I85PREP
⌘ K
Azure AZ-700 study materials
Azure AZ-700 study resources

Azure AZ-700 practice questions

One question at a time. Build your Azure AZ-700 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Design and implement core networking infrastructure

You are designing a virtual network and need a dedicated subnet for a single small management VM. What is the smallest subnet prefix that Azure supports?

  1. /30
  2. /27
  3. /28
  4. /29 Correct answer.

Explanation

Azure requires every subnet to be at least a /29. A /29 contains eight addresses, five of which are usable after Azure reserves its mandatory addresses, which is enough for a small management workload but leaves little room to grow.

Question 2Design and implement core networking infrastructure

How many IP addresses does Azure reserve from the address range of every subnet?

  1. Three
  2. Eight
  3. Five Correct answer.
  4. Two

Explanation

Azure reserves the first four addresses and the last address of each subnet range, for a total of five. These are used for the network address, the default gateway, and Azure DNS and platform services, so a /24 subnet yields 251 usable addresses, not 254.

Question 3Design and implement core networking infrastructure

VNet A is peered with VNet B, and VNet B is peered with VNet C. No other configuration exists. What is the connectivity result between A and C?

  1. A can reach C only when global peering is used.
  2. A cannot reach C because peering is not transitive. Correct answer.
  3. A can reach C because peering is transitive by default.
  4. A can reach C only if both peerings share the same address space.

Explanation

Virtual network peering is non-transitive: a peering only connects the two networks named in that peering. To reach C from A you must either create a direct A-to-C peering or route traffic through a network virtual appliance or gateway in the hub.

Question 4Design and implement core networking infrastructure

A subnet hosts virtual machines that have no public IP addresses but require predictable outbound internet connectivity through a fixed public IP. Which resource should you deploy?

  1. NAT gateway Correct answer.
  2. Azure Bastion
  3. A service endpoint
  4. Azure Route Server

Explanation

A NAT gateway provides source network address translation for outbound traffic from one or more subnets and uses a static public IP or prefix, which is the recommended replacement for default outbound access. It applies only to outbound flows initiated from the subnet.

Question 5Design and implement core networking infrastructure

Virtual machines in a virtual network must resolve names that are recorded in an Azure private DNS zone. What must you create to enable this?

  1. A public DNS zone with the same name
  2. A private endpoint for the DNS service
  3. A conditional forwarder on the virtual network
  4. A virtual network link on the private DNS zone Correct answer.

Explanation

A private DNS zone only answers queries from virtual networks that are linked to it. Creating a virtual network link registers the VNet with the zone so that the Azure-provided resolver at 168.63.129.16 can return the zone's records to resources in that VNet.

Question 6Design and implement core networking infrastructure

A subnet has no route table associated with it. How is traffic destined for the internet from that subnet routed?

  1. A user-defined route with next hop None drops it.
  2. An Azure system route with next hop Internet handles it. Correct answer.
  3. A BGP route learned from on-premises carries it.
  4. It is sent to the local network gateway.

Explanation

Azure automatically creates system routes in every VNet, including a default route for 0.0.0.0/0 with next hop Internet, routes for the VNet address space, and routes for peered VNets. Without a route table, these system routes determine how traffic leaves the subnet.

Question 7Design and implement core networking infrastructure

Which IP address do Azure virtual machines use to reach the Azure-provided DNS resolver?

  1. 10.0.0.1
  2. 168.63.129.16 Correct answer.
  3. 127.0.0.1
  4. 169.254.169.254

Explanation

168.63.129.16 is a virtual public IP address used by the Azure platform for DNS resolution, health probes, and other fabric services. It is not assigned to your resources and should not be blocked by firewall rules.

Question 8Design and implement core networking infrastructure

What routing behavior applies to a newly created subnet that has no route table associated with it?

  1. All traffic is forced through a virtual network gateway.
  2. Azure system routes handle the traffic automatically. Correct answer.
  3. Traffic follows only subscription-level user-defined routes.
  4. All traffic is dropped until a route table is attached.

Explanation

Route tables are optional. When no route table is associated, Azure applies its built-in system routes, which cover the VNet address space, internet-bound traffic, and traffic to peered virtual networks, so a new subnet is functional immediately.

