Good AZ-700 Exam Dumps Save Your Preparation Time

1. HOTSPOT

Your on-premises network uses an IP address range of 10.1.0.0 to 10.1.255.255.

You plan to deploy a new Azure virtual network solution that will include the following elements:

• A virtual network named VNet1

• A Site-to-Site (S2S) VPN connection between VNet1 and the on-premises network

• GatewaySubnet in VNet1, which will be used as a route-based virtual network gateway

You need to recommend which subnet masks to assign to VNet1 and GatewaySubnet.

The solution must meet the following requirements:

• Maximize the number of available IP addresses on VNet1.

• Minimize the number of available IP addresses on GatewaySubnet

Which address spaces should you assign to VNet1 and GatewaySubnet? To answer, select them appropriate options in the answer area. NOTE: Each correct selection is worth one point.

2. You have an Azure subscription that contains an ExpressRoute Standard gateway named GW1.

You need to upgrade GW1 to support ExpressRoute FastPath. The solution must minimize downtime.

Which SKU should you use?

3. You have an Azure subscription that contains the resources shown in the following table.





You need to ensure that the virtual machines can access storage1, storage2, and DB1 by using service endpoints.

What is the minimum number of service endpoints you should create?

4. HOTSPOT

You ate configuring the DNS forwarding ruleset for DNSR1

You need to configure the destination IP address for azure.proseware.com and for corp.proseware.com. The solution must meet the general requirements.

Which IP addresses should you configure for each namespace? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

5. HOTSPOT

You plan to deploy Azure Virtual WAN.

You need to deploy a virtual WAN hub that meets the following requirements:

✑ Supports 10 sites that will connect to the virtual WAN hub by using a Site-to-Site VPN connection

✑ Supports 8 Gbps of ExpressRoute traffic

✑ Minimizes costs

What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

6. SIMULATION

Task 7

You plan to deploy 100 virtual machines to subnet4-1. The virtual machines will NOT be assigned a public IP address. The virtual machines will call the same API. which is hosted by a third party. The virtual machines will make more than 10,000 calls per minute to the API.

You need to minimize the risk of SNAT port exhaustion. The solution must minimize administrative effort.

7. HOTSPOT

Your company has 40 branch offices across North America and Europe.

You have an Azure subscription that contains the following virtual networks:

• Two networks in the East US Azure region

• Three networks in the West Europe Azure region

You need to implement Azure Virtual WAN.

The solution must meet the following requirements:

• Each branch office in North America must have an ExpressRoute circuit and a Site-to-Site VPN that

connects to the East US region.

• Each branch office in Europe must have an ExpressRoute circuit and a Site-to-Site VPN that connects to the West Europe region.

• Transitive connections must be supported between all the branch offices and all the virtual networks.

• Costs must be minimized.

What is the minimum number of Virtual WAN resources required? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

8. HOTSPOT

Your on-premises network contains the subnets shown in the following table.





The network contains a firewall named FW1 that uses a public IP address of 131.107.100.200.

You have an Azure subscription that contains the resources shown in the following table.





You plan to configure a Site-to-Site (S2S) VPN named VPN1 that will connect GW1 to FW1.

You need to configure LNG1 to support VPN1.

The solution must meet the following requirements:

• Ensure that the resources on Subnet1 and Subnet2 can communicate with the resources on VNe1l.

• Minimize administrative effort.

How should you configure LNG1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

9. DRAG DROP

You have art Azure subscription.

You plan to deploy Azure Front Door with Azure Web Application Firewall (WAF).

You plan to implement custom rules and managed rules that meet the following requirements:

• Block malicious bots.

• Throttle client IP addresses that exceed 100 connections per minute.

You need to identify which Front Door SKU to configure, and which type of rule to configure for each requirement. The solution must minimize administrative effort and costs.

What should identify? To answer, drag the appropriate options to the correct targets. Each option may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

10. You have an Azure subscription that contains the public IP addresses shown in the following table.





You plan to deploy a NAT gateway named NAT1.

Which public IP addresses can be used as the public IP address for NAT1?

A. IP3 and IP5 only

B. IP5 only

C. IP1, IP3, and IP5 only

D. IP3 only

E. IP2 and IP4 only

11. You have an Azure subscription.

You plan to deploy Azure Firewall Premium, enable all the Premium features, and configure both network and application rules.

