Improve Your Knowledge with AZ-720 Exam Dumps

1. You need to resolve the VM2 routing issue.

What should you do?

2. HOTSPOT

A company uses Azure Active Directory (Azure AD) with Azure role-based access control (RBAC) for access to resources.

Some users report that they are unable to grant RBAC roles to other users.

You need to troubleshoot the issue.

How should you complete the Azure Monitor query?

3. DRAG DROP

A company has an Azure virtual network (VNet). An administrator creates a subet in the VNet named AzureSastionSubnet. The administrator deploys Azure Bastion to AzureBastionSubnet.

The administrator creates a default network security group named nsg-Bastion. The following error message display when the administrator attempts to assign nsg-Bastion to AzureBastionSubnet:

Network security group nsg-Bastion does not have necessary rules for Azure Bastion Subnet AzureBastionSubnet

You need to resolve the issues with the inbound security rules.

Which port or set of ports should you configure?

4. HOTSPOT

You need to troubleshoot issues that scheduling agents report accessing Alpine Ski House resources.

Which tool and port should you test? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

5. A company uses Azure Backup Server to back up re deployed in an availability group.

The company reports that a backup operation for a database fails. The following error message displays:

Unable to configure protection.

You need to ensure that the backup operation runs successfully.

What should you do?

6. A company has an Azure Virtual Network gateway named VNetGW1. The company enables point-to-site connectivity on VNetGW1.

An administrator configures VNetGW1 for the following:

✑ OpenVPN for the tunnel type.

✑ Azure certificate for the authentication type.

Users receive a certificate mismatch error when connecting by using a VPN client.

You need to resolve the certificate mismatch error.

What should you do?

7. A company has a pay-as-you-go subscription named Subl1.

The company has a virtual machine (VM) named VM1 in a subnet named Subnet1.

You create the following network security group (NSG) named NSG1 and associate it with Subnet1.





You observe that an application on VM1 is unable to send email to recipient outside the company

You need to resolve the issue.

What should you do?

8. A company enables just-in-time (JIT) virtual machine (VM) access in Azure.

An administrator observes a list of VMs on the Unsupported tab of the JIT VM access page in the Microsoft Defender for Cloud portal.

You need to determine why some VMs are not supported for JIT VM access.

What should you conclude?

9. HOTSPOT

A company deploys an Azure Firewall.

The company reports the following log entry:





For each of the following questions, select Yes or No.

10. HOTSPOT

A company uses Azure Active Directory (Azure AD) for authentication. The company synchronizes Azure AD with an on-premises Active Directory domain.

The company reports that an Azure AD object fails to sync.

You need to determine which objects are not syncing.

Which troubleshooting steps should you use to diagnose the failure?

11. HOTSPOT

A company attempts to implement just-in-time (JIT) access for a virtual machine (VM) named VM1. The company reports that they are unable to complete the process.

You need to implement JIT access and test the deployment.

Which PowerShell cmdlets should you run?

12. HOTSPOT

A company has an Azure Active Directory (Azure AD) tenant. You are assigned the Owner role-based access control (RBAC) role of an Azure resource group named RG1.

An administrator grants a user named User1 the Contributor RBAC role for RG1. User1 receives an authorization error when attempting to create a Cosmos DB account in RG1. The administrator verifies that they can create a Cosmos DB account in RG1.

You need to troubleshoot the issue.

What should you do?

13. Topic 2, Fabrikam Inc.

Fabrikam Inc. runs an online reservation service that allows agents to manage online registrations for various hotels, vacation rentals, and customers.

The company has on-premises infrastructure and services that are hosted in Azure. The on-premises infrastructure includes servers that run Active Directory Domain Services (AD DS). Azure services include virtual machines (VMs) that are in one subscription and the following environments: development, testing, and production. Each environment is located in a different virtual network (VNet).

The company has a perimeter network that supports connections to the internet. The perimeter network is also hosted in a separate VNet All of the VNets are connected by using virtual network peering.





The company's subscription contains the following Azure virtual machines (VMs):





The Web Server (IIS) role is installed on VM4 The operating system firewall for each VM allows inbound ping requests.

The company's subscription includes the following network security groups (NSGs):





NSG1, NSG2. NSG3, and NSG5 use the default inbound security rules. NSG4. NSG5. and NSG10 use the default outbound security rules.

NSG4 has the following inbound security rule:





NSG10 has the following inbound security rules:





Network Policy Server (NPS) is installed on an on-premises server named SRV2. The NPS extension for Azure AD multi-factor authentication (MFA) is configured on the server as well.

The virtual network peering connections are in the following table.





You provision a virtual network gateway named VNetGW in the perimeter network. The virtual network gateway uses SKU VpnGw1 and the public IP address 16.4.4.4.

