AZ-700 Sample Questions & Answers

Using Application Security Groups (ASGs) is the most efficient and scalable solution. By creating an ASG for each application tier (WebASG, AppASG, DataASG) and associating the VM NICs accordingly, you can define NSG rules based on these logical groups rather than explicit IP addresses. A single NSG can be applied to all subnets with rules like: 'Allow traffic from source WebASG to destination AppASG' and 'Deny traffic from source WebASG to destination DataASG'. This simplifies management, as you don't need to update IP addresses in the NSG rules when VMs are added or removed.

ExpressRoute Global Reach is designed for this exact scenario. It allows you to link ExpressRoute circuits together to make a private network between your on-premises locations, using the Microsoft global network as the backbone. This enables direct connectivity between the New York and London offices without the traffic having to hairpin through a VNet in Azure or traverse the public internet. The Premium Add-on is required for global connectivity to Azure services, but Global Reach is the specific feature for on-premises to on-premises communication.

This statement is false. Data transfer costs for Global VNet Peering (across regions) are different and typically higher than for VNet peering within the same region. For regional VNet peering, both ingress and egress traffic are charged. For Global VNet Peering, traffic is charged at zonal data transfer rates, which vary based on the Azure zones the data is traversing.

IP Flow Verify checks if a packet is allowed or denied to or from a virtual machine based on the effective security rules. An 'Access Denied' result directly points to a Network Security Group (NSG) rule blocking the traffic. The block could be on the outbound path from the source VM (VM1) or on the inbound path to the destination VM (VM2). While a disabled peering or incorrect routing would cause a failure, they would typically result in a 'Traffic is not routable' or similar error, not 'Access Denied'.

Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. The 'Performance' routing method is specifically designed to route traffic to the endpoint that has the lowest network latency from the client's perspective, effectively sending them to the 'closest' region. It also includes built-in endpoint health monitoring and automatic failover, which satisfies the requirement to redirect users if one region becomes unavailable. Azure Load Balancer and Application Gateway are regional services and cannot perform DNS-based global routing on their own.

Application Gateway's 'Rewrite sets' feature allows you to rewrite URLs, query strings, and HTTP headers of requests and responses. To change the URL path from '/images' to '/content', you would create a rewrite rule within a rewrite set. This rule would have a condition to match the incoming path and an action to set the new path. This rewrite set is then associated with the appropriate routing rule. While a path-based routing rule directs traffic, it doesn't change the path itself. A backend path override in the HTTP settings appends a fixed string, but rewrite sets offer more powerful and conditional rewriting capabilities.

This scenario is the primary use case for Azure Private Link Service. The service provider places their application behind a Standard SKU internal Azure Load Balancer. They then create a Private Link Service that references the load balancer's frontend IP configuration. The partner (consumer) can then create a Private Endpoint in their own VNet that requests a connection to the Private Link Service. Once the provider approves the connection, the partner's VNet has a private, secure connection to the service without IP space overlap concerns, VNet peering, or internet exposure.

To use Microsoft Entra ID as the authentication method for a Point-to-Site VPN, you must use the OpenVPN tunnel type. The OpenVPN protocol allows for modern, token-based authentication mechanisms, which is how the integration with Microsoft Entra ID works. SSTP and IKEv2 primarily support certificate-based or RADIUS authentication and do not natively support direct Microsoft Entra ID authentication for P2S VPNs in Azure.

The primary function of Azure Route Server is to simplify dynamic routing between your Network Virtual Appliances (NVAs) and your Azure virtual network. It establishes BGP peering with NVAs and injects their routes into the VNet's route table. This avoids the need for complex, manually configured User-Defined Routes (UDRs) to direct traffic to the NVA. It doesn't inspect or filter traffic itself; it only facilitates the exchange of routing information.

Azure Front Door Premium tier supports integrating with Private Link to secure the connection to the origin (backend). By enabling Private Link on the origin configuration in Front Door and approving the private endpoint connection on the App Service, traffic flows from Front Door to the App Service over the Azure private backbone network. This ensures the backend is not exposed to the public internet and all communication is private and secure.