Microsoft AZ-700 Designing and Implementing Microsoft Azure Networking Solutions Exam Practice Test

The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

Box 1: VM2, VM3 and VM4.

VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocki ng inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

Box 2:

VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

Box 1: No

Zone2.contoso.com is not linked to any virtual networks. Therefore, no VMs are able to resolve names in the zone.

Box 2: Yes

VM4 is in VNet3. Zone1.contoso.com has a link to VNet3 and auto-registration is enabled on the link.

Box3: No

VNet3 is linked to zone1.contoso.com and auto-registration is enabled on the link. A virtual network can only have one registration zone. You can link zone2.contoso.com to VNet3 but you won’t be able to enable auto-registration on the link.

No

subnet1(WM1- > NSG1 outbound- > NSG10 outbound)- > subnet2(NSG1 inbound- > NSG11 inbound- > VM2)

Yes

NSG10 blocks ICMP from VNet4 (source 10.10.0.0/16) but it is not blocked from VM2 ג €™s subnet (VNet1 /Subnet2).

No

NSG11 blocks RDP (port TCP 3389) destined for ג €˜VirtualNetwork ג €™. VirtualNetwork is a service tag and means the address space of the virtual network (VNet1) which in this case is 10.1.0.0/16. Therefore, RDP traffic from subnet2 to anywhere else in VNet1 is blocked.

NGS1 only

VM2, VM3, VM4 and VM5

There is no virtual network peering between VM4’s VNet (VNet3) and VM5’s VNet (VNet4). To enable the VMs to communicate over the Microsoft backbone network a VNet peering is required between VNet3 and VNet4.

For the first question, only ExpressRoute GW SKU Ultra Performance support FastPath feature.

For the second question, vnet1 will connect to ExpressRoute gw, once Vnet1 peers with Vnet2, the traffic from on-premise network will bypass GW and Vnet1, directly goes to Vnet2, while this feature is under public preview.

====Reference

ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

To configure FastPath, the virtual network gateway must be either:

Ultra Performance

ErGw3AZ

VNet Peering - FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway.

https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

Gateway SKU

https://docs.microsoft.com/en-us/azure/expressroute/express route-about-virtual-network-gateways

Box 2: One NSG

The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way you would need two custom NSG rules.

Box 1: Two custom rules

With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic f rom VMScaleSet1. Then you would need to create another custom rule with a higher priority than the first rule that allows traffic on port 443.

The default rules in the NSG will allow all other traffic to VMScaleSet2.

Here are the steps and explanations for creating the object that will provide the IP addressing configu ration of the on-premises network to the Site-to-Site VPN:

The object that you need to create is called a local network gateway. A local network gateway represents your on-premises network and VPN device in Azure.  It c ontains the publ ic IP address of your VPN device and the a dd ress prefixes of your on-premises network that you want to connect to the Azure virtual network 1 .

To create a local network gateway, you need to go to the Azure portal and select Create a resource.  Sea rch for  local network gat eway , select  Local network gateway , then select  Crea te 2 .

On the Create local network gateway page, enter or select the following information and accept the defaults for the remaining settings:

Name: Type a unique name f or your local network gateway.

IP address: Type the public IP address of your VPN device, which is 131.107.50.60 in this case.

Address space: Type the internal address range of your on-premises network, which is 10.10.0.0/16 in this case.

Subscription: Select your subscription name.

Resource group: Select your resource group name.

Location: Select the same region as your virtual network.

Sel e ct  Review + c reate  and then select  Crea te  to create yo ur local network gateway 2 .

To minimize the risk of SNAT port exhaustion for your 100 virtual machines in subnet4-1, while ensuring minimal administrative effort, you can use an  Azure NAT Gateway . This service provides scalable and resilient outbound connectivity for virtual networks, dynamically allocating SNAT ports to avoid exhaustion.

Navigate to the Azure Portal .

Search for “NAT gateways”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NAT gateway (e.g.,  NATGateway-Subnet4-1 ).

Region : Select the region where your virtual network is located.

Click on “Next: Outbound IP” .

Choose whether to use existing public IP addres ses or create new ones .

If creating new ones, click on  “Add new”  and configure the new public IP addresses.

Click on “Next: Subnet” .

Click on “Associate subnet” .

Select the virtual network  that contains subnet4-1.

Select subnet4-1  from the list of subnets.

Click on “OK” .

Review your settings  to ensure everything is correct.

Click on “Review + create”  and then  “Create” .

Azure NAT Gateway : This service provides outbound connectivity for virtual networks, dynamically allocating SNAT ports across all VM instances within a subnet.  This dynamic allocation helps prevent S NAT port exhaustion, especially in scenarios with high outbound connection volumes 1 2 .