The virtual network gateway will provide:

• Network routing to customer data centers using site-to-site VPN connections.

• Network routing to Azure for the scheduling agents and sales employees using a point-to-site VPN connection.

The company's site-to-site VPN connections with customers are shown in the following table.





The point-to-site VPN is configured as shown in the following table;





The company's user and group memberships are shown in the following table:





The scheduling agents, warehouse, and sales groups are members of the self-service password reset (SSPR) group named SSPR-group.

Azure AD Connect is installed on an on-premises server named SRV1. In addition;

• The server uses a pass-through authentication agent.

• The SSPR feature is enabled

• The SSPR feature is applied only to a group named SSPR-group

• The scheduling agents' internet connectivity must be blocked when connected to the point-to-site VPN.

• Sales employees must use the default VPN client on MacOS computers to connect to Azure.

• Azure AD Connect must synchronize all user accounts from AD DS to Azure AD.

• Pass-through authentication is required for all users.

• Azure AD multi-factor authentication (MFA) is requited for all users.

• All admin user accounts must be in an organizational unit (OU) named Admins.



VM3

Users report issues connecting from VM3 to resources at Margie's Travel. The administrator for Margie's Travel has verified that their VPN gateway is working correctly. You must verify whether the Fabrikam virtual network gateway is available.



VM10

All ping tests bust be performed by using the ICMP protocol. You are unable to ping VM10 from VM1 Alpine Ski House

You discover during testing that scheduling agents are experiencing latency when accessing resources at the Alpine Ski House. You suspect that the issue is related to

ICMP latency.



Contoso Suites

You receive reports that VM1 is unable to access resources at Contoso Suites Blue Yonder Airlines

The administrator of a partner company named Blue Yonder Airlines reports VPN disconnections and IPsec failure to connect errors.



Other resource issues

• MFA requests on SRV2 are failing with a security token error.

• You are unable to ping VM10 from VM1.



Admin1

You receive the following error on SRV1 only when trying to synchronize an administrator named Admin1: 8344 insufficient access rights to perform the operation



Admin2

An administrator named Admin2 reports they cannot connect to the web server public IP address on VM4 from VM2.



Agent 1

A scheduling agent named Agent1 reports issues authenticating to Azure AD.



Used 1

A scheduling agent named User1 reports that they can access the internet when connected to the point-to-site VPN.



User2

A user named User2 reports the following error when registering for SSPR: Your administrator has

not enabled you to use this feature.

Sales team

Sales team employees report that they are unable to connect by using point-to-site VPN.



You need to resolve the issue with Admin1.

What should you do?

14. A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR).

An administrator receives an error that password writeback cloud not be enabled during the Azure AD Connect configuration. The administrator observes the following event log error: Error getting auth token

You need to resolve the issue.

Solution: Use a global administrator account that is not federated to configure Azure AD Connect. Does the solution meet the goal?

15. HOTSPOT

A company develops an Azure Cosmos DB solution.

The solution has the following components:

✑ A virtual network named VNet1 in a resource group named RG1.

✑ A subnet named Subnet1 in VNet1.

✑ A Private Link service.

The company is unable to configure a source IP address for the Private Link service from Subnet1.

You need to resolve the issue for Subnet1.

How should you complete the PowerShell commands?

16. HOTSPOT

A company uses Azure Backup Agent to back up specific files and folders from an on-premises virtual machine (VM).

An administrator reports that the backup job is transferring files slowly. You determine that the backup job is verifying changes in directories by scanning the entire volume. You need to determine the state of the backup job.

In which state will the backups occur?

17. You need to resolve the issue with VM10.

What should you do?

18. HOTSPOT

A company uses a service principal to assign RBAC roles for an application hosted in Azure.

The company attempts to create a rule assignment.

The following error displays: Insufficient privileges to complete the operation.

You need to resolve the issue.

How should you complete the CLI command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

19. HOTSPOT

A company uses public Azure DNS zones.

The company reports DNS record creation and name resolution issues.

You need to troubleshoot the issues.

What are the causes of the issues?

20. HOTSPOT

A company is deploying Azure Bastion to provide secure clientless access to its Azure VMs. The company configures a network security group named NSG1.

During deployment, the following error displays: Network security group NSG1 does not have necessary rules for Azure Bastion Subnet AzureBastionSubnet.

You need to fix the inbound rules for NSG1.

How should you complete the configuration?

21. HOTSPOT

A company uses Azure Site Recovery for an on-premises server.

The company reports that replication of the server to Azure has failed.

You need to inspect the logs on the server to troubleshoot the issue.

How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

22. A company has an Azure Active Directory (Azure AD) tenant. The company deploys Azure AD Connect to synchronize users from an Active Directory Domain Services (AD DS). The synchronization of a user object is failing.

You need to troubleshoot the failing synchronization by using a built-in Azure AD Connect troubleshooting task.

