AZ-700 Designing and Implementing Microsoft Azure Networking Solutions Questions and Answers

For the first question, only ExpressRoute GW SKU Ultra Performance support FastPath feature.

For the second question, vnet1 will connect to ExpressRoute gw, once Vnet1 peers with Vnet2, the traffic from on-premise network will bypass GW and Vnet1, directly goes to Vnet2, while this feature is under public preview.

====Reference

ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

To configure FastPath, the virtual network gateway must be either:

Ultra Performance

ErGw3AZ

VNet Peering - FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway.

https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

Gateway SKU

https://docs.microsoft.com/en-us/azure/expressroute/express route-about-virtual-network-gateways

There is no virtual network peering between VM4’s VNet (VNet3) and VM5’s VNet (VNet4). To enable the VMs to communicate over the Microsoft backbone network a VNet peering is required between VNet3 and VNet4.

VNet 1 will get the default from BGP and propagate it to VNET 2 and 3

NGS1 only

VM2, VM3, VM4 and VM5

Here are the steps and explanations for creating the object that will provide the IP addressing configu ration of the on-premises network to the Site-to-Site VPN:

The object that you need to create is called a local network gateway. A local network gateway represents your on-premises network and VPN device in Azure.  It c ontains the publ ic IP address of your VPN device and the a dd ress prefixes of your on-premises network that you want to connect to the Azure virtual network 1 .

To create a local network gateway, you need to go to the Azure portal and select Create a resource.  Sea rch for  local network gat eway , select  Local network gateway , then select  Crea te 2 .

On the Create local network gateway page, enter or select the following information and accept the defaults for the remaining settings:

Name: Type a unique name f or your local network gateway.

IP address: Type the public IP address of your VPN device, which is 131.107.50.60 in this case.

Address space: Type the internal address range of your on-premises network, which is 10.10.0.0/16 in this case.

Subscription: Select your subscription name.

Resource group: Select your resource group name.

Location: Select the same region as your virtual network.

Sel e ct  Review + c reate  and then select  Crea te  to create yo ur local network gateway 2 .

No

subnet1(WM1- > NSG1 outbound- > NSG10 outbound)- > subnet2(NSG1 inbound- > NSG11 inbound- > VM2)

Yes

NSG10 blocks ICMP from VNet4 (source 10.10.0.0/16) but it is not blocked from VM2 ג €™s subnet (VNet1 /Subnet2).

No

NSG11 blocks RDP (port TCP 3389) destined for ג €˜VirtualNetwork ג €™. VirtualNetwork is a service tag and means the address space of the virtual network (VNet1) which in this case is 10.1.0.0/16. Therefore, RDP traffic from subnet2 to anywhere else in VNet1 is blocked.

Box 1: VM2, VM3 and VM4.

VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocki ng inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

Box 2:

VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

Box 1: No

Zone2.contoso.com is not linked to any virtual networks. Therefore, no VMs are able to resolve names in the zone.

Box 2: Yes

VM4 is in VNet3. Zone1.contoso.com has a link to VNet3 and auto-registration is enabled on the link.

Box3: No

VNet3 is linked to zone1.contoso.com and auto-registration is enabled on the link. A virtual network can only have one registration zone. You can link zone2.contoso.com to VNet3 but you won’t be able to enable auto-registration on the link.

To ensure that the owner of VNET3 receives an alert whenever an administrative operation is performed on the virtual network, you can set up an  Activity Log Alert  in Azure Monitor. Here’s how you can do it:

Step-by-Step Solution

Step 1: Create an Activity Log Alert

Navigate to the Azure Portal .

Search for “Monitor”  and select it.

In the Monitor blade , select  “Alerts”  from the left-hand menu.

Click on “New alert rule” .

Step 2: Configure the Alert Rule

Select the Scope :

Click on  “Select resource” .

Choose  “Virtual Network”  as the resource type.

Select  VNET3  from the list of virtual networks.

Define the Condition :

Click on  “Add condition” .

In the  “Signal type”  dropdown, select  “Activity Log” .

