AZ-700 Networking Fundamentals 3 — Questions and Answers
Question 1: An organization needs to route traffic from an Azure subnet through a network virtual appliance (NVA) before it reaches the internet. Which Azure feature should be used?
- Network Security Group (NSG)
- User Defined Route (UDR) (Correct answer)
- Azure Firewall Policy
- Service Endpoint
Correct answer: User Defined Route (UDR)
User Defined Routes (UDRs) override Azure's default system routes, allowing you to direct traffic to a next-hop such as an NVA.
Question 2: What is the purpose of the 'effective routes' view in Azure Network Watcher?
- It lists all NSG rules applied to a NIC
- It shows the combined routing table applied to a network interface (Correct answer)
- It displays all BGP routes learned from on-premises
- It shows the DNS resolution path for a VM
Correct answer: It shows the combined routing table applied to a network interface
The effective routes view combines system routes, user-defined routes, and BGP routes to show the actual routing table used by a network interface.
Question 3: Which Azure networking component operates as a stateful packet filter and can be associated with both subnets and individual network interfaces?
- Azure Firewall
- Network Security Group (NSG) (Correct answer)
- Web Application Firewall (WAF)
- Route Table
Correct answer: Network Security Group (NSG)
NSGs are stateful packet filters that contain inbound and outbound security rules and can be applied at the subnet level or directly to a network interface.
Question 4: When configuring VNet peering between two virtual networks in different Azure regions, what is this configuration called?
- Local VNet peering
- Global VNet peering (Correct answer)
- Cross-region VPN
- ExpressRoute peering
Correct answer: Global VNet peering
VNet peering between virtual networks in different Azure regions is called global VNet peering, and it uses the Microsoft backbone network.
Question 5: A subnet has a route table with a user-defined route pointing 0.0.0.0/0 to an NVA. What happens to traffic destined for an Azure Storage service endpoint configured on the same subnet?
- Traffic goes to the NVA before storage
- Traffic goes directly to Azure Storage via the service endpoint route (Correct answer)
- Traffic is dropped
- Traffic uses the default internet route
Correct answer: Traffic goes directly to Azure Storage via the service endpoint route
Service endpoint routes have a longer prefix match than 0.0.0.0/0 and take precedence, routing storage traffic directly to the service over the Azure backbone.
Question 6: What is the CIDR notation for a subnet that contains exactly 256 IP addresses?
- /22
- /23
- /24 (Correct answer)
- /25
Correct answer: /24
A /24 prefix leaves 8 bits for host addresses, providing 2^8 = 256 total IP addresses in the subnet.
Question 7: Which Azure DNS feature allows you to use custom domain names for resources within a virtual network without deploying your own DNS servers?
- Azure DNS public zones
- Azure Private DNS zones (Correct answer)
- Azure Resolver
- Azure Traffic Manager
Correct answer: Azure Private DNS zones
Azure Private DNS zones provide name resolution for resources within and across virtual networks using custom domain names without requiring custom DNS infrastructure.
AZ-700 Networking Fundamentals 3
An organization needs to route traffic from an Azure subnet through a network virtual appliance (NVA) before it reaches the internet.
Which Azure feature should be used?