View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 221

Which Azure Traffic Manager routing method directs users to an endpoint based on a configured priority order?

1. Priority
2. Weighted
3. Geographic
4. Multivalue

Correct Answer: 1
Explanation

Traffic Manager priority routing allows administrators to define an ordered list of endpoints. Traffic Manager directs DNS queries toward the highest-priority available endpoint and uses lower-priority endpoints when higher-priority endpoints are unavailable. This method is useful when one endpoint should normally serve traffic while another acts as a failover destination. Weighted routing distributes traffic according to assigned weights, geographic routing considers user location, and multivalue routing can return multiple healthy endpoints. Health monitoring should be configured so unavailable endpoints are removed from consideration.

Question 222

An organization needs to inspect encrypted HTTPS traffic at the Azure firewall before allowing it to reach internal workloads. Which Azure Firewall Premium capability is designed for this requirement?

1. DNAT
2. TLS inspection
3. Network peering
4. Load balancing

Correct Answer: 2
Explanation

Azure Firewall Premium provides TLS inspection capabilities that can decrypt and inspect supported encrypted traffic before re-encrypting it toward the destination. This can provide deeper visibility into HTTPS traffic and support security inspection policies that cannot be applied when traffic remains encrypted. DNAT performs destination address translation, peering connects virtual networks, and load balancing distributes traffic across backend resources. TLS inspection requires appropriate certificate deployment and careful planning because certificate trust, privacy, performance, application compatibility, and security policy requirements must all be considered.

Question 223

Which Azure ExpressRoute feature allows private connectivity between virtual networks that are connected through different ExpressRoute circuits?

1. FastPath
2. Global Reach
3. NAT Gateway
4. Private DNS

Correct Answer: 2
Explanation

ExpressRoute Global Reach allows private connectivity between on-premises networks connected to different ExpressRoute circuits. It can help organizations connect geographically distributed corporate locations through Microsoft’s private network infrastructure rather than relying entirely on the public Internet. FastPath is designed to improve data-path performance by allowing traffic to bypass certain gateway processing, while NAT Gateway and Private DNS serve different purposes. Global Reach planning should consider circuit locations, peering configuration, routing advertisements, supported scenarios, and the organization’s existing hybrid network topology.

Question 224

A company wants Azure Firewall to resolve domain names through a designated DNS server instead of relying only on default DNS resolution. Which feature can support this design?

1. DNS proxy
2. Public IP prefix
3. Gateway transit
4. Connection draining

Correct Answer: 1
Explanation

Azure Firewall DNS proxy can allow DNS requests from protected workloads to be processed through the firewall and forwarded according to the configured DNS architecture. This can provide centralized DNS visibility and help maintain consistent name resolution for firewall application rules that depend on fully qualified domain names. Public IP prefixes manage address ranges, gateway transit enables gateway sharing across peered networks, and connection draining is an Application Gateway capability. DNS proxy should be designed together with the organization’s private zones, DNS servers, forwarding requirements, and firewall policies.

Question 225

Which Application Gateway feature allows multiple websites with different host names to share the same Application Gateway instance?

1. Multi-site listener
2. Health probe
3. Backend pool
4. Connection draining

Correct Answer: 1
Explanation

Application Gateway multi-site listeners allow a single Application Gateway to support multiple websites by matching incoming requests according to host names. This can reduce the need for separate gateways when several web applications can share the same entry point and security architecture. Backend pools contain the destination servers, health probes monitor backend availability, and connection draining helps existing connections complete during backend changes. Multi-site designs should use appropriate DNS records, listener configuration, certificates, routing rules, and backend settings to ensure each hostname reaches the intended application.

Question 226

Which Azure Virtual WAN capability can automatically provide connectivity between branches connected to the same virtual hub?

1. Branch-to-branch connectivity
2. Public IP prefix
3. Service endpoint
4. Private DNS linking

Correct Answer: 1
Explanation

Azure Virtual WAN supports branch-to-branch connectivity through its managed virtual hub architecture. Branch sites connected to Virtual WAN can communicate through the Microsoft-managed WAN infrastructure without requiring every branch to maintain direct tunnels to every other branch. This simplifies large distributed network designs and can reduce the operational complexity of full-mesh connectivity. Public IP prefixes manage address ranges, service endpoints provide optimized Azure service access, and Private DNS links provide name resolution. Routing policies, security inspection, hub configuration, and connectivity requirements should still be planned carefully.

Question 227

Which Azure Application Gateway setting determines how a gateway communicates with servers in a backend pool, including protocol and port information?

1. HTTP settings
2. Route table
3. Service endpoint
4. NSG priority

Correct Answer: 1
Explanation

Application Gateway HTTP settings define important communication parameters between the gateway and backend servers. Depending on the configuration, these settings can specify the backend protocol and port, host name behavior, connection draining, cookie-based affinity, and related options. Backend pools identify the servers that can receive requests, while route tables and NSG priorities perform different network functions. Correct HTTP settings are important when backend applications use nonstandard ports, HTTPS, specific host headers, or session requirements. Misconfigured settings can cause gateway-generated backend connection failures.

