I85PREP
⌘ K
Azure AZ-720 study materials
Azure AZ-720 study resources

Azure AZ-720 practice questions

One question at a time. Build your Azure AZ-720 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Troubleshoot business continuity issues

A company's Azure SQL database is configured with geo-redundant backup storage. An administrator needs to confirm how long point-in-time restore is supported for this configuration. What is the maximum retention period for point-in-time restore with geo-redundant backups?

  1. 1 day
  2. 14 days
  3. 7 days
  4. 35 days Correct answer.

Explanation

For Azure SQL Database, point-in-time restore retention depends on the backup storage redundancy chosen. Geo-redundant, zone-redundant, and locally redundant backup storage all support a maximum point-in-time restore retention of 35 days by default. Shorter values such as 7 or 14 days are configurable minimums, not the maximum.

Question 2Troubleshoot business continuity issues

An administrator is troubleshooting why an Azure virtual machine cannot be included in an Azure Backup recovery vault. The VM resides in a different region than the vault. What is the most likely cause?

  1. The VM uses premium managed disks
  2. The VM lacks a system-assigned managed identity
  3. Recovery Services vaults can only back up VMs in the same region as the vault Correct answer.
  4. The VM's resource group has a delete lock applied

Explanation

A Recovery Services vault backs up Azure VMs that are located in the same Azure region as the vault. Cross-region backup requires separate vaults per region or newer vault constructs with cross-region restore features. Region mismatch is therefore the primary reason a VM cannot be protected by a given vault.

Question 3Troubleshoot business continuity issues

A team reports that an Azure Storage account configured with read-access geo-redundant storage (RA-GRS) is not allowing read access to the secondary endpoint during a regional outage. Which configuration should the administrator verify first?

  1. The account's minimum TLS version
  2. Whether the secondary region has been made readable via a failover or the account's read-access setting Correct answer.
  3. The storage account's network firewall rules for the primary region
  4. The blob service's soft delete setting

Explanation

RA-GRS and RA-GZRS expose a readable secondary endpoint only when read access to the secondary region is enabled on the account. If the account is configured as GRS or GZRS without the read-access option, the secondary endpoint is not readable until a failover occurs. Verifying the redundancy and read-access setting is the correct first step.

Question 4Troubleshoot business continuity issues

An administrator needs to verify that an Azure virtual machine's backup policy retains daily recovery points for 30 days. Which setting in the backup policy controls this requirement?

  1. Weekly backup retention duration
  2. Daily backup retention duration Correct answer.
  3. Archive tier move after days
  4. Instant restore snapshot retention

Explanation

In an Azure VM backup policy, the daily backup retention setting defines how many days daily recovery points are kept. Instant restore snapshot retention controls the fast-restore snapshot window, which is separate from long-term recovery point retention. Configuring daily retention to 30 days satisfies the requirement.

Question 5Troubleshoot business continuity issues

During a test of business continuity, an administrator observes that an Azure Site Recovery replication for a VM shows a status of 'Critical' with a health error about the mobility service. What is the most likely cause?

  1. The mobility service agent on the source VM is not running or is outdated Correct answer.
  2. The target region does not support the VM size
  3. The VM's disk size exceeds the supported limit
  4. The recovery vault is in a different subscription

Explanation

Azure Site Recovery relies on the mobility service agent installed on the source VM to capture changes. A critical health error referencing the mobility service usually means the agent is stopped, crashed, or out of date. Restarting or updating the agent typically resolves the replication health error.

Question 6Troubleshoot business continuity issues

A user reports that they cannot restore a deleted blob even though soft delete is enabled on the storage account. The blob was deleted 40 days ago. What is the most likely explanation?

  1. The blob was deleted by a service principal
  2. The storage account uses locally redundant storage
  3. Soft delete retention was set to fewer than 40 days Correct answer.
  4. The container has a legal hold applied

Explanation

Blob soft delete retains deleted blobs only for the configured retention period, which can be between 1 and 365 days. If the blob was deleted 40 days ago and retention was set below 40 days, the blob has already been permanently removed. Extending the retention period before deletion would have preserved recoverability.

Question 7Troubleshoot business continuity issues

An administrator is troubleshooting a failed Azure Backup job for an Azure Files share. The job error indicates the storage account has firewall restrictions enabled. Which action resolves the issue while keeping the firewall enabled?