Which type of rule will the firewall process first?

12. HOTSPOT

You have the Azure environment shown in the exhibit.





You have virtual network peering between Vnet1 and Vnet2. You have virtual network peering between Vnet4 and Vnet5.

The virtual network peering is configured as shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

13. Task 10

You need to configure VNET1 to log all events and metrics. The solution must ensure that you can query the events and metrics directly from the Azure portal by using KQL.

14. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.

Hub1 has a security status of Unsecured.

You need to ensure that the security status of Hub1 is marked as Secured.

Solution: You implement Azure Web Application Firewall (WAF).

Does this meet the requirement?

15. HOTSPOT

You need to implement name resolution for the cloud.liwareinc.com. The solution must meet the networking requirements.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

16. You have a hybrid environment that uses ExpressRoute to connect an on-premises network and Azure.

You need to log the uptime and the latency of the connection periodically by using an Azure virtual machine and an on-premises virtual machine.

What should you use?

17. HOTSPOT

Which virtual machines can VM1 and VM4 ping successfully? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

18. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an Azure Virtual Desktop host pool named Pool1.

You need to implement Azure Firewall and TLS inspection for all the outbound traffic from Pool1.

Which two resources should you configure? Each correct answer present part of the solution. NOTE: Each correct answer is worth one point

19. HOTSPOT

You have an Azure subscription that contains an app named Appl.

App1 is hosted on the Azure App Service instances shown in the following table.





You need to implement Azure Traffic Manager to meet the following requirements:

• App1 traffic must be assigned equally to each App Service instance in each Azure region.

• App1 traffic from North Europe must be routed to the Appl instances in the North Europe region.

• App1 traffic from North America must be routed to the Appl instances in the East US Azure region.

20. You have an on-premises network named Site1.

You have an Azure subscription that contains a storage account named storage1 and a virtual network named VNet1. VNet1 contains a subnet named Subnet1. A private endpoint for storage1 is connected to Subnet1 Site1 is connected to VNet1 by using a Site-to-Site (S2S) VPN.

You need to control access to storage1 from Site1 by using network security groups (NSGs).

What should you do first?

21. HOTSPOT

You have the Azure environment shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

22. You are planning the IP addressing for the subnets in Azure virtual networks.

Which type of resource requires IP addresses in the subnets?

23. HOTSPOT

You have an Azure subscription. The subscription contains multiple Azure SQL Database resources and a virtual network named VNet1 that has five subnets. All the subnets are associated with a network security group (NSG) named NSG1. NSG1 blocks all outbound traffic, unless specifically allowed by a rule.

Each subnet contains 50 virtual machines. Multiple virtual machines host instances of SQL Server on Virtual Machines and will be configured to replicate with the Azure SQL Database resources.

You need to configure a new outbound rule in NSG1 to allow the SQL Server on Virtual Machines instances to connect to the Azure SQL Database resources.

The solution must meet the following requirements:

• Minimize modifications to NSG1 when additional instances of SQL Server on Virtual Machines are deployed.

• Ensure that only SQL Server on Virtual Machines instances can connect to the Azure SQL Database resources.

How should you configure each setting for the new outbound rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

24. You have an Azure virtual network named VNet1 that contains the subnets shown in the following table.





You need to deploy an Azure application gateway named AppGW1 to VNetl.

To where can you deploy AppGW1?

25. You need to configure a custom rule for APPGWI-WAFPolicy to allow only connections that originate from FD1. The solution must support the planned changes.

Which Match type and Match variable should you select?

26. DRAG DROP

You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.

You plan to deploy the resources shown in the following table.





You need to deploy two load balancers to manage the traffic for VMSS1, VM 1. and VM2.

The solution must meet the following requirements:

• Either VM1 or VM2 must inspect all the traffic from the internet to App 1.

• All user connections from the internet to App1 must be load balanced.

• Costs must be minimized.

Which load balancer SKU should you include in the solution? To answer, drag the appropriate SKUs to the correct resources. Each SKU may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

27. HOTSPOT

You have an Azure application gateway named AppGW1 that provides access to the following hosts:

* www.adatum.com

* www.contoso.com

* www.fabrikam.com

AppGW1 has the listeners shown in the following table.