Question 228

Which Azure networking service is primarily responsible for distributing incoming network traffic across multiple backend resources at Layer 4?

1. Azure Front Door
2. Azure Load Balancer
3. Azure DNS Private Resolver
4. Azure Firewall Manager

Correct Answer: 2
Explanation

Azure Load Balancer operates primarily at Layer 4 and distributes TCP or UDP traffic across healthy backend resources. It uses frontend IP configurations, load-balancing rules, backend pools, and health probes to determine how connections are handled. Azure Front Door provides global Layer 7 application delivery, DNS Private Resolver handles DNS resolution, and Firewall Manager provides centralized firewall management capabilities. Load Balancer designs should account for frontend configuration, backend health, availability zones where applicable, inbound NAT requirements, and whether internal or public exposure is appropriate.

Question 229

A network administrator needs to determine which route Azure will use to reach a particular destination from a virtual machine. Which Network Watcher capability is appropriate?

1. IP flow verify
2. Next hop
3. Packet capture
4. Topology

Correct Answer: 2
Explanation

Network Watcher Next hop determines the next hop for traffic originating from a virtual machine toward a specified destination. It can help administrators understand whether traffic will use a virtual network route, Internet route, virtual appliance, or another applicable next hop. IP flow verify focuses on security-rule decisions, Packet Capture records traffic for analysis, and Topology provides a network-resource view. Next hop is particularly useful when troubleshooting unexpected routing caused by system routes, user-defined routes, peering, or network virtual appliances.

Question 230

Which Azure networking option provides a private connection from an Azure virtual network to a supported PaaS service without exposing the service through a public IP address?

1. Service endpoint
2. Private endpoint
3. Traffic Manager
4. Public IP prefix

Correct Answer: 2
Explanation

A private endpoint creates a private IP address inside an Azure virtual network and maps that endpoint to a supported Azure service through Azure Private Link. This allows applications to reach the service using private connectivity rather than a publicly accessible service endpoint. Service endpoints provide a different security and routing model in which traffic remains on the Azure backbone while the service still uses its public endpoint. Traffic Manager manages DNS-based distribution, and public IP prefixes reserve public addresses. Private endpoint deployments should include appropriate DNS configuration and network access controls.

Question 231

Which ExpressRoute capability can improve data-path performance by allowing supported traffic to bypass the ExpressRoute virtual network gateway?

1. FastPath
2. Global Reach
3. Gateway transit
4. DNS proxy

Correct Answer: 1
Explanation

ExpressRoute FastPath is designed to improve network performance for supported traffic by providing a more direct data path between on-premises networks and virtual network resources. This can reduce the amount of gateway processing involved in the data path and may improve latency and throughput for appropriate workloads. Global Reach connects on-premises networks through ExpressRoute, gateway transit supports shared gateway scenarios, and DNS proxy handles DNS forwarding through Azure Firewall. FastPath has specific support and design considerations, so administrators should verify compatibility before deployment.

Question 232

Which Azure VPN Gateway capability can allow two gateway instances to operate simultaneously to improve availability?

1. Active-active mode
2. Priority routing
3. Weighted routing
4. Connection draining

Correct Answer: 1
Explanation

VPN Gateway active-active mode allows both gateway instances to operate simultaneously, providing a more resilient VPN architecture than relying on a single active instance. Connections can be established across the available gateway instances according to the supported configuration. Priority and weighted routing are Traffic Manager concepts, while connection draining is associated with Application Gateway backend changes. Active-active VPN designs require compatible configuration on the on-premises side and should account for tunnel setup, BGP where applicable, redundant devices, monitoring, and failure scenarios.

Question 233

Which Azure feature allows an administrator to restrict access to a storage account from selected virtual networks while using service endpoints?

1. Storage firewall and virtual network rules
2. Traffic Manager priority routing
3. Application Gateway listener
4. Public IP prefix

Correct Answer: 1
Explanation

Azure Storage supports network access controls that can restrict service access to selected virtual networks and subnets when the appropriate service endpoint architecture is used. This allows administrators to limit which network locations can access the storage service while retaining the service’s supported endpoint model. Traffic Manager priority routing manages DNS traffic distribution, Application Gateway listeners accept web requests, and public IP prefixes reserve public addresses. Storage network restrictions should be combined with identity-based authorization, appropriate firewall settings, and carefully selected subnet access to create layered protection.

Question 234

Which Azure Bastion capability allows administrators to connect to virtual machines without assigning public IP addresses directly to those virtual machines?