Dynamic S NAT Port Allocation : Unlike static allocati on methods, NAT Gateway dynamically allocates SNAT ports based on demand, ensuring efficient use of availab le ports and reducing the risk of exhaus tion 2 .

Step-by-Step Solution Step 1: Create a NAT Gateway Step 2: Configure Outbound IP Addresses Step 3: Associate the NAT Gateway with Subnet4-1 Step 4: Review and Create Explanation By following these steps, you can ensure that your 100 virtual machines in subnet4-1 can make the necessary API calls without running into SNAT port exhaustion, all while minimizing administrative effort.

To archive all the metrics of VNET1 to an existing storage account, you can use Azure Monitor’s diagnostic settings. Here’s how you can do it:

Step-by-Step Solution

Step 1: Navigate to VNET1 in the Azure Portal

Ope n the Azure Portal .

Search for “Virtual networks”  and select  VNET1  from the list.

Step 2: Configure Diagnostic Settings

In the VNET1 blade , select  “Diagnostic settings”  under the “Monitoring” section.

Click on “Add diagnostic setting” .

Step 3: Set Up the Diagnostic Setting

Enter a name  for the diagnostic setting (e.g., VNET1-Metrics-Archive).

Select the metrics  you want to archive. You can choose from various metrics like TotalBytesReceived, TotalBytesSent, etc.

Under “Destination details” , select  “Archive to a storage account” .

Choose the existing storage account  where you want to archive the metrics.

Configure the retention period  if needed.

Step 4: Save the Configuration

Review your settings  to ensure everything is correct.

Click on “Save”  to apply the diagnostic setting.

Explanation

Diagnostic Settings : These allow you to collect and route metrics and logs from your Azure resources to various destinations, including storage accounts, Log Analytics workspaces, and Event Hubs.

Metrics : Metrics provide num erical data about the performance and health of your resources. Archiving these metrics helps in long-term analysis and compliance.

Storage Account : Using an existing storage account ensures that the metrics are stored securely and can be accessed for futu re analysis.

By following these steps, you can ensure that all the metrics of VNET1 are archived to your existing storage account, enabling you to monitor and analyze the performance and health of your virtual network over time.

To prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts within subnet 1-2, you can use a  Network Security Group (NSG) . This solution is straightforward and minimizes administrative effort.

Step-by-Step Solution

Step 1: Create a Network Security Group (NSG)

Navigate to the Azure Portal .

Search for “Network security groups”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NSG (e.g., NSG-Subnet1-2).

Region : Select the region w here your virtual network is located.

Click on “Review + create”  and then  “Create” .

Step 2: Create an Inbound Security Rule

Navigate to the newly created NSG .

Select “Inbound security rules”  from the left-hand menu.

Click on “Add”  to create a new rule.

Ent er the following details :

Source : Select  Service Tag .

Source Service Tag : Select  VirtualNetwork .

Source port ranges : Leave as *.

Destination : Select  IP Addresses .

Destination IP addresses/CIDR ranges : Enter the IP range of subnet1-2 (e.g., 10.1.2.0/24).

Destination port ranges : Enter 5585.

Protocol : Select  TCP .

Action : Select  Deny .

Priority : Enter a priority value (e.g., 100).

Name : Enter a name for the rule (e.g., Deny-TCP-5585).

Click on “Add”  to create the rule.

Step 3: Associate the NSG with Subnet1-2

Navigate to the virtual network  that contains subnet1-2.

Select “Subnets”  from the left-hand menu.

Select subnet1-2  from the list of subnets.

Click on “Network security group” .

Select the NSG  you created (NSG-Subnet1-2).

Click on “Save” .

Explanation

Netwo rk Security Group (NSG) : NSGs are used to filter network traffic to and from Azure resources in an Azure virtual network.  They contain security rules tha t allow or deny inbound and outbound traffic based on source and destination IP addresses, port, and pr otocol 1 .

Inbound Security Rule : By creating a rule that denies traffic on TCP port 5585 from any source outside of subnet1-2, you ensure that only hosts within subnet1-2 can connect to this port.

Association with Subnet : Associating the NSG with subnet1-2 ensures that the security rules are applied to all resources within this subnet.

By following these steps, you can effectively prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts within subnet1-2, while minimizing administrative effort.

To ensure that the owner of VNET3 receives an alert whenever an administrative operation is performed on the virtual network, you can set up an  Activity Log Alert  in Azure Monitor. Here’s how you can do it:

Step-by-Step Solution

Step 1: Create an Activity Log Alert

Navigate to the Azure Portal .

Search for “Monitor”  and select it.

In the Monitor blade , select  “Alerts”  from the left-hand menu.

