Free AZ-700 practice test: 30 questions with answers

NSG rules with service tags and firewall policies control traffic to Azure services from a subnet. The other options do not provide targeted filtering and some break connectivity.

IP flow verify tests whether a specific packet is allowed or denied and names the NSG rule. Advisor, cost tools and policy dashboards do not test traffic paths.

The effective routes view shows the routes actually applied to a NIC, including user-defined routes and BGP routes. The other tools do not show next hops for the interface.

Azure Firewall provides centralized network and application rules with threat intelligence across virtual networks. NSGs alone lack centralized application-layer filtering, DNS forwarders and Bastion do not inspect outbound traffic.

Azure DDoS Protection provides adaptive mitigation and reporting for public IPs in protected virtual networks. Advisor only recommends, larger VMs do not stop floods, and blocking all inbound traffic removes the service.

Connection Monitor continuously tests connectivity and latency between endpoints and can alert on thresholds. Manual pings and backup reports are not continuous monitoring.

IP flow verify, next hop and Connection Monitor test or show the path and rules for traffic. Cost anomaly alerts track spend and do not diagnose connectivity.

FQDN filtering in Azure Firewall with routing through it enforces approved destinations. An allow-all NSG offers no filtering, DNS alone does not block, and inbound-only design misses the outbound requirement.

An active-active gateway with two public IPs and redundant tunnels provides high availability for site-to-site connectivity. A basic single gateway and no gateway do not provide that resilience.

Virtual WAN provides a managed hub for branches and virtual networks with scalable routing. Bastion provides secure remote access, Load Balancer distributes traffic, and Traffic Manager routes DNS requests.

ExpressRoute private peering gives private connectivity to Azure virtual networks, and Microsoft peering offers access to Microsoft cloud services over the dedicated link. Public IPs and VPN substitutes do not keep traffic off the internet.

BGP dynamically exchanges routes and supports automatic failover. Static routes need manual changes, and BGP does not encrypt application traffic or assign IPs.

Point-to-site VPN is designed for individual client devices connecting to Azure. Site-to-site VPNs are for networks, public RDP is unsafe, and ExpressRoute is for dedicated site connectivity.

ExpressRoute provides dedicated private connectivity with more predictable performance. It requires a connectivity provider and circuit, is not always cheaper, and still needs routing.

BGP on a gateway advertises and learns routes dynamically between on-premises and Azure. NAT, DNS and subnet size do not provide route advertisement.

Route-based VPNs support dynamic routing and are generally recommended for multiple tunnels. Policy-based VPNs are more limited, and both types encrypt traffic.

A /23 provides 512 addresses, leaving 507 usable after the five reserved addresses, which covers 500 VMs. A /24 gives only 251 usable addresses, and a /25 is smaller still.

Virtual network peering connects virtual networks with low-latency private connectivity over the Azure backbone. VPN gateways add hops, Front Door is for global HTTP delivery, and public IPs expose traffic unnecessarily.

A user-defined route with the firewall as next hop forces internet-bound traffic through the appliance. NSGs filter but do not route, service endpoints target Azure services, and accelerated networking improves performance only.

When NSGs are applied at the subnet and NIC, inbound traffic must be permitted by both, so the combined rules control access. Evaluating only one NSG ignores the other.

NAT Gateway provides outbound connectivity with a managed public IP while keeping inbound traffic closed. The other options expose inbound access.

Private DNS zones resolve private names within linked virtual networks and can auto-register VM records. Public zones are visible to the internet, hosts files do not scale, and NSG rules do not provide name resolution.

NSG rules are processed by priority, and NSGs attach to subnets or NICs. They filter by address, port and protocol rather than inspecting application content, and they do not need to be in a different region or override routes.

Front Door provides global HTTP routing, health probing, TLS termination and WAF integration across regions. A regional load balancer does not provide global routing, and internal balancers are not reachable from the internet.

Application Gateway provides Layer 7 path-based routing with WAF in a region. Standard Load Balancer operates at Layer 4 without path rules, DNS does not balance load, and Bastion is for administrative access.

A private endpoint assigns a private IP to the service in the virtual network, keeping access private. Public endpoints and public IPs expose the service, and service endpoints still use the public service address.

Without the private DNS zone linked to the virtual network, names resolve to public addresses. Linking the zone with the correct record corrects resolution. The other options do not change DNS.

Private endpoints give the service a private IP in the virtual network, which also supports private connectivity from on-premises networks. Keeping the public endpoint open and removing DNS or NSG needs are not reasons.

Front Door routes users to the nearest healthy origin and caches content at edge locations. Internal load balancers, Bastion and Firewall Manager do not provide global edge routing and caching.

Cookie-based affinity keeps a session on the same backend. Health probes, listeners and DNS TTL settings do not provide session stickiness.