View Full Microsoft AZ-700 Exam Dumps and Practice Test Dumps.

 

Question 161

Which Azure networking feature can provide centralized DNS forwarding rules for multiple virtual networks?

1. Azure Load Balancer
2. Azure DNS Private Resolver
3. Azure Bastion
4. Azure Traffic Manager

Correct Answer: 2
Explanation

Azure DNS Private Resolver can provide centralized DNS forwarding capabilities for Azure and hybrid environments. Administrators can configure forwarding rulesets so that selected DNS queries are sent to designated DNS servers, such as on-premises DNS infrastructure. This can simplify hybrid DNS management when multiple virtual networks need consistent resolution behavior. Load Balancer distributes network traffic, Bastion provides administrative access, and Traffic Manager performs DNS-based application routing. A centralized DNS architecture should consider forwarding paths, inbound and outbound endpoints, virtual network links, and DNS server reachability.

Question 162

Which Azure networking capability allows an organization to connect an on-premises network to Azure using a dedicated private circuit instead of an Internet-based VPN?

1. ExpressRoute
2. Point-to-site VPN
3. Traffic Manager
4. Azure Bastion

Correct Answer: 1
Explanation

ExpressRoute provides private connectivity between an organization’s network and Microsoft cloud services through an ExpressRoute connectivity provider or supported network exchange. Unlike a standard site-to-site VPN, ExpressRoute does not rely on the public Internet as the primary transport path. Point-to-site VPN is intended for individual client connections, Traffic Manager provides DNS-based routing, and Bastion provides secure administrative access. ExpressRoute planning should consider circuit bandwidth, provider diversity, routing, gateway requirements, redundancy, peering, and the organization’s geographic connectivity requirements.

Question 163

Which Azure networking component can be used to centrally inspect traffic from multiple spoke virtual networks before it reaches the Internet?

1. Azure Firewall
2. Azure DNS
3. Public IP prefix
4. Traffic Manager

Correct Answer: 1
Explanation

Azure Firewall can provide centralized stateful traffic inspection for workloads across multiple virtual networks. In a hub-and-spoke design, spokes can route appropriate Internet-bound or inter-network traffic through a firewall deployed in the hub. This enables centralized policy enforcement, logging, and monitoring. Azure DNS handles name resolution, public IP prefixes manage public address ranges, and Traffic Manager provides DNS-based application routing. The routing design must ensure that traffic reaches the firewall as intended and that return paths remain valid to prevent asymmetric routing or connectivity failures.

Question 164

Which Azure Virtual Network Manager feature can apply connectivity settings to a selected group of virtual networks without manually configuring each network separately?

1. Network groups
2. Front Door origins
3. Application Gateway listeners
4. Load Balancer probes

Correct Answer: 1
Explanation

Azure Virtual Network Manager network groups allow administrators to organize virtual networks into logical collections. Connectivity and security configurations can then target these groups rather than requiring administrators to configure every virtual network independently. This can simplify management in large Azure environments where networks are distributed across subscriptions or organizational units. Front Door origins identify application backends, Application Gateway listeners receive web requests, and Load Balancer probes monitor backend health. Network group membership should be carefully governed so that centralized configurations affect only the intended virtual networks.

Question 165

Which Azure Firewall feature is designed to identify and help protect against network and application threats beyond basic traffic filtering?

1. Threat intelligence
2. DNS autoregistration
3. Gateway transit
4. Connection draining

Correct Answer: 1
Explanation

Azure Firewall includes threat intelligence capabilities that can identify traffic associated with known malicious IP addresses and domains based on Microsoft’s threat intelligence information. This provides an additional security layer beyond manually configured network and application rules. DNS autoregistration manages private DNS records, gateway transit supports shared gateway access across peered networks, and connection draining applies to backend traffic management. Threat intelligence settings should be incorporated into a broader security strategy that includes logging, monitoring, application protection, identity controls, and regular policy review.

Question 166

A web application has two backend servers, but one server becomes unhealthy. Which Application Gateway mechanism helps prevent new requests from being sent to that server?

1. Health probe
2. Public IP prefix
3. BGP session
4. NAT rule

Correct Answer: 1
Explanation

Application Gateway health probes continuously evaluate backend availability according to the configured probe settings. When a backend is identified as unhealthy, Application Gateway can stop directing new requests to that backend and use healthy instances instead. Public IP prefixes reserve public addresses, BGP sessions exchange routing information, and NAT rules perform address translation. Health probes should be configured to test a meaningful application endpoint and should account for expected response codes, protocol, host headers, and timing so that temporary conditions do not result in inappropriate backend removal.

Question 167

Which Azure Load Balancer option is most appropriate when backend resources need outbound connectivity through specific public IP addresses?

