Free AZ-700 sample questions

Correct answer: Configure a per-rule exclusion for rule 942100 that applies only to the 'RequestArgNames' for the specific search query parameter.

The best practice for handling a false positive in WAF is to be as specific as possible to avoid weakening security. Creating a per-rule exclusion is the most precise method. By specifying the rule ID (942100) and limiting the exclusion to the specific request argument name (e.g., 'search_query'), you are telling the WAF to ignore this specific SQL injection check only for that parameter, while keeping the rule active for all other parts of the request. Disabling the rule entirely or switching to Detection mode would significantly increase the security risk. A custom allow rule for apostrophes is too broad and could be exploited.

Correct answers: Azure NAT Gateway; Azure Firewall

Both Azure NAT Gateway and Azure Firewall are excellent solutions for providing secure, managed outbound internet access for private VMs. Azure NAT Gateway is a fully managed and highly resilient service that simplifies outbound-only internet connectivity for virtual networks. It's easy to set up and provides scalable SNAT capabilities. Azure Firewall provides the same outbound SNAT capability but adds a layer of security by allowing you to define FQDN-based application rules, ensuring the VMs can only connect to the approved vendor websites and not the entire internet. The choice between them depends on whether simple NAT or full-featured firewalling is required.

Correct answer: An Azure Private Endpoint for the Azure SQL Database.

An Azure Private Endpoint is the correct solution. It creates a network interface within your VNet with a private IP address, effectively bringing the Azure SQL Database into your private network. This ensures traffic from the VNet to the database stays on the Microsoft backbone. Crucially, because the database now has a private IP in the VNet, on-premises resources connected via ExpressRoute or VPN can resolve and connect to it privately. A VNet Service Endpoint also keeps traffic on the Azure backbone but does not provide a private IP in the VNet, making it inaccessible directly from on-premises without additional configuration like NAT.

Correct answer: Create three ASGs (WebASG, AppASG, DataASG) and associate them with the respective VM NICs. Create one NSG associated with all three subnets containing rules that use the ASGs as source and destination.

Using Application Security Groups (ASGs) is the most efficient and scalable solution. By creating an ASG for each application tier (WebASG, AppASG, DataASG) and associating the VM NICs accordingly, you can define NSG rules based on these logical groups rather than explicit IP addresses. A single NSG can be applied to all subnets with rules like: 'Allow traffic from source WebASG to destination AppASG' and 'Deny traffic from source WebASG to destination DataASG'. This simplifies management, as you don't need to update IP addresses in the NSG rules when VMs are added or removed.

Correct answer: ExpressRoute Global Reach

ExpressRoute Global Reach is designed for this exact scenario. It allows you to link ExpressRoute circuits together to make a private network between your on-premises locations, using the Microsoft global network as the backbone. This enables direct connectivity between the New York and London offices without the traffic having to hairpin through a VNet in Azure or traverse the public internet. The Premium Add-on is required for global connectivity to Azure services, but Global Reach is the specific feature for on-premises to on-premises communication.

Correct answer: False

This statement is false. Data transfer costs for Global VNet Peering (across regions) are different and typically higher than for VNet peering within the same region. For regional VNet peering, both ingress and egress traffic are charged. For Global VNet Peering, traffic is charged at zonal data transfer rates, which vary based on the Azure zones the data is traversing.

Correct answers: A Network Security Group (NSG) rule associated with VM1's NIC or subnet is blocking outbound traffic on port 3389.; A Network Security Group (NSG) rule associated with VM2's NIC or subnet is blocking inbound traffic on port 3389.

IP Flow Verify checks if a packet is allowed or denied to or from a virtual machine based on the effective security rules. An 'Access Denied' result directly points to a Network Security Group (NSG) rule blocking the traffic. The block could be on the outbound path from the source VM (VM1) or on the inbound path to the destination VM (VM2). While a disabled peering or incorrect routing would cause a failure, they would typically result in a 'Traffic is not routable' or similar error, not 'Access Denied'.

Correct answer: Azure Traffic Manager with the Performance routing method.

Azure Traffic Manager is a DNS-based traffic load balancer that enables you to distribute traffic optimally to services across global Azure regions. The 'Performance' routing method is specifically designed to route traffic to the endpoint that has the lowest network latency from the client's perspective, effectively sending them to the 'closest' region. It also includes built-in endpoint health monitoring and automatic failover, which satisfies the requirement to redirect users if one region becomes unavailable. Azure Load Balancer and Application Gateway are regional services and cannot perform DNS-based global routing on their own.

Correct answer: A rewrite set associated with the routing rule.

Application Gateway's 'Rewrite sets' feature allows you to rewrite URLs, query strings, and HTTP headers of requests and responses. To change the URL path from '/images' to '/content', you would create a rewrite rule within a rewrite set. This rule would have a condition to match the incoming path and an action to set the new path. This rewrite set is then associated with the appropriate routing rule. While a path-based routing rule directs traffic, it doesn't change the path itself. A backend path override in the HTTP settings appends a fixed string, but rewrite sets offer more powerful and conditional rewriting capabilities.

Correct answer: An internal Azure Load Balancer in the service provider VNet and a Private Endpoint in the partner's VNet, connected via a Private Link Service.

This scenario is the primary use case for Azure Private Link Service. The service provider places their application behind a Standard SKU internal Azure Load Balancer. They then create a Private Link Service that references the load balancer's frontend IP configuration. The partner (consumer) can then create a Private Endpoint in their own VNet that requests a connection to the Private Link Service. Once the provider approves the connection, the partner's VNet has a private, secure connection to the service without IP space overlap concerns, VNet peering, or internet exposure.