View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 241

Which Azure Firewall capability can identify and block known malicious traffic based on threat intelligence information?

1. DNAT
2. Threat intelligence
3. Gateway transit
4. Connection draining

Correct Answer: 2
Explanation

Azure Firewall threat intelligence filtering can identify traffic associated with known malicious IP addresses and domains and apply configured actions such as alerting or denial. This provides an additional security layer beyond manually created firewall rules. DNAT performs destination network address translation, gateway transit supports shared gateway connectivity, and connection draining is an Application Gateway feature. Threat intelligence should be used alongside carefully designed network and application rules, logging, monitoring, and other security controls because threat intelligence alone does not address every possible attack or unauthorized communication path.

Question 242

Which Azure VPN Gateway setting can be used when an organization requires a specific combination of IPsec and IKE cryptographic parameters?

1. Custom IPsec/IKE policy
2. Traffic Manager profile
3. Service endpoint policy
4. DNS forwarding rule

Correct Answer: 1
Explanation

A custom IPsec/IKE policy allows supported Azure VPN Gateway configurations to specify particular cryptographic parameters for IPsec and IKE negotiations. This can be important when connecting Azure to an on-premises VPN device that requires specific encryption, integrity, Diffie-Hellman, or related settings. Traffic Manager manages DNS-based traffic routing, service endpoint policies apply to supported Azure services, and DNS forwarding rules control name-resolution forwarding. Before applying a custom policy, administrators should verify that the settings are compatible with the remote VPN device and the selected gateway configuration.

Question 243

Which ExpressRoute peering type is intended for private connectivity between an on-premises network and Azure virtual networks?

1. Microsoft peering
2. Private peering
3. Public peering
4. Internet peering

Correct Answer: 2
Explanation

ExpressRoute private peering provides private connectivity between an on-premises network and Azure virtual networks through an ExpressRoute circuit. It is commonly used for hybrid workloads that require private network communication without traversing the public Internet. Microsoft peering is designed for supported Microsoft services and destinations rather than direct virtual network connectivity. Public peering is a historical ExpressRoute concept and is not the standard choice for current Azure virtual network connectivity. Private peering requires appropriate circuit, gateway, VLAN, IP addressing, and routing configuration.

Question 244

An administrator needs to allow several virtual machines to communicate with an application tier while avoiding hard-coded individual VM IP addresses in NSG rules. Which approach is appropriate?

1. Application Security Groups
2. Public IP prefixes
3. Traffic Manager
4. Azure DNS

Correct Answer: 1
Explanation

Application Security Groups allow network interfaces to be grouped according to application roles and referenced directly by Network Security Group rules. This makes security policies easier to maintain when workload instances change over time. Instead of continually updating rules with individual IP addresses, administrators can define communication between logical groups such as web, application, and database tiers. Public IP prefixes manage public address ranges, Traffic Manager distributes DNS-based traffic, and Azure DNS provides name resolution. ASGs should still be combined with specific ports, protocols, and least-privilege access requirements.

Question 245

Which Azure Front Door capability allows an administrator to keep an origin’s hostname separate from the hostname used by clients?

1. Origin host header
2. NSG priority
3. BGP route
4. NAT rule

Correct Answer: 1
Explanation

Azure Front Door can use an origin host header to control the hostname presented to the backend origin when Front Door forwards a client request. This is useful when the public hostname used by clients differs from the hostname expected by the origin application or web server. NSG priority controls the order of security rules, BGP routes support dynamic routing, and NAT rules translate network addresses. Origin host header configuration should match the backend application’s expectations, TLS certificate requirements, and host-based routing behavior to prevent unexpected backend errors.

Question 246

Which Azure service is designed to provide secure browser-based administrative access to virtual machines through RDP and SSH without exposing those management ports directly to the Internet?

1. Azure Traffic Manager
2. Azure Bastion
3. Azure Route Server
4. Azure NAT Gateway

Correct Answer: 2
Explanation

Azure Bastion provides managed administrative access to Azure virtual machines through RDP and SSH from the Azure portal without requiring public IP addresses on the individual virtual machines. This can reduce direct exposure of management ports to the Internet. Traffic Manager provides DNS-based application routing, Route Server supports BGP route exchange, and NAT Gateway provides managed outbound connectivity. Bastion should be deployed with appropriate subnet configuration and strong identity controls. Network security rules should also restrict unnecessary access to management resources and supporting network components.

Question 247

Which Traffic Manager routing method is useful when different endpoints should serve users based on their geographic location?

1. Priority
2. Geographic
3. Multivalue
4. Weighted

Correct Answer: 2
Explanation

Traffic Manager geographic routing directs DNS responses according to the geographic location associated with the DNS query. It can be useful when an organization wants users from different regions to reach different application endpoints because of regulatory, localization, performance, or architectural requirements. Priority routing is intended for ordered failover, multivalue can return multiple healthy endpoints, and weighted routing distributes responses according to configured weights. Geographic routing requires careful mapping of geographic regions to endpoints and should be evaluated alongside endpoint health monitoring and DNS caching behavior.

