AZ-700 無料問題集「Microsoft Designing and Implementing Microsoft Azure Networking Solutions」
Task 6
You have two servers that are each hosted by a separate service provider in New York and Germany. The server hosted in New York is accessible by using a host name of ny.contoso.com. The server hosted in Germany is accessible by using a host name of de.contoso.com.
You need to provide a single host name to access both servers. The solution must ensure that traffic originating from Germany is routed to de contoso.com. All other traffic must be routed to ny.contoso.com.
You have two servers that are each hosted by a separate service provider in New York and Germany. The server hosted in New York is accessible by using a host name of ny.contoso.com. The server hosted in Germany is accessible by using a host name of de.contoso.com.
You need to provide a single host name to access both servers. The solution must ensure that traffic originating from Germany is routed to de contoso.com. All other traffic must be routed to ny.contoso.com.
正解：
See the Explanation below for step by step instructions.
Explanation:
To provide a single host name that routes traffic based on the origin, you can use Azure Traffic Manager. This service allows you to route traffic to different endpoints based on various routing methods, including geographic routing.
Navigate to the Azure Portal.
Search for "Traffic Manager profiles" and select it.
Click on "Create".
Enter the following details:
Name: Enter a name for the Traffic Manager profile (e.g., ContosoTrafficManager).
Routing method: Select Geographic.
Subscription: Select your subscription.
Resource group: Select an existing resource group or create a new one.
Resource group location: Choose a location (this does not affect the routing).
Click on "Create".
Navigate to the newly created Traffic Manager profile.
Select "Endpoints" from the left-hand menu.
Click on "Add" to add a new endpoint.
Enter the following details:
Type: Select External endpoint.
Name: Enter a name for the endpoint (e.g., NewYorkEndpoint).
FQDN: Enter ny.contoso.com.
Geographic region: Select "World" (this will be adjusted later).
Click on "Add" to save the endpoint.
Repeat the process to add the second endpoint:
Type: Select External endpoint.
Name: Enter a name for the endpoint (e.g., GermanyEndpoint).
FQDN: Enter de.contoso.com.
Geographic region: Select Europe.
Navigate to the Traffic Manager profile.
Select "Configuration" from the left-hand menu.
Under "Geographic routing", adjust the regions:
For the GermanyEndpoint, ensure that the geographic region is set to Europe.
For the NewYorkEndpoint, ensure that the geographic region is set to World (excluding Europe).
Use a DNS query tool to test the routing.
From a location in Germany, query the Traffic Manager profile's DNS name and ensure it resolves to de.
contoso.com.
From a location outside Europe, query the Traffic Manager profile's DNS name and ensure it resolves to ny.
contoso.com.
Azure Traffic Manager: This service uses DNS to direct client requests to the most appropriate endpoint based on the routing method you choose. Geographic routing ensures that traffic is directed based on the origin of the request.
Geographic Routing: This method allows you to route traffic based on the geographic location of the DNS query origin, ensuring that users are directed to the nearest or most appropriate endpoint.
Step-by-Step SolutionStep 1: Create a Traffic Manager ProfileStep 2: Configure EndpointsStep 3: Adjust Geographic RoutingStep 4: Test the ConfigurationExplanationBy following these steps, you can provide a single host name that routes traffic to de.contoso.com for users in Germany and to ny.contoso.com for users from other locations, ensuring efficient and appropriate traffic management.
Explanation:
To provide a single host name that routes traffic based on the origin, you can use Azure Traffic Manager. This service allows you to route traffic to different endpoints based on various routing methods, including geographic routing.
Navigate to the Azure Portal.
Search for "Traffic Manager profiles" and select it.
Click on "Create".
Enter the following details:
Name: Enter a name for the Traffic Manager profile (e.g., ContosoTrafficManager).
Routing method: Select Geographic.
Subscription: Select your subscription.
Resource group: Select an existing resource group or create a new one.
Resource group location: Choose a location (this does not affect the routing).
Click on "Create".
Navigate to the newly created Traffic Manager profile.
Select "Endpoints" from the left-hand menu.
Click on "Add" to add a new endpoint.
Enter the following details:
Type: Select External endpoint.
Name: Enter a name for the endpoint (e.g., NewYorkEndpoint).
FQDN: Enter ny.contoso.com.
Geographic region: Select "World" (this will be adjusted later).
Click on "Add" to save the endpoint.
Repeat the process to add the second endpoint:
Type: Select External endpoint.
Name: Enter a name for the endpoint (e.g., GermanyEndpoint).
FQDN: Enter de.contoso.com.
Geographic region: Select Europe.
Navigate to the Traffic Manager profile.
Select "Configuration" from the left-hand menu.
Under "Geographic routing", adjust the regions:
For the GermanyEndpoint, ensure that the geographic region is set to Europe.
For the NewYorkEndpoint, ensure that the geographic region is set to World (excluding Europe).
Use a DNS query tool to test the routing.
From a location in Germany, query the Traffic Manager profile's DNS name and ensure it resolves to de.
contoso.com.