Question 9Design and implement core networking infrastructure

A subnet has the effective routes 0.0.0.0/0 via Internet, 10.0.0.0/16 via VirtualNetwork, 10.1.0.0/16 via VirtualAppliance, and 10.1.4.0/24 via VirtualNetworkGateway. Which route is used for a packet addressed to 10.1.4.20?

  1. 10.1.4.0/24 via VirtualNetworkGateway Correct answer.
  2. 10.1.0.0/16 via VirtualAppliance
  3. 0.0.0.0/0 via Internet
  4. 10.0.0.0/16 via VirtualNetwork

Explanation

Azure selects routes by longest prefix match. The /24 route covers 10.1.4.20 with the most specific mask, so it wins over the less specific /16 and default routes even though those routes also match the destination.

Question 10Design and implement core networking infrastructure

You must prevent a subnet from reaching a specific on-premises range while leaving all other traffic unaffected. Which user-defined route accomplishes this?

  1. The target prefix with next hop VirtualNetworkGateway
  2. The target prefix with next hop None Correct answer.
  3. The target prefix with next hop VirtualNetwork
  4. The target prefix with next hop Internet

Explanation

A user-defined route with next hop None intentionally discards traffic that matches the prefix. Because the route is scoped to the specific on-premises range, other destinations keep using their existing system or learned routes.

Question 11Design and implement core networking infrastructure

All internet-bound traffic from a subnet must be inspected by an on-premises firewall reached over a site-to-site VPN. Which user-defined route should you add?

  1. 10.0.0.0/8 with next hop VirtualAppliance
  2. 0.0.0.0/0 with next hop VirtualNetworkGateway Correct answer.
  3. 0.0.0.0/0 with next hop VirtualNetwork
  4. 0.0.0.0/0 with next hop Internet

Explanation

Forced tunneling is implemented by a user-defined route for 0.0.0.0/0 whose next hop is the virtual network gateway, which sends internet-bound traffic over the VPN or ExpressRoute connection. The next hop must be the gateway type that matches the deployed gateway, such as VirtualNetworkGateway for VPN.

Question 12Design and implement core networking infrastructure

Two virtual networks both use the address space 10.0.0.0/16. What happens when you attempt to create a peering between them?

  1. The peering fails because the address spaces overlap. Correct answer.
  2. The peering is created but only works within the same region.
  3. The peering is created but traffic is blocked by network security groups.
  4. The peering is created and Azure performs NAT automatically.

Explanation

Virtual network peering requires the address spaces of both networks to be unique; overlapping ranges make routing ambiguous. NAT is not performed across a peering, so the address spaces must be redesigned before peering can succeed.

Question 13Design and implement core networking infrastructure

A hub virtual network hosts a VPN gateway. Spoke virtual networks are peered with the hub and must use that gateway for on-premises connectivity without deploying their own gateways. What should you configure on the spoke side of each spoke-to-hub peering?

  1. Use remote gateways Correct answer.
  2. Allow gateway transit
  3. Allow virtual network access
  4. Allow forwarded traffic

Explanation

On the spoke's peering connection you enable Use remote gateways so the spoke consumes the hub gateway, while the hub-side peering connection must have Allow gateway transit enabled. Both settings must be in place for the spoke to use the hub's gateway.

Question 14Design and implement core networking infrastructure

You want virtual machines in a virtual network to register their hostnames in an Azure private DNS zone automatically, with records removed when the VMs are deleted. What must be in place?

  1. Autoregistration is enabled on the VNet link Correct answer.
  2. The VNet uses custom DNS servers pointing at the zone
  3. The zone is a public zone with autoregistration enabled
  4. Each VM is assigned a public IP address

Explanation

Automatic registration is a property of the virtual network link between a private DNS zone and a virtual network. When autoregistration is enabled on the link, A records for VMs in that VNet are created and removed automatically as the VMs are deployed and deleted.

Question 15Design and implement core networking infrastructure

Every virtual machine in a virtual network must use a specific pair of on-premises DNS servers by default. Where do you configure this with the least administrative effort?