1. Browser-based RDP/SSH through Bastion
2. BGP route advertisement
3. DNS forwarding
4. Layer 4 load balancing

Correct Answer: 1
Explanation

Azure Bastion provides managed RDP and SSH connectivity to virtual machines through the Azure portal without requiring public IP addresses on those virtual machines. This can reduce direct Internet exposure of management interfaces while providing controlled administrative access through the Bastion service. BGP route advertisement is associated with dynamic routing, DNS forwarding handles name resolution, and Layer 4 load balancing distributes network traffic. Bastion deployments should still use appropriate identity controls, network security rules, subnet configuration, and administrative procedures to protect management access.

Question 235

Which Traffic Manager routing method can return multiple healthy endpoints in response to a DNS query?

1. Priority
2. Multivalue
3. Geographic
4. Weighted

Correct Answer: 2
Explanation

Traffic Manager multivalue routing can return multiple healthy endpoint addresses in DNS responses. This can provide clients with several possible destinations and can support application designs where multiple endpoints should remain available rather than selecting only one destination. Priority routing focuses on ordered failover, geographic routing considers the client’s location, and weighted routing distributes DNS responses according to configured weights. Multivalue routing should be evaluated alongside endpoint health monitoring, client DNS behavior, application retry behavior, and the number of endpoints that should be returned.

Question 236

An organization wants to make one Azure Firewall policy inherit common rules from a centrally managed parent policy. Which capability supports this arrangement?

1. Policy inheritance
2. Gateway transit
3. NAT translation
4. Connection monitoring

Correct Answer: 1
Explanation

Azure Firewall policy inheritance allows child policies to inherit configurations from a parent policy in supported hierarchical designs. This can help central teams define common security controls while allowing more specific policies to address individual environments. Gateway transit is a network peering capability, NAT translation changes network addresses, and connection monitoring evaluates connectivity. Policy hierarchy should be planned carefully so that centrally managed rules remain consistent while delegated administrators have appropriate control. Administrators should understand rule collection processing and inheritance behavior before deploying complex policy structures.

Question 237

Which Application Gateway feature can maintain a user’s session with the same backend server by using an application gateway-generated cookie?

1. Cookie-based affinity
2. BGP peering
3. Public IP prefix
4. DNS forwarding

Correct Answer: 1
Explanation

Application Gateway cookie-based affinity can help maintain session persistence by directing subsequent requests from a client to the same backend server when supported by the configuration. This can be useful for applications that maintain session state locally rather than storing it in a shared session repository. BGP peering handles route exchange, public IP prefixes manage public address ranges, and DNS forwarding handles name resolution. Session affinity should not automatically replace application-level session design because backend failures and scaling events can still affect session continuity.

Question 238

Which Azure networking architecture is most appropriate when Internet-bound traffic from multiple spoke networks must pass through a centralized security appliance?

1. Direct spoke-to-Internet connectivity
2. Hub-and-spoke with forced routing through an NVA
3. Independent public IP allocation
4. Separate DNS zones only

Correct Answer: 2
Explanation

A hub-and-spoke architecture can centralize security inspection by routing Internet-bound traffic from spoke networks through a network virtual appliance or Azure Firewall in the hub. User-defined routes can direct the required traffic toward the inspection device, while return paths must be designed to preserve routing symmetry. Direct spoke-to-Internet connectivity does not provide centralized inspection, public IP allocation alone does not establish a security path, and DNS zones do not control network traffic forwarding. The design should consider high availability, routing, firewall policies, monitoring, and failure behavior.

Question 239

Which Azure Virtual WAN capability can be used to steer traffic through security services based on centralized routing policies?

1. Routing intent
2. Public IP prefix
3. Service endpoint
4. Private DNS link

Correct Answer: 1
Explanation

Azure Virtual WAN routing intent allows administrators to define routing policies that steer traffic through designated security solutions in supported virtual hub architectures. This can help create centralized security inspection for traffic such as Internet-bound or private network traffic while reducing the need for extensive manual route management. Public IP prefixes manage address ranges, service endpoints provide Azure service connectivity, and private DNS links control DNS zone association. Routing intent should be planned alongside secured virtual hub architecture, firewall deployment, route propagation, branch connectivity, and required traffic inspection paths.

Question 240

A network team is choosing between Azure Application Gateway and Azure Load Balancer for a web application that requires URL-based routing. Which requirement points specifically toward Application Gateway?

1. UDP load distribution
2. URL path-based routing
3. Basic TCP forwarding
4. Network-level health probing only

Correct Answer: 2
Explanation

URL path-based routing is an Application Gateway capability designed for Layer 7 web traffic. It allows requests to different URL paths to be directed toward different backend pools or application services. Azure Load Balancer primarily operates at Layer 4 and is better suited to TCP or UDP traffic distribution without understanding HTTP URL paths. Choosing between the services should consider application-layer requirements, protocol support, TLS handling, security controls, health monitoring, scalability, and network architecture. The requirement to inspect and route requests based on HTTP content strongly favors an application delivery service.