You create Azure Web Application Firewall (WAF) policies for AppGW1 as shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

28. SIMULATION

Task 1

You need to ensure that virtual machines on VNET1 and VNET2 are included automatically in a DNS zone named contoso.azure. The solution must ensure that the virtual machines on VNET1 and VNET2 can resolve the names of the virtual machines on either virtual network.

29. 1. Topic 1, Litware. Inc Case Study 1



Overview

Litware. Inc. is a financial company that has a main datacenter in Boston and 20 branch offices across the United States. Users have Android, iOS, and Windows 10 devices.



Existing Environment:

Hybrid Environment

The on-prernises network contains an Active Directory forest named litwareinc.com that syncs to an Azure Active Directory (Azure AD) tenant named litwareinc.com by usinq Azure AD Connect.

All the offices connect to a virtual network named Vnetl by using a Site-to-Site VPN connection.



Azure Environment

Litware has an Azure subscription named Sub1 that is linked to the litwareinc.com Azure AD tenant.

Sub1 contains resources in the East US Azure region as shown in the following table.







There is bidirectional peering between Vnet1 and Vnet2. There is bidirectional peering between Vnet1 and Vnet3. Currently, Vnet2 and Vnet3 cannot communicate directly.



Requirements:

Business Requirements

Litware wants to minimize costs whenever possible, as long as all other requirements are met.



Virtual Networking Requirements

Litware identifies the following virtual networking requirements:

* Direct the default route of 0.0.0.0/0 on Vnet2 and Vnet3 to the Boston datacenter over an ExpressRoute circuit.

* Ensure that the records in the cloud.litwareinc.com zone can be resolved from the on-premises locations.

* Automatically register the DNS names of Azure virtual machines to the cloud.litwareinc.com zone.

* Minimize the size of the subnets allocated to platform-managed services.

* Allow traffic from VMScaleSet1 to VMScaleSet2 on the TCP port 443 only.



Hybrid Networking Requirements

Litware identifies the following hybrid networking requirements:

* Users must be able to connect to Vnet1 by using a Point-to-Site (P2S) VPN when working remotely. Connections must be authenticated by Azure AD.

* Latency of the traffic between the Boston datacenter and all the virtual networks must be minimized.

* The Boston datacenter must connect to the Azure virtual networks by using an ExpressRoute FastPath connection.

* Traffic between Vnet2 and Vnet3 must be routed through Vnet1.



PaaS Networking Requirements

Litware identifies the following networking requirements for platform as a service (PaaS):

* The storage1 account must be accessible from all on-premises locations without exposing the public endpoint of storage1.

* The storage2 account must be accessible from Vnet2 and Vnet3 without exposing the public endpoint of storage2.



You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements.

Which two actions should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

30. You have an Azure Private Link service named PL1 that uses an Azure load balancer named LB1. You need to ensure that PL1 can support a higher volume of outbound traffic.

What should you do?

31. You have an Azure virtual network named Vnet1.

You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines must be prevented from accessing any Azure Storage

resources.

Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

A. an allow rule that has the IP address range of Vnet1 as the source and destination of Sq1.EastUS

B. a deny rule that has a source of VirtualNetwork and a destination of Sq1

C. a deny rule that has a source of VirtualNetwork and a destination of 168.63.129.0/24

D. a deny rule that has the IP address range of Vnet1 as the source and destination of Storage

32. HOTSPOT

You have the Azure firewall shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

33. HOTSPOT

You have an Azure subscription that contains the resource groups shown in the following table.





You have the virtual networks shown in the following table.





Vne1l contains two virtual machines named VM1 and VM2. Vnet2 contains two virtual machines named VM3 and VM4. You have the network security groups (NSGs) shown in the following table that include only default rules.

You have the Azure load balancers shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

34. DRAG DROP

You have an on-premises network.

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway.

You need to connect VNet1 to the on-premises network by using an ExpressRoute circuit.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

35. Task 6

You need to ensure that all hosts deployed to subnet3-2 connect to the internet by using the same static public IP address. The solution must minimize administrative effort when adding hosts to the subnet.

36. You have an Azure subscription that contains the resources is shown in the following table.





You need to ensure that the apps hosted on VM1 can resolve the IP address of the

What should you create first?