  1. On each subnet's route table
  2. On the virtual network's DNS servers setting Correct answer.
  3. On the NAT gateway
  4. On the Azure private DNS zone

Explanation

Custom DNS servers configured on the virtual network are inherited by all VMs in that VNet through DHCP, so a single change covers the whole network. A per-NIC DNS setting can override the VNet-level value when an individual VM needs different servers.

Question 16Design and implement core networking infrastructure

Which statement describes NAT gateway association limits?

  1. Multiple NAT gateways per subnet; each serves one subnet
  2. One NAT gateway per VNet; it can serve subnets in any VNet
  3. Multiple NAT gateways per subnet; each can serve subnets in any VNet
  4. One NAT gateway per subnet; it can serve multiple subnets in the same VNet Correct answer.

Explanation

A subnet can be associated with only one NAT gateway, but a single NAT gateway can be attached to several subnets within the same virtual network. This lets you centralize outbound IP addresses for multiple subnets.

Question 17Design and implement core networking infrastructure

A virtual network uses 10.0.0.0/16 and needs additional IP capacity for growth. Which change is supported?

  1. Delete and recreate the VNet with the larger range
  2. Add the same range again under a second address space name
  3. Change the VNet prefix from /16 to /15 in place
  4. Add a non-overlapping address space to the VNet Correct answer.

Explanation

You can add additional, non-overlapping address spaces to an existing virtual network, and existing subnets can be created from the new ranges. Changing the prefix of an existing address space is not supported, and duplicate ranges are rejected.

Question 18Design and implement core networking infrastructure

You must apply a hub-and-spoke or mesh topology consistently to many virtual networks across several subscriptions and keep the configuration centrally managed. Which Azure Virtual Network Manager capability should you use?

  1. IP address pool allocation
  2. Security admin configuration
  3. Network group static membership
  4. Connectivity configuration Correct answer.

Explanation

A connectivity configuration defines the topology, such as hub-and-spoke or mesh, and applies it to the virtual networks placed in a network group. This delivers centrally managed, repeatable connectivity across subscriptions and regions.

Question 19Design and implement core networking infrastructure

You deploy a service that must be injected into a dedicated subnet and requires the subnet to be reserved for that service. Which virtual network feature do you use?

  1. Service endpoint
  2. Azure Route Server
  3. Subnet delegation Correct answer.
  4. Private endpoint

Explanation

Subnet delegation reserves a subnet for a specific Azure service and allows that service to create service-specific resources in it, such as an App Service environment's infrastructure or a managed instance. The subnet cannot be used by other resource types once delegated.

Question 20Design and implement core networking infrastructure

Virtual machines in a West Europe virtual network must exchange traffic with virtual machines in an East US virtual network with low latency and without traversing the public internet. Which solution meets the requirement?

  1. Azure ExpressRoute
  2. A site-to-site VPN between the two virtual networks
  3. A NAT gateway in each virtual network
  4. Global virtual network peering Correct answer.

Explanation

Global virtual network peering connects VNets in different regions over the Microsoft backbone, providing private, low-latency connectivity without gateways or public internet traversal. Traffic is billed as peering egress but stays on the Microsoft network.

Question 21Design and implement core networking infrastructure

A route for 10.10.0.0/16 is learned over BGP from an on-premises gateway, and a user-defined route for the same prefix points to a network virtual appliance. Which route is used?

  1. Neither route, because overlapping prefixes are dropped
  2. The route with the lower metric, resolved at the network interface
  3. The user-defined route, because UDRs win over BGP for the same prefix Correct answer.
  4. The BGP route, because learned routes take precedence over UDRs

Explanation

When multiple routes have the same prefix, Azure applies precedence in the order user-defined route, BGP route, then system route. Longest prefix match is evaluated first, and only when prefixes are equal does this precedence order decide.

Question 22Design and implement core networking infrastructure

Spoke A and spoke B are peered with a hub that hosts a network virtual appliance. Spoke A must reach spoke B through that appliance. What configuration is required?

  1. Enable Allow gateway transit on the hub and Allow virtual network access on both spokes
  2. Enable Use remote gateways on both spokes and Allow gateway transit on the hub
  3. Allow forwarded traffic on the hub peerings and enable Use remote gateways in each spoke
  4. Allow forwarded traffic on both peerings and add a route to the appliance in each spoke Correct answer.