  1. Disable the storage account firewall permanently
  2. Register the vault's managed identity or enable the trusted Microsoft services exception Correct answer.
  3. Change the share to a premium file share
  4. Delete and recreate the backup policy

Explanation

Azure Backup for Azure Files requires network access to the storage account. When firewall restrictions are enabled, the storage account must allow trusted Microsoft services or the vault's managed identity so backup traffic can reach the share. This preserves the firewall while permitting backup operations.

Question 8Troubleshoot business continuity issues

A company needs to ensure that an Azure SQL managed instance can be restored to a point in time after an accidental data deletion. The administrator notices that the earliest available restore point is only 7 days back, but the requirement is 35 days. What should the administrator change?

  1. Move the managed instance to a different region
  2. Enable long-term retention for weekly backups
  3. Increase the backup storage redundancy to geo-redundant
  4. Configure the point-in-time restore retention to 35 days Correct answer.

Explanation

Azure SQL Managed Instance point-in-time restore retention is configurable up to 35 days. The default may be shorter, so the administrator must explicitly set the retention period to meet the 35-day requirement. Changing redundancy or adding long-term retention does not extend the point-in-time window.

Question 9Troubleshoot business continuity issues

An administrator is validating an Azure Site Recovery recovery plan. During a test failover, some VMs boot but application health checks fail because dependent VMs start in the wrong order. Which configuration should be adjusted?

  1. Replication frequency of the source VMs
  2. The target VM disk type
  3. Recovery plan groups and startup order Correct answer.
  4. The vault's storage redundancy setting

Explanation

A recovery plan organizes VMs into groups that start in a defined order, with optional pre and post actions. If dependent VMs start in the wrong sequence, the group membership and startup order must be corrected. Replication frequency and storage redundancy do not govern boot sequencing.

Question 10Troubleshoot business continuity issues

An administrator discovers that an Azure Backup vault reports a VM backup failure with the error 'UserErrorGuestAgentStatusUnavailable'. What is the most appropriate troubleshooting step?

  1. Change the storage redundancy of the vault
  2. Recreate the backup policy with a new schedule
  3. Increase the backup policy retention duration
  4. Verify the VM guest agent is installed, running, and reporting a healthy status Correct answer.

Explanation

The error indicates that the Azure VM guest agent is not reporting a healthy status, which prevents the backup extension from coordinating snapshots. The administrator should confirm the guest agent is installed, running, and communicating with the fabric. Policy and redundancy changes do not address guest agent health.

Question 11Troubleshoot business continuity issues

A team is troubleshooting why an Azure Site Recovery failover of a VM produces a target VM with the wrong IP address, breaking application connectivity. Which setting should the administrator review?

  1. The target storage account's replication type
  2. The vault's replication policy frequency
  3. The source VM's boot diagnostics setting
  4. The network mapping and target IP configuration in the recovery plan or replication settings Correct answer.

Explanation

Azure Site Recovery allows network mapping so that source VM networks map to target virtual networks, and target IP settings can be defined per VM. An incorrect network mapping or missing target IP configuration causes the failed-over VM to receive an unexpected address. Reviewing these settings resolves connectivity problems after failover.

Question 12Troubleshoot business continuity issues

An administrator needs to recover an Azure VM that was deleted three days ago. Soft delete for Azure Backup was enabled on the vault. What is the correct recovery approach?

  1. Restore the VM's disks from the storage account's blob soft delete
  2. Recreate the VM from an ARM template export
  3. Restore the VM from a snapshot taken by the guest OS
  4. Use the vault's soft delete feature to undelete the backup item and restore the VM Correct answer.

Explanation

Soft delete for Azure Backup retains backup data for deleted or stopped backup items for 14 additional days by default. The administrator can undelete the backup item from the vault and then perform a restore. Recreating from templates or relying on blob soft delete does not recover the VM backup data.

Question 13Troubleshoot business continuity issues

A storage account is configured with geo-zone-redundant storage (GZRS). During a regional outage, the administrator wants to restore write access in the secondary region. What action is required?

