[Microsoft] AZ-700 - Azure Network Engineer Associate Exam Dumps & Study Guide

Free [Microsoft] AZ-700 - Azure Network Engineer Associate Practice Questions Preview

• Question 1

  Your company has a single on-premises datacenter in Washington DC. The East US Azure region has a peering location in Washington DC.
  The company only has Azure resources in the East US region.
  You need to implement ExpressRoute to support up to 1 Gbps. You must use only ExpressRoute Unlimited data plans. The solution must minimize costs.
  Which type of ExpressRoute circuits should you create?
  

  • A. ExpressRoute Local
  • B. ExpressRoute Direct
  • C. ExpressRoute Premium
  • D. ExpressRoute Standard

  Correct Answer: A

  Explanation:

  Based on the question's requirements and the discussion, I agree with the suggested answer A: ExpressRoute Local.
  
  Reasoning:
  The scenario focuses on connecting an on-premises datacenter to Azure resources within the same peering location (Washington DC) while minimizing costs and using an ExpressRoute Unlimited data plan. ExpressRoute Local is the most cost-effective option for this scenario because:

  • It's designed for connectivity within the same peering location, which aligns with the requirement of connecting the Washington DC datacenter to the East US Azure region (which has a peering location in Washington DC).
  • It supports the required bandwidth of up to 1 Gbps.
  • It supports the Unlimited data plan, as specified in the requirements.
  • It is the most cost-effective ExpressRoute option when connectivity is limited to a single region.

  
  Reasons for not choosing other options:
  

  • ExpressRoute Direct: This is for much larger bandwidth requirements (10 Gbps or 100 Gbps) and involves a different connectivity model, making it significantly more expensive and unsuitable for the stated 1 Gbps requirement.
  • ExpressRoute Standard: While it provides global connectivity, it's more expensive than ExpressRoute Local when the connectivity requirement is only within a single region (East US). Standard is not the most cost effective solution.
  • ExpressRoute Premium: This adds features like global connectivity and increased route limits on top of Standard, making it even more expensive and unnecessary for the scenario's single-region requirement.

  Therefore, ExpressRoute Local is the most appropriate choice to minimize costs while fulfilling all the technical requirements.

  
  Citations:

  • ExpressRoute Local, https://learn.microsoft.com/en-us/azure/expressroute/expressroute-locations
  • ExpressRoute Pricing, https://azure.microsoft.com/en-us/pricing/details/expressroute/

• Question 2

  You are planning an Azure Point-to-Site (P2S) VPN that will use OpenVPN.
  Users will authenticate by an on-premises Active Directory domain.
  Which additional service should you deploy to support the VPN authentication?
  

  • A. an Azure key vault
  • B. a RADIUS server
  • C. a certification authority
  • D. Azure Active Directory (Azure AD) Application Proxy

  Correct Answer: B

  Explanation:

  I agree with the suggested answer.
  The correct answer is B. a RADIUS server.
  Reasoning:
  When using OpenVPN for an Azure Point-to-Site (P2S) VPN and authenticating users against an on-premises Active Directory, a RADIUS server is required. The RADIUS server acts as an intermediary, verifying user credentials against the on-premises Active Directory and allowing or denying VPN access based on the authentication result. This setup allows for centralized authentication and authorization management.
  Using a RADIUS server enables you to leverage your existing on-premises Active Directory infrastructure for VPN authentication, avoiding the need to create and manage separate user accounts in Azure.
  Why other options are incorrect:

  • A. an Azure key vault: Azure Key Vault is used for securely storing and managing secrets, keys, and certificates. While it's useful in Azure environments, it's not directly involved in authenticating users against an on-premises Active Directory for a P2S VPN.
  • C. a certification authority: A certification authority (CA) is used for issuing digital certificates. While certificates are used for VPN authentication in some scenarios, authenticating against an on-premises Active Directory typically involves a RADIUS server.
  • D. Azure Active Directory (Azure AD) Application Proxy: Azure AD Application Proxy is used for publishing on-premises web applications and making them accessible remotely. It's not used for authenticating users against an on-premises Active Directory for a P2S VPN.

  Supporting Citations:

  • Configure Azure AD Multi-Factor Authentication settings, https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-client

• Question 3

  You plan to configure BGP for a Site-to-Site VPN connection between a datacenter and Azure.
  Which two Azure resources should you configure? Each correct answer presents a part of the solution. (Choose two.)
  NOTE: Each correct selection is worth one point.
  