37. HOTSPOT

You have an Azure Traffic Manager parent profile named TM1. TM1 has two child profiles named TM2 and TM3.

TM1 uses the performance traffic-routing method and has the endpoints shown in the following table.





TM2 uses the weighted traffic-routing method with MinChildEndpoint = 2 and has the endpoints shown in the following table.





TM3 uses priority traffic-routing method and has the endpoints shown in the following table.





The App2, App4, and App6 endpoints have a degraded monitoring status.

To which endpoint is traffic directed? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point

38. You have an Azure virtual machine named VM1.

You need to capture all the network traffic of VM1 by using Azure Network Watcher.

To which locations can the capture be written?

39. HOTSPOT

You have an Azure subscription that contains the resources shown in the following table.





You need to ensure that network traffic is routed over the Azure backbone network for the following scenarios:

• Traffic from SQIMI1 to storage1

• Traffic from domain joined servers on VNet2 to storage1

The solution must minimize costs.

What should you configure for each scenario? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

40. HOTSPOT

Your company has an Azure virtual network named Vnet1 that uses an IP address space of 192.168.0.0/20. Vnet1 contains a subnet named Subnet1 that uses an IP address space of 192.168.0.0/24.

You create an IPv6 address range to Vnet1 by using a CIDR suffix of /48.

You need to enable the virtual machines on Subnet1 to communicate with each other by using IPv6 addresses assigned by the company. The solution must minimize the number of additional IPv4 addresses.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

41. You have an Azure subscription that contains the resources shown in the following table.





You need to configure FW1 to filter traffic that originates from VNet1 and targets the FQDN of SQLDB1 Which type of rule should you use?

42. SIMULATION

Task 9

You plan to use VNET4 for an Azure API Management implementation.

You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canad

a You do NOT need to create the application gateway to complete this task.

43. Task 8

You need to ensure that the storage34280945 storage account will only accept connections from hosts on VNET1

44. HOTSPOT

You have an Azure subscription. The subscription contains two virtual machine scale sets that host two apps named App1 and App2, an Azure Private Link service named PLS1. and an Azure load balancer named LB1. PLS1 uses LB1 and has TCP Proxy V2 disabled PLS1 provides access to App1 only.

You need to perform the following actions:

• Provide access to App1 and App2.

• Increase the number of supported private endpoint connections.

What should you modify to provide access to App2, and what should you modify to increase the number of supported connections? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

45. You have an Azure subscription that contains the resources shown in the following table.





You need to ensure that VM1 and VM2 can connect only to storage1.

The solution must meet the following requirements:

• Prevent VM1 and VM2 from accessing any other storage accounts.

• Ensure that storage1 is accessible from the internet.

What should you use?

46. HOTSPOT

Your on-premises network contains a VPN device.

You have an Azure subscription that contains a virtual network and a virtual network gateway.

You need to create a Site-to-Site VPN connection that has a custom cryptographic policy.

How should you complete the PowerShell script? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

47. HOTSPOT

You have an Azure subscription that contains the resources shown in the following table.





You plan to deploy an app named App1 to meet the following requirements.

• External users must be able to access App1 from the internet.

• App1 will be load balanced across all the virtual machines.

• App1 will be hosted on VM1, VM2. VM3. and VM4.

• App1 must be available if an Azure region fails.

• Costs must be minimized.

You need to implement a global load balancer solution for App.

What should you configure? To answer, select the appropriate options in the answer area. NOTE: Bach correct answer is worth one point.

48. HOTSPOT

You need to recommend a configuration for the ExpressRoute connection from the Boston datacenter. The solution must meet the hybrid networking requirements and business requirements.

What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

49. HOTSPOT

You have two Azure subscriptions.

You need to perform the following actions in the East US Azure region of each subscription:

• Deploy 50 virtual machines to availability zone 1.

• Deploy 50 virtual machines to availability zone 2.

• Deploy 50 virtual machines to availability zone 3.

What is the minimum number of virtual networks and /25 subnets you should create? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

50. You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements.

Which connectivity method should you use?

51. HOTSPOT

You have an on-premises network that includes the sites shown in the following table.





Each site is connected to the Internet by a firewall. All sites are connected to an SD-WAN. Each site is configured to propagate routes by using BGP.

You have an Azure subscription that includes a virtual network named Vnet1 that contains a Virtual Network Gateway named Gateway 1.