  1. Initiate a customer-managed account failover to the secondary region Correct answer.
  2. Delete and recreate the storage account in the secondary region
  3. Enable read access to the secondary region
  4. Change the account to locally redundant storage

Explanation

GZRS replicates data synchronously across zones in the primary region and asynchronously to a secondary region. To make the secondary region writable after a primary outage, a customer-managed failover must be initiated. Read access alone does not provide write capability in the secondary region.

Question 14Troubleshoot business continuity issues

An administrator is investigating why Azure Site Recovery replication for a VMware VM is stuck at 'Initial replication 0%'. The configuration server and process server appear healthy. Which cause is most likely?

  1. The recovery vault is in a different subscription
  2. The replication policy has a zero-hour recovery point objective
  3. The mobility service is installed but the source VM has no network connectivity to the process server Correct answer.
  4. The target VM size is not supported

Explanation

Initial replication requires the source VM to send data to the process server over the network. If the mobility service is installed but the VM cannot reach the process server on the required ports, replication stalls at zero percent. Verifying network connectivity and firewall rules between the VM and process server is the correct diagnostic step.

Question 15Troubleshoot business continuity issues

A company uses Azure Backup to protect an SAP HANA database on an Azure VM. A backup job fails with a pre-registration error. Which requirement is most likely unmet?

  1. The VM must have a public IP address
  2. The HANA instance must be pre-registered with the backup vault using the hdbuserstore key Correct answer.
  3. The backup policy must include a weekly full backup
  4. The VM must use premium SSD disks

Explanation

Backup of SAP HANA databases in Azure VMs requires the HANA instance to be registered with the Recovery Services vault, typically using a hdbuserstore key for authentication. Without this pre-registration, backup jobs fail before data protection begins. Public IPs, disk tiers, and weekly schedules are not prerequisites for registration.

Question 16Troubleshoot business continuity issues

An administrator is troubleshooting a failed restore of an Azure VM from a Recovery Services vault. The restore fails with an error indicating the target resource group is in a different region than the vault. Which statement explains the constraint?

  1. Cross-region restore requires the Cross Region Restore feature to be enabled on the vault Correct answer.
  2. The target resource group must be empty before restore
  3. Restores are always possible to any region without configuration
  4. The VM must be restored to the same subscription only

Explanation

By default, Azure Backup restores VMs within the same region as the vault. Restoring to a different region requires enabling the Cross Region Restore option on the vault, which uses geo-redundant storage. Without that feature enabled, cross-region restore attempts fail.

Question 17Troubleshoot business continuity issues

A team reports that an Azure Site Recovery test failover succeeded, but the production failover later failed with a disk provisioning error in the target region. Which factor should the administrator investigate?

  1. The vault's soft delete configuration
  2. The replication policy's application-consistent snapshot frequency
  3. Whether the target region supports the required VM size and disk type for all replicated disks Correct answer.
  4. The source VM's time zone setting

Explanation

A test failover may succeed in a test network while the production failover fails if the target region lacks capacity or support for the chosen VM size or disk type. Disk provisioning errors during failover usually indicate a target configuration or regional capability mismatch. Verifying supported sizes and disk types in the target region is the correct investigation.

Question 18Troubleshoot business continuity issues

An administrator needs to confirm that an Azure Backup policy for Azure Files supports restoring a share to a previous point in time. Which mechanism provides this capability?

  1. Azure Site Recovery replication of the file share
  2. Storage account failover to the secondary region
  3. Blob versioning on the storage account
  4. Share snapshots managed by Azure Backup Correct answer.

Explanation

Azure Backup for Azure Files takes share snapshots on a schedule defined by the backup policy. These snapshots allow restoring the entire share or individual files to a prior point in time. Blob versioning, Site Recovery, and account failover serve different purposes and do not provide file share point-in-time restore.

Question 19Troubleshoot business continuity issues

An administrator is troubleshooting an Azure Site Recovery issue where replication health shows 'Warning' because the available recovery points exceed the configured recovery point objective. What should the administrator check?

  1. The source VM's page file size
  2. The target VM's disk caching setting
  3. The vault's diagnostic log retention
  4. The crash-consistent snapshot frequency and the RPO threshold in the replication policy Correct answer.

Explanation

Azure Site Recovery monitors whether the age of the latest recovery point stays within the recovery point objective defined in the replication policy. Warnings appear when snapshot frequency or RPO thresholds are misaligned with actual replication performance. Adjusting the policy or resolving replication throughput issues restores healthy status.