Click on “New alert rule” .

Step 2: Configure the Alert Rule

Select the Scope :

Click on  “Select resource” .

Choose  “Virtual Network”  as the resource type.

Select  VNET3  from the list of virtual networks.

Define the Condition :

Click on  “Add condition” .

In the  “Signal type”  dropdown, select  “Activity Log” .

Choose  “Administrative”  as the category.

Select the specific operations you want to monitor (e.g., Microsoft.Network/virtualNetworks/write for any write operations on the virtual network).

Set the Alert Details :

Enter a  name  for the alert rule (e.g., VNET3 Admin Operations Alert).

Provide a  description  if needed.

Configure the Action Group :

Click on  “Add action group” .

Enter a  name  for the action group.

Select the  action type  (e.g., Email/SMS/Push/Voice).

Enter the  details  of the recipient (e.g., the email address of the owner of VN ET3).

Review and Create :

Review the alert rule settings.

Click on  “Create alert rule” .

Explanation

Activity Log Alerts : These alerts notify you when specific operations are performed on your Azure resources. By setting up an alert for administrative operations, you ensure that any changes to VNET3 are promptly reported.

Action Groups : These define the actions to take when an alert is triggered. You can configure notifications via email, SMS, or other methods to ensure the owner of VNET3 is informed im mediately.

Administrative Operations : Monitoring these operations helps in tracking changes and maintaining the security and integrity of your virtual network.

By following these steps, you can ensure that the owner of VNET3 receives timely alerts for any administrative operations performed on the virtual network, helping to maintain oversight and security.

Here are the steps and explanations for ensuring that connections to the storage34280945 storage account can be made by using an IP address in the 10.1.1.0/24 range and the name stor-age34280945.pnvatelinlcblob.core.windows.net:

To allow access from a specific IP address range, you need to configure the Azure Storage firewall and virtual network setti ngs for your storage account.  You can do this in the Azure port al by selecting your storage account and then sele cting Networking under Settings 1 .

On the Networking page, sele ct Firewall s and virtual networks, and then select Selected networks under Allow access from 1 . This will block all access to your storage account except from the networks or resources that you specify.

Under Firewall, select Add rule, and then enter 10. 1.1.0/24 as the IP address or range.  You can also enter an option al rule name and description 1 . This will allow access from any IP address in the 10.1.1.0/24 range.

Sele ct Save to apply your changes 1 .

To map a custom domain name to your storage accou nt, you need to create a CNAME record with your domain provider that points to your s torage account endpoint 2 . A CNAME record is a type of DNS record that maps a source domain name to a desti nation domain name.

Sign in to your domain registrar’s website, and then go to the page for managing DNS settings 2 .

Create a CNAME record with the following information 2 :

Source domain name: stor-age34280945.pnvatelinlcblob.core.windows.net

Destination domain name: stor-age34280945.pnvatelinlcblob.core.windows.ne t

Save your changes a nd wait for the DNS propagation to take e ffec t 2 .

To register the custom domain name with Azure, you need to go back to the Azure portal and select you r storage account.  Then select Custom domain under Blob service 2 .

On the Custom domain page, enter stor-age34280945.pnvatelinlcblob.core.windows .net as the custom domain name and select Save 2 .

To configure a policy in Azure API Management that can be used by an Azure Application Gateway to protect against known web attack vectors and only allow requests from IP addresses in Canada, follow these steps:

Step-by-Step Solution

Step 1: Create or Access Your API Management Instance

Navigate to the Azure Portal .

Search for “ API Management services”  and select your API Management instance.

Step 2: Configure the Policy

In the API Management instance , go to the  “APIs”  section.

Select the API  you want to apply the policy to.

Go to the “Design” tab .

Select “All operations”  if you want to apply the policy to all operations, or select a specific operation.

Step 3: Add the Inbound Policy

In the Inbound processing section , click on  “+ Add policy” .

Select “IP filter”  from the list of policies.

Add the IP address ranges for Canada . You c an find the IP ranges for Canada from a reliable source or use a service that provides this information.

Here is an example of the XML configuration for the policy:

< inbound >

< ip-filter action= " allow " >

< address-range from= " 24.0.0.0 " to= " 24.255.255.255 " / >

< address-range from= " 47.0.0.0 " to= " 47.255.255.255 " / >

< !-- Add other Canadian IP ranges as needed -- >

< /ip-filter >

< ip-filter action= " deny " >

< address-range from= " 0.0.0.0 " to= " 255.255.255.255 " / >

< /ip-filter >

< /inbound >

Save the policy  to apply the changes.

Explanation

IP Filter Policy : This policy allows you to filter incoming requests based on their IP addresses. By specifying the IP ranges for Canada, you ensure that only requests originating from these IPs are allowed.