Explanation

Transit through an appliance requires the peerings to accept traffic that did not originate in the sending VNet, so Allow forwarded traffic must be enabled, and each spoke needs a user-defined route pointing the remote spoke prefix at the appliance's private IP. Gateway transit settings apply to VPN and ExpressRoute gateways, not appliance transit.

Question 23Design and implement core networking infrastructure

On-premises hosts must resolve names held in Azure private DNS zones. You deploy Azure DNS Private Resolver. Which component must exist in the virtual network to receive the queries from on-premises?

  1. An inbound endpoint Correct answer.
  2. An outbound endpoint
  3. A private endpoint
  4. A service endpoint

Explanation

An inbound endpoint provides an IP address in the virtual network that on-premises DNS servers can forward queries to, allowing resolution of private zone records. An outbound endpoint is used in the reverse direction, to forward queries from Azure to on-premises DNS.

Question 24Design and implement core networking infrastructure

You add a second address space to a virtual network that is already peered with another virtual network. What must you do so the peering routes traffic to the new range?

  1. Recreate the route table in both networks
  2. Nothing, because peering refreshes automatically
  3. Delete and recreate the peering
  4. Resync the peering Correct answer.

Explanation

After changing a VNet's address space, the peering shows a state that requires synchronization, and running the sync operation refreshes the peering so the remote network learns the new range. Until the peering is synced, traffic to the added range is not routed across the peering.

Question 25Design and implement core networking infrastructure

A subnet must host 250 virtual machines that each consume one private IP address, with room for 20 additional addresses during scale-out. Which subnet prefix is the smallest one that satisfies the requirement?

  1. /23 Correct answer.
  2. /25
  3. /24
  4. /22

Explanation

This needs 270 usable addresses. Azure reserves five addresses per subnet, so a /24 yields only 251 usable addresses and falls short, while a /23 yields 507 usable addresses and is the smallest prefix that meets the requirement.

Question 26Design and implement core networking infrastructure

How many IP addresses does Azure reserve in every subnet for internal platform use?

  1. One
  2. Three
  3. Five Correct answer.
  4. Eight

Explanation

Azure reserves the first four addresses of each subnet (the network address, the default gateway, and two addresses used for Azure-provided DNS) plus the last address, which is the broadcast address. These addresses cannot be assigned to resources, so five addresses per subnet are always unavailable.

Question 27Design and implement core networking infrastructure

Which statement describes a Standard SKU public IP address?

  1. It can be assigned only to a virtual machine network interface
  2. It is dynamic by default and can be changed to static
  3. It is bound to one zone and cannot be zone-redundant
  4. It is static and blocks inbound traffic unless an NSG allows it Correct answer.

Explanation

Standard SKU public IPs are always allocated with the static method and are secure by default, meaning inbound traffic is denied until a network security group rule explicitly permits it. They can also be zone-redundant or bound to a specific zone, and they support load balancers, NAT gateways, VPN gateways, and other resources beyond VM NICs.

Question 28Design and implement core networking infrastructure

You must deploy a VPN gateway into an existing virtual network. Which subnet name is required for the gateway?

  1. VirtualNetworkGateway
  2. GatewaySubnet-Primary
  3. GatewaySubnet Correct answer.
  4. AzureGatewaySubnet

Explanation

Azure identifies the gateway subnet by its exact reserved name, GatewaySubnet, and will not deploy a virtual network gateway anywhere else. The subnet cannot be renamed after deployment or used for other resources.

Question 29Design and implement core networking infrastructure

You are connecting a virtual network to an on-premises network through a site-to-site VPN. Which requirement applies to the virtual network address space?

  1. It must be at least a /16 prefix
  2. It must be an RFC 1918 private range
  3. It must be a subset of the on-premises ranges
  4. It must not overlap the on-premises ranges Correct answer.

Explanation

Routing between a virtual network and an on-premises network relies on distinct prefixes; if the two sides share any address range, traffic is ambiguous and the connection cannot route correctly. Azure blocks creation of the gateway connection when an overlap is detected with the local network gateway address space.