Which two pieces of information should you collect before you start troubleshooting?

23. A company deploys an ExpressRoute circuit.

You need to verify accepted peering routes from the ExpressRoute circuit.

Which PowerShell cmdlet should you run?

24. A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).

A new subnet should be unreachable from the on-premises network. You need to implement a solution.

Solution: Scale the gateway to Generation2.

Does the solution meet the goal?

25. HOTSPOT

A company uses Azure Firewall.

The firewall uses the following rules:





The company requires the following:

• Block outbound connections to Contoso.com on ports 80 and 443. You configure the NetRC2

firewall rule to block the connections. Users report that they can still access Contoso.com on port 80

• Allow outbound connections to Adatuin.com on ports 80 and 443. You configure the AppRC2

firewall rule to allow the connections. Users report that they can access the Adaturn com website by using the IP address but not by using the fully qualified domain name (FQDN).

You need to troubleshoot the rules that are causing the issues.

Which rules should you review? To answer, select the appropriate options in the answer area.

26. A company deploys Azure Bastion to connect to their virtual machine (VM) infrastructure.

An engineer attempts to connect to a Windows VM by using Remote Desktop Protocol (RDP). The connection fails.

You need to troubleshoot the issue.

Which two actions should you perform?

27. HOTSPOT

You need to troubleshoot and resolve the reverse DNS lookup issues.

What should you do? To answer, select the appropriate option in the answer area. NOTE: Each correct selection is worth one point.

28. DRAG DROP

A customer has an Azure subscription. Microsoft Defender for servers is enabled for the subscription. The customer has not configured network security groups.

The customer configures a resource group named RG1 that contains the following resources:

• A virtual machine named VM1.

• A network interface named NIC1 that is attached to VM1.

The customer grants a user named Admin1 the following permission for RG1:

Microsoft.Security/locations/jitNetworkAccessPolicies/write.

Admin1 reports that the JIT VM access pane in the Azure portal does not show any entries.

When you view the same pane, VM1 appears on the Unsupported tab.

You need to ensure that Admin1 can enable just-in-time (JIT) VM access for VM1. The solution must adhere to the principle of least privilege.

Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

29. A company hosts a network virtual appliance (VNA) and Azure Route Server in different virtual networks (VNets). Border Gateway Protocol (BGP) peering is enabled between the NVA loses internet connectivity after it advertises the default route to the route server. You need to resolve the problem with the NVA.

What should you do?

30. HOTSPOT

A company creates an Azure resource group named RG1.

RG1 has an Azure SQL Database logical server named sqlsvr1 that hosts the following resources:





An administrator grants a user named User1 the Reader RBAC role in RG1. The administrator grants User2 the Contributor role in sqlsvr1.

User1 reports that they can connect to SQLDB1 from the IP address 155.127.95.212. User1 cannot connect to SQLDB2. User2 can connect to both SQLDB1 and SQLDB2 from the IP address 121.19.27.18. Both users can successfully connect to SQLDB1 and SQLDB2 from VM1.

You are helping the administrator troubleshoot the issue. You run the following PowerShell command:

Get-AzSqlServerFirewallRule -ResourceGroupName 'RG1' -ServerName 'sqlsvr1'

The following output displays:





You need to identify the cause for the reported issue and resolve User1's issues. The solution must satisfy the principle of least privilege.

What should you do?

31. A company has two subnet in a virtual network named VNe1m the subnet are named SubnetA and SubnetB. The company uses a site-to-site (S2) VPN in SubnetB to connect its on-premises environment to Azure.

You deploy an Azure SQL Database named SQL1. You configure a service endpoint in SubnetA for Microsft.SqL

32. A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).

A new subnet should be unreachable from the on-premises network. You need to implement a solution.

Solution: Configure subnet delegation.

Does the solution meet the goal?

33. HOTSPOT

You need to troubleshoot and resolve issues reported for contosostorage1.

What should you do? To answer, select the appropriate option in the answer area. NOTE: Each correct selection is worth one point.

34. A company has an Azure tenant. The company deploys an Azure firewall named FW1 to control access from an on-premises datacenter to an Azure virtual machine named VM1.

The company troubleshoots ICMP connectivity from the on-premises datacenter to VM1. You are unable to ping VM1 from an on-premises server.

You need to determine if ICMP connectivity to VM1 is allow on FW1.

What should you do?

35. A company has an Azure Active Directory (Azure AD) tenant. The company provisions an Azure Active Directory Domain Services (Azure AD DS) instance.

Users report that they are unable to sign into Azure AD DS after being provisioned from Azure AD.

You verify the user accounts exist in Azure AD DS.

You need to resolve the issue.

What should you do?

36. HOTSPOT

You need to resolve the Azure virtual machine (VM) deployment issues.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.