AZ-700 Troubleshooting and Performance Optimization 5

Question 1

A newly deployed Azure Firewall Premium is not decrypting TLS traffic for IDPS inspection. What must be configured?

Accepted Answer

Configure a TLS inspection policy with a CA certificate and associate it with the firewall policy

Answer

TLS inspection in Azure Firewall Premium requires a CA certificate (uploaded to Key Vault) configured in the firewall policy so the firewall can perform man-in-the-middle TLS decryption.

Question 2

An on-premises network uses address space 10.0.0.0/8. An Azure VNet also uses 10.0.0.0/16. They are connected via ExpressRoute. Users report connectivity issues. What is the fundamental problem?

Accepted Answer

The overlapping address spaces cause routing ambiguity that cannot be resolved without NAT

Answer

Overlapping address spaces between on-premises and Azure VNets create routing ambiguity that requires NAT or re-IP to resolve since Azure VNet peering and ExpressRoute do not support overlapping prefixes.

Question 3

Azure Traffic Manager is directing all users to one endpoint even though multiple healthy endpoints exist. The routing method is set to Performance. What is a likely cause?

Accepted Answer

Users are resolving the Traffic Manager DNS from a location where one endpoint has the lowest measured latency

Answer

Performance routing selects the endpoint with lowest latency from the user's DNS resolver location, so users from the same region will consistently be sent to the same closest endpoint.

Question 4

After migrating a VM to a new subnet, the VM loses connectivity. The subnet has different NSGs and route tables. What is the fastest way to identify which rule is blocking traffic?

Accepted Answer

Use Network Watcher IP Flow Verify specifying the new source/destination to pinpoint the blocking rule

Answer

IP Flow Verify tests a specific traffic flow and returns exactly which NSG rule (name and action) is responsible for allowing or denying it.

Question 5

You need to enforce that all outbound internet traffic from multiple spoke VNets passes through a centralized Azure Firewall in a hub VNet. What combination of configurations achieves this?

Accepted Answer

Create UDRs in each spoke with 0.0.0.0/0 pointing to the Azure Firewall private IP, and ensure spoke-to-hub peering allows forwarded traffic

Answer

UDRs with a default route (0.0.0.0/0) pointing to the Azure Firewall's private IP in each spoke, combined with peering settings that allow forwarded traffic, force all spoke internet traffic through the firewall.

(AZ-700) Azure Network Engineer Associate Practice Test

(AZ-700) Azure Network Engineer Associate Practice Test

AZ-700 Troubleshooting and Performance Optimization 5