Question 30Design and implement core networking infrastructure

You plan to deploy Azure Bastion. Which subnet configuration is required?

  1. A subnet named AzureBastionSubnet of exactly /29
  2. A subnet named BastionSubnet of at least /24
  3. Any existing subnet in the virtual network, because Bastion needs no dedicated subnet
  4. A subnet named AzureBastionSubnet of at least /26 Correct answer.

Explanation

Azure Bastion must be deployed into a dedicated subnet named AzureBastionSubnet, and that subnet must be at least /26 (or larger). The reserved name and minimum size are enforced by the platform during deployment.

Question 31Design and implement core networking infrastructure

A user-defined route for 172.16.0.0/12 specifies the next hop type None. How is traffic that matches this route handled?

  1. It is dropped Correct answer.
  2. It is routed to the virtual network gateway
  3. It is sent to the first available virtual appliance
  4. It is routed to the internet

Explanation

The None next hop type is an explicit black-hole route: any traffic matching the prefix is discarded rather than forwarded. It is commonly used to block traffic to a specific range without affecting other destinations.

Question 32Design and implement core networking infrastructure

A virtual machine sends a request to a storage account after you enable the Microsoft.Storage service endpoint on its subnet. What source IP address does the storage account see for that request?

  1. The public IP address of a NAT gateway
  2. The public IP address of the virtual machine
  3. The address of the Azure backbone front end that serves the storage account
  4. The private IP address of the virtual machine Correct answer.

Explanation

With a service endpoint, traffic to the service travels over the Azure backbone and the service sees the private IP address of the originating resource in the virtual network. This is why storage firewall rules can allow access by virtual network and subnet rather than by public address.

Question 33Design and implement core networking infrastructure

A subnet hosts private endpoints for several platform services. By default, how are network security groups applied to traffic directed to those private endpoints?

  1. NSG rules are not applied until private endpoint network policies are enabled on the subnet Correct answer.
  2. NSG rules apply to private endpoint traffic exactly as to any other subnet traffic
  3. Only the default NSG rules apply to private endpoint traffic
  4. NSGs can never be applied to private endpoint traffic under any configuration

Explanation

For subnets that contain private endpoints, the private endpoint network policy setting is disabled by default, so network security group rules on the subnet are not evaluated for that traffic. Enabling private endpoint network policies on the subnet makes NSG rules effective for private endpoint traffic.

Question 34Design and implement core networking infrastructure

You create a virtual network peering from VNet1 to VNet2, but no peering is created from VNet2 to VNet1. What is the result?

  1. Both peering links stay in the Initiated state and no traffic flows Correct answer.
  2. VNet2 automatically receives a matching peering after 24 hours
  3. The peering connects in one direction and traffic flows from VNet1 to VNet2
  4. Traffic flows only for connections initiated by VNet2

Explanation

A peering is only functional when each virtual network has a matching peering object pointing at the other; until the reverse peering is created, both links remain in the Initiated state and connectivity is not established. Both sides must reach the Connected state before traffic can flow.

Question 35Design and implement core networking infrastructure

Virtual machines in Azure must resolve names of on-premises servers. You are using Azure DNS Private Resolver. Which component sends the queries toward the on-premises DNS servers?

  1. A private DNS zone linked to the virtual network
  2. An inbound endpoint
  3. A conditional forwarder configured on each virtual machine
  4. An outbound endpoint paired with a forwarding ruleset Correct answer.

Explanation

An outbound endpoint provides the egress point from the virtual network for DNS queries, and the forwarding ruleset defines which domain names are sent to which on-premises DNS servers. The inbound endpoint serves the opposite direction, allowing on-premises clients to resolve Azure private DNS zones.

Question 36Design and implement core networking infrastructure

Which statement about route tables and subnets is correct?

  1. A subnet can have one route table, which can serve many subnets Correct answer.
  2. Associating a route table with a subnet requires the subnet to contain no resources
  3. A subnet can be associated with multiple route tables at the same time
  4. A route table can be associated with only one subnet

Explanation

A subnet can be associated with zero or one route table, but a single route table can be associated with multiple subnets. This lets you apply the same routing policy consistently across several subnets.