Question 20Troubleshoot hybrid and cloud connectivity issues

A site-to-site VPN tunnel between an on-premises network and an Azure VPN gateway drops intermittently. Which diagnostic step should you take first to determine whether the failure is on the Azure side or the on-premises side?

  1. Increase the gateway SKU to the highest available tier
  2. Delete and recreate the virtual network gateway
  3. Check the VPN gateway connection status and IKE diagnostics in the Azure portal and Azure Network Watcher Correct answer.
  4. Rebuild the on-premises VPN device configuration from scratch

Explanation

Diagnosis should start with the observable telemetry: the gateway connection status, tunnel state, and IKE log data available through the portal and Network Watcher. These confirm whether the tunnel is negotiating, whether rekeys are failing, or whether traffic counters are moving. Only after that evidence exists should configuration or SKU changes be considered.

Question 21Troubleshoot hybrid and cloud connectivity issues

An ExpressRoute circuit shows that the Border Gateway Protocol session to the Microsoft Enterprise Edge routers is down. Which condition most directly explains this state?

  1. The Azure virtual network has no gateway subnet
  2. The circuit is provisioned but the service key has never been associated with a connection
  3. The customer edge router's BGP peer IP or ASN does not match the configuration provided in the service key Correct answer.
  4. The customer edge router is advertising a default route

Explanation

A BGP session with the Microsoft Enterprise Edge routers can only form when the peering configuration matches exactly: the peer IP addresses, the customer ASN, and the VLAN identifier must align with what is configured on the Microsoft side. A mismatch in peer address or ASN prevents the TCP session from establishing.

Question 22Troubleshoot hybrid and cloud connectivity issues

Users in a branch office resolve internal names slowly and sometimes receive public IP addresses for internal-only services. Which change most directly addresses this symptom?

  1. Configure the branch clients to use a public DNS resolver as primary
  2. Disable DNS registration on the internal zone
  3. Add a conditional forwarder on the branch DNS servers for the internal zone pointing to the domain controllers Correct answer.
  4. Convert the internal zone to a secondary zone on the branch servers

Explanation

When branch clients are resolving internal names through servers that do not host the internal zone, they fall back to root hints or public resolution and may return public records. A conditional forwarder for the internal namespace directs those queries to the authoritative internal DNS servers, restoring correct and fast resolution.

Question 23Troubleshoot hybrid and cloud connectivity issues

You have configured a point-to-site VPN using Azure certificate authentication, but clients receive an authentication failure during the IKEv2 handshake. Which cause is most likely?

  1. The client certificate was issued by a root certificate that is not uploaded to the gateway Correct answer.
  2. The root certificate was uploaded without its public key
  3. The client is using the OpenVPN tunnel type
  4. The virtual network gateway is in the Basic SKU

Explanation

Certificate authentication requires the chain of trust: the root certificate that issued the client certificate must be uploaded to the gateway as a trusted root. If the issuing root is absent, the gateway cannot validate the client certificate and rejects the handshake.

Question 24Troubleshoot hybrid and cloud connectivity issues

A virtual network peering between two virtual networks in different subscriptions shows a state of Disconnected. Which action resolves this?

  1. Create the matching peering from the second virtual network back to the first Correct answer.
  2. Delete the peering on both sides and recreate it with the same names
  3. Attach a network security group to both gateway subnets
  4. Add a user-defined route between the two address spaces

Explanation

Virtual network peering is only established when both virtual networks have a peering object pointing at each other. A one-sided peering remains in the Initiated or Disconnected state until the reciprocal peering is created.

Question 25Troubleshoot hybrid and cloud connectivity issues

Traffic from an on-premises network reaches an Azure virtual machine, but the return traffic is dropped by Azure. The on-premises address space is 10.10.0.0/16 and the virtual network is 10.10.5.0/24. What is the most likely cause?

  1. The network security group blocks outbound traffic on all ports
  2. The route table lacks a route for the on-premises prefix
  3. The virtual network address space overlaps the on-premises address space Correct answer.
  4. The gateway subnet is too small

Explanation

Azure cannot route traffic to an address space that overlaps the virtual network's own address space, because the platform cannot distinguish local from remote destinations. Overlapping prefixes cause return traffic to be treated as local and dropped or misrouted.

