View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 41

Which Azure service is designed to provide centralized, stateful network security for traffic flowing through an Azure virtual network?

1. Azure Firewall
2. Azure Traffic Manager
3. Azure DNS
4. Azure Bastion

Correct Answer: 1
Explanation

Azure Firewall is a managed, stateful network security service that can centrally inspect and control network traffic in Azure environments. It supports network and application-level filtering and can be deployed as part of hub-and-spoke or other centralized network architectures. Traffic Manager handles DNS-based traffic routing, Azure DNS provides name resolution, and Bastion provides secure administrative access to virtual machines. Azure Firewall policies should be designed according to application dependencies, segmentation requirements, approved destinations, and organizational security standards.

Question 42

Which Azure feature allows resources in different virtual networks to communicate directly over the Microsoft backbone?

1. VPN Gateway
2. Virtual network peering
3. Traffic Manager
4. Public IP address

Correct Answer: 2
Explanation

Virtual network peering enables communication between Azure virtual networks using the Microsoft backbone network. It can connect virtual networks within the same region or, through global peering, across different Azure regions. This avoids requiring traffic to traverse the public Internet for communication between the peered networks. VPN Gateway provides VPN-based connectivity, Traffic Manager provides DNS-based traffic routing, and public IP addresses provide Internet-facing addressing. Peering architecture should consider address spaces, routing, security rules, connectivity requirements, and limitations related to transitive communication.

Question 43

Which Azure service provides application-layer protection against common web vulnerabilities when deployed with a supported web traffic service?

1. Azure Network Watcher
2. Azure VPN Gateway
3. Web Application Firewall
4. Azure Route Server

Correct Answer: 3
Explanation

Web Application Firewall, or WAF, provides application-layer protection for HTTP and HTTPS traffic and can help defend web applications against common attacks. Depending on the deployment, WAF can be integrated with services such as Application Gateway or Azure Front Door. Network Watcher is used for diagnostics, VPN Gateway provides encrypted connectivity, and Route Server supports dynamic routing. WAF policies should be reviewed and tuned to the application’s legitimate traffic patterns. Security teams should also monitor WAF logs to identify attacks, false positives, and emerging threats.

Question 44

An organization has several Azure virtual networks and wants centralized connectivity through a managed wide-area networking architecture. Which service should it consider?

1. Azure DNS
2. Azure Load Balancer
3. Azure Virtual WAN
4. Azure Bastion

Correct Answer: 3
Explanation

Azure Virtual WAN provides a managed networking architecture for connecting branch locations, remote users, Azure virtual networks, and other network environments through virtual hubs. It can simplify large-scale connectivity and routing compared with manually maintaining numerous individual connections. Azure DNS handles name resolution, Load Balancer distributes traffic, and Bastion provides secure administrative access. Virtual WAN designs should consider hub placement, routing intent, security services, branch connectivity, regional requirements, and the expected scale of the enterprise network.

Question 45

Which Azure component should be used when a workload requires a custom route that directs traffic to a network virtual appliance?

1. User-defined route
2. Public IP prefix
3. Private DNS zone
4. Service tag

Correct Answer: 1
Explanation

A user-defined route allows network administrators to specify a custom next hop for traffic within an Azure virtual network. A common scenario is directing traffic through a network virtual appliance for inspection, filtering, or specialized routing. Public IP prefixes manage public addresses, private DNS zones provide name resolution, and service tags simplify security rule definitions for supported Azure services. User-defined routes should be carefully planned because incorrect routes can cause connectivity failures, asymmetric routing, or unintended bypassing of security inspection points.

Question 46

Which Azure service provides a managed private connection between a virtual network and supported Azure platform services using private IP addressing?

1. Azure Traffic Manager
2. Azure Private Link
3. Azure Network Watcher
4. Azure Load Balancer

Correct Answer: 2
Explanation

Azure Private Link provides private connectivity to supported Azure services through private endpoints. The service can be accessed using a private IP address associated with the private endpoint, helping reduce reliance on publicly accessible service endpoints. Traffic Manager performs DNS-based routing, Network Watcher provides diagnostics, and Load Balancer distributes network traffic. Private Link architecture should include correct DNS resolution, virtual network connectivity, access permissions, and appropriate network security controls. It is particularly useful when organizations require stronger network isolation for sensitive platform services.

Question 47

Which Azure service provides a secure browser-based method for administrators to connect to virtual machines without exposing RDP or SSH directly to the Internet?

1. Azure Traffic Manager
2. Azure Route Server
3. Azure Bastion
4. Azure DNS

Correct Answer: 3
Explanation

Azure Bastion provides secure administrative access to virtual machines through the Azure portal without requiring public IP addresses on the virtual machines for RDP or SSH access. This reduces direct exposure of common management ports to the Internet. Traffic Manager provides DNS-based routing, Route Server manages routing exchange, and Azure DNS provides name resolution. Bastion should be combined with strong identity controls, least-privilege permissions, monitoring, and appropriate network segmentation. Administrative access should remain restricted to authorized personnel and required management scenarios.