From a location outside Europe, query the Traffic Manager profile's DNS name and ensure it resolves to ny.
contoso.com.
Azure Traffic Manager: This service uses DNS to direct client requests to the most appropriate endpoint based on the routing method you choose. Geographic routing ensures that traffic is directed based on the origin of the request.
Geographic Routing: This method allows you to route traffic based on the geographic location of the DNS query origin, ensuring that users are directed to the nearest or most appropriate endpoint.
Step-by-Step SolutionStep 1: Create a Traffic Manager ProfileStep 2: Configure EndpointsStep 3: Adjust Geographic RoutingStep 4: Test the ConfigurationExplanationBy following these steps, you can provide a single host name that routes traffic to de.contoso.com for users in Germany and to ny.contoso.com for users from other locations, ensuring efficient and appropriate traffic management.
Task 9
You plan to use VNET4 for an Azure API Management implementation.
You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canada. You do NOT need to create the application gateway to complete this task.
You plan to use VNET4 for an Azure API Management implementation.
You need to configure a policy that can be used by an Azure application gateway to protect against known web attack vectors. The policy must only allow requests that originate from IP addresses in Canada. You do NOT need to create the application gateway to complete this task.
正解：
See the Explanation below for step by step instructions.
Explanation:
To configure a policy in Azure API Management that can be used by an Azure Application Gateway to protect against known web attack vectors and only allow requests from IP addresses in Canada, follow these steps:
Step-by-Step Solution
Step 1: Create or Access Your API Management Instance
Navigate to the Azure Portal.
Search for "API Management services" and select your API Management instance.
Step 2: Configure the Policy
In the API Management instance, go to the "APIs" section.
Select the API you want to apply the policy to.
Go to the "Design" tab.
Select "All operations" if you want to apply the policy to all operations, or select a specific operation.
Step 3: Add the Inbound Policy
In the Inbound processing section, click on "+ Add policy".
Select "IP filter" from the list of policies.
Add the IP address ranges for Canada. You can find the IP ranges for Canada from a reliable source or use a service that provides this information.
Here is an example of the XML configuration for the policy:
< inbound >
< ip-filter action= " allow " >
< address-range from= " 24.0.0.0 " to= " 24.255.255.255 " / >
< address-range from= " 47.0.0.0 " to= " 47.255.255.255 " / >
< !-- Add other Canadian IP ranges as needed -- >
< /ip-filter >
< ip-filter action= " deny " >
< address-range from= " 0.0.0.0 " to= " 255.255.255.255 " / >
< /ip-filter >
< /inbound >
Save the policy to apply the changes.
Explanation:
IP Filter Policy: This policy allows you to filter incoming requests based on their IP addresses. By specifying the IP ranges for Canada, you ensure that only requests originating from these IPs are allowed.
Inbound Processing: Applying the policy in the inbound section ensures that the requests are filtered before they reach your API.
By following these steps, you can configure a policy in Azure API Management that restricts access to your API to only those requests originating from IP addresses in Canada, thereby enhancing security and compliance
Explanation:
To configure a policy in Azure API Management that can be used by an Azure Application Gateway to protect against known web attack vectors and only allow requests from IP addresses in Canada, follow these steps:
Step-by-Step Solution
Step 1: Create or Access Your API Management Instance
Navigate to the Azure Portal.
Search for "API Management services" and select your API Management instance.
Step 2: Configure the Policy
In the API Management instance, go to the "APIs" section.
Select the API you want to apply the policy to.
Go to the "Design" tab.
Select "All operations" if you want to apply the policy to all operations, or select a specific operation.
Step 3: Add the Inbound Policy
In the Inbound processing section, click on "+ Add policy".
Select "IP filter" from the list of policies.
Add the IP address ranges for Canada. You can find the IP ranges for Canada from a reliable source or use a service that provides this information.
Here is an example of the XML configuration for the policy:
< inbound >
< ip-filter action= " allow " >
< address-range from= " 24.0.0.0 " to= " 24.255.255.255 " / >
< address-range from= " 47.0.0.0 " to= " 47.255.255.255 " / >
< !-- Add other Canadian IP ranges as needed -- >
< /ip-filter >
< ip-filter action= " deny " >
< address-range from= " 0.0.0.0 " to= " 255.255.255.255 " / >
< /ip-filter >
< /inbound >
Save the policy to apply the changes.
Explanation:
IP Filter Policy: This policy allows you to filter incoming requests based on their IP addresses. By specifying the IP ranges for Canada, you ensure that only requests originating from these IPs are allowed.
Inbound Processing: Applying the policy in the inbound section ensures that the requests are filtered before they reach your API.
By following these steps, you can configure a policy in Azure API Management that restricts access to your API to only those requests originating from IP addresses in Canada, thereby enhancing security and compliance
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure application gateway that has Azure Web Application Firewall (WAF) enabled.
You configure the application gateway to direct traffic to the URL of the application gateway.
You attempt to access the URL and receive an HTTP 403 error. You view the diagnostics log and discover the following error.