Question 26Troubleshoot hybrid and cloud connectivity issues

Which Azure tool should you use to verify that packets from an Azure virtual machine are reaching an on-premises host and to identify where along the path they are dropped?

  1. Azure Service Health
  2. Azure Advisor
  3. Connection Monitor in Azure Network Watcher Correct answer.
  4. Cost Management exports

Explanation

Connection Monitor continuously tests reachability between sources and destinations and reports latency, loss, and hop-level diagnostics. It is the appropriate tool for confirming end-to-end connectivity and localizing where packets fail.

Question 27Troubleshoot hybrid and cloud connectivity issues

An Azure VPN gateway connection shows Connected, but no traffic flows to the on-premises subnet 192.168.20.0/24. The virtual network has no custom route table. What should you check?

  1. Whether the Azure firewall is enabled on the gateway subnet
  2. Whether the virtual network gateway SKU supports active-active mode
  3. Whether the on-premises VPN device is advertising the 192.168.20.0/24 prefix over BGP or whether it is defined in the local network gateway address space Correct answer.
  4. Whether accelerated networking is enabled on the virtual machines

Explanation

For a route-based or policy-based connection, Azure must know the remote prefixes. They come either from the local network gateway address space definitions or from BGP advertisements. If the prefix is absent, Azure has no route and traffic is not sent over the tunnel.

Question 28Troubleshoot hybrid and cloud connectivity issues

You need to confirm that an ExpressRoute circuit is receiving the expected on-premises routes. Which command-line approach provides this information?

  1. Get-AzVirtualNetworkGatewayAdvertisedRoute on the virtual network gateway
  2. Get-AzExpressRoutePortLinkDetail on the ExpressRoute port
  3. Get-AzNetworkWatcherNextHop from an Azure virtual machine
  4. Get-AzExpressRouteCircuitRouteTableSummary with the peering type and path Correct answer.

Explanation

Route table summary and route table commands for an ExpressRoute circuit return the routes learned from and advertised to the customer edge router for a given peering. This directly answers whether the expected prefixes are being received.

Question 29Troubleshoot hybrid and cloud connectivity issues

A company uses Azure DNS private zones linked to a hub virtual network. Spoke virtual networks cannot resolve records in the private zone. What is the required configuration?

  1. Enable auto-registration on the hub link only
  2. Add the spoke address spaces to the private zone as records
  3. Create a public DNS zone with the same name
  4. Add a virtual network link from the private zone to each spoke virtual network Correct answer.

Explanation

A private DNS zone resolves only for the virtual networks explicitly linked to it. Spokes that are not linked cannot use the zone even if they are peered to a linked hub. Adding a virtual network link per spoke, or forwarding through a resolver in the hub, is required.

Question 30Troubleshoot hybrid and cloud connectivity issues

An on-premises network connects to Azure through both ExpressRoute and a site-to-site VPN. You want the VPN to be used only when ExpressRoute fails. What should you configure?

  1. Route filters that block the VPN prefixes permanently
  2. A higher BGP local preference on the VPN path
  3. Equal-cost multi-path routing across both connections
  4. A longer AS path prepended on the VPN connection so ExpressRoute is preferred Correct answer.

Explanation

Route preference between the two paths is controlled through BGP attributes. Prepending the AS path on the VPN-learned routes makes them less preferred than the ExpressRoute routes, so the VPN is selected only when the ExpressRoute path disappears.

Question 31Troubleshoot hybrid and cloud connectivity issues

A user reports that a private endpoint for an Azure Storage account is unreachable from an on-premises host over ExpressRoute. Name resolution from on-premises returns the public IP address. What is the most likely cause?

  1. The on-premises DNS servers do not forward the privatelink zone to Azure DNS or a DNS forwarder that can resolve it Correct answer.
  2. The ExpressRoute circuit is in the wrong peering location
  3. The private endpoint subnet lacks a network security group
  4. The storage account firewall blocks the on-premises range

Explanation

Private endpoint names are published in a privatelink DNS zone that must be resolvable by the client. If on-premises DNS does not forward that zone to a resolver with visibility of the private zone, clients receive the public address and bypass the private endpoint.

Question 32Troubleshoot hybrid and cloud connectivity issues

Which Azure feature lets you capture packets on a virtual machine's network interface for later analysis in Wireshark?

