View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 101

Which Azure service can provide outbound Internet connectivity for virtual machines while using a dedicated, scalable source NAT capability?

1. Azure NAT Gateway
2. Azure Bastion
3. Azure Route Server
4. Azure Private DNS

Correct Answer: 1
Explanation

Azure NAT Gateway provides managed outbound Internet connectivity for resources deployed in a subnet. It performs source network address translation and can provide scalable outbound connectivity without requiring each virtual machine to have a public IP address. NAT Gateway is associated with a subnet rather than individual virtual machines. Bastion provides administrative access, Route Server supports dynamic routing, and Private DNS provides name resolution. NAT Gateway is particularly useful when applications require predictable outbound public IP addresses and substantial outbound connection capacity.

Question 102

An enterprise wants to allow its network virtual appliance to exchange routes dynamically with Azure instead of maintaining numerous static routes. Which service should it use?

1. Azure DNS Private Resolver
2. Azure Route Server
3. Azure Front Door
4. Azure Load Balancer

Correct Answer: 2
Explanation

Azure Route Server enables dynamic BGP route exchange between Azure virtual networks and supported network virtual appliances. This can reduce the operational effort required to maintain large numbers of manually configured routes. The appliance can advertise routes to Azure and receive applicable routes from Azure through BGP. DNS Private Resolver focuses on DNS resolution, Front Door provides global application delivery, and Load Balancer distributes network traffic. Route Server should be planned alongside subnet addressing, appliance capabilities, route propagation, and the desired traffic path.

Question 103

Which Application Gateway capability allows the service to increase or decrease capacity based on application traffic without requiring manual instance management?

1. URL path-based routing
2. Autoscaling
3. DNS forwarding
4. BGP route exchange

Correct Answer: 2
Explanation

Application Gateway v2 supports autoscaling, allowing the gateway to adjust capacity based on traffic requirements. This reduces the need for administrators to manually provision gateway instances as application demand changes. Autoscaling is particularly useful for applications with variable workloads because capacity can adapt to changing request volumes. URL path-based routing controls how requests are directed to backend pools, DNS forwarding handles name resolution, and BGP route exchange is associated with routing services. Autoscaling should still be planned with expected traffic patterns, availability requirements, and operational limits.

Question 104

A company wants to connect two Azure virtual networks so that workloads in both networks can communicate using private IP addresses. Which option is appropriate?

1. Azure Front Door
2. Azure Traffic Manager
3. Virtual network peering
4. Azure Firewall

Correct Answer: 3
Explanation

Virtual network peering enables communication between Azure virtual networks using the Azure backbone rather than sending traffic through the public Internet. Depending on the peering configuration and architecture, resources in the connected virtual networks can communicate using private IP addresses. Front Door provides global application delivery, Traffic Manager performs DNS-based routing, and Azure Firewall provides traffic filtering. Peering requires careful address-space planning because overlapping address ranges can prevent successful connectivity. Organizations should also consider routing, gateway transit, security rules, and cross-region requirements.

Question 105

Which Azure networking component is specifically designed to resolve DNS queries from Azure workloads while forwarding selected requests to on-premises DNS infrastructure?

1. Azure DNS Private Resolver
2. Azure Load Balancer
3. Azure Bastion
4. Azure Traffic Manager

Correct Answer: 1
Explanation

Azure DNS Private Resolver provides managed DNS resolution capabilities for Azure virtual networks and hybrid environments. Its inbound and outbound endpoints can support scenarios where Azure workloads need to resolve names from on-premises DNS infrastructure or where on-premises systems need to resolve private Azure names. Load Balancer distributes network traffic, Bastion provides administrative connectivity, and Traffic Manager performs DNS-based application routing. Private Resolver can reduce the need to deploy and maintain custom DNS forwarding virtual machines while supporting centralized hybrid DNS architecture.

Question 106

Which Azure Load Balancer feature allows multiple backend virtual machines to receive traffic on all configured ports and protocols through a load-balancing rule?

1. Floating IP
2. HA ports
3. Connection draining
4. DNS forwarding

Correct Answer: 2
Explanation

The HA ports feature of Azure Load Balancer allows a load-balancing rule to forward traffic across all ports and supported protocols rather than requiring individual rules for each port. This capability is useful in network virtual appliance scenarios where traffic may need to traverse an appliance regardless of destination port. Floating IP is a separate load-balancing capability, connection draining relates to backend removal behavior, and DNS forwarding concerns name resolution. HA ports should be configured carefully because broad forwarding can expose more traffic than a narrowly scoped rule.

Question 107

An administrator needs to configure a centralized network architecture where Internet-bound traffic from several spoke networks must pass through a security appliance in the hub. What should be used to direct that traffic?