Question 37Design and implement core networking infrastructure

Traffic between virtual machines in two peered virtual networks must be encrypted at the virtual network layer, in addition to any encryption the application performs. What should you configure?

  1. A private endpoint in each virtual machine's subnet
  2. An IPsec tunnel over the peering connection
  3. Virtual network encryption enabled on both virtual networks Correct answer.
  4. Azure Bastion in each virtual network

Explanation

Virtual network encryption encrypts traffic between virtual machines in the same virtual network and across peered virtual networks, and it must be enabled on each virtual network that participates. It works with supported VM sizes and does not require an IPsec tunnel on the peering.

Question 38Design and implement core networking infrastructure

Virtual machines reach storage accounts through a Microsoft.Storage service endpoint on their subnet. You must limit those virtual machines to a specific set of storage accounts when they use the endpoint. What should you configure?

  1. A service endpoint policy on the subnet Correct answer.
  2. A route filter on the virtual network gateway
  3. A private DNS zone for the storage accounts
  4. A network security group rule that uses the Storage service tag

Explanation

A service endpoint policy lets you allow traffic from a subnet to specific service resources, such as individual storage accounts, and denies access to all other resources of that service through the endpoint. A network security group service tag can only allow or deny the service as a whole, not individual accounts.

Question 39Design and implement core networking infrastructure

On-premises hosts connected through ExpressRoute must reach an Azure Storage account over private IP addresses without using the internet, and the Azure virtual machines must also use private addresses. Which feature should you implement?

  1. A public IP address on the storage account protected by a firewall rule
  2. A private endpoint in a subnet of the virtual network Correct answer.
  3. A point-to-site VPN on each on-premises client
  4. A service endpoint on the gateway subnet

Explanation

A private endpoint places a network interface with a private IP address from your subnet in front of the storage account, so both Azure and on-premises clients connected by ExpressRoute or VPN can reach it privately. Service endpoints extend a subnet identity to the service but do not provide a private IP address reachable from on-premises.

Question 40Design and implement core networking infrastructure

A hub virtual network hosts a network virtual appliance. The appliance forwards traffic that originated in spoke1 toward spoke2. Which peering setting must be enabled on the peering over which the forwarded traffic arrives?

  1. Use remote gateways
  2. Allow gateway transit
  3. Allow virtual network access
  4. Allow forwarded traffic Correct answer.

Explanation

Traffic that is forwarded by an appliance has a source address that belongs to neither of the two virtual networks on that peering link, so the peering must have Allow forwarded traffic enabled for it to be accepted. Without that setting, the forwarded packets are dropped at the peering boundary.

Question 41Design, implement, and manage connectivity services

A hub virtual network is peered with spoke1 and spoke2. No gateways or network virtual appliances are deployed in any of the virtual networks. Which statement describes connectivity between spoke1 and spoke2?

  1. Spoke1 and spoke2 communicate directly because the hub relays traffic between its two peering links.
  2. Spoke1 and spoke2 communicate because peering automatically creates a full mesh.
  3. Spoke1 and spoke2 cannot communicate over the peering because peering is non-transitive. Correct answer.
  4. Spoke1 and spoke2 communicate only if both spokes use the same address space.

Explanation

Virtual network peering links are non-transitive: a peering between hub and spoke1 and between hub and spoke2 does not create a path between the two spokes. Spoke-to-spoke traffic requires a gateway or network virtual appliance in the hub plus user-defined routes.

Question 42Design, implement, and manage connectivity services

Two virtual networks are deployed in the East US and West Europe regions. Which statement about peering them is correct?

  1. Cross-region peering requires both virtual networks to be in the same Azure subscription.
  2. Cross-region peering requires a VPN gateway in each of the two virtual networks.
  3. Peering is not possible across regions, so a VNet-to-VNet VPN connection is required.
  4. Global virtual network peering supports cross-region peering and carries traffic over the Microsoft backbone. Correct answer.

Explanation

Global virtual network peering connects virtual networks in different Azure regions, and the traffic stays on the Microsoft backbone network without requiring gateways. Regional peering applies when the virtual networks are in the same region.

Question 43Design, implement, and manage connectivity services

You are deploying a site-to-site VPN gateway into an existing virtual network. Which subnet name must the gateway subnet use?