  1. NSG flow logs
  2. Network Watcher packet capture Correct answer.
  3. IP flow verify
  4. Connection troubleshoot

Explanation

Packet capture in Network Watcher records traffic on a virtual machine network interface and stores it in a storage account or locally for analysis. It is the tool intended for deep packet-level inspection.

Question 33Troubleshoot hybrid and cloud connectivity issues

A site-to-site VPN uses policy-based traffic selectors, and only the first subnet pair passes traffic. Other subnets configured in the local network gateway are unreachable. What explains this?

  1. Policy-based gateways require a single virtual network gateway
  2. The connection must use IKEv2 instead of IKEv1
  3. The local network gateway address space is limited to one prefix
  4. Policy-based gateways support only one pair of traffic selectors, so additional subnet pairs cannot be negotiated Correct answer.

Explanation

Policy-based VPN gateways match traffic using a single traffic selector pair rather than the any-to-any selectors used by route-based gateways. Additional subnet pairs therefore never match the policy and are not sent over the tunnel.

Question 34Troubleshoot hybrid and cloud connectivity issues

You want to confirm which network security rule is allowing or denying a specific five-tuple flow to an Azure virtual machine. Which tool should you use?

  1. Network Watcher topology
  2. Network Watcher IP flow verify Correct answer.
  3. Azure Monitor metrics
  4. Connection Monitor

Explanation

IP flow verify evaluates a specified five-tuple against the effective security rules on a virtual machine and returns whether the traffic is allowed or denied along with the rule name. It is designed exactly for this question.

Question 35Troubleshoot hybrid and cloud connectivity issues

An Azure VPN gateway is configured in active-active mode, but only one tunnel is carrying traffic. Which factor most likely explains this?

  1. The virtual network uses a custom DNS server
  2. The gateway subnet is /27
  3. The on-premises device supports only a single tunnel to a single peer address Correct answer.
  4. The connection uses a shared key shorter than 32 characters

Explanation

Active-active gateways present two public IP addresses and expect the on-premises device to establish a tunnel to each. If the device is configured with only one peer address, only one tunnel forms and the second instance remains idle.

Question 36Troubleshoot hybrid and cloud connectivity issues

An ExpressRoute connection is up, but traffic from Azure to on-premises is being dropped by the customer edge router. Which Azure-side check confirms that Azure is advertising the expected prefixes to on-premises?

  1. Get-AzExpressRouteCircuitARPTable
  2. Get-AzVirtualNetworkGatewayLearnedRoute
  3. Get-AzExpressRouteCircuitRouteTable for the private peering
  4. Get-AzVirtualNetworkGatewayAdvertisedRoute for the ExpressRoute peering Correct answer.

Explanation

Advertised route output shows the prefixes that the virtual network gateway sends toward the customer edge router over the ExpressRoute peering. Comparing this to expectations confirms whether the missing prefixes are an Azure advertisement problem or an on-premises filter problem.

Question 37Troubleshoot hybrid and cloud connectivity issues

Branch users connected through a site-to-site VPN cannot reach an Azure private endpoint because the private endpoint's subnet has no route back to the branch prefix. Which configuration corrects this?

  1. Add the branch prefix to the virtual network address space
  2. Enable service endpoints on the private endpoint subnet
  3. Add an NSG rule allowing all inbound traffic
  4. Associate a route table containing the branch prefix via the virtual network gateway to the private endpoint subnet Correct answer.

Explanation

Return traffic from the private endpoint subnet needs a route pointing the branch prefix at the virtual network gateway. Associating a route table with that next-hop type provides the missing path without altering address spaces.

Question 38Troubleshoot hybrid and cloud connectivity issues

A point-to-site VPN client connects successfully but cannot reach any resources in the virtual network. The virtual network has a custom route table applied to the client address pool subnet. What is the likely issue?

  1. The client address pool overlaps the virtual network address space
  2. The route table contains a default route to a virtual appliance that is not reachable Correct answer.
  3. The client is using SSTP instead of IKEv2
  4. The point-to-site client does not receive routes because the gateway is in the Basic SKU

Explanation

Point-to-site clients receive routes pushed by the gateway, but a user-defined default route that sends traffic to an unreachable appliance will black-hole the traffic. Verifying the effective routes on the client and the appliance health identifies this condition.

