Free AZ-700 Practice Test Free Microsoft AZ-700 Practice Test 1 / 35A network engineer wants to monitor packet capture data and diagnose connectivity issues between Azure VMs.Which tool should be used? Network Watcher Azure Monitor NSG flow logs only Azure Advisor Traffic Manager Correct Answer: Network WatcherExplanation:Network Watcher provides advanced diagnostics such as packet capture, connection troubleshooting, and topology views. It is specifically designed for network troubleshooting, whereas Azure Monitor provides broader telemetry and metrics.2 / 35A global application needs to route users to the closest Azure region based on geographic location and DNS resolution.Which service is MOST appropriate? Application Gateway Azure Firewall VPN Gateway Traffic Manager Azure Bastion Correct Answer: Traffic ManagerExplanation:Traffic Manager uses DNS-based routing to direct clients to the closest or healthiest endpoint based on policies such as geographic routing or performance. It operates globally and does not handle traffic directly, unlike Application Gateway.3 / 35A company wants to ensure that Azure PaaS services such as storage accounts are accessible only from a specific VNet and not over public endpoints.Which feature should be used? Public IP prefix NSG rule Load Balancer Traffic Manager Private Endpoint Correct Answer: Private EndpointExplanation:Private Endpoints provide private IP addresses within a VNet for accessing Azure PaaS services. This ensures traffic remains within the private network and prevents exposure to the public internet, significantly improving security.4 / 35A network engineer needs to route traffic from a subnet through a network virtual appliance (NVA) before reaching the internet.What should be configured? User-defined route Network Security Group DNS zone Load balancer rule Private endpoint Correct Answer: User-defined routeExplanation:User-defined routes allow custom routing paths in Azure. By defining a route that sends traffic to an NVA, all outbound traffic from the subnet can be inspected or filtered before reaching its destination. NSGs control access but do not dictate routing paths.5 / 35A company uses Azure Virtual Machines and wants to allow secure RDP access without exposing public IP addresses.Which solution is BEST? Azure Firewall VPN Gateway Azure Bastion NSG rule Load Balancer Correct Answer: Azure BastionExplanation:Azure Bastion provides secure RDP and SSH access directly through the Azure portal without requiring public IPs on virtual machines. This reduces the attack surface and eliminates the need to expose management ports to the internet.6 / 35A company wants to ensure that Azure resources are protected from volumetric network attacks targeting public IP addresses.Which service should be implemented? Azure DDoS Protection Network Watcher Azure Monitor Azure Bastion Private DNS Correct Answer: Azure DDoS ProtectionExplanation:Azure DDoS Protection provides automatic detection and mitigation of distributed denial-of-service attacks. It safeguards public endpoints by absorbing and filtering malicious traffic before it reaches resources. Monitoring tools like Network Watcher only observe traffic and do not mitigate attacks.7 / 35A web application hosted in Azure must distribute incoming traffic across multiple backend servers based on URL paths. The solution must operate at Layer 7.Which service should be used? Azure Load Balancer Traffic Manager Azure Firewall Application Gateway NAT Gateway Correct Answer: Application GatewayExplanation:Application Gateway operates at Layer 7 and supports advanced routing features such as URL-based routing, host-based routing, and SSL termination. Layer 4 solutions like Azure Load Balancer cannot inspect HTTP requests to make routing decisions.8 / 35A company wants to connect its on-premises network to Azure using a private, dedicated connection that does not traverse the public internet.Which service BEST meets this requirement? VPN Gateway VNet peering Azure Bastion Private Endpoint ExpressRoute Correct Answer: ExpressRouteExplanation:ExpressRoute provides a private, dedicated connection between on-premises infrastructure and Azure datacenters. Unlike VPN Gateway, which uses encrypted tunnels over the internet, ExpressRoute ensures higher reliability, lower latency, and increased security by avoiding the public internet entirely.9 / 35A network engineer needs to restrict inbound traffic to a subnet so only HTTPS traffic from a specific IP range is allowed. All other traffic must be denied.Which Azure feature should be used? Network Security Group Network Security Group Azure DNS Route table Route table Correct Answer: Network Security GroupExplanation:NSGs allow fine-grained filtering of inbound and outbound traffic using rules based on IP, port, and protocol. By creating an allow rule for HTTPS and denying everything else, traffic can be tightly controlled. Other services like load balancers do not enforce security policies at this level.10 / 35A company deploys multiple Azure Virtual Networks (VNets) across regions and needs private communication between them without exposing traffic to the internet. The solution must minimize latency and avoid additional gateways.What is the BEST solution? Site-to-site VPN ExpressRoute Azure Firewall VNet peering Azure Firewall Correct Answer: VNet peeringExplanation:VNet peering allows direct private connectivity between VNets over Microsoft’s backbone network, eliminating the need for gateways and reducing latency. Unlike VPN or ExpressRoute, it