support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Microsoft
  4. AZ-700

Free AZ-700 Exam Braindumps
Designing and Implementing Microsoft Azure Networking Solutions Questions 146–150 (page: 31)

Updated On: 10-Feb-2026
Page 31 of 75
PDF with 396 Questions
View Related Case Study

HOTSPOT (Drag and Drop is not supported)

You have an on-premises network.

You have an Azure subscription that contains the resources shown in the following table.



You need to ensure that on-premises devices can communicate with Azure resources that are connected to Subnet4.

What should you do on each resource? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: Deploy the On-Premises Extended-Network Gateway appliance Server1

Server is an On-premises Windows Server 2022 server connected to Subnet1 and Subnet2.
Subnet4 is an Azure virtual subnet in VNet11.
S2SVPN1 is a Site-to-Site (S2S) connecting the on-premises network to VNet1.

Note: Site-to-site VPN
A site-to-site (S2S) VPN gateway connection is a connection over IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. Site-to-site connections can be used for cross-premises and hybrid configurations. A site-to-site connection requires a VPN device located on-premises that has a public IP address assigned to it.



Create a local network gateway
The local network gateway is a specific object deployed to Azure that represents your on-premises location (the site) for routing purposes.

Box 2: Deploy the Azure Extended-Network Gateway appliance
VM2

VM2 is an Azure virtual machine that is connected to Subnet3 and Subnet4.

Configuration in Azure
Create a VPN gateway


Reference:

https://learn.microsoft.com/en-us/azure/vpn-gateway/design



View Related Case Study

You have an Azure subscription. The subscription contains a locally-redundant storage (LRS) account named storage1 that is deployed to the US East Azure region and has a Microsoft.Storage service endpoint.

You set Redundancy for storage1 to Read-access geo-redundant storage (RA-GRS).

You need to ensure that the contents of storage1 will be accessible by using a service endpoint in a paired region. The solution must minimize administrative effort.

What should you do first?

  1. Create an object replication rule for storage1.
  2. Delete the existing service endpoint.
  3. From storage1, select Secure transfer required.
  4. Create a service endpoint policy.

Answer(s): B

Explanation:

Incorrect:
Not A:
Object replication asynchronously copies block blobs between a source storage account and a destination account. Some scenarios supported by object replication include:
Minimizing latency. Object replication can reduce latency for read requests by enabling clients to consume data from a region that is in closer physical proximity.
Increase efficiency for compute workloads. With object replication, compute workloads can process the same sets of block blobs in different regions.
Optimizing data distribution. You can process or analyze data in a single location and then replicate just the results to additional regions.
Optimizing costs. After your data has been replicated, you can reduce costs by moving it to the archive tier using life cycle management policies.

Not C:
The "Secure transfer required" feature is now supported in Azure Storage account. This feature enhances the security of your storage account by enforcing all requests to your account through a secure connection.
Not D:
Virtual Network service endpoint policies allow you to filter egress virtual network traffic to Azure Storage accounts over service endpoint, and allow data exfiltration to only specific Azure Storage accounts. Endpoint policies provide granular access control for virtual network traffic to Azure Storage when connecting over service endpoint.


Reference:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoint-policies-overview https://azure.microsoft.com/en-us/blog/secure-transfer-required-is-available-in-azure-storage-account/



View Related Case Study

HOTSPOT (Drag and Drop is not supported)

You have two Azure subscriptions.

You need to perform the following actions in the East US Azure region of each subscription:

Deploy 50 virtual machines to availability zone 1.

Deploy 50 virtual machines to availability zone 2.

Deploy 50 virtual machines to availability zone 3.

What is the minimum number of virtual networks and /25 subnets you should create? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: 2
Virtual networks:

VNet cannot span subscriptions, so we need two VNets.

Note: Virtual networks and availability zones
Virtual networks and subnets span all availability zones in a region. You don't need to divide them by availability zones to accommodate zonal resources. For example, if you configure a zonal VM, you don't have to take into consideration the virtual network when selecting the availability zone for the VM. The same is true for other zonal resources.

