📘 Free AZ-700 Sample Questions
Your company has a single on-premises datacenter in Washington DC.
The East US Azure region has a peering location in Washington DC.
The company only has Azure resources in the East US region.
You need to implement ExpressRoute to support up to 1 Gbps.
You must use only ExpressRoute Unlimited data plans.
The solution must minimize costs.
Which type of ExpressRoute circuits should you create?
A
ExpressRoute Local
B
ExpressRoute Direct
C
ExpressRoute Premium
D
ExpressRoute Standard
Correct Answer:
A. ExpressRoute Local
Explanation:
Reference:
https://azure.microsoft.com/en-us/pricing/details/expressroute/
Expressroute Local supports this particular networking scenario for two reasons. 1) The Washington DC peering
location has East US as its Local Azure region. So, you don’t need access to all the Geopolitical locations in order to
connect the on-prem DC to Azure. Which means you won’t necessarily need Expressroute standard. 2) ExpressRoute
Local is a more economical solution compared to the standard.
You are planning an Azure Point-to-Site (P2S) VPN that will use OpenVPN.
Users will authenticate by an on-premises Active Directory domain.
Which additional service should you deploy to support the VPN authentication?
A
an Azure key vault
B
a RADIUS server
C
a certification authority
D
Azure Active Directory (Azure AD) Application Proxy
Correct Answer:
B. a RADIUS server
Explanation:
In order to support the VPN authentication for your Azure Point-to-Site (P2S) VPN using OpenVPN, you will need to
deploy a RADIUS server on your on-premises network. The RADIUS server will be used to authenticate users who are
trying to connect to the VPN using their Active Directory credentials. This will allow you to securely and efficiently
manage user access to the VPN. A certification authority is not necessary for this scenario, because you are not using
certificates for authentication. Similarly, an Azure key vault is not needed, because you are not using keys for
authentication. Azure Active Directory (Azure AD) Application Proxy is not relevant to this scenario, because it is
used for publishing web applications, not for VPN authentication.
You plan to configure BGP for a Site-to-Site VPN connection between a datacenter and Azure.
Which two Azure resources should you configure? Each correct answer presents a part of the solution. (Choose two.)
NOTE: Each correct selection is worth one point.
A
a virtual network gateway
B
Azure Application Gateway
C
Azure Firewall
D
a local network gateway
E
Azure Front Door
Correct Answer:
A. a virtual network gateway
Explanation:
The correct answers are A. a virtual network gateway and D. a local network gateway.
To configure BGP for a Site-to-Site VPN connection between a datacenter and Azure, you will need to configure a virtual network gateway
and a local network gateway. The virtual network gateway will be used to establish the VPN connection between your datacenter and Azure, and the local network gateway will be used to define the on-premises network that you want to connect to Azure.
Azure Application Gateway, Azure Firewall, and Azure Front Door are not relevant to this scenario, because they are not used for configuring BGP for a Site-to-Site VPN connection.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/bgp-howto
You fail to establish a Site-to-Site VPN connection between your company's main office and an Azure virtual network.
You need to troubleshoot what prevents you from establishing the IPsec tunnel.
Which diagnostic log should you review?
A
IKEDiagnosticLog
B
RouteDiagnosticLog
C
GatewayDiagnosticLog
D
TunnelDiagnosticLog
Correct Answer:
A. IKEDiagnosticLog
Explanation:
IKEDiagnosticLog = The IKEDiagnosticLog table offers verbose debug logging for IKE/IPsec. This is very useful to review when troubleshooting disconnections, or failure to connect VPN scenarios.
GatewayDiagnosticLog = Configuration changes are audited in the GatewayDiagnosticLog table.
TunnelDiagnosticLog = The TunnelDiagnosticLog table is very useful to inspect the historical connectivity statuses of the tunnel.
RouteDiagnosticLog = The RouteDiagnosticLog table traces the activity for statically modified routes or routes received via BGP.