does not require additional infrastructure or encryption overhead. This makes it the most efficient and cost-effective solution for intra-Azure communication.11 / 35A network engineer must ensure that Azure storage accounts are accessible only from a specific subnet and not from the public internet.What should be configured? Enable service endpoints for storage within subnet Apply NSG rules restricting outbound storage traffic Configure route tables directing traffic to storage Create a private endpoint within the required subnet Use Traffic Manager to restrict storage access Correct Answer: Create a private endpoint within the required subnetExplanation:Private Endpoints fully remove public exposure by assigning private IPs. Service endpoints still allow public endpoint exposure. NSGs cannot secure the service itself.12 / 35A company wants to provide secure access to Azure VMs without exposing management ports to the internet. Administrators must connect through a browser.What should be implemented? Deploy Azure Bastion within the virtual network Configure VPN Gateway for administrative access Assign public IPs with restricted NSG rules Use Traffic Manager to control admin connections Deploy load balancer with inbound NAT rules Correct Answer: Deploy Azure Bastion within the virtual networkExplanation:Azure Bastion enables secure browser-based access without exposing ports. This reduces attack surface significantly. Other options still expose or depend on external access methods.13 / 35A company needs to restrict inbound HTTPS traffic to a web application so only a specific IP range is allowed. All other inbound traffic must be blocked.What should be configured? Deploy Azure Firewall with application filtering rules Configure route tables restricting inbound traffic sources Use Traffic Manager with geographic routing policies Create NSG rules allowing HTTPS from defined source range Assign private endpoints to restrict external connectivity Correct Answer: Create NSG rules allowing HTTPS from defined source rangeExplanation:NSGs can filter inbound traffic by IP and port efficiently. This provides a direct solution without extra infrastructure. Other options introduce unnecessary complexity.14 / 35A network engineer must ensure that traffic between two VNets in different regions remains private and does not traverse the public internet. The solution should not require gateways.What should be used? Deploy site-to-site VPN between the regional VNets Implement ExpressRoute circuit between both environments Configure global VNet peering between the virtual networks Assign private endpoints for cross-region connectivity Use Traffic Manager to route requests between regions Correct Answer: Configure global VNet peering between the virtual networksExplanation:Global VNet peering uses Microsoft’s backbone for private communication. It avoids gateways and reduces latency. VPN and ExpressRoute add complexity and unnecessary overhead here.15 / 35A company deploys a hub-and-spoke network and needs to ensure all outbound traffic from spokes is inspected by a firewall in the hub. Traffic must not bypass the firewall under any condition.What should be configured? Enable peering options allowing forwarded traffic between VNets Configure NSG rules permitting outbound traffic to hub Deploy private endpoints for all spoke resources Assign public IP addresses to spoke virtual machines Apply route tables directing traffic to the hub appliance Correct Answer: Apply route tables directing traffic to the hub applianceExplanation:User-defined routes ensure all outbound traffic is forced through the firewall. Without UDRs, traffic may take default system routes and bypass inspection. Peering settings alone do not enforce traffic flow direction.16 / 35Intermittent connectivity issues occur between VNets in different regions. Peering is configured, but traffic does not always flow.What is the MOST likely cause? DNS resolution intermittently failing Peering missing on one VNet side NSG rules blocking inbound traffic Firewall misconfigured for outbound rules Load balancer health probes failing Correct Answer: Peering missing on one VNet sideExplanation:VNet peering must be configured in both directions. If one side is missing, connectivity fails. DNS and NSGs would not cause intermittent peering failure specifically.17 / 35The company needs DNS resolution between Azure VNets and on-premises systems without deploying DNS servers in each VNet.What should be implemented? NSG rules allowing DNS traffic Route tables for DNS forwarding Traffic Manager for DNS queries Private DNS zones with VNet links Public DNS zones for internal names Correct Answer: Private DNS zones with VNet linksExplanation:Private DNS zones provide centralized name resolution across VNets. Linking VNets ensures seamless communication. Other options do not provide internal DNS resolution.18 / 35Users report inconsistent latency when accessing the web application globally. The company wants to route users to the closest region dynamically.What should be configured? Traffic Manager with weighted routing Application Gateway in each region Load balancer with multiple regions Azure Firewall for traffic routing Front Door with global routing enabled Correct Answer: Front Door with global routing enabledExplanation:Front Door uses Anycast and edge routing to minimize latency. It directs users to the nearest healthy endpoint. Traffic Manager relies on DNS and reacts more slowly.19 / 35The company wants to ensure that backend APIs are not accessible