Question 48

Which Azure networking capability allows an organization to use a private IP address for accessing a supported PaaS service from a virtual network?

1. Public IP address
2. Azure Traffic Manager
3. Azure Private Endpoint
4. Azure Load Balancer

Correct Answer: 3
Explanation

An Azure Private Endpoint creates a network interface with a private IP address in a virtual network and connects it privately to a supported Azure service. This enables applications to access the service through private connectivity rather than depending on a publicly reachable endpoint. Public IP addresses provide Internet-facing access, Traffic Manager performs DNS-based routing, and Load Balancer distributes traffic. Private Endpoint implementations should include appropriate DNS configuration, access restrictions, subnet planning, and service-level authorization to ensure that private connectivity is also properly secured.

Question 49

Which DNS service is intended for resolving private DNS names within Azure virtual networks?

1. Azure Private DNS
2. Azure Front Door
3. Azure Load Balancer
4. Azure Firewall

Correct Answer: 1
Explanation

Azure Private DNS provides DNS zones for private name resolution within Azure virtual networks. It allows applications and resources to resolve internal names without publishing those records to the public DNS system. Private DNS zones can be linked to virtual networks and can support architectures involving private endpoints and internal services. Front Door provides global application delivery, Load Balancer distributes network traffic, and Azure Firewall provides network security. Private DNS planning should include zone ownership, virtual network links, record management, hybrid resolution, and operational processes.

Question 50

Which Azure networking service can route client requests to different backend origins based on URL paths or host names?

1. Azure VPN Gateway
2. Azure Application Gateway
3. Azure Route Server
4. Azure ExpressRoute

Correct Answer: 2
Explanation

Azure Application Gateway operates at Layer 7 and can make routing decisions based on HTTP information such as host names and URL paths. This makes it suitable for applications where different requests need to be directed to different backend pools. VPN Gateway and ExpressRoute provide network connectivity, while Route Server supports dynamic routing. Application Gateway can also integrate with Web Application Firewall capabilities. A proper design should define listeners, routing rules, backend pools, health probes, certificates, and security policies based on application requirements.

Question 51

Which Azure service can protect public-facing Azure resources from distributed denial-of-service attacks at the network layer?

1. Azure DNS
2. Azure DDoS Protection
3. Azure Bastion
4. Azure Route Server

Correct Answer: 2
Explanation

Azure DDoS Protection provides managed protection against distributed denial-of-service attacks for supported Azure resources. It is designed to help identify and mitigate volumetric network attacks that attempt to overwhelm publicly accessible services. Azure DNS manages name resolution, Bastion provides secure administrative access, and Route Server provides dynamic routing capabilities. DDoS protection should not be treated as the only security control for Internet-facing applications. Organizations should also consider WAF protection, secure application design, monitoring, capacity planning, and appropriate network architecture.

Question 52

A company needs private connectivity from an on-premises data center to Azure through a connectivity provider rather than an Internet-based VPN. Which option is appropriate?

1. Azure Traffic Manager
2. Azure VPN Gateway
3. Azure ExpressRoute
4. Azure Front Door

Correct Answer: 3
Explanation

Azure ExpressRoute provides private connectivity between an organization’s on-premises network and Microsoft cloud services through an ExpressRoute connectivity provider. Unlike an Internet-based site-to-site VPN, ExpressRoute is designed for private network connectivity and can provide predictable networking characteristics for enterprise workloads. Traffic Manager provides DNS-based routing, VPN Gateway provides encrypted VPN connectivity, and Front Door provides global application delivery. ExpressRoute architecture should include appropriate routing, redundancy, security controls, failover planning, and address-space management.

Question 53

Which networking component provides automatic health checking of backend instances before forwarding load-balanced traffic?

1. Azure Load Balancer health probe
2. Azure Private DNS
3. Azure Route Server
4. Azure Public IP prefix

Correct Answer: 1
Explanation

An Azure Load Balancer health probe checks the availability of backend instances and helps determine which instances should receive traffic. If an instance fails the configured health check, the load balancer can stop directing new connections to that instance until it becomes healthy again. Private DNS provides name resolution, Route Server supports routing exchange, and public IP prefixes manage address ranges. Health probe configuration should reflect the actual application’s availability requirements and should test a meaningful endpoint rather than merely confirming that a server responds to basic network traffic.

Question 54

Which Azure networking architecture is commonly used to centralize shared services such as firewalls and VPN gateways while isolating workload networks?

