Microsoft Certified: Azure Network Engineer Associate - (AZ-700) Exam Questions

Option C is CORRECT because Azure AD authentication for P2S VPN connections is supported only for OpenVPN protocol connections. This means that only OpenVPN protocol can be used when you want to authenticate P2S VPN connections using Azure AD​1​.

Option A is INCORRECT because Azure AD authentication is not supported for IKEv2. IKEv2 is a VPN protocol that's quick and easy to set up, and it has a robust security association, but it doesn't support Azure AD authentication.

Option B is INCORRECT because Azure AD authentication is not supported for IKEv2 and SSTP. Even though this option combines two different protocols, neither of these supports Azure AD authentication for P2S VPN connections.

Option D is INCORRECT because Azure AD authentication is not supported for SSTP. While SSTP is a commonly used protocol for Windows users and it's known for passing through firewalls, it does not support Azure AD authentication for P2S VPN connections.

Reference links:

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

• https://docs.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices

• https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

Option C is CORRECT because it allows for private, secure data exchange between different ExpressRoute circuits. In this case, it can be used to connect the datacenters in New York and Seattle using the ExpressRoute circuits ERC1 and ERC2. Global Reach adds the capability to use Microsoft's network as the transit network between your sites, which is a cost-effective solution because you're utilizing the existing ExpressRoute circuits without needing to upgrade to a more expensive plan or add new circuits.

Option A is INCORRECT because ExpressRoute Direct provides dedicated network connectivity to Azure, but it doesn't connect multiple ExpressRoute circuits together. Additionally, ExpressRoute Direct is typically more expensive because it offers greater bandwidth options.

Option B is INCORRECT because it is a feature that optimizes the path for network traffic from your network to an Azure virtual network. It doesn't connect multiple ExpressRoute circuits together.

Option D is INCORRECT because the Premium add-on increases the number of routes that you can advertise over BGP, extends the availability of Azure services across multiple regions, and provides higher limits. However, it doesn't connect multiple ExpressRoute circuits together and is more expensive than the Global Reach solution.

Reference links:

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-global-reach

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-faqs

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-direct

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-about-virtual-network-gateways

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-troubleshooting-expressroute-link

• https://docs.microsoft.com/en-us/azure/expressroute/how-to-routefilter-portal

Option B is CORRECT because the Private Peering is the correct choice in this scenario. In Azure ExpressRoute, Private Peering is used to connect your on-premises networks to Azure virtual networks over a private connection facilitated by a connectivity provider. This is a direct, private connection that does not go over the public internet, which would meet the requirement to ensure all the data sent between the datacenters is routed via the ExpressRoute circuits.

Option A is INCORRECT because Microsoft peering is used for connectivity to Microsoft cloud services, such as Microsoft 365. This is not the requirement here, as we're looking to ensure data sent between the on-premises datacenters is routed via the ExpressRoute circuits.

Option C is INCORRECT because Public Peering is deprecated and no longer a recommended approach. Azure has transitioned away from Public Peering and now recommends using Microsoft Peering for the public-facing Azure services.

Reference links:

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-faqs#what-is-private-peering

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-faqs#what-is-microsoft-peering

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-faqs#what-is-public-peering

Option B is CORRECT because peering is the most cost-effective and efficient way to connect virtual networks within the same Azure region. In this case, Vnet2 and Vnet3 can be peered with Vnet1 (the hub network), and since Vnet1 is already connected to the on-premises network via a Site-to-Site VPN, all virtual machines in the peered networks will be able to communicate with the on-premises network. Peering provides low-latency, high-bandwidth connections between virtual networks, making it ideal for this scenario.

Option A is INCORRECT because VNet-to-VNet VPN connections would involve creating additional VPN Gateways for Vnet2 and Vnet3, which would increase costs. VPN connections also have more latency and less bandwidth compared to peering.

Option C is INCORRECT because service endpoints are used to secure Azure service resources to a virtual network, not for connecting virtual networks to each other or to an on-premises network.

Option D is INCORRECT because route tables are used to direct network traffic, not to establish connections between networks. While route tables would be used in conjunction with network peering or VPN connections, they are not a standalone solution for connecting networks.

Reference links:

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

• https://docs.microsoft.com/en-us/azure/virtual-network/manage-route-table

Option A is CORRECT because one ExpressRoute Premium circuit can meet all the requirements in this scenario. The Premium add-on provides global connectivity, allowing you to link to Microsoft's network at any location and access your resources in any Azure region, including the regions where your virtual networks Vnet1, Vnet2, Vnet3, and Vnet4 are hosted (East US, North Europe, West US, and West Europe). The ExpressRoute Premium add-on also supports up to 10 Gbps, which is well above the requirement of 1 Gbps. This option also minimizes costs as it involves provisioning only one circuit.

Option B is INCORRECT because provisioning two ExpressRoute Premium circuits would exceed the requirements and increase costs unnecessarily.

Option C is INCORRECT because while four ExpressRoute Standard circuits would technically connect all the virtual networks to the office, this would not be cost-effective as it involves provisioning four separate circuits. Furthermore, the Standard SKU doesn't provide global connectivity, which is required in this scenario to connect virtual networks in different regions.

Option D is INCORRECT because one ExpressRoute Standard circuit wouldn't meet the requirements as it doesn't support global connectivity. The office wouldn't be able to access all the virtual networks since they're in different regions.

Reference links:

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-faqs

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuits

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-troubleshooting-network-performance

Option C is CORRECT because the VpnGw4AZ SKU is the most suitable for the given requirements. VpnGw4AZ supports up to 100 Site-to-Site VPN connections, which is sufficient for the 90 connections required in the scenario. In addition, this SKU offers zone-redundancy (AZ), ensuring that the Site-to-Site VPN connections remain available if an Azure datacenter fails. While VpnGw5AZ also meets the requirements, it does not minimize costs as well as VpnGw4AZ.

Option A and B are INCORRECT because both VpnGw1AZ and VpnGw2AZ support only up to 30 Site-to-Site VPN connections, which is insufficient for the 90 connections required in the scenario.

Option D is INCORRECT because while VpnGw5AZ supports the required number of connections and offers zone-redundancy, it does not minimize costs as effectively as VpnGw4AZ.

Reference links:

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways#gwsku

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-zone-redundant-vnet-gateways

Option D is CORRECT because the Basic SKU of the Azure Load Balancer (LB1) does not support cross-region load balancing. In order to allow virtual machines connected to Vnet2 (which is in the West US region) to connect to VM1 and VM2 (which are in the East US region) via LB1, you need to change the SKU of LB1 to Standard. The Standard SKU supports cross-region load balancing through Global VNet Peering.

Option A is INCORRECT because simply allowing traffic forwarded from Vnet1 in the peering settings of Vnet2 won't enable cross-region load balancing. This setting is not relevant when the load balancer is not capable of handling cross-region traffic.

Option B is INCORRECT because changing the Floating IP configurations of LB1 won't affect the ability of the load balancer to handle cross-region traffic. Floating IP (also known as Direct Server Return) is used to preserve the client's IP address, which is not related to the issue at hand.

Option C is INCORRECT because changing the peering settings of Vnet1 won't make the Basic SKU load balancer support cross-region traffic.

Reference links:

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-basic-overview

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Option B is CORRECT.

The sequence of actions to perform would be:

• From AppGwy1, create an SSL profile. This is where you'll upload your client certificate(s). The SSL Policy tab is to configure a listener-specific SSL policy​.

• From an on-premises computer, upload a certificate to AppGwy1. You create the certificate locally and then upload it to the Azure portal when you create the listener for the application gateway​

• From AppGwy1, add an HTTP listener and associate the listener to the SSL profile. This step involves associating the SSL profile to the listener to complete the setup of mutual authentication​.

• From AppGwy1, create a routing rule. This step involves connecting the frontend and backend pool using a routing rule​.

Reference Links:

https://learn.microsoft.com/en-us/azure/application-gateway/mutual-authentication-portal

Option B is CORRECT.

To query the health probe of an Azure virtual network gateway, you should use an HTTPS URI with the public IP address of the gateway and port 8081, followed by /healthprobe. Therefore, in this case, the correct URI would be https://20.25.32.214:8081/healthprobe​.

Reference Link:

• https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-site-to-site-cannot-connect#step-7-verify-the-azure-gateway-health-probe

Option A is CORRECT because one ExpressRoute Standard circuit can provide up to 10 Gbps connection which meets the requirement of 1000-Mbps connection. ExpressRoute provides redundancy in every peering location to achieve high availability. Thus, even if two availability zones fail, the on-premises datacenter will still maintain connectivity to the virtual machines. ExpressRoute Standard circuit is cheaper than ExpressRoute Premium, hence it minimizes costs.

Option B is INCORRECT because while a single ExpressRoute Premium circuit does meet the speed and availability requirements, it does not minimize costs. ExpressRoute Premium is more expensive than ExpressRoute Standard, and the additional features of the Premium circuit, such as increased route limits and global connectivity, are not specified as requirements in the scenario.

Option C and Option D are INCORRECT because they do not minimize costs. Two ExpressRoute Standard circuits or two ExpressRoute Premium circuits would provide redundancy beyond what's required and would add unnecessary expense. The increased number of circuits would not provide additional benefits in case of the failure of two availability zones, as one circuit already provides the necessary redundancy.

Option E and Option F are INCORRECT because they further increase costs without providing additional benefits. Three ExpressRoute Standard or Premium circuits would provide an even higher level of redundancy, which is not required according to the scenario. The cost of three circuits would far exceed the cost of one circuit, thus not meeting the requirement to minimize costs.

Reference links:

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-faqs

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings

• https://docs.microsoft.com/en-us/azure/expressroute/expressroute-troubleshooting-connectivity