support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Microsoft
  4. AZ-700

Free AZ-700 Exam Braindumps
Designing and Implementing Microsoft Azure Networking Solutions Questions 166–170 (page: 35)

Updated On: 10-Feb-2026
Page 35 of 75
PDF with 396 Questions
View Related Case Study

You have an Azure subscription that contains the resources shown in the following table.



You test DDoSplan1 by running a simulation that targets IP1.

You need to review the DDoS Protection mitigation reports.

What should you use?

  1. DDos protection plan in the Azure portal
  2. Log Analytics
  3. Microsoft Defender for Cloud
  4. Azure Monitor Network Insights

Answer(s): A

Explanation:

To review DDoS Protection mitigation reports in Azure, you'll primarily use the Metrics and Logs features within the Azure portal. You can view real-time metrics during an attack and analyze historical logs to understand mitigation activity and identify potential areas for improvement.
1. Reviewing Metrics:
*-> Navigate to your DDoS Protection plan in the Azure portal.
Select Metrics under Monitoring.
Configure the metrics to view:
Scope: Select the public IP address you want to monitor.
Metric: Choose "Under DDoS attack or not" to see if the protection is active.
Aggregation: Use "Max" to see the peak values.
This allows you to see if the protection is being triggered during a simulation.


Reference:

https://learn.microsoft.com/en-us/azure/ddos-protection/test-through-simulations



View Related Case Study

HOTSPOT (Drag and Drop is not supported)

You have an Azure subscription that contains virtual networks, network security groups (NSGs), load balancer, virtual machines, and virtual network gateways.

You enable Azure Monitor Network Insights.

You need to perform the following actions:

Review the NSG flow logs.

Monitor resource utilization.

Review the results of IP flow verify testing.

Which Azure Monitor Network Insights feature should you use for each action? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: Traffic
Review the NSG Flow logs

Traffic Analytics within Network Insights can be used to monitor network traffic to and from clusters and identify potential data exfiltration. This feature, also part of Azure Monitor Network Insights, leverages NSG flow logs to provide a comprehensive view of traffic flow, helping you identify potential security risks and optimize network configurations.

Box 2: Topology
Monitor resource utilization

To monitor resource utilization in your Azure network, use Network Watcher's Topology and Traffic Analytics features in conjunction with Azure Monitor's Metrics and Logs capabilities

Azure Monitor Network Insights:
Topology:
Provides a visual representation of your Azure virtual network and connected resources, helping you understand the relationships between them. You can drill down into specific resources, like VMs, to see their traffic and connectivity insights and access diagnostic tools.

Box 3: Diagnostic Toolkit
Review the results of IP flow verify testing

Diagnostic Toolkit provides access to all the diagnostic features available for troubleshooting the network. You can use this drop-down list to access features like packet capture, VPN troubleshoot, connection troubleshoot, next hop, and IP flow verify:


Reference:

https://learn.microsoft.com/en-us/azure/network-watcher/network-insights-overview



View Related Case Study

HOTSPOT (Drag and Drop is not supported)

You have an Azure subscription that contains 20 virtual machines and a virtual network named VNet1.

You plan to provide access to the virtual machines by using Azure Bastion.

You need to configure a subnet for Azure Bastion. The solution must minimize the number of IP addresses required for the subnet.

How should you configure the subnet? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Box 1: /26
Subnet mask:

To minimize the number of IP addresses used by an Azure Bastion subnet, configure it with the smallest allowed subnet size, which is /26 (or larger, like /25 or /24). This provides the minimum necessary IP addresses while still allowing for Bastion's scaling requirements.

Box 2: AzureBastionSubnet
Name:

Creating the AzureBastionSubnet:
When creating the subnet for Azure Bastion, name it AzureBastionSubnet.
Assign it a CIDR block of /26 (or larger, like /25 or /24).
Ensure this subnet is within the virtual network's address space. For example, if your VNet has the address space 10.1.0.0/16, you could assign AzureBastionSubnet as 10.1.1.0/26.


Reference:

https://learn.microsoft.com/en-us/azure/bastion/configuration-settings



View Related Case Study

HOTSPOT (Drag and Drop is not supported)

You need to plan the deployment of LBGW1. The solution must support the planned changes.

What should you include in the solution? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: 2
Minimum required number of load balancing rules:

Load Balancer rules
A load balancer rule is used to define how incoming traffic is distributed to all the instances within the backend pool. A load-balancing rule maps a given frontend IP configuration and port to multiple backend IP addresses and ports. Load Balancer rules are for inbound traffic only.

For example, use a load balancer rule for port 80 to route traffic from your frontend IP to port 80 of your backend instances.

Scenario:
Proseware plans to implement the following changes:
* Deploy two network virtual appliances (NVAs) named NVA1 and NVA2 to HubVNet.

* Deploy a gateway load balancer named LBGW1 to HubVNet.

* Configure LBGW1 to inspect traffic on TCP ports 443, 1433, and 1434 from LBS1 by using NVA1 and NVA2.

Box 2: Frontend IP configuration
Configure LBGW1 to reference LBS1 by modifying the:

Frontend IP configuration
The IP address of your Azure Load Balancer. It's the point of contact for clients. These IP addresses can be either:

Public IP Address
Private IP Address
The nature of the IP address determines the type of load balancer created. Private IP address selection creates an internal load balancer. Public IP address selection creates a public load balancer.

Incorrect:
* Backend pool
The group of virtual machines or instances in a virtual machine scale set that is serving the incoming request. To scale cost-effectively to meet high volumes of incoming traffic, computing guidelines generally recommend adding more instances to the backend pool.

* Load Balancer rules


Reference:

https://learn.microsoft.com/en-us/azure/load-balancer/components



View Related Case Study

You need to configure FD1 to provide user access to app2.proseware.com. The solution must meet the security requirements and the general requirements.

What should you do first?

  1. Request a certificate from a trusted root C
  2. Add a security policy to FD1.
  3. Add a custom domain to FD1.
  4. Export the TLS certificate and the private key from App2.

Answer(s): A

Explanation:

Transport Layer Security (TLS), previously known as Secure Sockets Layer (SSL), is the standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and encrypted. Application gateway supports both TLS termination at the gateway as well as end to end TLS encryption.
End to end TLS and allow listing of certificates
Application Gateway only communicates with those backend servers that have either allow-listed their certificate with the Application Gateway or whose certificates are signed by well-known CA authorities and the certificate's CN matches the host name in the HTTP backend settings.
Scenario:
Proseware identifies the following security requirements:
Ensure that all inbound internet traffic to app2.proseware.com is routed via FD1.
*-> Ensure that user connections to Azure-hosted apps use end-to-end encryption.
-
The subscription contains an Azure Front Door Standard profile named FD1. FD1 contains a single origin group that targets APPGW1 by using the default endpoint name.
APPGW1 is an application gateway.
VM3 and VM4 host a web app named App2 that is accessed by using a FQDN of app2.proseware.com. Users access app2.proseware.com by using HTTP or HTTPS.


Reference:

https://learn.microsoft.com/en-us/azure/application-gateway/ssl-overview#end-to-end-tls-and-allow-listing-of- certificates



  PDF
Viewing page 35 of 75
Viewing questions 171 - 175 out of 396 questions


Post your Comments and Discuss Microsoft AZ-700 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!