Question 39Troubleshoot hybrid and cloud connectivity issues

Which log should you enable to see IPsec security association events and dropped packet reasons for an Azure VPN gateway?

  1. Azure Monitor activity metrics
  2. Activity log
  3. NSG flow logs
  4. Gateway diagnostic logs with the tunnel and IKE diagnostic categories Correct answer.

Explanation

VPN gateway diagnostic settings include categories for tunnel diagnostics and IKE diagnostics that record security association negotiation and data-path events. These logs are the source for diagnosing why packets are dropped inside the tunnel.

Question 40Troubleshoot hybrid and cloud connectivity issues

A hybrid environment uses Azure DNS Private Resolver. On-premises clients must resolve private zone records. Which design achieves this?

  1. Link the private zone to the on-premises network by using a virtual network link
  2. Configure a forwarding rule set in the Private Resolver and forward the private zone from on-premises DNS to the inbound endpoint Correct answer.
  3. Configure the outbound endpoint only and rely on auto-registration
  4. Point on-premises DNS at the Azure recursive resolver 168.63.129.16

Explanation

The inbound endpoint of Azure DNS Private Resolver provides an IP address reachable from on-premises, and a forwarding rule set maps the private zone to that endpoint. On-premises DNS conditional forwarders then send queries for the zone to the inbound endpoint.

Question 41Troubleshoot hybrid and cloud connectivity issues

You are troubleshooting an ExpressRoute circuit where the private peering is up but the virtual network gateway shows no learned routes. Which condition should you verify first?

  1. That the circuit has Global Reach enabled
  2. That the gateway subnet is /29
  3. That the gateway SKU is ErGw3AZ
  4. That the virtual network gateway is connected to the circuit through a connection object in the same subscription or an authorized subscription Correct answer.

Explanation

A virtual network gateway learns routes from a circuit only when a connection object links the gateway to the circuit's private peering. Without that association, the peering can be up while the gateway has nothing to learn from.

Question 42Troubleshoot hybrid and cloud connectivity issues

A virtual network gateway is deployed in a subnet named GatewaySubnet that was created as /29. You need to add a second gateway for coexistence with ExpressRoute. What must you do?

  1. Enable accelerated networking on the gateway
  2. Resize the existing GatewaySubnet to /27 or larger Correct answer.
  3. Move the gateway to the default subnet
  4. Create a second gateway subnet named GatewaySubnet2

Explanation

Azure requires the gateway subnet to be large enough to host the gateway instances and any additional gateways. A /29 is too small for coexistence scenarios, so the subnet must be resized before the second gateway can be deployed.

Question 43Troubleshoot hybrid and cloud connectivity issues

Users report that access to an Azure web application over ExpressRoute fails while access over the public internet succeeds. Which cause should you investigate?

  1. The web application's TLS certificate has expired
  2. The application gateway health probe is misconfigured
  3. The virtual network has no DDoS protection plan
  4. The on-premises route for the application's public IP prefix prefers the internet path and the ExpressRoute path is filtered or asymmetric Correct answer.

Explanation

When ExpressRoute is used to reach public endpoints through Microsoft peering, the on-premises routing and any route filters determine whether that prefix is reachable over the circuit. Asymmetric routing or a filtered prefix causes the circuit path to fail while internet access still works.

Question 44Troubleshoot hybrid and cloud connectivity issues

Which statement correctly describes how Azure resolves name queries sent to the platform-provided DNS address 168.63.129.16 from a virtual machine?

  1. It resolves names only for virtual machines in the same subnet
  2. It forwards queries to custom DNS servers configured on the virtual network when they are present Correct answer.
  3. It resolves only public names and never forwards to custom DNS servers
  4. It requires an ExpressRoute circuit to function

Explanation

The platform DNS address acts as a resolver that forwards queries to the custom DNS servers configured for the virtual network when present, and otherwise performs Azure-provided resolution. It is reachable from any virtual machine in the virtual network, not just one subnet.

Question 45Troubleshoot hybrid and cloud connectivity issues

An on-premises host opens a TCP connection to an Azure virtual machine over a site-to-site VPN. The SYN arrives, but the Azure VM never responds. You confirm the guest firewall allows the port. Which Azure capability should you use to prove whether the packet is being dropped by a network security group before it reaches the guest?

