AZ-700 Troubleshooting and Performance Optimization 2 — Questions and Answers
Question 1: A virtual machine cannot reach the internet despite having a public IP assigned. Network Watcher IP flow verify returns 'Access Denied'. What is the most likely cause?
- The VM's NIC has no subnet associated
- An NSG rule is blocking outbound traffic on port 80/443 (Correct answer)
- The public IP SKU is Basic instead of Standard
- The VNet has no DNS server configured
Correct answer: An NSG rule is blocking outbound traffic on port 80/443
IP flow verify identifies which NSG rule is denying traffic, so a blocking outbound NSG rule is the most likely cause.
Question 2: You notice intermittent packet loss between two Azure VMs in the same VNet. Which Network Watcher tool provides hop-by-hop latency and packet loss statistics?
- Connection Monitor (Correct answer)
- IP Flow Verify
- Next Hop
- VPN Diagnostics
Correct answer: Connection Monitor
Connection Monitor continuously measures latency, packet loss, and reachability between endpoints including hop-by-hop metrics.
Question 3: An Azure Load Balancer health probe is marking all backend VMs as unhealthy. The VMs are running and their application is listening. What should you check first?
- Whether the VMs have accelerated networking enabled
- Whether an NSG is blocking the health probe source IP 168.63.129.16 (Correct answer)
- Whether the load balancer SKU matches the public IP SKU
- Whether the backend pool uses availability zones
Correct answer: Whether an NSG is blocking the health probe source IP 168.63.129.16
Azure health probes originate from 168.63.129.16 and NSGs blocking this IP will cause all probes to fail.
Question 4: A site-to-site VPN tunnel shows as connected but no traffic passes. You confirm routing on the Azure side is correct. What on-premises configuration should you verify?
- That the on-premises device supports BGP
- That the on-premises firewall permits the Azure VNet address space (Correct answer)
- That the on-premises device has IKEv2 disabled
- That the shared key is at least 32 characters
Correct answer: That the on-premises firewall permits the Azure VNet address space
A connected tunnel with no traffic flow typically indicates the on-premises firewall is not permitting the remote (Azure) address space.
Question 5: Users report that name resolution fails for private endpoints from on-premises machines connected via ExpressRoute. DNS queries go to on-premises DNS servers. What is required?
- Deploy Azure DNS Private Resolver with inbound endpoints in the VNet (Correct answer)
- Enable DNS forwarding on the ExpressRoute gateway
- Configure split-horizon DNS on the private endpoint
- Assign a public DNS zone to the private endpoint
Correct answer: Deploy Azure DNS Private Resolver with inbound endpoints in the VNet
Azure DNS Private Resolver with inbound endpoints allows on-premises DNS servers to forward queries into Azure's private DNS zones.
Question 6: An Application Gateway returns HTTP 502 errors for some requests but not others. What is the most common root cause?
- The Application Gateway subnet is too small
- Backend pool members are unhealthy or timing out (Correct answer)
- The WAF policy is in prevention mode
- SSL termination is misconfigured on the listener
Correct answer: Backend pool members are unhealthy or timing out
HTTP 502 from Application Gateway indicates the gateway could not get a valid response from a backend server, typically due to unhealthy or slow backends.
Question 7: A VNet peering shows status 'Disconnected'. What is the most likely cause?
- The peered VNets are in different Azure regions
- One side of the peering was deleted (Correct answer)
- Traffic forwarding is not enabled on the peering
- The VNets have overlapping address spaces
Correct answer: One side of the peering was deleted
Peering enters 'Disconnected' state when one side of the bidirectional peering link has been deleted.
AZ-700 Troubleshooting and Performance Optimization 2
A virtual machine cannot reach the internet despite having a public IP assigned.
Network Watcher IP flow verify returns 'Access Denied'.
What is the most likely cause?