You create a local network gateway with the configuration shown in the gateway exhibit (Click the Gateway tab.)





You create a Site-to-Site (S2S) connection with the configuration shown in connection exhibit. (Click the Connection tab)





For each of the following statements, select Yes if the statement is true Otherwise, select No. NOTE: Each correct selection is worth one point.

52. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains the following resources:

* A virtual network named Vnet1

* A subnet named Subnet1 in Vnet1

* A virtual machine named VM1 that connects to Subnet1

* Three storage accounts named storage1, storage2, and storage3

You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

Solution: You create a network security group (NSG) and associate the NSG to Subnet1.

Does this meet the goal?

53. You have the Azure environment shown in the exhibit.





VM1 is a virtual machine that has an instance-level public IP address (ILPIP).

Basic Load Balancer uses a public IP address. VM1 and VM2 are in the backend pool.

NAT Gateway uses a public IP address named IP3 that is associated to Subnet A.

VNet1 has a virtual network gateway that has a public IP address named IP4.

When initiating outbound traffic to the internet from VM1, which public address is used?

54. You have an Azure subscription that contains the resources shown in the following table.





Gateway1 provides access to App1 by using a URL of http://app1.contoso.com.

You create a new web app named App2.

You need to configure Gateway1 to enable minimize administrative effort.

What should you configure on Gateway1?

55. HOTSPOT

You have the network security groups (NSGs) shown in the following table.





In NSG1, you create inbound rules as shown in the following table.





You have the Azure virtual machines shown in the following table.





NSG2 has only the default rules configured.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

56. You have an Azure subscription that contains the resources shown in the following table.





Subshell contains Three virtual machines that host an app named App1. App1 is accessed by using the SFTP protocol.

From NSG1. you configure an inbound security rule named Rule2 that allows inbound SFTP connections to ASG1.

You need to ensure that the inbound SFTP connections are managed by using ASG1. The solution

must minimize administrative effort.

What should you do?

57. HOTSPOT

You have an on-premises network and an Azure virtual network named VNet1.

You need to implement Azure Extended Network. The solution must minimize costs.

Which type of virtual machine should you deploy to VNet1, and which tool should you use to configure Azure Extended Network? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

58. You have the Azure subscriptions shown in the following table.





Each virtual network contains 20 internet-accessible resources that are assigned public IP addresses. You need to implement Azure DDoS Network Protection to protect the resources. The solution must minimize costs.

What is the minimum number of DDoS Network Protection plans you should deploy?

59. DRAG DROP

Your on-premises network contains two subnets named Subnet1 and Subnet2. Subnet2 contains a Hyper-V host that contains two virtual machines named VM1 and VM2. VM1 and VM2 are connected to Subnet2.

You have an Azure virtual network named VNet1 that contains GatewaySubnet and a subnet named VSubnet1. VNet1 is connected to the on-premises network by using a Site-to-Site (S2S) VPN connection.

You plan to migrate VM1 to VNet1 and maintain the existing IP address of VM1. VM2 will remain on Subnet2.

You need to prepare the environment to ensure that VM1 can communicate with VM2 once the migration is complete.

Which five actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.’

60. HOTSPOT

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

61. You have an Azure subscription that contains the resources shown in the following table.





Users on HP1 connect to App1 by using a URL of https://app1.comoso.com.

You need to ensure that the IDPS on FW1 can identify security threats in the connections from HP1 to Server1.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

62. HOTSPOT

You have an Azure subscription that contains six Azure App Service apps. The apps have an identical configuration and are deployed across multiple Azure regions.

You plan to deploy Azure Front Door to load balance traffic across the apps.

You need to ensure that the round robin load-balancing algorithm will send traffic only to a limited number App Service apps based on their proximity to a user. The solution must minimize administrative effort.

What should you modify, and what should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

63. HOTSPOT

You have an Azure subscription that contains a virtual network named VNet1.

VNet1 contains the resources shown in the following table.





You need to publish App1 by using AG1 and a URL of https://app1.contoso.com.

The solution must meet the following requirements:

• TLS connections must terminate on AG1.

• Minimize the number of targets in the backend pool of AG1.

• Minimize the number of deployed copies of the SSL certificate of App1.