  1. Gateway
  2. AzureGateway
  3. VpnSubnet
  4. GatewaySubnet Correct answer.

Explanation

Azure identifies the gateway subnet by the exact reserved name GatewaySubnet. A subnet with any other name cannot host a virtual network gateway, and the subnet must not contain other resources.

Question 44Design, implement, and manage connectivity services

Which statement about the SSTP protocol for point-to-site VPN connections is accurate?

  1. SSTP is available only for Windows client connections and uses TCP port 443. Correct answer.
  2. SSTP tunnels use UDP ports 500 and 4500.
  3. SSTP cannot traverse firewalls that allow only outbound TCP port 443.
  4. SSTP is supported on all client operating systems, including Linux and macOS.

Explanation

SSTP uses TLS over TCP port 443, which lets it pass through most firewalls and proxies, but Azure supports it only for Windows clients. IKEv2 and OpenVPN are the protocols used for the other client platforms.

Question 45Design, implement, and manage connectivity services

Which ExpressRoute peering configuration is used to reach the private IP addresses of virtual machines inside an Azure virtual network?

  1. Azure public peering
  2. Global Reach
  3. Azure private peering Correct answer.
  4. Microsoft peering

Explanation

Azure private peering connects an ExpressRoute circuit to private IP addresses in virtual networks, which is how VMs and internal load balancers are reached. Microsoft peering is for Microsoft public services, and Azure public peering is retired for new circuits.

Question 46Design, implement, and manage connectivity services

In a site-to-site VPN configuration, which resource represents the on-premises VPN device's public IP address and the on-premises address spaces?

  1. Connection
  2. Route server
  3. Virtual network gateway
  4. Local network gateway Correct answer.

Explanation

The local network gateway is an Azure resource that holds the public IP address of the on-premises VPN device and the address prefixes reachable behind it. The virtual network gateway represents the Azure side of the connection.

Question 47Design, implement, and manage connectivity services

Which virtual network gateway type must be created for an IPsec/IKE site-to-site connection over the public internet?

  1. Azure Route Server
  2. Vpn Correct answer.
  3. Azure Firewall
  4. ExpressRoute

Explanation

Gateways of type Vpn terminate IPsec/IKE tunnels from on-premises devices or other Azure virtual networks over the internet. Gateways of type ExpressRoute are used for private circuits from a connectivity provider.

Question 48Design, implement, and manage connectivity services

Which condition prevents two virtual networks from being peered?

  1. The two virtual networks have overlapping IP address spaces. Correct answer.
  2. The two virtual networks are in different Azure subscriptions.
  3. The two virtual networks are in different resource groups.
  4. The two virtual networks are in different Azure regions.

Explanation

Peering requires that the address spaces of the two virtual networks do not overlap, because routing between them is based on direct prefix reachability. Regions, subscriptions, and resource groups do not block peering.

Question 49Design, implement, and manage connectivity services

Spoke virtual networks must use the ExpressRoute gateway that is deployed in the hub virtual network. Which two peering settings must be enabled?

  1. Allow virtual network access on both peerings and enable BGP in each spoke virtual network.
  2. Allow forwarded traffic on the hub peering and enable BGP on the hub gateway.
  3. Use the remote gateway on both peerings and deploy a gateway in each spoke virtual network.
  4. Allow gateway transit on the hub peering and use the remote gateway on the spoke peering. Correct answer.

Explanation

The hub peering must allow gateway transit, and the spoke peering must be configured to use the remote gateway. The spoke must not contain its own virtual network gateway, and the configuration is applied per peering in each direction.

Question 50Design, implement, and manage connectivity services

Which requirements must be met to deploy an active-active site-to-site VPN gateway?

  1. One public IP address with BGP disabled on the gateway.
  2. Two gateway subnet address ranges and a single public IP address.
  3. A zone-redundant SKU combined with a NAT gateway.
  4. Two public IP addresses and BGP enabled on the gateway. Correct answer.

Explanation

An active-active gateway runs two gateway instances, each requiring its own public IP address, and Azure requires BGP to be enabled so that both instances advertise and learn routes. The configuration is available on the non-Basic SKUs.