AZ-700: Designing and Implementing Microsoft Azure Networking SolutionsDemo

You have an Azure subscription linked to an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. The subscription contains these resources:

• A virtual network named Vnet1
• An App Service plan named ASP1
• An Azure App Service named webapp1
• An Azure private DNS zone named private.contoso.com

• Virtual machines on Vnet1 that cannot communicate outside the virtual network

You need to ensure that the virtual machines on Vnet1 can access webapp1 by using the URL https://www.private.contoso.com.

Which two actions should you take? Each correct answer is part of the solution.

NOTE: Each correct selection is worth one point.

You have an Azure subscription that contains a virtual network. The virtual network has two subnets named Subnet1 and Subnet2. You have an Azure Application Gateway v2 instance named AppGw1 connected to Subnet1.

You need to move AppGw1 to Subnet2. The solution must minimize downtime.

What should you do?

Your on-premises network contains a VPN device.

You have an Azure subscription that contains a virtual network and a virtual network gateway.

You need to create a Site-to-Site VPN connection with a custom cryptographic policy.

How should you complete the PowerShell script?

$policy = Select… -IkeEncryption AES256 -IkeIntegrity SHA384 -DhGroup DHGroup24 -IpsecEncryption AES256
    -IpsecIntegrity SHA256 -PfsGroup None -SALifeTimeSeconds 14400 -SADataSizeKilobytes 102400000

Select… -Name $Connection16 -ResourceGroupName $RG1 -VirtualNetworkGateway1 $vnet1gw
    -LocalNetworkGateway2 $lng6 -Location $Location1 -ConnectionType IPsec -IpsecPolicies $policy -SharedKey 'AzureA1b2C3'

You have an Azure subscription that contains the resources shown in the following table.

You create a virtual network named Vnet2 in the West US region.

You plan to enable peering between Vnet1 and Vnet2.

You need to ensure that virtual machines connected to Vnet2 can connect to VM1 and VM2 through LB1.

What should you do?

You have an Azure subscription.

You plan to deploy an Azure application gateway named AGW1.

You must implement an external TLS certificate store for AGW1 that meets these requirements:

• Store keys with the highest possible security.
• Minimize administrative effort.

Which certificate-store type and identity type should be used to access the store?

An Azure subscription contains a virtual machine named VM1 and a network security group (NSG) named NSG1. NSG1 has its default rules configured. VM1 runs Windows Server 2022 and has one NIC, named NIC1. NIC1 is associated with NSG1.

You need to block access to the Azure Instance Metadata Service (IMDS) REST API from VM1. The solution must minimize administrative effort.

What should you add to NSG1?

HOTSPOT -

You have an Azure private DNS zone named contoso.com linked to the virtual networks shown in the following table.

The links have auto-registration enabled. You create the virtual machines shown in the following table.

You manually add the following entry to the contoso.com zone:

✑ Name: VM1

IP address: 10.1.10.9 -

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

HOTSPOT -

You have an Azure subscription containing 10 virtual machines. The virtual machines have private IP addresses. The subscription includes the resources shown in the following table.

You need to configure FWPolicy1 to meet these requirements:

• Allow inbound internet connections to the virtual machines on port 4567.
• Block outbound connections from the virtual machines to an FQDN of *.fabrikam.com.

What should you configure in FWPolicy1?

You have an on-premises network.

Your Azure subscription contains a virtual network named VNet1. VNet1 is connected to an Azure Virtual WAN hub named Hub1.

You need to enable connectivity between the on-premises network and VNet1 by using Hub1.

Which three actions should you perform, in sequence?

You purchase an Azure subscription and plan to deploy the resources shown in the following table to that subscription.

You need to create an NSG1 rule named Rule1 that meets these requirements:

• Allow the search servers of App1 to establish outbound HTTP connections to internet services.
• Minimize administrative effort when new search servers are deployed.
• Apply the principle of least privilege.

What should you choose as the source for Rule1?

Solution: Disable the WAF rule with ruleId 920300.