Question 248

Which Azure Load Balancer capability can forward a specific inbound port from a frontend IP address to a specific virtual machine instance?

1. Inbound NAT rule
2. Application rule
3. DNS forwarding rule
4. BGP session

Correct Answer: 1
Explanation

Azure Load Balancer inbound NAT rules can map a frontend IP address and port to a specific backend virtual machine and port. This can be useful for scenarios such as accessing individual virtual machines for administration or testing through a load balancer frontend. Application rules are associated with Azure Firewall, DNS forwarding rules manage name resolution, and BGP sessions exchange routing information. Inbound NAT should be used carefully because it can create externally reachable management or application ports. Appropriate network security controls and restricted source access remain important.

Question 249

Which Azure Private DNS configuration allows virtual networks to resolve records from a private DNS zone?

1. Virtual network link
2. Public IP prefix
3. Route Server peer
4. Load-balancing rule

Correct Answer: 1
Explanation

A virtual network link associates a private DNS zone with a virtual network, allowing resources in that network to resolve records contained in the zone. This is a fundamental component of private name resolution for internal applications and many private endpoint deployments. Public IP prefixes manage public address ranges, Route Server peers exchange routes, and load-balancing rules distribute traffic. Administrators should verify that the correct virtual networks are linked and that DNS clients use the expected Azure-provided or custom DNS infrastructure. Incorrect zone links can result in name-resolution failures despite healthy network connectivity.

Question 250

Which Azure networking architecture is commonly used to centralize shared services such as firewalls, DNS, and hybrid connectivity while keeping application networks separate?

1. Hub-and-spoke
2. Full public exposure
3. Single flat subnet
4. Independent Internet routing

Correct Answer: 1
Explanation

A hub-and-spoke architecture places shared networking services in a central hub while application workloads are deployed in separate spoke virtual networks. The hub can contain services such as Azure Firewall, VPN or ExpressRoute gateways, DNS components, and other shared infrastructure. Spokes can remain logically separated while using approved connectivity through the hub. This model can improve centralized governance and simplify hybrid connectivity, although routing, security boundaries, address spaces, and availability must be planned carefully. It is particularly useful for organizations managing multiple application environments or business units.

Question 251

Which Azure service can provide Layer 7 web application protection against common HTTP-based attacks when integrated with an Application Gateway?

1. Web Application Firewall
2. Route Server
3. NAT Gateway
4. Public IP prefix

Correct Answer: 1
Explanation

Web Application Firewall provides Layer 7 protection for supported HTTP and HTTPS applications and can be integrated with Application Gateway. It can help protect applications against common web attacks by inspecting HTTP requests and applying configured security rules. Route Server handles dynamic routing, NAT Gateway manages outbound source translation, and public IP prefixes reserve public address ranges. WAF policies should be tuned according to application requirements because overly restrictive rules can block legitimate requests. Monitoring logs and reviewing detected events are important for maintaining effective application-layer protection.

Question 252

Which Azure Virtual Network Manager configuration is designed to connect all virtual networks within a defined network group to each other?

1. Mesh connectivity
2. Priority routing
3. DNAT
4. DNS forwarding

Correct Answer: 1
Explanation

Azure Virtual Network Manager mesh connectivity can establish connectivity among virtual networks that belong to the applicable network group. This can simplify large-scale connectivity management when multiple networks need direct communication without individually configuring every peering relationship. Priority routing belongs to Traffic Manager, DNAT is a firewall address-translation function, and DNS forwarding handles name-resolution requests. Network Manager configurations should be scoped carefully because mesh connectivity can create broader communication paths than a strictly hub-and-spoke model. Administrators should define network groups according to actual application and security requirements.

Question 253

A company wants clients to reach an application through a single global endpoint while Azure automatically directs requests toward healthy regional origins. Which service is designed for this purpose?

1. Azure Front Door
2. Azure Route Server
3. Azure NAT Gateway
4. Azure DNS Private Resolver

Correct Answer: 1
Explanation

Azure Front Door provides a global entry point for HTTP and HTTPS applications and can route requests toward configured origins based on health and routing configuration. It is designed for global application delivery and can help organizations provide a consistent public endpoint while distributing traffic across regional application deployments. Route Server provides dynamic routing, NAT Gateway manages outbound connectivity, and DNS Private Resolver handles private DNS resolution. Front Door architectures should include origin health configuration, routing rules, TLS requirements, caching decisions, and appropriate protection for the backend origins.

Question 254

Which Azure networking feature can prevent traffic from a private endpoint subnet from being subject to certain network policies when those policies are not supported for the deployment?