How many locations should you import to the certificate, and how many targets should you add to the backend pool of AG1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

64. Topic 4, Labs / Tasks



Task 1

You plan to deploy a firewall to subnetl-2. The firewall will have an IP address of 10.1.2.4.

You need to ensure that traffic from subnetl-1 to the IP address range of 192.168.10.0/24 is routed through the firewall that will be deployed to subnetl-2. The solution must be achieved without using dynamic routing protocols.

65. You have an Azure subscription that contains the Azure app service web apps show in the following table:





You need to deploy Azure Traffic Manager.

The solution must meet the following requirements:

• Traffic to https//www.fabrikam.com must be directed to App1eu.

• If App1eu becomes unresponsive, all the traffic to https://www.fabrikam.com must be directed to App1us.

You need to implement Traffic Manager to meet the requirements.

Which two resources should you create? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

66. HOTSPOT

You have an Azure virtual network named Vnet1 that contains two subnets named Subnet1 and Subnet2. Both subnets contain virtual machines.

You create a NAT gateway named NATgateway1 as shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

67. Your company has an office in New York.

The company has an Azure subscription that contains the virtual networks shown in the following table.





You need to connect the virtual networks to the office by using ExpressRoute.

The solution must meet the following requirements:

• The connection must have up to 1 Gbps of bandwidth.

• The office must have access to all the virtual networks.

• Costs must be minimized.

How many ExpressRoute circuits should be provisioned, and which ExpressRoute 5KU should you enable?

68. You have 10 on-premises networks that are connected by using a 3rd party Software Defined Wide Area Network (SD-WAN) solution. You have an Azure subscription that contains five virtual networks. You plan to connect the Azure virtual networks and the on-premises networks by using an Azure Virtual WAN with a single virtual WAN hub.

You need to ensure that the Azure Virtual WAN can act as a node in the 3rd party SD-WAN solution.

What should you include in the solution?

69. You have an Azure subscription that contains the public IPv4 addresses shown in the following table.





You plan to create a load balancer named LB1 that will have the following settings:

* Name: LB1

* Location: West US

* Type: Public

* SKU: Standard

Which public IPv4 addresses can be used by LB1?

70. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals- Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have on Azure subscription that contains an Azure Virtual WAN named VWAN1. VWAN1 contains a hub named Hub1.

Hub! has a security status of Unsecured.

You need to ensure that the security status of Hub1 is marked as Secured.

Solution: You implement Azure NAT Gateway.

Does this meet the requirement?

71. HOTSPOT

You have an Azure subscription that contains the resources shown in the following table.





The virtual network topology is shown in the following exhibit.





Firewall1 is configured as shown in following exhibit.





FirewallPolicy1 contains the following rules:

• Allow outbound traffic from Vnet1 and Vnet2 to the internet.

• Allow any traffic between Vnet1 and Vnet2.

No custom private endpoints. service endpoints. routing tables, or network security groups (NSGs) were created.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

72. SIMULATION

Task 5

You need to archive all the metrics of VNET1 to an existing storage account.

73. HOTSPOT

You need to identify which IP address space to allocate for the planned deployment of PRDNS1 to HubVNet and SpokeVNet. The solution must meet the general requirements.

What should you identify for each virtual network? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

74. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result, these questions will not appear in the review screen.

You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1. You need to configure a rate limit for incoming requests to AFD1.

Solution: You configure a managed rule for WAF1.

Does this meet the goal?

75. HOTSPOT

You are planning an Azure solution that will contain the following types of resources in a single Azure region:

✑ Virtual machine

✑ Azure App Service

✑ Virtual Network gateway

✑ Azure SQL Managed Instance

App Service and SQL Managed Instance will be delegated to create resources in virtual networks.

You need to identify how many virtual networks and subnets are required for the solution.

The solution must minimize costs to transfer data between virtual networks.

What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

76. You need to configure GW1 to meet the network security requirements for the P2S VPN users.

Which Tunnel type should you select in the Point-to-site configuration settings of GW1?

77. Task 2

You need to create an Azure Firewall instance named FW1 that meets the following requirements:

• Has an IP address from the address range of 10.1.255.0/24

• Uses a new Premium firewall policy named FW-pohcy1

• Routes traffic directly to the internet

78. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have two Azure virtual networks named Vnet1 and Vnet2.