  1. Enable IP flow verify on the VM's network interface and test the five-tuple flow Correct answer.
  2. Capture packets inside the guest operating system with a tracing tool
  3. Enable the NSG flow log and wait for the connection attempt to be recorded
  4. Run Network Watcher connection troubleshoot from the VM to the on-premises host

Explanation

IP flow verify evaluates a specific five-tuple against the effective network security rules applied to a network interface and reports whether the traffic is allowed or denied, along with the rule responsible. It is the fastest way to prove that an NSG, rather than the guest, is discarding the inbound SYN.

Question 46Troubleshoot hybrid and cloud connectivity issues

You need to determine whether an Azure VPN gateway's IPsec tunnel is failing phase 1 negotiation or phase 2 negotiation. Which diagnostic source provides security association and IKE event details for the gateway?

  1. Virtual network flow logs on the GatewaySubnet
  2. Activity log of the virtual network gateway resource
  3. Boot diagnostics of the gateway subnet
  4. VPN gateway diagnostics logs sent to Log Analytics Correct answer.

Explanation

Diagnostic settings on the VPN gateway can stream IKE and IPsec diagnostic events, including security association establishment and failure reasons, to Log Analytics or a storage account. Those events distinguish phase 1 (IKE) failures from phase 2 (quick mode) failures.

Question 47Troubleshoot hybrid and cloud connectivity issues

A site-to-site VPN connection between an Azure VPN gateway and a third-party on-premises device reports Connected, yet no traffic reaches the Azure subnet. The on-premises device uses policy-based traffic selectors. What is the most likely cause?

  1. The Azure gateway is configured in active-active mode
  2. The shared key contains special characters
  3. The Azure gateway requires BGP peering before any traffic passes
  4. The traffic selectors on the two sides do not match the Azure subnet prefixes Correct answer.

Explanation

Policy-based VPN devices negotiate a single traffic selector pair, so the local and remote address prefixes must exactly mirror the Azure address space and the on-premises prefixes. A mismatch causes the tunnel to come up while traffic for unmatched prefixes is silently discarded.

Question 48Troubleshoot hybrid and cloud connectivity issues

An ExpressRoute circuit's private peering is established, but the virtual network gateway in Azure shows no learned routes from on-premises. Which two elements should you verify first? (Choose the best single answer.)

  1. The DNS settings of the virtual network and the private zone links
  2. The public IP address of the gateway and the UDR on the gateway subnet
  3. The NSG rules on the gateway subnet and the VM's effective routes
  4. The route filters and the advertised prefixes from the customer edge router Correct answer.

Explanation

When private peering is up but no routes appear, the usual causes are that the customer edge router is not advertising the expected prefixes or that a route filter attached to the gateway is limiting what is accepted. Verifying advertisements and route filters isolates the control-plane issue.

Question 49Troubleshoot hybrid and cloud connectivity issues

On-premises clients must resolve records in an Azure DNS private zone over ExpressRoute. The environment already has Azure DNS Private Resolver deployed in the hub virtual network. Which design lets on-premises DNS servers forward queries to Azure?

  1. Create an outbound endpoint and forward queries from Azure to on-premises
  2. Create an inbound endpoint and forward queries from on-premises to its IP address Correct answer.
  3. Enable auto-registration on the hub virtual network
  4. Link the private zone to the GatewaySubnet

Explanation

An inbound endpoint provides an IP address inside a delegated subnet that accepts DNS queries from outside Azure, including over ExpressRoute or VPN. On-premises DNS servers conditionally forward the private zone to that endpoint address.

Question 50Troubleshoot hybrid and cloud connectivity issues

A point-to-site VPN client connects successfully but cannot reach any virtual machines in the virtual network. The virtual network address space is 10.10.0.0/16 and the client address pool is 10.10.1.0/24. What is the most likely cause?

  1. The client address pool overlaps the virtual network address space Correct answer.
  2. The client certificate has expired
  3. The gateway SKU does not support point-to-site
  4. The virtual network has no route table attached

Explanation

The point-to-site address pool must not overlap any virtual network, peered network, or on-premises address space that the client needs to reach. An overlapping pool causes routing ambiguity so client traffic cannot be delivered to the intended subnet.