should be used?

1. IP flow verify
2. Next hop
3. Packet capture
4. Connection Monitor

Correct Answer: 2
Explanation

Network Watcher Next hop determines the next hop that Azure routing will use from a virtual machine toward a specified destination. It can help administrators identify whether traffic will remain within the virtual network, use a virtual network gateway, pass through a network virtual appliance, or follow another applicable route. IP flow verify focuses on whether traffic is allowed or denied by security rules, Packet Capture records network traffic for analysis, and Connection Monitor evaluates connectivity. Next-hop analysis is especially useful when troubleshooting custom routing and unexpected traffic paths.

Question 194

Which Azure service can capture network packets from a virtual machine’s network interface for troubleshooting purposes?

1. Network Watcher Packet Capture
2. Azure Traffic Manager
3. Azure Bastion
4. Azure Private Link

Correct Answer: 1
Explanation

Network Watcher Packet Capture can capture network traffic associated with a virtual machine’s network interface for troubleshooting and analysis. Administrators can use captured traffic to investigate connectivity failures, unexpected communication, application behavior, or security-related issues. Traffic Manager manages DNS-based application routing, Bastion provides secure administrative access, and Private Link provides private service connectivity. Packet captures should be carefully scoped using appropriate filters and durations because unrestricted captures can generate large amounts of data. Captured information should also be handled according to organizational security and privacy requirements.

Question 195

Which Azure architecture allows centralized services such as Azure Firewall and VPN Gateway to support multiple isolated application networks?

1. Hub-and-spoke
2. Single-subnet network
3. Public-only network
4. Independent Internet architecture

Correct Answer: 1
Explanation

A hub-and-spoke architecture places shared network services in a central hub while application workloads are separated into individual spoke virtual networks. The hub can contain services such as Azure Firewall, VPN Gateway, ExpressRoute Gateway, Bastion, and DNS components. Spokes can communicate with shared services through controlled connectivity while maintaining logical isolation. This architecture requires appropriate virtual network peering, routing, security rules, DNS configuration, and redundancy. It is particularly useful for organizations that want centralized governance while allowing application teams to maintain separate workload networks.

Question 196

Which Azure Front Door capability can serve cached content from an edge location instead of requesting the same content from the origin for every client request?

1. Caching
2. BGP
3. DNAT
4. Route propagation

Correct Answer: 1
Explanation

Azure Front Door caching can store eligible content at edge locations and serve subsequent requests without contacting the origin for every request. This can reduce origin workload and improve response times for users located far from the backend application. BGP is used for dynamic route exchange, DNAT translates destination addresses, and route propagation concerns network routing. Cache behavior depends on Front Door configuration and HTTP caching characteristics. Administrators should carefully determine which content is safe to cache, particularly when applications process personalized, authenticated, or sensitive information.

Question 197

Which Azure networking feature allows a private endpoint connection request to be associated with a specific service provider resource?

1. Private Link service
2. Azure Traffic Manager
3. Azure Bastion
4. NAT Gateway

Correct Answer: 1
Explanation

A Private Link service enables a service provider to make its supported service privately accessible to consumers through Azure Private Link. Consumer private endpoint connections can be associated with the provider’s Private Link service and managed through the appropriate approval and access process. Traffic Manager performs DNS-based routing, Bastion provides virtual machine administration, and NAT Gateway handles outbound translation. Private Link service designs require coordination between providers and consumers, including network addressing, connection approval, DNS resolution, load balancer configuration, security policies, and ongoing monitoring.

Question 198

Which Azure VPN Gateway feature allows a gateway to exchange routing information dynamically with an on-premises router?

1. BGP
2. WAF
3. DNS forwarding
4. Connection draining

Correct Answer: 1
Explanation

BGP enables Azure VPN Gateway to exchange routing information dynamically with compatible on-premises network devices. This can be valuable for hybrid networks where routes change frequently or where multiple network prefixes need to be exchanged without maintaining every route manually. WAF protects web applications, DNS forwarding controls name-resolution paths, and connection draining manages existing backend connections. BGP configurations require compatible autonomous system numbers, peering addresses, route advertisements, and careful control of which prefixes are exchanged to avoid unintended routing behavior.

Question 199

Which Azure networking service can protect web applications against common HTTP-based attacks while integrated with an application delivery service?

1. Azure Route Server
2. Web Application Firewall
3. Azure NAT Gateway
4. Azure Private DNS

Correct Answer: 2
Explanation

Web Application Firewall provides application-layer protection against common HTTP and HTTPS attacks and can be integrated with supported Azure application delivery services such as Application Gateway and Azure Front Door. It can use managed and custom rules to inspect web requests and responses according to the configured policy. Route Server provides dynamic routing, NAT Gateway manages outbound translation, and Private DNS provides internal name resolution. WAF should be deployed as part of a layered security strategy that includes secure application development, identity controls, network segmentation, monitoring, and appropriate access restrictions.

Question 200

An organization is designing a large Azure network and wants to simplify management of connectivity policies across many virtual networks. Which service is designed for this requirement?

1. Azure Virtual Network Manager
2. Azure Load Balancer
3. Azure Bastion
4. Azure Traffic Manager

Correct Answer: 1
Explanation

Azure Virtual Network Manager provides centralized management capabilities for connectivity and security configurations across multiple Azure virtual networks. Administrators can organize networks into logical groups and apply standardized configurations instead of manually configuring each network independently. Load Balancer distributes network traffic, Bastion provides secure virtual machine administration, and Traffic Manager provides DNS-based application routing. Virtual Network Manager is particularly useful in large environments where consistent connectivity policies, segmentation, governance, and centralized administration are important. Network groups, configuration scope, security requirements, and organizational ownership should be established before deployment.