1. Private endpoint network policies
2. Traffic Manager priority
3. Public IP prefix
4. ExpressRoute FastPath

Correct Answer: 1
Explanation

Private endpoint network policies control whether certain network policies can be applied to private endpoints within a subnet. Administrators can configure the relevant subnet behavior according to supported private endpoint scenarios and required network controls. Traffic Manager priority determines DNS endpoint failover order, public IP prefixes reserve public addresses, and ExpressRoute FastPath relates to optimized ExpressRoute data paths. Private endpoint subnet configuration should be planned before deployment because network policy behavior can affect security inspection, routing, and traffic management. Always verify supported policy combinations for the specific Azure networking architecture.

Question 255

Which Azure VPN Gateway feature can improve availability by deploying the gateway across availability zones in supported regions?

1. Zone-redundant gateway
2. Weighted routing
3. Multivalue DNS
4. Application Security Group

Correct Answer: 1
Explanation

A zone-redundant VPN Gateway can provide improved resilience by distributing gateway infrastructure across availability zones in supported Azure regions. This reduces dependence on a single availability zone and can help maintain VPN connectivity during certain zone-level failures. Weighted routing is a Traffic Manager method, multivalue DNS is unrelated to VPN gateway infrastructure, and Application Security Groups organize network interfaces for NSG rules. Zone-redundant gateway selection should be considered alongside redundant tunnels, on-premises device redundancy, appropriate gateway SKUs, routing design, and tested recovery procedures.

Question 256

Which Azure Firewall feature allows administrators to perform URL filtering for supported web traffic using application-level rules?

1. Application rules
2. Inbound NAT rules
3. Route tables
4. Gateway transit

Correct Answer: 1
Explanation

Azure Firewall application rules provide application-layer filtering for supported web protocols and can use fully qualified domain names and other application-aware criteria. This enables administrators to create policies that control access to approved destinations rather than relying only on IP addresses and ports. Inbound NAT rules perform destination translation, route tables determine network paths, and gateway transit enables use of a shared gateway across peered networks. Application rules should follow least-privilege principles and be combined with network rules, threat intelligence, logging, and monitoring where appropriate.

Question 257

Which ExpressRoute feature is designed to allow supported traffic to take a more direct path instead of being processed through the virtual network gateway data path?

1. FastPath
2. Global Reach
3. Private DNS
4. Service endpoint

Correct Answer: 1
Explanation

ExpressRoute FastPath is designed to provide a more direct data path for supported traffic between an on-premises network and Azure virtual network resources. By reducing dependency on certain gateway data-path processing, FastPath can improve network performance for applicable workloads. Global Reach provides private connectivity between on-premises networks through ExpressRoute, Private DNS provides internal name resolution, and service endpoints provide optimized access to supported Azure services. FastPath has specific prerequisites and limitations, so organizations should verify the selected gateway, resource types, and architecture before relying on it for performance improvements.

Question 258

Which Azure service can centrally manage security policies across Azure Firewall deployments in multiple virtual networks?

1. Azure Firewall Manager
2. Azure Traffic Manager
3. Azure Bastion
4. Azure DNS

Correct Answer: 1
Explanation

Azure Firewall Manager provides centralized management capabilities for Azure Firewall deployments and security policies across supported network environments. It can help organizations apply consistent security governance while managing multiple firewalls and network architectures. Traffic Manager manages DNS-based traffic distribution, Bastion provides secure administrative access, and Azure DNS provides name-resolution services. Centralized firewall management is particularly useful in larger environments where separate teams or subscriptions contain multiple network segments. Administrators should establish clear policy ownership, hierarchy, delegated administration, logging, and change-management procedures.

Question 259

Which Azure service is appropriate when a workload requires outbound Internet access but should use a predictable public source IP address without assigning a public IP directly to each virtual machine?

1. Azure NAT Gateway
2. Azure Front Door
3. Azure Route Server
4. Azure Private DNS

Correct Answer: 1
Explanation

Azure NAT Gateway provides managed outbound Internet connectivity for resources in an associated subnet while using configured public IP addresses for source network address translation. This allows workloads to communicate externally without assigning public IP addresses directly to each virtual machine. It can also provide predictable outbound source addresses for allowlisting by external services. Front Door provides global application delivery, Route Server handles dynamic routing, and Private DNS provides private name resolution. NAT Gateway should be deployed with appropriate subnet design and security controls to ensure only intended workloads receive outbound connectivity.

Question 260

A company needs to connect Azure workloads privately to an on-premises network and requires predictable network performance without sending traffic through the public Internet. Which option is designed for this requirement?

1. ExpressRoute
2. Traffic Manager
3. Azure Front Door
4. Public IP prefix

Correct Answer: 1
Explanation

ExpressRoute provides private connectivity between an organization’s network and Microsoft cloud services through an ExpressRoute circuit rather than using the public Internet for the primary connection. It is suitable for workloads requiring predictable connectivity characteristics, private routing, and enterprise hybrid-network integration. Traffic Manager provides DNS-based endpoint selection, Front Door provides global HTTP and HTTPS delivery, and public IP prefixes reserve public addresses. ExpressRoute planning should include circuit location, provider availability, private peering, gateway sizing, routing requirements, redundancy, and appropriate failover arrangements for business-critical workloads.