Inbound Processing : Applying the policy in the inbound section ensures that the requests are filtered before they reach your API.

By following these steps, you can configure a polic y in Azure API Management that res tricts a ccess to your API to only those requests ori ginating from IP ad dresses in Canada, thereby enhancing security and compliance

To achieve the task of ensuring that virtual machines on VNET1 and VNET2 are included automatically in a DNS zone named contoso.azure, and that they can resolve the names of the virtual machines on either virtual network, you can follow these steps:

Step-by-Step Solution

Step 1: Create a Private DNS Zone

Navigate to the Azure Portal .

Search for “Private DNS zones”  in the search bar and select it.

Click on “Create” .

Enter the DNS zone name  as contoso.azure.

Select the appropriate subscription  and resource group.

Click on “Review + create”  and then  “Create” .

Step 2: Link VNET1 and VNET2 to the DNS Zone

Go to the newly created DNS zone  (contoso.azure).

Select “Virtual network links”  from the left-hand menu.

Click on “Add” .

Enter a name  for the link (e.g., VNET1-link).

Select the subs cription  and  virtual network (VNET1) .

Enable auto-registration  to ensure that VMs are automatically registered in the DNS zone.

Click on “OK” .

Repeat the process  for VNET2.

Step 3: Configure DNS Settings for VNET1 and VNET2

Navigate to VNET1  in the Azure P ortal.

Select “DNS servers”  under the “Settings” section.

Ensure that the DNS server is set to “Default (Azure-provided)” .

Repeat the process  for VNET2.

Step 4: Verify Name Resolution

Deploy a virtual machine  in VNET1 and another in VNET2.

Connect to the v irtual machines  using Remote Desktop Protocol (RDP) or Secure Shell (SSH).

Test name resolution  by pinging the VM in VNET2 from the VM in VNET1 using its hostname (e.g., ping < VM-name > .contoso.azure).

Explanation

Private DNS Zone : This allows you to manage and resolve domain names in a private network without exposing them to the public internet.

Virtual Network Links : Linking VNET1 and VNET2 to the DNS zone ensures that VMs in these networks can register their DNS records automatically.

Auto-registration : This feature automatically registers the DNS records of VMs in the linked virtual networks, simplifying management.

DNS Settings : Using Azure-provided DNS ensures that the VMs can resolve each other’s names without additional configuration.

By following these steps, you ensure that virtual machines on VNET1 and VNET2 are included automatically in the DNS zone contoso.azure and can resolve each other’s names seamlessly.

To ensure that only hosts on VNET1 can access the slcnage42150372 storage account and that access occurs over the Azure backbone network, you can use  Azure Private Endpoints . This method secures the connection by assigning a private IP address from your virtual network to the storage account, ensuring that traffic does not traverse the public internet.

Step-by-Step Solution

Step 1: Create a Private Endpoint for the Storage Account

Navigate to the Azure Portal .

Search for “Storage accounts”  and select the slcnage42150372 storage account.

In the storage account blade , select  “Networking”  under the “Security + networking” section.

Under “Private endpoint connections” , click on  “Add private endpoint” .

Enter the following details :

Name : Enter a name for the private endpoint (e.g., PrivateEndpoint-VNET1).

Region : Select the same region as your virtual network (VNET1).

Click on “Next: Resource” .

Step 2: Configure the Resource

Select “Target sub-resource” : Choose the storage service you want to connect to (e.g., blob, file, queue, table).

Click on “Next: Virtual network” .

Step 3: Select the Virtual Network and Subnet

Select the virtual n etwork : Choose VNET1.

Select the subnet : Choose the appropriate subnet within VNET1.

Click on “Next: Configuration” .

Step 4: Configure DNS Integration (Optional)

Configure DNS settings  if needed to ensure proper name resolution within your virtual network.

Click on “Next: Tags” , add any tags if necessary, and then click on  “Review + create” .

Review your settings  and click on  “Create” .

Step 5: Restrict Public Network Access

Navigate back to the storage account .

Select “Networking”  under the “Security + networking” section.

Under “Firewalls and virtual networks” , select  “Selected networks” .

Ensure that only VNET1 is listed  under the virtual networks section.

Click on “Save” .

Explanation

Private Endpoints : These provide secure connectivity to Azure services by assigning a private IP address from your VNet to the service, ensuring that traffic stays wit hin the Azure backbone ne twork 1 2 .

Firewall and Virtual Networks : Configuring the storage account to allow access only from selected networks (VNET1) ensures that no other network can access the s torage account 3 .

By following these steps, you can ensure that only hosts on VNET1 can access the slcnage42150372 storage account, and that all access occurs over the secure Azure backbone network.