  • A. a virtual network gateway
  • B. Azure Application Gateway
  • C. Azure Firewall
  • D. a local network gateway
  • E. Azure Front Door

  Correct Answer: AD

  Explanation:

  I agree with the suggested answer AD (Virtual Network Gateway and Local Network Gateway).
  Reason: Configuring BGP for a Site-to-Site VPN connection between a datacenter and Azure requires both a Virtual Network Gateway in Azure and a Local Network Gateway representing the on-premises network. The Virtual Network Gateway is the Azure resource that terminates the VPN connection and supports BGP peering. The Local Network Gateway represents the on-premises VPN device and its BGP settings.
  Reasons for not choosing the other options:

  • B. Azure Application Gateway: Azure Application Gateway is a web traffic load balancer and does not participate in establishing VPN connections or BGP routing.
  • C. Azure Firewall: Azure Firewall is a network security service and, while it can be integrated with VPNs, it is not directly involved in the BGP configuration for the VPN connection itself.
  • E. Azure Front Door: Azure Front Door is a global, scalable entry-point that uses the Microsoft global network. It is not directly involved in establishing VPN connections or BGP routing.

  Citations:

  • About VPN gateway BGP support, https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-bgp

• Question 4

  You fail to establish a Site-to-Site VPN connection between your company's main office and an Azure virtual network.
  You need to troubleshoot what prevents you from establishing the IPsec tunnel.
  Which diagnostic log should you review?
  

  • A. IKEDiagnosticLog
  • B. RouteDiagnosticLog
  • C. GatewayDiagnosticLog
  • D. TunnelDiagnosticLog

  Correct Answer: A

  Explanation:

  The suggested answer is correct. To troubleshoot issues with establishing an IPsec tunnel for a Site-to-Site VPN connection, the IKEDiagnosticLog is the appropriate log to review. This log provides detailed information about the Internet Key Exchange (IKE) protocol, which is essential for setting up the IPsec tunnel. Analyzing this log helps identify configuration errors, authentication problems, or connectivity issues that prevent the tunnel from being established.
  
  Here's why the other options are less suitable:

  • RouteDiagnosticLog: This log would be useful for troubleshooting routing issues, not the establishment of the IPsec tunnel itself.
  • GatewayDiagnosticLog: While gateway logs are important, they provide a more general overview of the VPN gateway's status and might not offer the detailed IKE-specific information needed for initial tunnel establishment troubleshooting.
  • TunnelDiagnosticLog: This log would be relevant after the tunnel is established to monitor its performance and identify issues like packet loss or latency, but it does not assist in troubleshooting the initial establishment of the IPsec tunnel.

  The IKEDiagnosticLog is specifically designed to capture the IKE negotiation process, making it the primary source for diagnosing tunnel establishment failures.

  Citations:

  • Azure VPN Gateway Diagnostic Logs, https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-vpn-with-azure-diagnostics
  • About VPN Logging and Analytics, https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-logging-and-analytics

• Question 5

  You have an Azure virtual network and an on-premises datacenter.
  You are planning a Site-to-Site VPN connection between the datacenter and the virtual network.
  Which two resources should you include in your plan? Each correct answer presents part of the solution.
  NOTE: Each correct selection is worth one point.
  

  • A. a user-defined route
  • B. a virtual network gateway
  • C. Azure Firewall
  • D. Azure Web Application Firewall (WAF)
  • E. an on-premises data gateway
  • F. an Azure application gateway
  • G. a local network gateway

  Correct Answer: BG

  Explanation:

  I agree with the suggested answer of B. a virtual network gateway and G. a local network gateway.
  
  Here's the reasoning:

  • A Site-to-Site VPN connection requires a VPN gateway on both ends of the connection: Azure and on-premises.
  • The virtual network gateway (B) is the VPN gateway that you create within your Azure virtual network. It serves as the Azure endpoint for the VPN tunnel.
  • The local network gateway (G) represents your on-premises VPN device in Azure. You configure it with the public IP address of your on-premises VPN device and the address prefixes of your on-premises network.

  
  The other options are incorrect because:

  • A. a user-defined route: While user-defined routes (UDRs) are essential for directing traffic within Azure, they don't establish the VPN connection itself. They are used to route traffic through the virtual network gateway once the VPN connection is established.
  • C. Azure Firewall: Azure Firewall is a network security service, but it is not directly involved in creating the VPN connection. It can be used in conjunction with a VPN gateway to inspect traffic flowing through the VPN tunnel, but it is not a prerequisite.
  • D. Azure Web Application Firewall (WAF): Azure WAF protects web applications from common exploits. It is not relevant to establishing a Site-to-Site VPN connection.
  • E. an on-premises data gateway: An on-premises data gateway is used to connect to on-premises data sources from Azure services like Power BI and Logic Apps. It is not used for Site-to-Site VPN connections.
  • F. an Azure application gateway: Azure Application Gateway is a web traffic load balancer. It is not used for Site-to-Site VPN connections.

