Free Microsoft AZ-700 Practice Exam with Questions & Answers

Box 1: VM2, VM3 and VM4.

VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocki ng inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

Box 2:

VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

To minimize the risk of SNAT port exhaustion for your 100 virtual machines in subnet4-1, while ensuring minimal administrative effort, you can use an  Azure NAT Gateway . This service provides scalable and resilient outbound connectivity for virtual networks, dynamically allocating SNAT ports to avoid exhaustion.

Navigate to the Azure Portal .

Search for “NAT gateways”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NAT gateway (e.g.,  NATGateway-Subnet4-1 ).

Region : Select the region where your virtual network is located.

Click on “Next: Outbound IP” .

Choose whether to use existing public IP addres ses or create new ones .

If creating new ones, click on  “Add new”  and configure the new public IP addresses.

Click on “Next: Subnet” .

Click on “Associate subnet” .

Select the virtual network  that contains subnet4-1.

Select subnet4-1  from the list of subnets.

Click on “OK” .

Review your settings  to ensure everything is correct.

Click on “Review + create”  and then  “Create” .

Azure NAT Gateway : This service provides outbound connectivity for virtual networks, dynamically allocating SNAT ports across all VM instances within a subnet.  This dynamic allocation helps prevent S NAT port exhaustion, especially in scenarios with high outbound connection volumes 1 2 .

Dynamic S NAT Port Allocation : Unlike static allocati on methods, NAT Gateway dynamically allocates SNAT ports based on demand, ensuring efficient use of availab le ports and reducing the risk of exhaus tion 2 .

Step-by-Step Solution Step 1: Create a NAT Gateway Step 2: Configure Outbound IP Addresses Step 3: Associate the NAT Gateway with Subnet4-1 Step 4: Review and Create Explanation By following these steps, you can ensure that your 100 virtual machines in subnet4-1 can make the necessary API calls without running into SNAT port exhaustion, all while minimizing administrative effort.

To provide a single host name that routes traffic based on the origin, you can use  Azure Traffic Manager . This service allows you to route traffic to different endpoints based on various routing methods, i ncluding geographic routing.

Navigate to the Azure Portal .

Search for “Traffic Manager profiles”  and select it.

Click on “Create” .

Enter the following details :

Name : Enter a name for the Traffic Manager profile (e.g.,  ContosoTrafficManager ).

Routing method : Select  Geographic .

Subscription : Select your subscription.

Resource group : Select an existing resource group or create a new one.

Resource group location : Choose a location (this does not affect the routing).

Click on “Create” .

Navigate to the newly created Traffic Manager profile .

Select “Endpoints”  from the left-hand menu.

Click on “Add”  to add a new endpoint.

Enter the following details :

Type : Select  Exter nal endpoint .

Name : Enter a name for the endpoint (e.g.,  NewYorkEndpoint ).

FQDN : Enter  ny.contoso.com .

Geographic region : Select  “World”  (this will be adjusted later).

Click on “Add”  to save the endpoint.

Repeat the process  to add the second endpoint:

Type : Select  External endpoint .

Name : Enter a name for the endpoint (e.g.,  GermanyEndpoint ).

FQDN : Enter  de.contoso.com .

Geographic region : Select  Europe .

Navigate to the Traffic Manager profile .

Select “Configuration”  from the left-hand menu.

Under “Geographic routing” , adjust the regions:

For the  GermanyEndpoint , ensure that the geographic region is set to  Europe .

For the  NewYorkEndpoint , ensure that the geographic region is set to  World  (excluding Europe).

Use a DNS query tool  to test the routing.

From a location in Germany , query the Traffic Manager profile’s DNS name and ensure it resolves to  de.contoso.com .

From a location outside Europe , query the Traffic Manager profile’s DNS name and ensure it resolves to  ny.contoso.com .

Azure Traffic Manager : This service uses DNS to direct client requests to the most appropriate endpoint based on the routing method you choose. Geographic routing ensures that traffic is directed based on t he origin of the request.

Geographic Routing : This method allows you to route traffic based on the geographic location of the DNS query origin, ensuring that users are directed to the nearest or most appropriate endpoint.

Step-by-Step Solution Step 1: Create a Traffic Manager Profile Step 2: Configure Endpoints Step 3: Adjust Geographic Routing Step 4: Test the Configuration Explanation By following these steps, you can provide a single host name that routes traffic to  de.contoso.com  for users in Germany and to  ny.contoso.com  for users from other locations, ensuring efficient and appropriate traffic management.

Here are the steps and explanations for ensuring that the storage34280945 storage account will only accept connections from hosts on VNET1:

To restrict network access to your storage account, you need to config ure the Azure Storage firewall and virtual network settings for your storage account.  You can do this in the Azure portal by selecti ng your storage account and then selecting  Networki ng  under  Settings 1 .

O n the  Networking   page, select  Firewalls and virtual networks , and then select  Selected ne tworks  under  Allow access from 1 . This will block all access to your storage account except from the networks or resources that you specify.

Under Virtual networks, select + Add existing virtual network.  Then select VNET1 from the list of virtual networks and select the sub net that c ontains the hosts that you want to allow access to y our storage acco unt 1 .  This will enable a service endpoin t for Storage in the sub net and configure a virtual network rule f or that subnet through the Azure storage firewall 2 .

Select  Add  to add the virtual network and subnet to your storage accoun t 1 .

Select  Save  to apply your changes 1 .

Here are the steps and explanations for ensuring that connections to the storage34280945 storage account can be made by using an IP address in the 10.1.1.0/24 range and the name stor-age34280945.pnvatelinlcblob.core.windows.net:

To allow access from a specific IP address range, you need to configure the Azure Storage firewall and virtual network setti ngs for your storage account.  You can do this in the Azure port al by selecting your storage account and then sele cting Networking under Settings 1 .

On the Networking page, sele ct Firewall s and virtual networks, and then select Selected networks under Allow access from 1 . This will block all access to your storage account except from the networks or resources that you specify.

Under Firewall, select Add rule, and then enter 10. 1.1.0/24 as the IP address or range.  You can also enter an option al rule name and description 1 . This will allow access from any IP address in the 10.1.1.0/24 range.

Sele ct Save to apply your changes 1 .

To map a custom domain name to your storage accou nt, you need to create a CNAME record with your domain provider that points to your s torage account endpoint 2 . A CNAME record is a type of DNS record that maps a source domain name to a desti nation domain name.

Sign in to your domain registrar’s website, and then go to the page for managing DNS settings 2 .

Create a CNAME record with the following information 2 :

Source domain name: stor-age34280945.pnvatelinlcblob.core.windows.net

Destination domain name: stor-age34280945.pnvatelinlcblob.core.windows.ne t

Save your changes a nd wait for the DNS propagation to take e ffec t 2 .

To register the custom domain name with Azure, you need to go back to the Azure portal and select you r storage account.  Then select Custom domain under Blob service 2 .

On the Custom domain page, enter stor-age34280945.pnvatelinlcblob.core.windows .net as the custom domain name and select Save 2 .