1. Flat network
2. Hub-and-spoke
3. Public-only network
4. Single-subnet architecture

Correct Answer: 2
Explanation

A hub-and-spoke architecture places shared networking services in a central hub while workload-specific virtual networks are deployed as spokes. The hub can host services such as Azure Firewall, VPN Gateway, Bastion, or other centralized components. Spokes can be separated according to applications, business units, or security requirements. A flat network can make segmentation more difficult, while public-only and single-subnet designs can increase exposure or reduce isolation. Effective hub-and-spoke implementations require careful peering, routing, security rules, and traffic inspection design.

Question 55

Which Azure feature can provide centralized route exchange between Azure and network virtual appliances using BGP?

1. Azure DNS Private Resolver
2. Azure Bastion
3. Azure Route Server
4. Azure Traffic Manager

Correct Answer: 3
Explanation

Azure Route Server provides a managed routing service that supports dynamic route exchange between Azure virtual networks and compatible network virtual appliances using BGP. This can simplify environments where routes need to be dynamically advertised or learned instead of being manually maintained. DNS Private Resolver handles DNS resolution, Bastion provides administrative connectivity, and Traffic Manager performs DNS-based application routing. Route Server should be planned together with the routing behavior of network virtual appliances, advertised prefixes, route propagation, and security inspection requirements.

Question 56

Which Azure service can distribute TCP or UDP traffic across multiple backend resources?

1. Azure Load Balancer
2. Azure Application Gateway
3. Azure Traffic Manager
4. Azure Front Door

Correct Answer: 1
Explanation

Azure Load Balancer provides Layer 4 load balancing for TCP and UDP traffic. It distributes connections across backend resources according to configured load-balancing rules and health probes. Application Gateway is primarily designed for Layer 7 web traffic, Traffic Manager provides DNS-based routing, and Front Door provides global application delivery at the HTTP and HTTPS layers. Load Balancer can support both public and internal scenarios. Architects should consider frontend IP configuration, backend pools, health probes, availability requirements, and whether session persistence is required.

Question 57

Which Azure networking capability can resolve DNS queries from Azure workloads while forwarding selected requests to on-premises DNS servers?

1. Azure Traffic Manager
2. Azure DNS Private Resolver
3. Azure Load Balancer
4. Azure Firewall

Correct Answer: 2
Explanation

Azure DNS Private Resolver provides managed DNS resolution capabilities for hybrid environments. Its outbound endpoints can forward DNS queries according to configured rules, including requests that need to be resolved by on-premises DNS infrastructure. This can eliminate the need to maintain custom DNS forwarding virtual machines in Azure. Traffic Manager provides DNS-based traffic routing, Load Balancer distributes network traffic, and Azure Firewall provides security filtering. Hybrid DNS design should define forwarding rules, resolver endpoints, network connectivity, and the authoritative sources for different namespaces.

Question 58

Which Azure connectivity method provides an encrypted connection for individual remote clients into an Azure virtual network?

1. Site-to-site VPN
2. ExpressRoute
3. Point-to-site VPN
4. Virtual network peering

Correct Answer: 3
Explanation

Point-to-site VPN provides an encrypted connection between an individual client device and an Azure virtual network. It is suitable for remote employees, administrators, or other users who need secure access to selected Azure resources. Site-to-site VPN connects entire networks, ExpressRoute provides private connectivity through a connectivity provider, and virtual network peering connects Azure virtual networks. Point-to-site architecture should include an appropriate authentication method, client address pool, routing configuration, access restrictions, and policies that limit users to resources required for their responsibilities.

Question 59

Which Azure service is best suited for DNS-based routing between multiple regional application deployments?

1. Azure Bastion
2. Azure Traffic Manager
3. Azure Firewall
4. Azure Private Endpoint

Correct Answer: 2
Explanation

Azure Traffic Manager provides DNS-based traffic routing between application endpoints and can support multiple routing methods, including performance, priority, geographic, weighted, and other configurations. It is useful when applications are deployed across multiple Azure regions and clients need to be directed toward appropriate endpoints. Bastion provides secure administration, Azure Firewall provides network security, and Private Endpoint provides private connectivity to supported services. Traffic Manager architecture should consider DNS caching, endpoint health, routing objectives, failover behavior, and the geographic distribution of users.

Question 60

Which principle should be followed when designing Azure network security rules for application workloads?

1. Allow all traffic and monitor later
2. Permit only required traffic based on documented needs
3. Use public access whenever possible
4. Disable network segmentation

Correct Answer: 2
Explanation

Network security rules should follow a least-privilege approach by allowing only the traffic required for legitimate application communication. Rules should be based on documented source, destination, protocol, port, and business requirements rather than broad unrestricted access. Allowing all traffic increases the attack surface and makes unauthorized lateral movement easier. Network segmentation, NSGs, Azure Firewall, private connectivity, and controlled routing can work together to enforce appropriate boundaries. Security rules should also be reviewed periodically as applications and dependencies change.