  Citations:

  • About VPN Gateway, https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about

• Question 6

  HOTSPOT -
  You need to connect an on-premises network and an Azure environment. The solution must use ExpressRoute and support failing over to a Site-to-Site VPN connection if there is an ExpressRoute failure.
  What should you configure? To answer, select the appropriate options in the answer area.
  NOTE: Each correct selection is worth one point.
  Hot Area:
  
  

  Correct Answer: See interactive view.

  Explanation:

  The recommended answer is to configure the solution with route-based routing and two virtual network gateways.
  Reasoning:
  To support both ExpressRoute and Site-to-Site VPN connections with failover, you need to configure two virtual network gateways. One gateway will be for the ExpressRoute connection, and the other will be for the Site-to-Site VPN connection. Route-based routing is necessary to direct traffic appropriately between the on-premises network and the Azure environment, and to enable failover from ExpressRoute to VPN in case of an ExpressRoute failure. This setup ensures that traffic can be routed through the VPN gateway if the ExpressRoute connection becomes unavailable, providing a resilient connection.
  Why other options are not suitable:
  Using a single virtual network gateway is not sufficient because ExpressRoute and VPN connections require distinct gateway configurations. A policy-based VPN is less flexible than a route-based VPN and may not be suitable for complex network topologies or dynamic routing scenarios. Using BGP on a policy-based VPN is not a standard or supported configuration.

  • The suggested answer aligns with the consensus that two virtual network gateways are required for ExpressRoute and VPN coexistence.

  I agree with the suggested answer.

• Question 7

  Your company has an on-premises network and three Azure subscriptions named Subscription1, Subscription2, and Subscription3.
  The departments at the company use the Azure subscriptions as shown in the following table.
  
  All the resources in the subscriptions are in either the West US Azure region or the West US 2 Azure region.
  You plan to connect all the subscriptions to the on-premises network by using ExpressRoute.
  What is the minimum number of ExpressRoute circuits required?
  

  • A. 1
  • B. 2
  • C. 3
  • D. 4
  • E. 5

  Correct Answer: A

  Explanation:

  Based on the question and the discussion, I agree with the suggested answer A.
  Reasoning:
  A single ExpressRoute circuit, especially with a Standard SKU, can connect multiple virtual networks (VNets) within the same geopolitical region. In this scenario, all three subscriptions (Subscription1, Subscription2, and Subscription3) and their respective resources are located either in the West US Azure region or the West US 2 Azure region. These two regions are considered to be within the same geopolitical region.
  Therefore, one ExpressRoute circuit is sufficient to connect all three subscriptions to the on-premises network.
  Reasons for not choosing other options:
  Options B, C, D, and E suggest using 2, 3, 4, or 5 ExpressRoute circuits, respectively. These are unnecessary because a single ExpressRoute circuit can handle the connectivity for all the subscriptions within the same geopolitical region. Multiple circuits would only be needed if the subscriptions were in different geopolitical regions or if there were specific requirements for redundancy and high availability that are not mentioned in the question. A local SKU is also incorrect because it only connects to the same metro.
  

  • Citations:
  • ExpressRoute circuits and routing domains, https://learn.microsoft.com/en-us/azure/expressroute/expressroute-circuit-routing

• Question 8

  Your company has offices in New York and Amsterdam. The company has an Azure subscription. Both offices connect to Azure by using a Site-to-Site VPN connection.
  The office in Amsterdam uses resources in the North Europe Azure region. The office in New York uses resources in the East US Azure region.
  You need to implement ExpressRoute circuits to connect each office to the nearest Azure region. Once the ExpressRoute circuits are connected, the on-premises computers in the Amsterdam office must be able to connect to the on-premises servers in the New York office by using the ExpressRoute circuits.
  Which ExpressRoute option should you use?
  

  • A. ExpressRoute FastPath
  • B. ExpressRoute Global Reach
  • C. ExpressRoute Direct
  • D. ExpressRoute Local

  Correct Answer: B

  Explanation:

  I agree with the suggested answer.
  
  The correct answer is B. ExpressRoute Global Reach.
  
  Reasoning:
  ExpressRoute Global Reach is the appropriate solution because the primary requirement is to enable connectivity between the Amsterdam and New York offices via ExpressRoute circuits. This means traffic must flow from on-premises in Amsterdam, through Azure, and then to on-premises in New York (and vice versa). ExpressRoute Global Reach specifically facilitates this type of connectivity, allowing you to connect your on-premises networks through the Microsoft backbone using ExpressRoute circuits.
  
  Why other options are incorrect:

  • A. ExpressRoute FastPath: FastPath is designed to improve the performance of connections to Azure virtual networks by bypassing the gateway. It does not address the requirement of connecting two separate on-premises locations.
  • C. ExpressRoute Direct: ExpressRoute Direct is for customers who need very high bandwidth or need to connect directly to Microsoft's network at a peering location. It is not necessary for simply connecting two offices via ExpressRoute.
  • D. ExpressRoute Local: ExpressRoute Local is for connecting to Azure regions within the same metro area. It does not provide connectivity between distant locations like Amsterdam and New York.

