support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Microsoft
  4. AZ-700

Free AZ-700 Exam Braindumps
Designing and Implementing Microsoft Azure Networking Solutions Questions 111–115 (page: 24)

Updated On: 10-Feb-2026
Page 24 of 75
PDF with 396 Questions
View Related Case Study

SIMULATION



Username and password

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: User-12345678@cloudslice.onmicrosoft.com
Azure Password: xxxxxxxxxx

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support purposes only:
Lab Instance: 12345678

You plan to deploy an appliance to subnet3-2. The appliance will perform packet inspection and will have an IP address of 10.3.2.100.

You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.

To complete this task, sign in to the Azure portal.

  1. See Explanation section for answer.

Answer(s): A

Explanation:

Plan:
Stage 1: Create a route table
Stage 2: Create a route
Stage 3: Associate a route table to a subnet

Stage 1: Create a route table
Step 1: On the Azure portal menu or from the Home page, select Create a resource.

Step 2: In the search box, enter Route table.
When Route table appears in the search results, select it.

Step 3: In the Route table page, select Create.

Step 4: In the Create route table dialog box:
* Details omitted*

Step 5: Select Review + create and then Create to create your new route table.

Stage 2: Create a route

Step 6: Make sure the route table you created is selected.

Step 7: From the route table menu bar, choose Routes and then select + Add.

Step 8: Enter a unique Route name for the route within the route table.



Step 9: Enter the Address prefix, in Classless Inter-Domain Routing (CIDR) notation, that you want to route traffic to. The prefix can't be duplicated in more than one route within the route table, though the prefix can be within another prefix. For example, if you defined 10.0.0.0/16 as a prefix in one route, you can still define another route with the 10.0.0.0/22 address prefix. Azure selects a route for traffic based on longest prefix match.

Enter the following:

Address prefixes: 0.0.0.0/0
Next hop type: Internet
Next hop address: 10.3.2.100

Step 10: Click Add.

Stage 3: Associate a route table to a subnet

Step 11: In the virtual network list, choose the virtual network that contains the subnet you want to associate a route table to.

Step 12: In the virtual network menu bar, choose Subnets.

Step 13: Select the subnet you want to associate the route table to. In our case select subnet3-1, (You need to ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance for inspection.)

Step 14: In Route table, choose the route table you want to associate to the subnet. Select the one you created earlier.

Step 15: Select Save.


Reference:

https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview#how-azure-selects-a- route



View Related Case Study

SIMULATION



Username and password

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: User-12345678@cloudslice.onmicrosoft.com
Azure Password: xxxxxxxxxx

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support purposes only:
Lab Instance: 12345678

You plan to use VNET4 for an Azure API Management implementation.

You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canada. You do NOT need to create the application gateway to complete this task.

To complete this task, sign in to the Azure portal.

  1. See Explanation section for answer.

Answer(s): A

Explanation:

Azure Front Door web application firewall (WAF) protects web applications from common vulnerabilities and exploits. Azure-managed rule sets provide an easy way to deploy protection against a common set of security threats.

You can restrict access to your web applications by country/region.

Plan:
Stage 1: Create a WAF policy
Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

First, create a basic WAF policy with a managed Default Rule Set (DRS) using the Azure portal.

Step 1: On the upper left side of the portal, select Create a resource. Search for WAF, select Web Application Firewall, then select Create.

Step 2: On Create a WAF policy page, Basics tab, enter or select the following information and accept the defaults for the remaining settings:

* details omitted *

Step 3: On the Association tab, select Add association, then select one of the following settings:
Application Gateway: Select the application gateway, and then select Add. HTTP Listener: Select the application gateway, select the listeners, then select Add. Route Path: Select the application gateway, select the listener, select the routing rule, and then select Add.

Step 4: Select Review + create, then select Create.



Stage 2: Create a custom WAF Geo location rule that blocks all traffic outside Canada

Configure WAF rules
When you create a WAF policy, by default it is in Detection mode. In Detection mode, WAF doesn't block any requests. Instead, the matching WAF rules are logged in the WAF logs. To see WAF in action, you can change the mode settings to Prevention. In Prevention mode, matching rules defined in the CRS Ruleset you selected are blocked and/or logged in the WAF logs.

Custom rules

Step 5: To create a custom rule, select Add custom rule under the Custom rules tab. This opens the custom rule configuration page.



Step 6: To create a geo-filtering custom rule in the Azure portal, simply select Geo location as the Match Type, and then select the country/region or countries/regions you want to allow/block from your application.

Step 7: Select Add Custom rule



Step 8: Select Geo location

Create your Custom Rule with an appropriate name and priority, then choose `Geo location' from the Match type drop down as above. Next, you'll want to ensure you choose RemoteAddr as the match variable, and decide what logic you want to apply. By logic I mean the pattern that will fire the rule. In this example, I want all traffic except Ireland blocked. So I will choose the Operation `Is not', then location Ireland, then Deny. If I wanted all traffic allowed and Ireland blocked, I would simply choose the Operation `Is'. I recommend figuring out your pattern then working your way through the final section of the CR.

Step 9: Set Match variable to Canada, choose IS NOT, Choose country Canada, and finally Then: Deny traffic.



