AZ-700 Troubleshooting and Performance Optimization 3 — Questions and Answers
Question 1: An Azure Firewall is deployed in a hub VNet. Spoke VMs can reach the internet but not each other through the firewall. What is likely missing?
- A network rule allowing spoke-to-spoke traffic in Azure Firewall (Correct answer)
- User-defined routes returning traffic to spoke VNets
- An application rule for internal RFC1918 addresses
- Forced tunneling configuration on spoke VNets
Correct answer: A network rule allowing spoke-to-spoke traffic in Azure Firewall
Azure Firewall blocks all traffic by default; a network rule explicitly allowing spoke-to-spoke traffic must be added.
Question 2: You are troubleshooting high latency on an ExpressRoute circuit. Azure Monitor shows low utilization. What tool helps identify if the latency is within Microsoft's network or on the provider segment?
- Network Performance Monitor with ExpressRoute monitoring (Correct answer)
- Azure Network Watcher Connection Monitor
- ExpressRoute Traffic Collector flow logs
- Azure Traffic Analytics
Correct answer: Network Performance Monitor with ExpressRoute monitoring
Network Performance Monitor with the ExpressRoute monitoring solution measures latency across each circuit segment including provider and Microsoft network legs.
Question 3: A VM behind an internal Standard Load Balancer cannot initiate outbound connections to the internet. What is the recommended fix?
- Assign a public IP directly to the VM's NIC
- Attach a NAT Gateway to the subnet (Correct answer)
- Upgrade the Load Balancer to a public-facing SKU
- Enable IP forwarding on the VM
Correct answer: Attach a NAT Gateway to the subnet
Standard internal Load Balancers do not provide outbound SNAT; a NAT Gateway on the subnet is the recommended solution for outbound connectivity.
Question 4: After enabling Azure DDoS Protection Standard on a VNet, legitimate traffic spikes are being dropped. What should you configure to prevent this?
- Increase the DDoS protection plan tier
- Configure DDoS protection policies with custom thresholds using adaptive tuning (Correct answer)
- Disable DDoS protection temporarily during traffic spikes
- Add the source IPs to an NSG allowlist
Correct answer: Configure DDoS protection policies with custom thresholds using adaptive tuning
DDoS Protection Standard uses adaptive tuning to learn normal traffic patterns, but custom threshold policies can be set to accommodate known legitimate traffic patterns.
Question 5: A BGP route learned over a site-to-site VPN takes priority over a static route to the same prefix. You need the static route to always win. What should you do?
- Increase the BGP local preference on the on-premises router
- Add the static route as a network route with a longer prefix mask
- Disable BGP route propagation on the route table and use only static routes (Correct answer)
- Set the BGP weight to 0 for VPN-learned routes
Correct answer: Disable BGP route propagation on the route table and use only static routes
Disabling BGP route propagation on the subnet route table prevents dynamically learned BGP routes from overriding manually configured static routes.
Question 6: An Azure Front Door origin health probe is failing, causing all traffic to fail over to a secondary origin. The primary origin responds correctly to direct requests. What should you check?
- Whether the origin group load balancing sensitivity is set too low
- Whether the origin's NSG or firewall blocks Front Door's probe IP ranges (Correct answer)
- Whether the origin uses HTTP instead of HTTPS
- Whether geo-filtering is enabled on Front Door
Correct answer: Whether the origin's NSG or firewall blocks Front Door's probe IP ranges
Front Door health probes come from specific Microsoft IP ranges; if the origin's firewall blocks those ranges, probes will fail even if the origin is healthy.
Question 7: A packet capture taken with Network Watcher shows TCP SYN packets reaching a VM but no SYN-ACK is returned. The NSG allows the traffic. What is the next thing to investigate?
- Whether the OS firewall (Windows Firewall / iptables) is blocking the port (Correct answer)
- Whether the subnet NSG differs from the NIC NSG
- Whether accelerated networking is causing packet drops
- Whether the VNet has a service endpoint configured
Correct answer: Whether the OS firewall (Windows Firewall / iptables) is blocking the port
If NSG rules permit traffic but the VM doesn't respond, the guest OS firewall is the next layer that could silently drop SYN packets.
AZ-700 Troubleshooting and Performance Optimization 3
An Azure Firewall is deployed in a hub VNet.
Spoke VMs can reach the internet but not each other through the firewall.
What is likely missing?