Choose  “Administrative”  as the category.

Select the specific operations you want to monitor (e.g., Microsoft.Network/virtualNetworks/write for any write operations on the virtual network).

Set the Alert Details :

Enter a  name  for the alert rule (e.g., VNET3 Admin Operations Alert).

Provide a  description  if needed.

Configure the Action Group :

Click on  “Add action group” .

Enter a  name  for the action group.

Select the  action type  (e.g., Email/SMS/Push/Voice).

Enter the  details  of the recipient (e.g., the email address of the owner of VN ET3).

Review and Create :

Review the alert rule settings.

Click on  “Create alert rule” .

Explanation

Activity Log Alerts : These alerts notify you when specific operations are performed on your Azure resources. By setting up an alert for administrative operations, you ensure that any changes to VNET3 are promptly reported.

Action Groups : These define the actions to take when an alert is triggered. You can configure notifications via email, SMS, or other methods to ensure the owner of VNET3 is informed im mediately.

Administrative Operations : Monitoring these operations helps in tracking changes and maintaining the security and integrity of your virtual network.

By following these steps, you can ensure that the owner of VNET3 receives timely alerts for any administrative operations performed on the virtual network, helping to maintain oversight and security.

Box 2: One NSG

The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way you would need two custom NSG rules.

Box 1: Two custom rules

With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic f rom VMScaleSet1. Then you would need to create another custom rule with a higher priority than the first rule that allows traffic on port 443.

The default rules in the NSG will allow all other traffic to VMScaleSet2.

To create an Azure Firewall instance, you need to go to the Azure portal and select Create a resource. Type firewall in the search box and press Enter.  Sel ect Firewall and then select Create 1 .

To assign an IP address from the address range of 1 0.1.255.0/24 to the firewall, you need to select a public IP address that belongs to that range.  You can either create a new public IP address or use an existing one 1 .

To use a new Premium firewall policy named FW-policy1, you need to select Premium as the Firewall tier and c reate a new policy with the name FW-policy1 2 .  A Pre mium firewall pol icy allows you t o configure ad vanced features such as TLS Inspection, IDPS, URL Filtering, and Web Categories 3 .

To route traffic directly to the internet, you need to enable SNAT (Source Network Address Translation) for the firewall.  SNAT allows the firewall to use its pub lic IP address as the source address for out bound t raffic 4 .

Here are the steps and explanations for creating a policy that can be linked to the planned application gateway and block connections from IP addresses in the 131.10 7.150.0/24 range:

To create a policy, you need to go to the Azure portal and select Create a resource.  Search for  WAF , select  Web Application Firewall , then se lect  Create 1 .

On the Create a WAF policy page, Basics tab, enter or select the following information and accept the defaults for the remaining settings:

Policy for: Regional WAF (Application Gateway)

Subscription: Select your subscription name

Resource group: Select your resource group

Policy name: Type a unique name for your WAF policy

On the  Custom rules  tab, select  Add a rule  to create a custom rule that bloc ks connections f rom IP addresses in the 131.107.150.0/24 range 2 . Enter or select the following information for the custom rule:

Rule name: Type a unique name for your custom rule

Priority: Type a number that indicates the order of evaluation for this rul e

Rule type: Select Match rule

Match variable: Select RemoteAddr

Operator: Select IPMatch

Match values: Type 131.107.150.0/24

Action: Select Block

On the  Review + create  tab, review your settings and select  Create  to create your WAF policy 1 .

To link your policy to the planned application gateway, you need to go to the  Application Gateway  service in the Azure port al and select your application gateway 3 .

On the  Web appl ication firewall  tab, select your WAF poli cy from the drop-down list a nd select  Save

Here are the steps and explanations for ensuring that requests for wwwjelecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net:

To use a custom domain with your Azure Front Door, you need to create a CNAME record with your domain provider that points to the Front Door default frontend host.  A CNAME record is a type of DNS record that maps a source domain name to a destination domain name 1 .