1. Outbound rules
2. Network groups
3. WAF policies
4. DNS forwarding rules

Correct Answer: 1
Explanation

Azure Load Balancer outbound rules can explicitly configure how backend instances obtain outbound connectivity through frontend public IP addresses. They provide administrators with greater control over outbound SNAT behavior and the public addresses used for external connections. Network groups are used with Virtual Network Manager, WAF policies protect web applications, and DNS forwarding rules control name resolution paths. Outbound connectivity should be planned based on application connection volume, public IP requirements, SNAT capacity, and security policies rather than assuming that inbound load-balancing configuration automatically provides the desired outbound behavior.

Question 168

Which Azure networking option allows a service provider to approve or reject requests from consumers that want to connect through a private endpoint?

1. Private Link service
2. Traffic Manager
3. Azure Bastion
4. NAT Gateway

Correct Answer: 1
Explanation

A Private Link service allows a service provider to expose a supported service privately to consumers through Azure Private Link. Depending on the configuration, the provider can control which private endpoint connection requests are approved. This creates a controlled provider-consumer relationship without requiring the service to be publicly exposed. Traffic Manager handles DNS-based routing, Bastion provides administrative connectivity, and NAT Gateway provides outbound translation. Private Link service deployments should define approval procedures, consumer authorization, DNS requirements, IP allocation, load balancer configuration, and monitoring responsibilities.

Question 169

Which VPN Gateway configuration can provide higher availability by using two active gateway instances rather than relying on a single active instance?

1. Active-active
2. Point-to-site
3. Weighted routing
4. Floating IP

Correct Answer: 1
Explanation

Active-active VPN Gateway configuration allows both gateway instances to operate simultaneously and handle supported VPN connections. This can improve availability and provide a more resilient connectivity architecture than relying on a single active instance. Point-to-site describes a connection model for individual clients, weighted routing belongs to DNS-based traffic management, and floating IP is a Load Balancer feature. Active-active designs should be coordinated with the on-premises VPN devices and routing configuration. Failover and connection recovery should be tested before relying on the design for critical workloads.

Question 170

Which Azure networking service can distribute TCP or UDP traffic across multiple backend resources?

1. Azure Load Balancer
2. Azure Front Door
3. Azure DNS Private Resolver
4. Azure Bastion

Correct Answer: 1
Explanation

Azure Load Balancer provides Layer 4 traffic distribution for TCP and UDP workloads. It can distribute incoming connections across healthy backend resources according to configured load-balancing rules and health probes. Front Door is designed primarily for global HTTP and HTTPS application delivery, DNS Private Resolver handles DNS resolution, and Bastion provides secure administrative access. Load Balancer deployments should consider frontend configuration, backend pools, health probes, availability zones, inbound rules, outbound connectivity, and the expected connection pattern of the application.

Question 171

Which Azure networking feature can allow an Azure virtual network to use a remote virtual network’s VPN gateway when appropriate peering settings are configured?

1. Gateway transit
2. NAT Gateway
3. Application Security Group
4. Service tag

Correct Answer: 1
Explanation

Gateway transit allows a peered virtual network to use the VPN or ExpressRoute gateway located in another virtual network. This is particularly useful in hub-and-spoke architectures where the hub contains centralized hybrid connectivity and spokes need access to on-premises networks. NAT Gateway provides outbound Internet translation, Application Security Groups organize workloads for NSG rules, and service tags simplify service-based security rules. Gateway transit requires compatible peering configuration on the participating virtual networks and should be combined with appropriate route propagation and security policies.

Question 172

Which Azure service can provide a global entry point for web applications and route requests to origins based on configured routing behavior and health?

1. Azure Front Door
2. Azure Route Server
3. Azure NAT Gateway
4. Azure Network Watcher

Correct Answer: 1
Explanation

Azure Front Door provides a global application entry point for HTTP and HTTPS workloads. It can route requests to configured origins and use health information to avoid sending traffic to unavailable backends. Front Door can also provide features such as caching, TLS termination, routing rules, and web application security integration depending on the configuration. Route Server manages dynamic network routes, NAT Gateway provides outbound translation, and Network Watcher provides diagnostics. Front Door architecture should account for origin security, custom domains, health probes, caching behavior, and application availability requirements.

Question 173

Which Network Security Group feature allows administrators to use a predefined identifier instead of maintaining individual Azure service IP ranges manually?

1. Service tag
2. Private endpoint
3. Gateway transit
4. Public IP prefix

Correct Answer: 1
Explanation

Service tags provide predefined representations of Azure service address prefixes that can be used in supported Network Security Group rules. They reduce the operational burden of manually maintaining changing IP address lists for supported Azure services. Private endpoints provide private connectivity, gateway transit enables use of a remote gateway across peering, and public IP prefixes reserve contiguous public addresses. Service tags should be selected according to the required service scope because a broad tag may allow more traffic than intended. Security rules should always follow the organization’s least-privilege requirements.

Question 174

Which Azure Firewall rule type is used to publish an internal service through a firewall’s public IP address by translating the destination address?