You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.

You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit.

Vnet2 can use the remote gateway.

You discover that Client1 cannot communicate with Vnet2.

You need to ensure that Client1 can communicate with Vnet2.

Solution: You download and reinstall the VPN client configuration.

Does this meet the goal?

79. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it as a result, these questions will not appear in the review screen.

You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAFT. You need to configure a rate limit for incoming requests to AFD1.

Solution: You configure a custom rule for WAF1.

Does this meet the goal?

80. HOTSPOT

You have an on-premises datacenter.

You have an Azure subscription that contains 10 virtual machines and a virtual network named VNe1l in the East US Azure region. The virtual machines are connected to VNet1 and replicate across three availability zones.

You need to connect the datacenter to VNetl1by using ExpressRoute.

The solution must meet the following requirements:

• Maintain connectivity to the virtual machines if two availability zones fail.

• Support 1000-Mbps connections-

What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

81. HOTSPOT

You create NSG10 and NSG11 to meet the network security requirements.

For each of the following statements, select Yes it the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

82. DRAG DROP

Your on-premises network uses an IP address space of 10.0.0.0/20.

You have an Azure subscription that contains the resources shown in the following table.





The on-premises network is connected to HubVnet by using a Site-to-Site (S2S) VPN.

You deploy an Azure firewall named AZFW1 to HubVNet.

You need to ensure that AZFW1 can inspect all the traffic between the on-premises network and SpokeVNet.

What should you do in RT1? To answer, drag the appropriate destination to the correct route. Each resource may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

83. SIMULATION

Task 6

You have two servers that are each hosted by a separate service provider in New York and Germany. The server hosted in New York is accessible by using a host name of ny.contoso.com. The server hosted in Germany is accessible by using a host name of de.contoso.com.

You need to provide a single host name to access both servers. The solution must ensure that traffic originating from Germany is routed to de contoso.com. All other traffic must be routed to ny.contoso.com.

84. You have an Azure application gateway for a web app named App1. The application gateway allows end-to-end encryption.

You configure the listener for HTTPS by uploading an enterprise signed certificate.

You need to ensure that the application gateway can provide end-to-end encryption for App1.

What should you do?

85. You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1. You need to configure a rate limit for incoming requests to AFD1.

Solution: You add a rule to the rule set of AFD1.

Does this meet the goal?

86. DRAG DROP

Your company, named Contoso, Ltd, has an Azure subscription that contains the resources show in the following table.





You plan to deploy Azure Front Door. The solution must meet the following requirement:

• Requests to a URL of https://contoso.azurefd.net/uk must be routed to App1uk.

• Requests to a URL of https://contoso.azurefd.net/us must be routed to App1us.

• Requests to a URL of https://contoso.azurefd.net/images must be routed to the storage account closest to the user.

What is the minimum number of backend pools and routing rules you should create? To answer, the appropriate number to the correct component. Each number may be used once, more than once, or not at all. You may need to drag the spilt bar between panes scroll to view content: Note: Each correct selection is worth one point.

87. HOTSPOT

You have an Azure subscription that contains 200 virtual machines

You need to use Azure Network Watcher to identify which virtual machines generate the most network traffic. The solution must minimize administrative effort.

Which prerequisites should you deploy for Network Watcher, and which Network Watcher feature should you use to identify the virtual machines? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

88. Your company has offices in Montreal. Seattle, and Paris. The outbound traffic from each office originates from a specific public IP address.

You create an Azure Front Door instance named FD1 that has Azure Web Application Firewall (WAF) enabled. You configure a WAF policy named Policy! that has a rule named Rule1. Rule1 applies a rate limit of 100 requests for traffic that originates from the office in Montreal.

You need to apply a rate limit of 100 requests for traffic that originates from each office.

What should you do?

89. HOTSPOT

You have an Azure subscription that contains an Azure application gateway named AG1 and two .

Azure App Service apps named App1 and App2 that have the following configurations:

• Both apps are accessible by using HTTP and HTTPS.

• HTTP host headers are used to route requests to the appropriate apps.

• Both apps are hosted in a single App Service Environment in the West Europe Azure region.

You need to publish the apps by using AG 1. The solution must ensure that AG1 provides both HTTP and HTTPS access.

What is the minimum number of resources required for AG1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.