To create a CNAME r ecor d, you need to sign in to your domain registrar’s website and go to the page for managing DNS settings 1 .

Creat e a CNAME record with the followin g information 1 :

Source domain name: wwwjelecloud.com

Destination domain name: frontdoor1.azurefd.net

Save your changes and wait for the DNS propagation to take effect 1 .

To verify the custom domain, you need to go to the Azure portal and select your Front Door profile.  Then select Domains un der Settings and select Add 2 .

On the Add a domain page, select Non-Azure validated domain as the Domain type and enter wwwjeleclou d.com as the Domain name.  Then select Add 2 .

On the Domains page, select wwwjelecloud.com and select Verify.  This will check if the CNAME record is correctly configured 2 .

Once the domain is verified, you can associate it with your Front Door endpoint. On the Domains page, select wwwjelecloud.com and select Associate endpoint.  Then select your Front Door endpoint from the drop-down list and select Associa te 2 .

The VPN client must be downloaded again if any changes are made to VNet peering or the network topology.

To archive all the metrics of VNET1 to an existing storage account, you can use Azure Monitor’s diagnostic settings. Here’s how you can do it:

Step-by-Step Solution

Step 1: Navigate to VNET1 in the Azure Portal

Ope n the Azure Portal .

Search for “Virtual networks”  and select  VNET1  from the list.

Step 2: Configure Diagnostic Settings

In the VNET1 blade , select  “Diagnostic settings”  under the “Monitoring” section.

Click on “Add diagnostic setting” .

Step 3: Set Up the Diagnostic Setting

Enter a name  for the diagnostic setting (e.g., VNET1-Metrics-Archive).

Select the metrics  you want to archive. You can choose from various metrics like TotalBytesReceived, TotalBytesSent, etc.

Under “Destination details” , select  “Archive to a storage account” .

Choose the existing storage account  where you want to archive the metrics.

Configure the retention period  if needed.

Step 4: Save the Configuration

Review your settings  to ensure everything is correct.

Click on “Save”  to apply the diagnostic setting.

Explanation

Diagnostic Settings : These allow you to collect and route metrics and logs from your Azure resources to various destinations, including storage accounts, Log Analytics workspaces, and Event Hubs.

Metrics : Metrics provide num erical data about the performance and health of your resources. Archiving these metrics helps in long-term analysis and compliance.

Storage Account : Using an existing storage account ensures that the metrics are stored securely and can be accessed for futu re analysis.

By following these steps, you can ensure that all the metrics of VNET1 are archived to your existing storage account, enabling you to monitor and analyze the performance and health of your virtual network over time.

To minimize the risk of SNAT port exhaustion for your 100 virtual machines in subnet4-1, while ensuring minimal administrative effort, you can use an  Azure NAT Gateway . This service provides scalable and resilient outbound connectivity for virtual networks, dynamically allocating SNAT ports to avoid exhaustion.

Navigate to the Azure Portal .

Search for “NAT gateways”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NAT gateway (e.g.,  NATGateway-Subnet4-1 ).

Region : Select the region where your virtual network is located.

Click on “Next: Outbound IP” .

Choose whether to use existing public IP addres ses or create new ones .

If creating new ones, click on  “Add new”  and configure the new public IP addresses.

Click on “Next: Subnet” .

Click on “Associate subnet” .

Select the virtual network  that contains subnet4-1.

Select subnet4-1  from the list of subnets.

Click on “OK” .

Review your settings  to ensure everything is correct.

Click on “Review + create”  and then  “Create” .

Azure NAT Gateway : This service provides outbound connectivity for virtual networks, dynamically allocating SNAT ports across all VM instances within a subnet.  This dynamic allocation helps prevent S NAT port exhaustion, especially in scenarios with high outbound connection volumes 1 2 .

Dynamic S NAT Port Allocation : Unlike static allocati on methods, NAT Gateway dynamically allocates SNAT ports based on demand, ensuring efficient use of availab le ports and reducing the risk of exhaus tion 2 .