Stage 3: Create a custom WAF Geo location rule that allows traffic from Canada

Step 10: Repeat steps 5 to 9 but instead use:
Operation: IS
Country/Region: Canada
Then: Allow traffic

Step 11: Finish the creation of the policy. Click Review+Create


Reference:

https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-drs https://wedoazure.ie/2021/08/09/how-to-enable-web-application-firewall-geomatch-custom-rules/ https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag



View Related Case Study

SIMULATION



Username and password

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: User-12345678@cloudslice.onmicrosoft.com
Azure Password: xxxxxxxxxx

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support purposes only:
Lab Instance: 12345678

You plan to deploy several virtual machines to subnet1-2.

You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2. The solution must minimize administrative effort.

To complete this task, sign in to the Azure portal.

  1. See Explanation section for answer.

Answer(s): A

Explanation:

You can use a network security group to filter inbound and outbound network traffic to and from Azure resources in an Azure virtual network.

Plan
Stage 1: Create a network security group

Stage 2: Associate network security group to subnet
Stage 3: Create security rule

Stage 1: Create a network security group
A network security group (NSG) secures network traffic in your virtual network.

Step 1: From the Azure portal menu, select + Create a resource > Networking > Network security group, or search for Network security group in the portal search box.

Step 2: Select Create.

Step 3: On the Basics tab of Create network security group, enter or select this information:

*Details omitted*

Step 4: Select the Review + create tab, or select the blue Review + create button at the bottom of the page.

Step 5: Select Create.

Stage 2: Associate network security group to subnet
In this section, you'll associate the network security group with the subnet of the virtual network you created earlier.

Step 6: Search for myNsg (the name you give in stage 1) in the portal search box.

Step 7: Select Subnets from the Settings section of myNSG.

Step 8: In the Subnets page, select + Associate:



Step 9: Under Associate subnet, select myVNet (the virtual network that is available) for Virtual network.

Step 10: Select subnet1-2 for Subnet, and then select OK.

Stage 3: Create security rule

Step 11: Select Inbound security rules from the Settings section of myNSG.

Step 12: In Inbound security rules page, select + Add:



Step 13: Create a security rule that blocks TCP port 5585 to the network security group you created earlier. In Add inbound security rule page, enter or select this information:
(You need to prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts on subnet1-2.)

Source: Leave the default of Any.
Source port ranges: Leave the default of (*).
Destination: Select Network security group.
Destination Network security groups: Select the network security group you created earlier.
Service: Leave the default of Custom.
Destination port ranges: Enter 5585
Protocol: Select TCP.
Action: Deny
Priority Leave the default of 100.
Name: Enter something



Step 14: Select Add.


Reference:

https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic



View Related Case Study

SIMULATION



Username and password

Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: User-12345678@cloudslice.onmicrosoft.com
Azure Password: xxxxxxxxxx

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

The following information is for technical support purposes only:
Lab Instance: 12345678

You need to ensure that only hosts on VNET1 can access the storage123456789 storage account. The solution must ensure that access occurs over the Azure backbone network.

To complete this task, sign in to the Azure portal.

  1. See Explanation section for answer.

Answer(s): A

Explanation:

Use private endpoints for Azure Storage
You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.

Connect to a storage account using an Azure Private Endpoint Create a private endpoint

Step 1: In the search box at the top of the portal, enter Storage account. Select Storage accounts in the search results.

Step 2: Locate and select the Storage Account storage123456789

Step 3: Select the Networking tab or select Next: Advanced then Next: Networking.

Step 4: In the Networking tab, under Network connectivity select Disable public access and use private access.

Step 5: In Private endpoint, select + Add private endpoint.

Step 6: In Create private endpoint enter or select the following information:
*Details omitted*

* Virtual network: Select VNET1.

Step 7: Select OK.

Step 8: Select Review.

Step 9: Select Create.


Reference:

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints https://learn.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-storage-portal



View Related Case Study

HOTSPOT (Drag and Drop is not supported)

You have an Azure virtual network named Vnet1 that contains two subnets named Subnet1 and Subnet2. Both subnets contain virtual machines.

You create a NAT gateway named NATgateway1 as shown in the following exhibit.



Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: Both Subnet1 and Subnet2
From exhibit: Subnets None
Virtual network: VNet1

VNet1 contains Subnet1 and Subnet2.

Azure NAT Gateway resources enable outbound Internet connections from subnets in a virtual network.

After NAT gateway is added to the subnet of the virtual network, all new connections will then use NAT gateway for making outbound connections.

Incorrect:
* Gateway subnet
Before you create a VPN gateway, you must create a gateway subnet. The gateway subnet contains the IP addresses that the virtual network gateway VMs and services use.
When you create your virtual network gateway, gateway VMs are deployed to the gateway subnet and configured with the required VPN gateway settings. Never deploy anything else (for example, additional VMs) to the gateway subnet. The gateway subnet must be named 'GatewaySubnet' to work properly. Naming the gateway subnet 'GatewaySubnet' let's Azure know that this is the subnet to deploy the virtual network gateway VMs and services to.

Box 2: 16 IP addresses
From exhibit: Public IP address: None
Public IP prefix is specified.

The /28 address range in the prefix provided 16 IP addresses.

Note: Add public IP prefix
Public IP prefixes extend the extensibility of SNAT for outbound connections from the NAT gateway. A public IP prefix avoids SNAT port exhaustion. Each IP provides 64,512 ephemeral ports to NAT gateway for connecting outbound.

When assigning a public IP prefix to a NAT gateway, the entire range will be used.


Reference:

https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-nat-gateway



  PDF
Viewing page 24 of 75
Viewing questions 116 - 120 out of 396 questions


Post your Comments and Discuss Microsoft AZ-700 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!