from the internet but remain reachable by frontend applications in other VNets.What should be used? Public IP with NSG restrictions Traffic Manager for API routing Load balancer with inbound rules Private endpoints for API services NAT Gateway for API access Correct Answer: Private endpoints for API servicesExplanation:Private Endpoints restrict access to internal networks using private IPs. This ensures APIs are not publicly exposed. NSGs cannot fully prevent public endpoint access.20 / 35Traffic from spoke VNets sometimes bypasses the Azure Firewall when accessing external endpoints. The engineer needs to ensure that all outbound traffic is always inspected.What should be implemented? Enable peering option for forwarded traffic Configure NSG rules allowing outbound flows Apply route tables sending traffic to firewall Assign public IPs to spoke resources Deploy load balancer for outbound traffic Correct Answer: Apply route tables sending traffic to firewallExplanation:User-defined routes enforce traffic flow through the firewall. Without them, Azure may use default system routes that bypass inspection. Peering and NSGs do not enforce routing paths.21 / 35The company requires automatic failover between ExpressRoute and VPN connections without manual intervention.What must be enabled? BGP on both connections Static routes in route tables NSG rules for failover control Traffic Manager routing policies Private endpoints for redundancy Correct Answer: BGP on both connectionsExplanation:BGP enables dynamic route updates and failover. When one path fails, routes automatically adjust. Static routes cannot adapt dynamically.22 / 35DNS resolution between VNets in different regions intermittently fails. The company wants a centralized and scalable solution.What should be configured? Custom DNS servers in each VNet Private DNS zones linked to VNets NSG rules allowing DNS traffic Route tables for DNS forwarding Public DNS zones for internal use Correct Answer: Private DNS zones linked to VNetsExplanation:Private DNS zones provide centralized name resolution. Linking VNets ensures consistent DNS behavior. Custom DNS servers increase complexity and maintenance.23 / 35Cross-region communication between VNets must remain private and avoid using VPN or ExpressRoute gateways.What should be used? Site-to-site VPN across regions ExpressRoute global reach configuration Global VNet peering between VNets Private endpoints across regions Traffic Manager routing configuration Correct Answer: Global VNet peering between VNetsExplanation:Global VNet peering provides private connectivity over Microsoft’s backbone. It avoids gateway overhead and reduces latency. VPN and ExpressRoute are unnecessary here.24 / 35The company wants to ensure that backend APIs are never exposed publicly but remain accessible to frontend services across VNets and regions.What should be implemented? NSG rules restricting inbound access Application Gateway with HTTPS listeners Traffic Manager for API endpoints Load balancer with internal backend pool Private endpoints for API resources Correct Answer: Private endpoints for API resourcesExplanation:Private Endpoints ensure APIs are accessible only via private IPs. This prevents public exposure entirely. NSGs cannot disable public endpoints at the service level.25 / 35Outbound traffic from spoke VNets sometimes reaches the internet without passing through Azure Firewall. The engineer must enforce inspection for all outbound flows.What should be configured? NSG rules allowing outbound traffic Peering with forwarded traffic enabled Load balancer outbound rules configured Route tables pointing to firewall Private endpoints for internet access Correct Answer: Route tables pointing to firewallExplanation:User-defined routes override default system routing and force traffic through the firewall. Without them, Azure may route traffic directly to the internet. NSGs filter traffic but do not control routing paths.26 / 35A company needs dynamic routing between Azure and on-premises networks that automatically adjusts during failover.What should be used? Static routes NSG rules Traffic Manager BGP Private endpoints Correct Answer: BGPExplanation:BGP (Correct): Dynamically exchanges routes and adapts to failures.Static routes: Require manual updates and do not fail over automatically.NSG rules: Do not influence routing.Traffic Manager: DNS-based routing only.Private endpoints: Not related to routing.27 / 35A subnet must only allow deployment of specific Azure services.What should be configured? NSG rules Route tables Firewall policies Subnet delegation Private endpoints Correct Answer: Subnet delegationExplanation:Subnet delegation (Correct): Restricts a subnet to specific Azure services.NSG rules: Control traffic, not deployment.Route tables: Affect routing only.Firewall policies: Control traffic, not resource types.Private endpoints: Do not restrict deployments.28 / 35A company needs global routing with SSL termination at edge locations for improved performance.What should be used? Azure Front Door Traffic Manager Application Gateway Load Balancer Azure Firewall Correct Answer: Azure Front DoorExplanation:Azure Front Door (Correct): Provides global routing, edge presence, and SSL termination.Traffic Manager: DNS-based and does not terminate SSL.Application Gateway: Regional service, not global edge.Load Balancer: Layer 4 only.Azure Firewall: Does not provide global routing.29 / 35A subnet must route all traffic through a network virtual appliance before reaching its destination.What should be