AZ-700 Networking Services 3 — Questions and Answers
Question 1: Which Azure networking service acts as a global HTTP/S load balancer with WAF, SSL offloading, and URL-based routing at the application layer?
- Azure Load Balancer
- Azure Application Gateway
- Azure Front Door (Correct answer)
- Azure Traffic Manager
Correct answer: Azure Front Door
Azure Front Door is Microsoft's globally distributed CDN and load balancing service that operates at Layer 7 with WAF, SSL offloading, and path-based routing.
Question 2: A network engineer needs to inspect and filter traffic between Azure virtual networks and on-premises networks. Which service provides centralized network security policy management with threat intelligence?
- Azure Firewall Basic
- Azure Firewall Premium (Correct answer)
- Network Security Group
- Azure DDoS Protection
Correct answer: Azure Firewall Premium
Azure Firewall Premium includes IDPS, TLS inspection, URL filtering, and web categories—making it suitable for inspecting traffic with threat intelligence.
Question 3: What is the purpose of the Azure Virtual Network NAT service?
- Translates private IPs to public IPs for inbound connections
- Provides outbound-only internet connectivity for subnet resources using static public IPs (Correct answer)
- Balances load across multiple backend VMs
- Encrypts traffic between VNets
Correct answer: Provides outbound-only internet connectivity for subnet resources using static public IPs
Virtual Network NAT (NAT Gateway) provides outbound-only internet connectivity, allowing resources in a subnet to share one or more static public IP addresses.
Question 4: In Azure, what does the term 'Service Endpoint' accomplish for a storage account?
- Creates a private IP for the storage account within the VNet
- Extends VNet identity to the service over the Azure backbone while keeping traffic off the public internet (Correct answer)
- Generates a private DNS record for the storage account
- Assigns a dedicated subnet for storage traffic
Correct answer: Extends VNet identity to the service over the Azure backbone while keeping traffic off the public internet
Service endpoints extend VNet private address space and identity to Azure services over the Azure backbone network, removing public internet traversal.
Question 5: Which BGP community value is used to identify routes learned from an Azure Virtual Network when advertising to on-premises via ExpressRoute?
- 12076:5010 (Correct answer)
- 12076:5020
- 12076:5030
- 12076:5040
Correct answer: 12076:5010
BGP community 12076:5010 is used to tag routes associated with Azure Virtual Networks advertised over ExpressRoute.
Question 6: An administrator wants to ensure that DNS queries from Azure VMs for a specific domain are forwarded to an on-premises DNS server. What Azure feature enables this?
- Azure DNS alias records
- Azure DNS Private Resolver outbound endpoint with forwarding ruleset (Correct answer)
- VNet custom DNS server setting only
- Azure Traffic Manager DNS policy
Correct answer: Azure DNS Private Resolver outbound endpoint with forwarding ruleset
Azure DNS Private Resolver's outbound endpoint with a DNS forwarding ruleset conditionally forwards queries for specific domains to on-premises or other DNS servers.
Question 7: What is the default Azure-provided DNS server IP address that VMs use when no custom DNS is configured?
- 10.0.0.1
- 168.63.129.16 (Correct answer)
- 8.8.8.8
- 192.168.1.1
Correct answer: 168.63.129.16
Azure's recursive DNS resolver is available at the virtual IP address 168.63.129.16, which is the default DNS for Azure VMs.
AZ-700 Networking Services 3
Which Azure networking service acts as a global HTTP/S load balancer with WAF, SSL offloading, and URL-based routing at the application layer?