Does this meet the goal?

You have an Azure subscription that contains a virtual network named Vnet1 and an Azure SQL database named SQL1. SQL1 has a private endpoint on Vnet1.

You have a partner company named Fabrikam, Inc. Fabrikam has an Azure subscription that contains a virtual network named Vnet2 and a virtual machine named VM1. VM1 is connected to Vnet2.

You need to give VM1 access to SQL1 by using an Azure Private Link service.

What should you implement on each virtual network? Each resource may be used once, more than once, or not at all.

You are designing the IP address space for subnets in Azure virtual networks.

Which resource type needs IP addresses within the subnets?

You have an Azure subscription containing a virtual network named Vnet1. Vnet1 includes 20 subnets and 500 virtual machines. Every subnet contains a virtual machine that runs network monitoring software.

A network security group (NSG) named NSG1 is associated with each subnet.

When a new subnet is created in Vnet1, an automated process creates an additional network-monitoring virtual machine in that subnet and associates the subnet with NSG1.

You need to create an inbound security rule in NSG1 that allows connections to the network-monitoring virtual machines from the IP address 131.107.1.15. The solution must meet the following requirements:

• Ensure that only the monitoring virtual machines receive a connection from 131.1071.15.
• Minimize changes to NSG1 when a new subnet is created.

What should you use as the destination in the inbound security rule?

You have an Azure subscription containing the resources shown in the following table.

You create a service endpoint policy with these settings:

• Associated subnets: Subnet1
• Service: Microsoft.Storage
• Scope: Single account
• Resource: storage1

Which resources can VM1 access?

You are planning an Azure deployment that will include three virtual networks in the East US Azure region, as shown in the following table.

A Site-to-Site VPN will connect Vnet1 to your company's on-premises network.

You need to recommend a solution that ensures the virtual machines on every virtual network can communicate with the on-premises network. The solution must minimize costs.

What should you recommend for Vnet2 and Vnet3?

You intend to configure BGP for a Site-to-Site VPN connection between a datacenter and Azure.

Which two Azure resources must you configure? Each correct answer represents part of the solution.

NOTE: Each correct selection is worth one point.

You have two Azure subscriptions, named Sub1 and Sub2, that contain the resources shown in the following table.

You need to make sure that App1 can access Resource1 by using the Azure Private Link service.

Which resource should you deploy to each virtual network to satisfy the Private Link service prerequisites?

Which virtual machines can VM1 and VM4 ping successfully?

You have an Azure subscription containing the resources shown in the following table.

NSG1 is linked to the NIC for VM1 and includes the rules shown in the following table.

You collect NSG flow logs for five minutes for these activities:

• Two RDP sessions from VM1 to VM2, each started from a different TCP port
• Three SSH sessions from VM2 to VM1, each started from a different TCP port

You analyze the logs by using Traffic Analytics in Azure Network Watcher.

How many aggregated flow entries will Traffic Analytics identify?

You need to deploy a P2S VPN for the branch-office users. The solution must satisfy the hybrid networking requirements.

What should you do?

You have an Azure subscription.

You must create an Azure application gateway named AGW1 with Azure Web Application Firewall (WAF) enabled. The solution must ensure that WAF blocks every request to AGW1 from an IP address in the 100.64.0.0/24 range.

Which five PowerShell cmdlets should be run, in order?

You plan to deploy an Azure virtual network containing 10 virtual subnets. The subnets will use IPv6 addresses. Each subnet will host up to 200 load-balanced virtual machines.

You need to recommend a load-balancing solution for the virtual network. The solution must meet these requirements:

• The virtual machines and the load balancer must be accessible only from within the virtual network.
• Costs must be minimized.

What should you include in the recommendation?

You have two Azure virtual networks in the East US Azure region, as shown in the following table.

The virtual networks are peered with each other. Each virtual network has four subnets.

You plan to deploy a virtual machine named VM1 to inspect and route traffic among all subnets across both virtual networks.

What is the minimum number of IP addresses that you must assign to VM1?