Free Microsoft AZ-700 Practice Exam with Questions & Answers | Set: 2

To ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance in subnet3-2 for packet inspection, you can use  User-Defined Routes (UDRs)  to direct the traffic. Here’s how you can do it:

Navigate to the Azure Portal .

Search for “Route tables”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the route table (e.g.,  RouteTable-Subnet3-1 ).

Region : Select the region where your virtual network is located.

Click on “Review + create”  and then  “Create” .

Navigate to the newly created route table .

Select “Routes”  from the left-hand menu.

Click on “Add”  to create a new route.

Enter the following details :

Route name : Enter a name for the route (e.g.,  RouteToAppliance ).

Address prefix : Enter  0.0.0.0/0  to route all internet traffic.

Next hop type : Select  Virtual appliance .

Next hop address : Enter the IP address of the appliance ( 10.3.2.100 ).

Click on “OK”  to add the route.

Navigate to the route table .

Select “Subnets”  from the left-hand menu.

Click on “Associate” .

Select the virtual network  that contains subnet3-1.

Select subnet3-1  from the list of subnets.

Click on “OK” .

User-Defined Routes (UDRs) : These allow you to control the routing of traffic within your virtual network.  By defining a route that directs all internet-bound traffic to the appliance, you ensure that the traffic is inspected before it reaches the internet 1 .

Virtual Appliance : This is a ne twork appliance that performs specif i c functions, such as packet inspection, and is treated as a next hop in the routin g table 2 .

Route Table Association : Associating the route table with subnet3-1 ensures that all traffic from this subnet follows the defined routes.

Step-by-Step Solution Step 1: Create a Route Table Step 2: Add a Route to the Route Table Step 3: Associate the Route Table with Subnet3-1 Explanation By following these steps, you can ensure that all internet-bound traffic from subnet3-1 is forwarded to the appliance in subnet3-2 for inspection, thereby enhancing your network security.

To ensure that hosts on VNET1 and VNET2 can communicate with minimal latency, you can use  Virtual Network Peering . This method connects the two virtual networks directly through the Microsoft backbone network, ensuring low-latency and high-bandwidth communication.

Step-by-Step Solution

Step 1: Set Up Virtual Network Peering

Navigate to the Azure Portal .

Search for “Virtual networks”  and select VNET1.

In the left-hand menu , select  “Peerings”  under the “Settings” section.

Click on “Add”  to create a new peering.

Enter the following details :

Name : Enter a name for the peering (e.g., VNET1-to-VNET2).

Peer virtual network : Select VNET2.

Allow virtual network access : Ensure this is enabled.

Allow forwarded traffic : Enable if needed.

Allow gateway transit : Enable if needed.

Click on “Add” .

Step 2: Configure Peering on VNET2

Navigate to VNET2  in the Azure Portal.

In the left-hand menu , select  “Peerings”  under the “Sett ings” section.

Click on “Add”  to create a new peering.

Enter the following details :

Name : Enter a name for the peering (e.g., VNET2-to-VNET1).

Peer virtual network : Select VNET1.

Allow virtual network access : Ensure this is enabled.

Allow forwarded traffic : Enable if needed.

Allow gateway transit : Enable if needed.

Click on “Add” .

Explanation

Virtual Network Peering : This feature connects two virtual networks in the same or different regions, allowing resources in both networks to communicate with each othe r as if they were part of the same network.  Th e traffic between peered virtual networks uses the Micros oft backbone infrastructure, ensuring low la tency and hi gh bandwidth 1 2 .

Allow Virtual Network Access : This setting ensures that the virtual networks can communicate with each other.

Allow Forwarded Traffic : This setting allows traffic forwarded from a network security appliance in the peered virtual network.

Allow Gateway Transit : This setting allows the peered virtual network to use the gateway in the local virtual network.

By following these steps, you can ensure that hosts on VNET1 and VNET2 can communicate with minimal latency, leveraging the high-speed Microsoft backbone network.

To archive all the metrics of VNET1 to an existing storage account, you can use Azure Monitor’s diagnostic settings. Here’s how you can do it:

Step-by-Step Solution

Step 1: Navigate to VNET1 in the Azure Portal

Ope n the Azure Portal .

Search for “Virtual networks”  and select  VNET1  from the list.

Step 2: Configure Diagnostic Settings

In the VNET1 blade , select  “Diagnostic settings”  under the “Monitoring” section.

Click on “Add diagnostic setting” .

Step 3: Set Up the Diagnostic Setting

Enter a name  for the diagnostic setting (e.g., VNET1-Metrics-Archive).

Select the metrics  you want to archive. You can choose from various metrics like TotalBytesReceived, TotalBytesSent, etc.

Under “Destination details” , select  “Archive to a storage account” .

Choose the existing storage account  where you want to archive the metrics.

Configure the retention period  if needed.

Step 4: Save the Configuration

Review your settings  to ensure everything is correct.

Click on “Save”  to apply the diagnostic setting.

Explanation

Diagnostic Settings : These allow you to collect and route metrics and logs from your Azure resources to various destinations, including storage accounts, Log Analytics workspaces, and Event Hubs.

Metrics : Metrics provide num erical data about the performance and health of your resources. Archiving these metrics helps in long-term analysis and compliance.

Storage Account : Using an existing storage account ensures that the metrics are stored securely and can be accessed for futu re analysis.

By following these steps, you can ensure that all the metrics of VNET1 are archived to your existing storage account, enabling you to monitor and analyze the performance and health of your virtual network over time.

To ensure that the owner of VNET3 receives an alert whenever an administrative operation is performed on the virtual network, you can set up an  Activity Log Alert  in Azure Monitor. Here’s how you can do it:

Step-by-Step Solution

Step 1: Create an Activity Log Alert

Navigate to the Azure Portal .

Search for “Monitor”  and select it.

In the Monitor blade , select  “Alerts”  from the left-hand menu.

Click on “New alert rule” .

Step 2: Configure the Alert Rule

Select the Scope :

Click on  “Select resource” .

Choose  “Virtual Network”  as the resource type.

Select  VNET3  from the list of virtual networks.

Define the Condition :

Click on  “Add condition” .

In the  “Signal type”  dropdown, select  “Activity Log” .

Choose  “Administrative”  as the category.

Select the specific operations you want to monitor (e.g., Microsoft.Network/virtualNetworks/write for any write operations on the virtual network).

Set the Alert Details :

Enter a  name  for the alert rule (e.g., VNET3 Admin Operations Alert).

Provide a  description  if needed.

Configure the Action Group :

Click on  “Add action group” .

Enter a  name  for the action group.

Select the  action type  (e.g., Email/SMS/Push/Voice).

Enter the  details  of the recipient (e.g., the email address of the owner of VN ET3).

Review and Create :

Review the alert rule settings.

Click on  “Create alert rule” .

Explanation

Activity Log Alerts : These alerts notify you when specific operations are performed on your Azure resources. By setting up an alert for administrative operations, you ensure that any changes to VNET3 are promptly reported.

Action Groups : These define the actions to take when an alert is triggered. You can configure notifications via email, SMS, or other methods to ensure the owner of VNET3 is informed im mediately.

Administrative Operations : Monitoring these operations helps in tracking changes and maintaining the security and integrity of your virtual network.

By following these steps, you can ensure that the owner of VNET3 receives timely alerts for any administrative operations performed on the virtual network, helping to maintain oversight and security.

To ensure that only hosts on VNET1 can access the slcnage42150372 storage account and that access occurs over the Azure backbone network, you can use  Azure Private Endpoints . This method secures the connection by assigning a private IP address from your virtual network to the storage account, ensuring that traffic does not traverse the public internet.

Step-by-Step Solution

Step 1: Create a Private Endpoint for the Storage Account

Navigate to the Azure Portal .

Search for “Storage accounts”  and select the slcnage42150372 storage account.

In the storage account blade , select  “Networking”  under the “Security + networking” section.

Under “Private endpoint connections” , click on  “Add private endpoint” .

Enter the following details :

Name : Enter a name for the private endpoint (e.g., PrivateEndpoint-VNET1).

Region : Select the same region as your virtual network (VNET1).

Click on “Next: Resource” .

Step 2: Configure the Resource

Select “Target sub-resource” : Choose the storage service you want to connect to (e.g., blob, file, queue, table).

Click on “Next: Virtual network” .

Step 3: Select the Virtual Network and Subnet

Select the virtual n etwork : Choose VNET1.

Select the subnet : Choose the appropriate subnet within VNET1.

Click on “Next: Configuration” .

Step 4: Configure DNS Integration (Optional)

Configure DNS settings  if needed to ensure proper name resolution within your virtual network.

Click on “Next: Tags” , add any tags if necessary, and then click on  “Review + create” .

Review your settings  and click on  “Create” .

Step 5: Restrict Public Network Access

Navigate back to the storage account .

Select “Networking”  under the “Security + networking” section.

Under “Firewalls and virtual networks” , select  “Selected networks” .

Ensure that only VNET1 is listed  under the virtual networks section.

Click on “Save” .

Explanation

Private Endpoints : These provide secure connectivity to Azure services by assigning a private IP address from your VNet to the service, ensuring that traffic stays wit hin the Azure backbone ne twork 1 2 .

Firewall and Virtual Networks : Configuring the storage account to allow access only from selected networks (VNET1) ensures that no other network can access the s torage account 3 .

By following these steps, you can ensure that only hosts on VNET1 can access the slcnage42150372 storage account, and that all access occurs over the secure Azure backbone network.

To create an Azure Firewall instance, you need to go to the Azure portal and select Create a resource. Type firewall in the search box and press Enter.  Sel ect Firewall and then select Create 1 .

To assign an IP address from the address range of 1 0.1.255.0/24 to the firewall, you need to select a public IP address that belongs to that range.  You can either create a new public IP address or use an existing one 1 .

To use a new Premium firewall policy named FW-policy1, you need to select Premium as the Firewall tier and c reate a new policy with the name FW-policy1 2 .  A Pre mium firewall pol icy allows you t o configure ad vanced features such as TLS Inspection, IDPS, URL Filtering, and Web Categories 3 .

To route traffic directly to the internet, you need to enable SNAT (Source Network Address Translation) for the firewall.  SNAT allows the firewall to use its pub lic IP address as the source address for out bound t raffic 4 .

To prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts within subnet 1-2, you can use a  Network Security Group (NSG) . This solution is straightforward and minimizes administrative effort.

Step-by-Step Solution

Step 1: Create a Network Security Group (NSG)

Navigate to the Azure Portal .

Search for “Network security groups”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NSG (e.g., NSG-Subnet1-2).

Region : Select the region w here your virtual network is located.

Click on “Review + create”  and then  “Create” .

Step 2: Create an Inbound Security Rule

Navigate to the newly created NSG .

Select “Inbound security rules”  from the left-hand menu.

Click on “Add”  to create a new rule.

Ent er the following details :

Source : Select  Service Tag .

Source Service Tag : Select  VirtualNetwork .

Source port ranges : Leave as *.

Destination : Select  IP Addresses .

Destination IP addresses/CIDR ranges : Enter the IP range of subnet1-2 (e.g., 10.1.2.0/24).

Destination port ranges : Enter 5585.

Protocol : Select  TCP .

Action : Select  Deny .

Priority : Enter a priority value (e.g., 100).

Name : Enter a name for the rule (e.g., Deny-TCP-5585).

Click on “Add”  to create the rule.

Step 3: Associate the NSG with Subnet1-2

Navigate to the virtual network  that contains subnet1-2.

Select “Subnets”  from the left-hand menu.

Select subnet1-2  from the list of subnets.

Click on “Network security group” .

Select the NSG  you created (NSG-Subnet1-2).

Click on “Save” .

Explanation

Netwo rk Security Group (NSG) : NSGs are used to filter network traffic to and from Azure resources in an Azure virtual network.  They contain security rules tha t allow or deny inbound and outbound traffic based on source and destination IP addresses, port, and pr otocol 1 .

Inbound Security Rule : By creating a rule that denies traffic on TCP port 5585 from any source outside of subnet1-2, you ensure that only hosts within subnet1-2 can connect to this port.

Association with Subnet : Associating the NSG with subnet1-2 ensures that the security rules are applied to all resources within this subnet.

By following these steps, you can effectively prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts within subnet1-2, while minimizing administrative effort.