configured? User-defined route NSG rules Private endpoints Traffic Manager Public IP assignment Correct Answer: User-defined routeExplanation:User-defined route (Correct): Directs traffic to a specified next hop such as an NVA.NSG rules: Filter traffic but do not control routing paths.Private endpoints: Used for PaaS access, not routing.Traffic Manager: DNS-based and unrelated.Public IP assignment: Does not affect routing behavior.30 / 35A network engineer must monitor latency between Azure resources without installing agents. The solution should provide ongoing visibility.What should be used? NSG flow logs Connection Monitor Packet capture Azure Monitor metrics Traffic Manager diagnostics Correct Answer: Connection MonitorExplanation:Connection Monitor (Correct): Provides continuous latency and connectivity tracking without requiring agents.NSG flow logs: Show traffic patterns but not latency measurements.Packet capture: Provides detailed snapshots, not ongoing monitoring.Azure Monitor metrics: General metrics, not specific connection paths.Traffic Manager diagnostics: Not designed for internal latency monitoring.31 / 35A company needs to distribute HTTP traffic across backend servers while routing based on URL paths and inspecting headers.What should be used? Azure Load Balancer Traffic Manager Azure Firewall NAT Gateway Application Gateway Correct Answer: Application GatewayExplanation:Application Gateway (Correct): Supports Layer 7 routing, header inspection, and path-based routing.Azure Load Balancer: Operates at Layer 4 and cannot inspect HTTP traffic.Traffic Manager: DNS-based routing only.Azure Firewall: Inspects traffic but does not perform application routing.NAT Gateway: Handles outbound connectivity only.32 / 35A company wants Azure PaaS services to be accessible only through private IP addresses and not through public endpoints.What should be implemented? Service Endpoints NSG outbound rules Route tables Private Endpoints Traffic Manager Correct Answer: Private EndpointsExplanation:Private Endpoints (Correct): These provide private IP access and remove public exposure completely.Service Endpoints: These keep traffic on Azure’s backbone but still use public endpoints.NSG outbound rules: NSGs cannot eliminate public access to a service.Route tables: Routing does not affect service exposure.Traffic Manager: This is unrelated to access control.33 / 35A company needs to allow communication between two subnets but only over TCP port 443. All other traffic must be blocked, and routing must remain unchanged.What should be configured? Configure route tables for filtering Deploy Azure Firewall between subnets Apply NSG rules to both subnets Use Private Endpoints for communication Configure Traffic Manager policies Correct Answer: Apply NSG rules to both subnetsExplanation:Apply NSG rules to both subnets (Correct): NSGs allow filtering by port and protocol without changing routing behavior.Configure route tables for filtering: Route tables do not filter traffic.Deploy Azure Firewall between subnets: This works but is excessive for simple port filtering.Use Private Endpoints for communication: Private Endpoints are for accessing PaaS services, not subnet filtering.Configure Traffic Manager policies: Traffic Manager does not control internal subnet traffic.34 / 35A subnet contains multiple VMs that must access external services using a consistent public IP address. The solution must scale automatically and require minimal management.What should be implemented? Assign a public IP to each virtual machine Configure Azure Firewall outbound rules Use load balancer outbound rules Configure route tables for internet access Associate NAT Gateway with the subnet Correct Answer: Associate NAT Gateway with the subnetExplanation:Associate NAT Gateway with the subnet (Correct): NAT Gateway provides a stable outbound IP for all resources in the subnet and scales automatically.Assign a public IP to each virtual machine: This creates management overhead and does not scale efficiently.Configure Azure Firewall outbound rules: Firewall can provide outbound access, but it is more complex and costly for this requirement.Use load balancer outbound rules: These are limited and less flexible compared to NAT Gateway.Configure route tables for internet access: Route tables control direction, not outbound IP assignment.35 / 35A company deploys multiple VNets and requires private connectivity between them without allowing transit through a third VNet. Each connection must be explicitly configured and controlled.What should be used? Deploy VPN Gateway connections between VNets Configure VNet peering between required VNets Use Azure Virtual WAN for connectivity Configure route tables for traffic control Use Traffic Manager for routing decisions Correct Answer: Configure VNet peering between required VNetsExplanation:Configure VNet peering between required VNets (Correct): Peering is non-transitive and must be explicitly configured, which matches the requirement for controlled connectivity.Deploy VPN Gateway connections between VNets: This would work but introduces unnecessary overhead compared to native peering.Use Azure Virtual WAN for connectivity: This centralizes routing but removes the requirement for explicit pairwise control.Configure route tables for traffic control: Route tables do not establish connectivity, only influence paths.Use Traffic Manager for routing decisions: Traffic Manager is DNS-based and does not provide private VNet connectivity.Your score isThe average score is 0% 0% Restart quiz