1. DNAT rule
2. Application rule
3. Network rule
4. Route table rule

Correct Answer: 1
Explanation

A DNAT rule on Azure Firewall translates an incoming destination address and port on the firewall’s public interface to the private address and port of an internal resource. This can allow controlled external access to a selected internal service. Application rules control supported application traffic, network rules control traffic based on network attributes, and route tables determine IP forwarding behavior. DNAT exposure should be minimized and protected through appropriate firewall policies, backend security controls, monitoring, logging, and strict limitation of publicly accessible ports.

Question 175

Which Azure service can help an administrator determine whether a virtual machine can reach a specific destination by testing network connectivity?

1. Network Watcher connection troubleshoot
2. Azure Traffic Manager
3. Azure Front Door
4. Azure Private DNS

Correct Answer: 1
Explanation

Network Watcher connection troubleshoot can help determine whether a source resource can communicate with a specified destination. It can provide diagnostic information about connectivity and help identify potential routing, security, or endpoint problems. Traffic Manager manages DNS-based application routing, Front Door provides global web application delivery, and Private DNS handles private name resolution. Connection troubleshooting is most effective when the administrator supplies an accurate source, destination, protocol, and port. Results should be correlated with effective routes, NSG rules, DNS resolution, and firewall policies.

Question 176

Which Azure networking capability can reduce the need to manually maintain routes when a network virtual appliance supports BGP?

1. Azure Route Server
2. Azure Bastion
3. Azure DNS
4. Application Gateway

Correct Answer: 1
Explanation

Azure Route Server provides managed BGP route exchange between Azure and supported network virtual appliances. By allowing appliances to advertise and learn routes dynamically, Route Server can reduce the number of static user-defined routes administrators must maintain. Bastion provides administrative access, Azure DNS provides name resolution, and Application Gateway manages application-layer traffic. Route Server should be deployed with careful consideration of BGP configuration, advertised prefixes, appliance behavior, route selection, failover, and security inspection requirements. Dynamic routing should be validated before being introduced into critical production paths.

Question 177

Which Azure networking service provides private connectivity between an Azure virtual network and an Azure PaaS service by using a network interface in the virtual network?

1. Private endpoint
2. Traffic Manager
3. Public IP prefix
4. Azure Bastion

Correct Answer: 1
Explanation

A private endpoint creates a network interface with a private IP address inside an Azure virtual network and associates it with a supported service through Azure Private Link. Applications can then communicate with the service through private connectivity. Traffic Manager provides DNS-based endpoint routing, public IP prefixes reserve public addresses, and Bastion provides secure virtual machine administration. Private endpoint deployments should include suitable DNS records, private DNS zone integration, subnet planning, authorization, and network security controls to prevent applications from unexpectedly resolving the service to a public address.

Question 178

Which Azure networking design uses a centralized hub for shared services while separate spokes contain application workloads?

1. Hub-and-spoke
2. Mesh-free public network
3. Single-subnet architecture
4. Internet-only architecture

Correct Answer: 1
Explanation

A hub-and-spoke design places shared networking services in a centralized hub while separate spoke virtual networks contain application workloads. The hub may contain services such as Azure Firewall, VPN Gateway, ExpressRoute Gateway, Bastion, and DNS infrastructure. Spokes can remain isolated while using approved connectivity through the hub. This approach can improve segmentation and centralized governance compared with placing all workloads in one network. The design requires appropriate peering, routing, security rules, DNS configuration, address planning, and redundancy to operate reliably at scale.

Question 179

Which Azure networking component is responsible for monitoring whether backend instances are healthy before sending them load-balanced traffic?

1. Health probe
2. Public IP prefix
3. Route table
4. DNS zone

Correct Answer: 1
Explanation

A health probe checks the availability of backend resources before the load-balancing service sends new traffic to them. Azure Load Balancer uses health probes to determine whether backend instances are available for load-balancing rules. Similar health-check concepts are also used by other Azure application delivery services. A public IP prefix manages public addresses, route tables define forwarding paths, and DNS zones provide name resolution. Probe configuration should use an appropriate protocol, port, and endpoint so that the service accurately represents the application’s ability to handle requests.

Question 180

An enterprise has multiple Azure regions and wants resilient private connectivity to its on-premises network. Which design consideration is most appropriate?

1. Deploy only one connectivity path and avoid redundancy
2. Plan redundant connectivity paths and appropriate regional gateways
3. Use public IP addresses for all internal resources
4. Disable dynamic routing to prevent route changes

Correct Answer: 2
Explanation

Resilient hybrid connectivity requires redundancy across appropriate network paths, gateways, circuits, or VPN connections. For multi-region Azure deployments, organizations should consider regional gateway placement, ExpressRoute or VPN connectivity, route exchange, provider redundancy, and failover behavior. A single connectivity path creates a potential single point of failure, while exposing internal resources through public IP addresses does not provide an appropriate private connectivity strategy. Dynamic routing can support resilient designs when properly configured. Failover should be tested regularly so that recovery behavior is understood before a production outage occurs.