P2SDiagnosticLog = The last available table for VPN diagnostics is P2SDiagnosticLog. This table traces the activity for Point to Site.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/troubleshoot-vpn-with-azure-diagnostics
HOTSPOT -
You need to connect an on-premises network and an Azure environment.
The solution must use ExpressRoute and support failing over to a Site-to-Site VPN connection if there is an ExpressRoute failure.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
A
Correct Answer:
A.
Explanation:
route based and two virtual network gateways - one for ExpressRoute connection (ExpressRoute virtual network gateway) and the second for the VPN connection (VPN virtual network gateway).
Check the architecture and read the description at the source.
Source: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid- networking/expressroute-vpn-failover
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-howto-coexist-resource-manager should read it carefully because it says exactly that you need 2 gateways.
"If you have a virtual network that has only one virtual network gateway (let's say, Site-to-Site VPN gateway) and you want to add another gateway of a different type (let's say, ExpressRoute gateway), you have to
first delete the virtual network gateway and increase the gateway subnet size."
Your company has an on-premises network and three Azure subscriptions named Subscription1, Subscription2, and Subscription3.
The departments at the company use the Azure subscriptions as shown in the following table.
A
1
B
2
C
3
D
4
E
5
Correct Answer:
A. 1
Explanation:
1
Managing Authorization
The circuit owner can share a circuit with up to 10 Azure subscriptions. The circuit owner can view who has been authorized to the circuit. The owner can revoke the authorization at any time.
https://azure.microsoft.com/en-us/blog/enable-multiple-subscription- expressroute/#:~:text=The%20circuit%20owner%20can%20share,the%20authorization%20at%20any%20time.
Your company has offices in New York and Amsterdam.
The company has an Azure subscription.
Both offices connect to Azure by using a Site-to-Site VPN connection.
The office in Amsterdam uses resources in the North Europe Azure region.
The office in New York uses resources in the East US Azure region.
You need to implement ExpressRoute circuits to connect each office to the nearest Azure region.
Once the ExpressRoute circuits are connected, the on-premises computers in the Amsterdam office must be able to connect to the on-premises servers in the New York office by using the ExpressRoute circuits.
Which ExpressRoute option should you use?
A
ExpressRoute FastPath
B
ExpressRoute Global Reach
C
ExpressRoute Direct
D
ExpressRoute Local
Correct Answer:
B. ExpressRoute Global Reach
Explanation:
ExpressRoute Global Reach
ExpressRoute Global Reach provides the ability to connect multiple Azure regions and on-premises locations with a single ExpressRoute
circuit. In this scenario, you need to connect the Amsterdam office to the North Europe Azure region and the New York office to the East US Azure region. ExpressRoute Global Reach enables the communication between the on-premises computers in the Amsterdam office and the on- premises servers in the New York office through the ExpressRoute circuits. Hence, ExpressRoute Global Reach is the most suitable option to use in this scenario.
Reference:
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach
HOTSPOT -
You have an Azure subscription that contains a single virtual network and a virtual network gateway.
You need to ensure that administrators can use Point-to-Site (P2S) VPN connections to access resources in the virtual network.
The connections must be authenticated by Azure Active Directory (Azure AD).
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
A
Correct Answer:
A.
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant
HOTSPOT -
You have the Azure environment shown in the exhibit.
A
Correct Answer:
A.
HOTSPOT -
You have on-premises datacenters in New York and Seattle.
You have an Azure subscription that contains the ExpressRoute circuits shown in the following table.
A
Correct Answer:
A.
Explanation:
Box 1: Global Reach -
ExpressRoute Global Reach is the service where if you have two datacenters, which are located at different geo-locations and both are connected to Microsoft
Azure via Express Route then these two datacenters can also connect to each other securely via Microsoft's backbone.
Incorrect:
FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.
Box 2: Private -
With ExpressRoute Global Reach, you can link ExpressRoute circuits together to make a private network between your on-premises networks.
Reference:
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach
Questions: 1-10 out of 372
Continue Full Practice..
GET ALL 372 QUESTIONS