Microsoft AZ-700 Practice Exam Questions & Answers

Explanation

The question describes deploying an Application Gateway to route traffic to web apps hosted on two App Service instances based on HTTP host headers, but the specific table showing the web apps is not provided.

To determine the minimum number of listeners and routing rules:

• Listeners: You need one listener per unique combination of protocol, port, and hostname. Since routing is based on HTTP host headers, you need one listener per unique host header.
• Routing Rules: You need one routing rule per unique host header destination to map requests to the appropriate backend pool.

The general principle is: if you have N unique host headers, you need N listeners and N routing rules minimum.

Without seeing the specific web app hostnames in the table, the typical answer for 2 App Service instances with different hostnames would be: 2 listeners and 2 routing rules.

Explanation

Here are the steps and explanations for ensuring that connections to the storage34280945 storage account can be made by using an IP address in the 10.1.1.0/24 range and the name stor-age34280945.pnvatelinlcblob.core.windows.net:

To allow access from a specific IP address range, you need to configure the Azure Storage firewall and virtual network settings for your storage account.You can do this in the Azure portal by selecting your storage account and then selecting Networking under Settings1.

On the Networking page, select Firewalls and virtual networks, and then select Selected networks under Allow access from1. This will block all access to your storage account except from the networks or resources that you specify.

Under Firewall, select Add rule, and then enter 10.1.1.0/24 as the IP address or range.You can also enter an optional rule name and description1. This will allow access from any IP address in the 10.1.1.0/24 range.

Select Save to apply your changes1.

To map a custom domain name to your storage account, you need to create a CNAME record with your domain provider that points to your storage account endpoint2. A CNAME record is a type of DNS record that maps a source domain name to a destination domain name.

Sign in to your domain registrar's website, and then go to the page for managing DNS settings2.

Create a CNAME record with the following information2:

Source domain name: stor-age34280945.pnvatelinlcblob.core.windows.net

Destination domain name: stor-age34280945.pnvatelinlcblob.core.windows.net

Save your changes and wait for the DNS propagation to take effect2.

To register the custom domain name with Azure, you need to go back to the Azure portal and select your storage account.Then select Custom domain under Blob service2.

On the Custom domain page, enter stor-age34280945.pnvatelinlcblob.core.windows.net as the custom domain name and select Save2.

Explanation

The question asks if configuring a custom cookie and an exclusion rule meets the goal of making a URL accessible through the application gateway that is receiving an HTTP 403 error due to WAF.

Assessment:

This solution is partially correct but the description is somewhat vague:

• Creating an exclusion rule: ? This IS a correct approach - creating WAF policy exclusions to exclude specific request parameters from WAF inspection is the recommended solution
• Custom cookie: This part is unclear. You don't typically 'configure' a custom cookie as a solution. You would instead create an exclusion rule that excludes cookies (or a specific cookie) from WAF inspection

The correct answer likely depends on interpretation:

• If this means 'create exclusion rules to exclude cookies from WAF inspection' - then Yes, this meets the goal
• If 'custom cookie' means something else in the context - the answer is unclear

More precise solution: Create a WAF policy exclusion rule that exempts the specific cookie/header/body element triggering the 403 error from WAF rule evaluation.

Explanation

Answer: Configure a DNAT (Destination Network Address Translation) rule on FP1

Explanation:

What DNAT does:

A DNAT rule translates incoming traffic destined for the firewall's public IP address to an internal IP address of VM1.

Configuration:

• Source: Any (or specific IP ranges if needed)
• Protocol: TCP
• Destination port: 3389 (RDP port)
• Translated address: VM1's private IP address
• Translated port: 3389

How it works:

1. Client initiates RDP connection to FW1's public IP (e.g., 20.1.1.1:3389)
2. Azure Firewall Policy FP1 matches the incoming traffic against DNAT rules
3. The DNAT rule translates the destination from FW1's public IP to VM1's private IP
4. Traffic is routed to VM1 on port 3389
5. VM1 responds, and the firewall performs reverse NAT translation for the return traffic

Why DNAT: DNAT is specifically designed for port forwarding and allowing external access to internal resources. This is the standard method for exposing internal services through a firewall's public IP address.

Explanation

https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha?tabs=cli

Explanation

Here are the steps and explanations for ensuring that subnet4-3 can accommodate 507 hosts:

To determine the subnet size that can accommodate 507 hosts, you need to use the formula:number of hosts = 2^(32 - n) - 2, wherenis the number of bits in the subnet mask1. You need to find the value ofnthat satisfies this equation for 507 hosts.

To solve this equation, you can use trial and error or a binary search method. For example, you can start withn = 24, which is the default subnet mask for Class C networks. Then, plug in the value ofninto the formula and see if it is too big or too small for 507 hosts.

If you tryn = 24, you getnumber of hosts = 2^(32 - 24) - 2 = 254, which is too small. You need to increase the value ofnto get a larger number of hosts.

If you tryn = 25, you getnumber of hosts = 2^(32 - 25) - 2 = 510, which is just enough to accommodate 507 hosts. You can stop here or try a smaller value ofnto see if it still works.

If you tryn = 26, you getnumber of hosts = 2^(32 - 26) - 2 = 254, which is too small again. You need to decrease the value ofnto get a larger number of hosts.

Therefore, the smallest value ofnthat can accommodate 507 hosts isn = 25.This means that the subnet mask for subnet4-3 should be/25or255.255.255.128in dot-decimal notation1.

To change the subnet mask for subnet4-3, you need to go to the Azure portal and select your virtual network.Then select Subnets under Settings and select subnet4-3 from the list2.

On the Edit subnet page, under Address range (CIDR block), change the value from/24to/25.Then select Save2.

Explanation A service endpoint connects your virtual network to Azure services, but it only provides access within your region. To access the read-only endpoint in the paired region, you first need to configure firewall rules that allow traffic from your subnet to the storage account's secondary endpoint. Without adjusting the firewall settings, the service endpoint won't work properly for cross-region access. The other options like creating another service endpoint or modifying network routes don't directly enable cross-region access through the existing service endpoint configuration.