Box 2: 4
Subnets.

Subnets in Azure span all availability zones in a given region.
A /25 subnet can contain a maximum of 126 hosts.
We need two subnets in each subscription.


Reference:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview#virtual-networks-and- availability-zones



View Related Case Study

DRAG DROP (Drag and Drop is not supported)

You have the resources shown in the following table.



From the Microsoft Entra admin center, you register the Azure VPN application as an enterprise application.

You need to enable Microsoft Entra authentication for the P2S VPN connections. The solution must meet the following requirements:

Ensure that only the members of Group1 can establish VPN connections to VPNGW1.

Ensure that only the members of Group2 can establish VPN connections to VPNGW2.

In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



VPN Gateway, Configure P2S for access based on users and groups - Microsoft Entra ID authentication When you use Microsoft Entra ID as the authentication method for P2S, you can configure P2S to allow different access for different users and groups. If you want different sets of users to be able to connect to different VPN gateways, you can register multiple apps in AD and link them to different VPN gateways.

Step 1: From the Microsoft Entra admin center, register two apps Named App1 and App2. Assign Group1 to App1 and Assign Group2 to App2.

Register additional applications
You can register additional applications for various users and groups. Repeat the steps to create as many applications that are needed for your security requirements. Each application will be associated to a VPN gateway and can have a different set of users. Only one application can be associated to a gateway.
Copy Application (client) ID
When you enable authentication on the VPN gateway, you'll need the Application (client) ID value in order to fill out the Audience value for the point-to-site configuration. [For Step 3]

Assign users to applications
Assign the users to your applications. If you're specifying a group, the user must be a direct member of the group.

1. Go to your Microsoft Entra ID and select Enterprise applications.
2. From the list, locate the application you just registered and click to open it.
3. Click Properties. On the Properties page, verify that Enabled for users to sign in is set to Yes. If not, change the value to Yes.
4. For Assignment required, change the value to Yes. For more information about this setting, see Application properties.
5. If you've made changes, click Save to save your settings.
6. In the left pane, click Users and groups. On the Users and groups page, click + Add user/group to open the Add Assignment page.
7. Click the link under Users and groups to open the Users and groups page. Select the users and groups that you want to assign, then click Select.
8. After you finish selecting users and groups, click Assign.

Step 2: From the Microsoft Entra admin center, add a scope to App1 and App2.
Add a scope
1. In the Azure portal, select Microsoft Entra ID.

2. In the left pane, select App registrations.

3. At the top of the App registrations page, select + New registration. [Part of Step 1]

4. On the Register an application page, enter the Name. For example, MarketingVPN. You can always change the name later.

Select the desired Supported account types.
At the bottom of the page, click Register.

5. Once the new app has been registered, in the left pane, click Expose an API. Then click + Add a scope.

6. On the Add a scope page, leave the default Application ID URI.
7. Click Save and continue.

8. The page returns back to the Add a scope page. Fill in the required fields and ensure that State is Enabled.
[Step 2]



9.
When you're done filling out the fields, click Add scope.

Step 3: From the Microsoft Entra admin center, add a client app to App1 and App2

Add a client application
1. On the Expose an API page, click + Add a client application.

2. On the Add a client application page, for Client ID, enter the following values depending on the cloud:

* Details omitted*

3. Select the checkbox for the Authorized scopes to include. Then, click Add application.



4. Click Add application.

Step 4: From the Azure Portal, configure Point-to-site configuration settings for VPNGW1 and VPNGW2.

Configure authentication for the gateway

1. Go to the virtual network gateway. In the left pane, click Point-to-site configuration.



2. * Details omitted*


Reference:

https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant-multi-app



View Related Case Study

DRAG DROP (Drag and Drop is not supported)

You have an on-premises network.

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an ExpressRoute gateway named Gateway1.

You need to implement an ExpressRoute solution from a third-party provider named Fabrikam, Inc. The solution must ensure that devices on the on-premises network can connect to the Azure resources on VNet1.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Step 1: Create an ExpressRoute circuit
ExpressRoute circuit
Ensure that your organization has met the ExpressRoute prerequisite requirements for connecting to Azure.

If you haven't already done so, add a subnet named GatewaySubnet to your Azure VNet and create an ExpressRoute virtual network gateway using the Azure VPN gateway service.

Create an ExpressRoute circuit as follows:

1. Run the following PowerShell command:

New-AzExpressRouteCircuit -Name <<circuit-name>> -ResourceGroupName <<resource-group>> -Location [Step 1]

Step 2: Send the Service key to Fabrikam

2. Send the ServiceKey for the new circuit to the service provider. [Step 2]

3. Wait for the provider to provision the circuit. To verify the provisioning state of a circuit, run the following PowerShell command:

Get-AzExpressRouteCircuit -Name <<circuit-name>> -ResourceGroupName <<resource-group>>

The Provisioning state field in the Service Provider section of the output will change from NotProvisioned to Provisioned when the circuit is ready.

Step 3: Configure private peering
Azure private peering
Azure compute services, namely virtual machines (IaaS) and cloud services (PaaS), that are deployed within a virtual network can be connected through the private peering domain. The private peering domain is considered to be a trusted extension of your core network into Microsoft Azure. You can set up bi-directional connectivity between your core network and Azure virtual networks (VNets). This peering lets you connect to virtual machines and cloud services directly on their private IP addresses.



Incorrect:
* Configure Azure Microsoft peering
Microsoft peering
Microsoft 365 was created to be accessed securely and reliably via the Internet. Because of this, we recommend ExpressRoute for specific scenarios.
Connectivity to Microsoft online services (Microsoft 365, Azure PaaS services and Microsoft PSTN services) occurs through Microsoft peering.
Note: 4. If you're using a layer 2 connection:

4a. Reserve two /30 subnets composed of valid public IP addresses for each type of peering you want to implement. These /30 subnets will be used to provide IP addresses for the routers used for the circuit. If you are implementing private and Microsoft peering, you'll need 4 /30 subnets with valid public IP addresses.

4b. Configure routing for the ExpressRoute circuit. Run the following PowerShell commands for each type of peering you want to configure (private and Microsoft).

Set-AzExpressRouteCircuitPeeringConfig -Name <<peering-name>> -ExpressRouteCircuit <<circuit-name>> - PeeringType <<peering-type>> -PeerASN <<peer-asn>> -PrimaryPeerAddressPrefix <<primary-peer-address- prefix>> -SecondaryPeerAddressPrefix <<secondary-peer-address-prefix>> -VlanId <<vlan-id>>

Set-AzExpressRouteCircuit -ExpressRouteCircuit <<circuit-name>>

4c. Reserve another pool of valid public IP addresses to use for network address translation (NAT) for Microsoft peering. It is recommended to have a different pool for each peering. Specify the pool to your connectivity provider, so they can configure border gateway protocol (BGP) advertisements for those ranges.

Step 4: Connect Gateway1 to the ExpressRoute circuit.
5. Run the following PowerShell commands to link your private VNet(s) to the ExpressRoute circuit.

$circuit = Get-AzExpressRouteCircuit -Name <<circuit-name>> -ResourceGroupName <<resource-group>> $gw = Get-AzVirtualNetworkGateway -Name <<gateway-name>> -ResourceGroupName <<resource-group>> New-AzVirtualNetworkGatewayConnection -Name <<connection-name>> -ResourceGroupName <<resource- group>> -Location <<location> -VirtualNetworkGateway1 $gw -PeerId $circuit.Id -ConnectionType ExpressRoute


Reference:

https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/expressroute https://learn.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings



  PDF
Viewing page 31 of 75
Viewing questions 151 - 155 out of 396 questions


Post your Comments and Discuss Microsoft AZ-700 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!