1. User-defined routes
2. Azure DNS
3. Traffic Manager
4. Public IP prefix

Correct Answer: 1
Explanation

User-defined routes can direct traffic from spoke virtual networks toward a network virtual appliance or centralized firewall in a hub. A route table can be associated with the relevant subnet and configured with an appropriate next hop, such as a virtual appliance. This supports centralized inspection and security enforcement in hub-and-spoke architectures. Azure DNS manages name resolution, Traffic Manager performs DNS-based endpoint routing, and a public IP prefix reserves public addresses. Routing should be tested carefully to ensure return traffic follows a valid path.

Question 108

Which Azure Virtual Network Manager capability allows an administrator to apply centralized security rules across multiple virtual networks?

1. Application Gateway rewrite rules
2. Security admin rules
3. Traffic Manager routing rules
4. DNS forwarding rules

Correct Answer: 2
Explanation

Azure Virtual Network Manager supports security administration through security admin rules. These rules can provide centralized network security governance across managed virtual networks and can be used alongside existing Network Security Groups. This approach helps organizations apply consistent security requirements across groups of networks rather than configuring every network independently. Application Gateway rewrite rules modify application requests, Traffic Manager rules influence DNS-based routing, and DNS forwarding rules control name resolution paths. Security admin rules should be designed with clear scope, priority, exceptions, and workload requirements.

Question 109

Which ExpressRoute capability allows private connectivity between Azure and an on-premises environment through a connectivity provider rather than an Internet-based VPN tunnel?

1. ExpressRoute
2. Azure Bastion
3. Azure Front Door
4. Azure Traffic Manager

Correct Answer: 1
Explanation

Azure ExpressRoute provides private connectivity between an organization’s network and Microsoft cloud services through an ExpressRoute connectivity provider or supported network exchange. Unlike an Internet-based site-to-site VPN, ExpressRoute uses a private connection and can provide predictable network characteristics. Bastion is designed for secure administrative access, Front Door provides global application delivery, and Traffic Manager provides DNS-based routing. ExpressRoute planning includes circuit capacity, peering, gateway configuration, routing, redundancy, provider availability, and organizational connectivity requirements.

Question 110

Which Application Gateway feature allows administrators to modify HTTP request or response headers before traffic reaches a backend or returns to a client?

1. Network Security Group
2. Rewrite rules
3. Route Server
4. NAT Gateway

Correct Answer: 2
Explanation

Application Gateway rewrite rules can modify HTTP request and response headers and, in supported configurations, URLs. This can help applications adapt requests to backend requirements without changing the application code itself. For example, organizations can alter headers, host-related information, or URL components according to routing requirements. Network Security Groups control network traffic, Route Server handles dynamic route exchange, and NAT Gateway provides outbound Internet connectivity. Rewrite rules should be carefully tested because incorrect transformations can affect authentication, routing, caching, or application behavior.

Question 111

A business wants its Azure web application to remain available when an entire Azure availability zone becomes unavailable. Which Application Gateway design consideration is most relevant?

1. Zone redundancy
2. DNS autoregistration
3. BGP peering
4. Private DNS forwarding

Correct Answer: 1
Explanation

Application Gateway v2 supports zone-redundant deployments in regions where availability zones are supported. Zone redundancy distributes gateway capacity across availability zones, helping maintain service availability if a zone experiences an outage. DNS autoregistration concerns private name resolution, BGP peering concerns route exchange, and DNS forwarding controls how queries are forwarded. High availability should be considered across the entire application path, including backend workloads, DNS, network connectivity, security services, and dependencies. Simply making the gateway redundant does not automatically make every backend component redundant.

Question 112

Which ExpressRoute feature allows private connectivity between Azure virtual networks in different regions through an ExpressRoute circuit?

1. NAT Gateway
2. ExpressRoute Global Reach
3. Azure Bastion
4. Application Gateway

Correct Answer: 2
Explanation

ExpressRoute Global Reach allows customers to connect their on-premises networks through ExpressRoute circuits, supporting private connectivity between connected on-premises locations through Microsoft’s network. It can help organizations build broader private connectivity architectures when multiple sites and ExpressRoute circuits are involved. NAT Gateway provides outbound Internet translation, Bastion provides administrative access, and Application Gateway handles application-layer traffic distribution. Global Reach should be evaluated alongside circuit topology, routing, provider availability, bandwidth, redundancy, and geographic requirements to determine whether it fits the organization’s connectivity design.

Question 113

Which Azure networking feature can group virtual networks into logical network groups for centralized management?

1. Azure Virtual Network Manager network groups
2. Azure Traffic Manager endpoints
3. Azure Load Balancer pools
4. Azure DNS records

Correct Answer: 1
Explanation

Azure Virtual Network Manager uses network groups to organize virtual networks logically for centralized network management. Administrators can use these groups with connectivity and security configurations to apply consistent policies across selected networks. This is useful in environments containing many subscriptions, virtual networks, or application teams. Traffic Manager endpoints manage application destinations, Load Balancer pools contain backend resources, and DNS records provide name resolution information. Network groups can simplify governance, but administrators should establish clear membership criteria and ownership so that policies are applied to the intended networks.