  Therefore, ExpressRoute Global Reach is the only option that directly addresses the stated requirement of connecting the two on-premises locations (Amsterdam and New York) via the ExpressRoute circuits.

  Citations:

  • ExpressRoute Global Reach, https://learn.microsoft.com/en-us/azure/expressroute/expressroute-global-reach

• Question 9

  HOTSPOT -
  You have an Azure subscription that contains a single virtual network and a virtual network gateway.
  You need to ensure that administrators can use Point-to-Site (P2S) VPN connections to access resources in the virtual network. The connections must be authenticated by Azure Active Directory (Azure AD).
  What should you configure? To answer, select the appropriate options in the answer area.
  NOTE: Each correct selection is worth one point.
  Hot Area:
  
  

  Correct Answer: See interactive view.

  Explanation:

  Based on the question and discussion, I agree with the suggested answer.
  The configuration required to allow administrators to use Point-to-Site (P2S) VPN connections to access resources in the virtual network, authenticated by Azure Active Directory (Azure AD), involves configuring an Enterprise Application and using OpenVPN (SSL).
  
  Reasoning:
  To enable Azure AD authentication for P2S VPN connections, an enterprise application representing the Azure VPN service must be configured within Azure AD. This allows Azure AD to handle the authentication process for VPN clients. The OpenVPN protocol must be selected as it is the only protocol that supports Azure AD authentication for P2S VPN connections in Azure.
  Why other options are incorrect:

  • IKEv2: While IKEv2 is a secure VPN protocol, it does not natively support Azure AD authentication for P2S VPN connections. It typically relies on certificate-based authentication or other methods.
  • SSTP: SSTP is another VPN protocol, but it also does not support Azure AD authentication for P2S VPN connections.
  • RADIUS server: While RADIUS can be used for authentication, it's an external authentication system and not the direct method for integrating Azure AD with P2S VPN in Azure. Using a RADIUS server for Azure AD authentication would require additional configuration and is not the most straightforward approach.

  • Box 1: An enterprise application
  • Box 2: Open VPN (SSL)

  
  Citations:

  • Configure a P2S Open VPN connection to use Azure AD authentication: https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• Question 10

  HOTSPOT -
  You have the hybrid network shown in the Network Diagram exhibit.
  
  You have a peering connection between Vnet1 and Vnet2 as shown in the Peering-Vnet1-Vnet2 exhibit.
  
  You have a peering connection between Vnet1 and Vnet3 as shown in the Peering-Vnet1-Vnet3 exhibit.
  
  For each of the following statements, select Yes if the statement is true. Otherwise, select No.
  NOTE: Each correct selection is worth one point.
  Hot Area:
  
  

  Correct Answer: See interactive view.

  Explanation:

  Based on the question and the discussion, I agree with the suggested answer, which is Yes, No, No.
  Reasoning:
  The key concept here is that Azure Virtual Network Peering is non-transitive by default. This means that if VNet1 is peered with both VNet2 and VNet3, VNet2 and VNet3 are NOT automatically peered with each other. Therefore, resources in VNet2 cannot directly communicate with resources in VNet3 using only the peering connections described. For VNet2 and VNet3 to communicate, a separate peering connection between them or a gateway/NVA facilitating routing between them would be needed. The problem statement specifies peering between VNet1 and VNet2, and VNet1 and VNet3, but not between VNet2 and VNet3.
  
  Let's break down each statement:
  

  • Statement 1: Resources in Vnet2 can communicate with resources in Vnet1. - Yes. This is true because there's a peering connection between VNet1 and VNet2.
  • Statement 2: Resources in Vnet2 can communicate with resources in the on-premises network. - No. There is no gateway transit configured, and peering itself does not extend connectivity to the on-premises network. Gateway transit would be required for this, as per the provided documentation.
  • Statement 3: Resources in Vnet2 can communicate with resources in Vnet3. - No. As mentioned earlier, VNet Peering is non-transitive. Since VNet2 and VNet3 only have peering connections with VNet1, they cannot communicate directly with each other without a direct peering connection or other routing solution.

  
  Reasons for not choosing other answers:
  The alternative suggestions usually involve the assumption that VNet peering is transitive, or that a gateway or NVA is present when the problem statement doesn't indicate that.
  

  • Assuming transitivity would lead to a "Yes" answer for the third statement, which is incorrect without a direct peering or a routing solution in place.
  • Assuming gateway transit without it being explicitly mentioned in the configuration would lead to a "Yes" answer for the second statement, which is incorrect.

  
  Citations:

  • Virtual network peering, https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview
  • VPN gateway transit for virtual network peering, https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit