AZ-700 Topic 4 Multiple Choice

You have an Azure virtual machine named VM1.

You need to capture all the network traffic of VM1 by using Azure Network Watcher.

To which locations can the capture be written?

• A. blob storage only

• B. blob storage, a file path on VM1, and a premium storage account

• C. a file path on VM1 only

• D. blob storage and a file path on VM1 only

You deploy an Azure firewall to AzureFirewallSubnet. You route all traffic from Subnet2 through the firewall.

You need to ensure that all the hosts on Subnet2 can access an external site located at https://*.contoso.com.

What should you do?

• A. In a firewall policy, create a DNAT rule.

• B. Create a network security group (NSG) and associate the NSG to Subnet2.

• C. In a firewall policy, create a network rule.

• D. In a firewall policy, create an application rule.

You have an Azure Web Application Firewall (WAF) policy in prevention mode that is associated to an Azure Front Door instance.

You need to configure the policy to meet the following requirements:

✑ Log all connections from Australia.

✑ Deny all connections from New Zealand.

✑ Deny all further connections from a network of 131.107.100.0/24 if there are more than 100 connections during one minute.

What is the minimum number of objects you should create?

• A. three custom rules that each has one condition

• B. one custom rule that has three conditions

• C. one custom rule that has one condition

• D. one rule that has two conditions and another rule that has one condition

You have an Azure subscription that contains multiple virtual machines in the West US Azure region.

You need to use Traffic Analytics.

Which two resources should you create? Each correct answer presents part of the solution. (Choose two.)

NOTE: Each correct answer selection is worth one point.

• A. an Azure Monitor workbook

• B. a Log Analytics workspace

• C. a storage account

• D. an Azure Sentinel workspace

• E. an Azure Monitor data collection rule

You have a hybrid environment that uses ExpressRoute to connect an on-premises network and Azure.

You need to log the uptime and the latency of the connection periodically by using an Azure virtual machine and an on-premises virtual machine.

What should you use?

• A. Azure Monitor

• B. IP flow verify

• C. Connection Monitor

• D. Azure Internet Analyzer

You have an Azure subscription that contains the following resources:

✑ A virtual network named Vnet1

✑ Two subnets named subnet1 and AzureFirewallSubnet

✑ A public Azure Firewall named FW1

✑ A route table named RT1 that is associated to Subnet1

✑ A rule routing of 0.0.0.0/0 to FW1 in RT1

After deploying 10 servers that run Windows Server to Subnet1, you discover that none of the virtual machines were activated.

You need to ensure that the virtual machines can be activated.

What should you do?

• A. On FW1, create an outbound service tag rule for AzureCloud.

• B. On FW1, create an outbound network rule that allows traffic to the Azure Key Management Service (KMS).

• C. Deploy a NAT gateway.

• D. To Subnet1, associate a network security group (NSG) that allows outbound access to port 1688.

You have an Azure virtual network that contains a subnet named Subnet1. Subnet1 is associated to a network security group (NSG) named NSG1.

NSG1 blocks all outbound traffic that is not allowed explicitly.

Subnet1 contains virtual machines that must communicate with the Azure Cosmos DB service.

You need to create an outbound security rule in NSG1 to enable the virtual machines to connect to Azure Cosmos DB.

What should you include in the solution?

• A. a service tag

• B. a service endpoint policy

• C. a subnet delegation

• D. an application security group

Your company has offices in Montreal, Seattle, and Paris. The outbound traffic from each office originates from a specific public IP address.

You create an Azure Front Door instance named FD1 that has Azure Web Application Firewall (WAF) enabled. You con gure a WAF policy named

Policy1 that has a rule named Rule1. Rule1 applies a rate limit of 100 requests for traffic that originates from the office in Montreal.

You need to apply a rate limit of 100 requests for traffic that originates from each office.

What should you do?

• A. Modify the rate limit threshold of Rule1.

• B. Create two additional associations.

• C. Modify the conditions of Rule1.

• D. Modify the rule type of Rule1.

You have an Azure virtual network named Vnet1.

You need to ensure that the virtual machines in Vnet1 can access only the Azure SQL resources in the East US Azure region. The virtual machines

must be prevented from accessing any Azure Storage resources.

Which two outbound network security group (NSG) rules should you create? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

• A. a deny rule that has a source of VirtualNetwork and a destination of Sql

• B. an allow rule that has the IP address range of Vnet1 as the source and destination of Sql.EastUS

• C. a deny rule that has a source of VirtualNetwork and a destination of 168.63.129.0/24

• D. a deny rule that has the IP address range of Vnet1 as the source and destination of Storage

You have an Azure subscription that contains the following resources:

✑ A virtual network named Vnet1

✑ A subnet named Subnet1 in Vnet1

✑ A virtual machine named VM1 that connects to Subnet1

✑ Three storage accounts named storage1, storage2, and storage3

You need to ensure that VM1 can access storage1. VM1 must be prevented from accessing any other storage accounts.

Solution: You configure the firewall on storage1 to only accept connections from Vnet1.

Does this meet the goal?

• A. Yes

• B. No