AZ-700 Online Practice Questions and Answers

Correct Answer:

Box 1: Yes

The integration subnet can be used by only one App Service plan.

Box 2: No

No Private Endpoint connections defined.

When regional virtual network integration is enabled, your app makes outbound calls through your virtual network. The outbound addresses that are listed in the app properties portal are the addresses still used by your app. However, if your

outbound call is to a virtual machine or private endpoint in the integration virtual network or peered virtual network, the outbound address will be an address from the integration subnet.

Box 3: Yes

Apps in App Service are hosted on worker roles. Regional virtual network integration works by mounting virtual interfaces to the worker roles with addresses in the delegated subnet. Because the from address is in your virtual network, it can

access most things in or through your virtual network like a VM in your virtual network would.

Reference:

https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration

Correct Answer:

Box 1: VM2, VM3 and VM4.

VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocking inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

Box 2:

VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks

inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

Correct Answer:

Box 1: No

NSG10 which is attached to VM1's subnet blocks RDP (port TCP 3389) to ‘Any’ which means the port is blocked to all destinations.

Box 2: Yes

NSG10 blocks ICMP from VNet4 (source 10.10.0.0/16) but it is not blocked from VM2's subnet (VNet1/Subnet2).

Box 3: No

NSG11 blocks RDP (port TCP 3389) destined for ‘VirtualNetwork’. VirtualNetwork is a service tag and means the address space of the virtual network (VNet1) which in this case is 10.1.0.0/16. Therefore, RDP traffic from subnet2 to

anywhere else in VNet1 is blocked.

Correct Answer: CD

Reference: https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns#on-premises-workloads-using-a-dns-forwarder https://azure.microsoft.com/en-gb/blog/new-enhanced-dns-features-in-azure-firewall-now-generally-available/

Correct Answer: B

Correct Answer: B

Correct Answer: C

Azure Firewall operates in a single VNET.

Azure Firewall is a regional service.

Yes. Vnet1: Same VNET and same region.

No. Vnet2: Same Resource Group but different VNET and different region. Must be in the same region.

No. Vnet3: Different VNET, different region. Must be in the same region.

No. Vnet4: Different VNET, same region.

Reference:

https://docs.microsoft.com/en-us/azure/architecture/networking/guide/well-architected-framework-azure-firewall

Correct Answer: C

Correct Answer(s):

Network security groups (NSGs) with service tags - To lock down your application to accept traffic only from your specific Front Door, you will need to set up IP ACLs for your backend and then restrict the traffic on your backend to the specific

value of the header 'X-Azure-FDID' sent by Front Door. These steps are detailed out as below:

Configure IP ACLing for your backends to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only.

The above step basically means configure NSGs with service tags.

https://docs.microsoft.com/en-us/azure/frontdoor/front-door-faq

Wrong Answers:

Azure Private Link - Azure Private Link enables you to access Azure PaaS Services over a private endpoint in your

virtual network.

Service endpoints - Service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. It does not restrict traffic.

Network security groups (NSGs) with application security groups - ASG's allow you to group virtual machines and define network security policies based on those groups. You must also use service tag AzureFrontDoor.Backend in the network

security groupsto restrict the traffic.

Correct Answer: D

ErGw3Az and Ultra Performance SKU supports FastPath. ErGw3Az is Zone-redundant, but not Ultra Performance SKU.

Correct Answer: A

Plan

Stage 1: Determine the resource group of VNET1

Stage 2: In Azure Monitor set up monitoring with the VNET's Resource Group as source, and Log Analytics workspace as destination

Stage 1: Determine the resource group of VNET1

Step 1: In Azure portal locate VNET1 and detect which resource group it is in (here we use XGroup).

Stage 2: In Azure Monitor set up monitoring with the VNET's Resource Group as source, and Log Analytics workspace as destination

Create diagnostic settings

Step 2: You can configure diagnostic settings in the Azure portal either from the Azure Monitor menu or from the menu for the resource (XGroup in our case).

Where you configure diagnostic settings in the Azure portal depends on the resource:

For a single resource, select Diagnostic settings under Monitoring on the resource's menu.

Step 3: If no settings exist on the resource you've selected, you're prompted to create a setting. Select Add diagnostic setting.

Step 4: Give your setting a name if it doesn't already have one.

Step 5: Logs and metrics to route: For logs, either choose a category group or select the individual checkboxes for each category of data you want to send to the destinations specified later. The list of categories varies for each Azure service.

Select AllMetrics if you want to store metrics in Azure Monitor Logs too.

We do the following:

Categories: Select AuditEvent

Metrics: Select AllMetrics

(to log all events and metrics)

Destination details: Select Send to Log Analytics workspace (To be able to query using KQL)

Step 6: Destination details -skip

Step 7: Select Save.

Note: Azure virtual network collects the same kinds of monitoring data as other Azure resources.

Azure virtual network uses Azure Monitor.

Collection and routing

Platform metrics and the Activity log are collected and stored automatically, but can be routed to other locations by using a diagnostic setting.

Each Azure resource requires its own diagnostic setting, which defines the following criteria:

Sources: The type of metric and log data to send to the destinations defined in the setting. The available types vary by resource type.

Destinations: One or more destinations to send to.

Destinations

Platform logs and metrics can be sent to the destinations listed in the following table.

*

Log Analytics workspace Metrics are converted to log form. This option might not be available for all resource types. Sending them to the Azure Monitor Logs store (which is searchable via Log Analytics) helps you to integrate them into queries, alerts, and visualizations with existing log data.

*

Etc.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings https://learn.microsoft.com/en-us/azure/virtual-network/monitor-virtual-network