Question 114

Which Azure Firewall capability translates an incoming public destination address to a private destination address for an internal workload?

1. SNAT
2. DNAT
3. BGP
4. DNS forwarding

Correct Answer: 2
Explanation

Destination Network Address Translation, or DNAT, allows Azure Firewall to translate an incoming destination address and port to a private address and port for an internal resource. This can support controlled publication of internal services through a public firewall endpoint. SNAT generally changes the source address, while BGP exchanges routing information and DNS forwarding handles name resolution. DNAT rules should be narrowly defined and combined with appropriate network and application rules. Administrators should also consider logging, monitoring, exposed ports, and the security implications of publishing internal services.

Question 115

Which Azure Load Balancer capability provides a dedicated rule for controlling outbound connections from backend resources?

1. Outbound rules
2. Security admin rules
3. DNS forwarding rules
4. Rewrite rules

Correct Answer: 1
Explanation

Azure Load Balancer outbound rules can explicitly configure outbound connectivity for backend resources using source network address translation. They provide control over the frontend public IP addresses used for outbound connections and can help manage outbound SNAT behavior. Security admin rules govern centralized network security, DNS forwarding rules control name resolution paths, and rewrite rules modify application requests or responses. Outbound connectivity should be planned separately from inbound load balancing because application requirements, public IP allocation, SNAT capacity, and connection patterns can differ substantially.

Question 116

Which Azure DNS Private Resolver component receives DNS queries from on-premises DNS infrastructure so that Azure private names can be resolved?

1. Outbound endpoint
2. Inbound endpoint
3. Load-balancing rule
4. Route table

Correct Answer: 2
Explanation

An inbound endpoint of Azure DNS Private Resolver receives DNS queries from sources such as on-premises DNS infrastructure and allows those queries to be resolved within the Azure DNS environment according to the configured architecture. An outbound endpoint is used when DNS queries need to be forwarded from Azure toward external DNS servers. Load-balancing rules distribute network traffic, while route tables control IP routing. Hybrid DNS designs should clearly define query direction, forwarding rulesets, reachable DNS servers, network connectivity, and the private zones that must be resolved.

Question 117

Which Azure VPN Gateway capability allows two gateway instances to operate simultaneously to improve availability?

1. Active-active mode
2. Weighted DNS routing
3. HA ports
4. URL path routing

Correct Answer: 1
Explanation

VPN Gateway active-active mode allows both gateway instances to be active and handle VPN connections, improving availability compared with a configuration where one instance is primarily active while another remains available for failover. This design can be useful for organizations requiring resilient site-to-site or point-to-site connectivity. Weighted DNS routing belongs to Traffic Manager, HA ports are associated with Load Balancer, and URL path routing is an Application Gateway capability. Active-active deployments still require appropriate on-premises configuration and should be tested for failover and route behavior.

Question 118

Which Azure Front Door component defines a collection of backend origins that can serve the same application workload?

1. Origin group
2. Route table
3. Network security group
4. Virtual network gateway

Correct Answer: 1
Explanation

An Azure Front Door origin group contains origins that can serve requests for an application. Front Door can use health probes to determine origin availability and route requests according to the configured routing behavior. This allows applications to use multiple backend locations and improve resilience. A route table controls network forwarding, an NSG controls network traffic, and a virtual network gateway provides connectivity between networks. Origin groups should be designed with appropriate health probes, backend priorities, latency considerations, security requirements, and application availability objectives.

Question 119

Which Azure networking option is designed to provide private access to a service that an organization owns and wants to make available to consumers through Private Link?

1. Private Link service
2. Traffic Manager
3. Azure Bastion
4. NAT Gateway

Correct Answer: 1
Explanation

Private Link service allows an organization to expose its own service privately to consumers through Azure Private Link. A service provider can place the service behind a supported load balancer and allow approved consumers to connect through private endpoints. This model avoids requiring consumers to access the provider service through a public endpoint. Traffic Manager provides DNS-based routing, Bastion provides administrative access, and NAT Gateway provides outbound connectivity. Private Link service deployments require careful approval, access control, IP planning, load balancer configuration, and consumer-provider coordination.

Question 120

A company wants centralized security inspection for traffic between several spoke networks and external destinations. Which architecture provides a suitable foundation?

1. Independent public IPs on every workload
2. Hub-and-spoke with centralized Azure Firewall
3. A single unrestricted subnet
4. Direct Internet access from every spoke

Correct Answer: 2
Explanation

A hub-and-spoke architecture with centralized Azure Firewall can provide a structured security inspection point for traffic moving between spoke networks and external destinations. User-defined routes can direct appropriate traffic through the hub firewall, allowing centralized policy enforcement and monitoring. Giving every workload direct Internet access or using an unrestricted subnet reduces centralized control and can increase exposure. The architecture should also consider routing symmetry, firewall policy, DNS, private connectivity, logging, high availability, and workload-specific security requirements when designing the complete network path.