Step-by-Step Solution Step 1: Create a NAT Gateway Step 2: Configure Outbound IP Addresses Step 3: Associate the NAT Gateway with Subnet4-1 Step 4: Review and Create Explanation By following these steps, you can ensure that your 100 virtual machines in subnet4-1 can make the necessary API calls without running into SNAT port exhaustion, all while minimizing administrative effort.

Here are the steps and explanations for ensuring that connections to the storage34280945 storage account can be made by using an IP address in the 10.1.1.0/24 range and the name stor-age34280945.pnvatelinlcblob.core.windows.net:

To allow access from a specific IP address range, you need to configure the Azure Storage firewall and virtual network setti ngs for your storage account.  You can do this in the Azure port al by selecting your storage account and then sele cting Networking under Settings 1 .

On the Networking page, sele ct Firewall s and virtual networks, and then select Selected networks under Allow access from 1 . This will block all access to your storage account except from the networks or resources that you specify.

Under Firewall, select Add rule, and then enter 10. 1.1.0/24 as the IP address or range.  You can also enter an option al rule name and description 1 . This will allow access from any IP address in the 10.1.1.0/24 range.

Sele ct Save to apply your changes 1 .

To map a custom domain name to your storage accou nt, you need to create a CNAME record with your domain provider that points to your s torage account endpoint 2 . A CNAME record is a type of DNS record that maps a source domain name to a desti nation domain name.

Sign in to your domain registrar’s website, and then go to the page for managing DNS settings 2 .

Create a CNAME record with the following information 2 :

Source domain name: stor-age34280945.pnvatelinlcblob.core.windows.net

Destination domain name: stor-age34280945.pnvatelinlcblob.core.windows.ne t

Save your changes a nd wait for the DNS propagation to take e ffec t 2 .

To register the custom domain name with Azure, you need to go back to the Azure portal and select you r storage account.  Then select Custom domain under Blob service 2 .

On the Custom domain page, enter stor-age34280945.pnvatelinlcblob.core.windows .net as the custom domain name and select Save 2 .

To deploy Azure virtual machines to the France Central region and ensure they are in a network segment with an IP address range of 10.5.1.0/24, follow these steps:

Step-by-Step Solution

Step 1: Create a Virtual Network in France Central

Navi gate to the Azure Portal .

Search for “Virtual networks”  in the search bar and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the virtual network (e.g., VNet-FranceCentral).

Region : Select  France Central .

Click on “Next: IP Addresses” .

Step 2: Configure the Address Space and Subnet

In the IP Addresses tab , enter the address space as 10.5.1.0/24.

Click on “Add sub net” .

Enter the following details :

Subnet name : Enter a name for the subnet (e.g., Subnet-1).

Subnet address range : Enter 10.5.1.0/24.

Click on “Add” .

Click on “Review + create”  and then  “Create” .

Step 3: Deploy Virtual Machines to the Virtual Network

Navi gate to the Azure Portal .

Search for “Virtual machines”  in the search bar and select it.

Click on “Create”  and then  “Azure virtual machine” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select the same resource group used for the virtual network.

Virtual machine name : Enter a name for the VM.

Region : Select  France Central .

Image : Select the desired OS image.

Size : Select the appropriate VM size.

Click on “Next: Disks” , configure the disks as needed, and then click on  “Next: Networking” .

In the Networking tab , select the virtual network (VNet-FranceCentral) and subnet (Subnet-1) created earlier.

Complete the remaining configuration steps  and click on  “Review + create”  and then  “Create” .

Explanation

Virtual Network : A vi rtual network in Azure allows you to create a logically isolated network that can host your Azure resources.

Address Space : The address space 10.5.1.0/24 ensures that the VMs are in a specific network segment.

Subnet : Subnets allow you to segment the virtu al network into smaller, manageable sections.

Region : Deploying the virtual network and VMs in the France Central region ensures that the resources are physically located in that region.

By following these steps, you can ensure that your Azure virtual machines in the France Central region are deployed within the specified IP address range of 10.5.1.0/24.