You need to ensure that the URL is accessible through the application gateway.
Solution: You disable the WAF rule that has a ruleld of 920300.
Does this meet the goal?
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure application gateway that has Azure Web Application Firewall (WAF) enabled.
You configure the application gateway to direct traffic to the URL of the application gateway.
You attempt to access the URL and receive an HTTP 403 error. You view the diagnostics log and discover the following error.
You need to ensure that the URL is accessible through the application gateway.
Solution: You disable the WAF rule that has a ruleld of 920300.
Does this meet the goal?
正解：A
解答を投票する
You have two Azure virtual networks named VNet1 and VNet2 that are peered with each other. VNet1 hosts
10 virtual machines that contain web servers. VNet2 hosts five virtual machines that contain database servers.
You need to configure a security solution that meets the following requirements:
* Ensures that the database servers can accept connections only from the web servers
* Ensures that the web servers can initiate connections only to the database servers
* Ensures that all network security groups (NSGs) are associated only with subnets
* Use application security groups to implement the solution
What is the minimum number of application security groups required?
10 virtual machines that contain web servers. VNet2 hosts five virtual machines that contain database servers.
You need to configure a security solution that meets the following requirements:
* Ensures that the database servers can accept connections only from the web servers
* Ensures that the web servers can initiate connections only to the database servers
* Ensures that all network security groups (NSGs) are associated only with subnets
* Use application security groups to implement the solution
What is the minimum number of application security groups required?
正解：C
解答を投票する
You have an Azure subscription that is linked to a Microsoft Entra tenant.
The subscription contains a virtual network named VNet1, a storage account named storage1, an Azure App Service web app named Appl. and an Azure SQL database named DB1. VNet1 contains two subnets named Subnet1 and Subnet2. Subnet 1 and Subnet2 each has a subnet mask of 255.255.255.224.
You plan to perform the following actions:
* On Subnet1. configure a service endpoint to connect to storage1 and a service endpoint to connect to the Microsoft Entra tenant.
* On Subnet2. configure a private endpoint to connect to App1 and a private endpoint to connect to DB1 How many IP addresses will be available on each subnet once the planned actions are complete? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
The subscription contains a virtual network named VNet1, a storage account named storage1, an Azure App Service web app named Appl. and an Azure SQL database named DB1. VNet1 contains two subnets named Subnet1 and Subnet2. Subnet 1 and Subnet2 each has a subnet mask of 255.255.255.224.
You plan to perform the following actions:
* On Subnet1. configure a service endpoint to connect to storage1 and a service endpoint to connect to the Microsoft Entra tenant.
* On Subnet2. configure a private endpoint to connect to App1 and a private endpoint to connect to DB1 How many IP addresses will be available on each subnet once the planned actions are complete? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
正解：
Explanation:
You have an Azure subscription that contains 200 virtual machines
You need to use Azure Network Watcher to identify which virtual machines generate the most network traffic. The solution must minimize administrative effort.
Which prerequisites should you deploy for Network Watcher, and which Network Watcher feature should you use to identify the virtual machines? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You need to use Azure Network Watcher to identify which virtual machines generate the most network traffic. The solution must minimize administrative effort.
Which prerequisites should you deploy for Network Watcher, and which Network Watcher feature should you use to identify the virtual machines? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解：
Explanation:
You have the Azure environment shown In the Azure Environment exhibit. (Click the Azure Environment tab.) The settings for each subnet are shown in the following table.
The Firewalls and virtual networks settings for storage1 are configured as shown in the Storage1 exhibit.
(Click the Storage1 tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
The Firewalls and virtual networks settings for storage1 are configured as shown in the Storage1 exhibit.
(Click the Storage1 tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
正解：
Explanation:
You have an on-premises datacenter named DC1 that contains two routers
You have an Azure subscription. The subscription contains a virtual network named VNet1 and a zone- redundant ExpressRoute virtual network gateway named GW1 that uses the ErGw3Az SKU. GW1 is attached to VNet1.
DO is connected to VNet1 by using an ExpressRoute Standard circuit named Circuits The DC1 routers are configured as endpoints for Circuit1. Circuit1 traffic traverses two physical links.
During a link outage, the connection takes three minutes to fail over
You need to ensure that failovers between the links take less than one second What should you do?
You have an Azure subscription. The subscription contains a virtual network named VNet1 and a zone- redundant ExpressRoute virtual network gateway named GW1 that uses the ErGw3Az SKU. GW1 is attached to VNet1.
DO is connected to VNet1 by using an ExpressRoute Standard circuit named Circuits The DC1 routers are configured as endpoints for Circuit1. Circuit1 traffic traverses two physical links.
During a link outage, the connection takes three minutes to fail over
You need to ensure that failovers between the links take less than one second What should you do?
正解：B
解答を投票する
You have an Azure subscription that contains the resource groups shown in the following table.
You have the virtual networks shown in the following table.
You have the subnets shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You have the virtual networks shown in the following table.
You have the subnets shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
正解：
Explanation:
