AZ-720 Exam Study Guide Free Practice Test LAST UPDATED DATE Dec 02, 2023
The New AZ-720 2023 Updated Verified Study Guides & Best Courses
Microsoft AZ-720 exam is designed to test the skills and knowledge of IT professionals responsible for troubleshooting Microsoft Azure connectivity issues. Passing AZ-720 exam demonstrates expertise in identifying and resolving connectivity issues between on-premises and Azure resources, resolving issues with Azure virtual networks, and troubleshooting issues related to Azure traffic management solutions, Azure DNS, and load balancers. Candidates for AZ-720 exam should have experience working with Azure networking and connectivity solutions and using Azure monitoring tools to troubleshoot connectivity issues.
To prepare for the AZ-720 exam, IT professionals should have a solid understanding of Azure networking and security concepts. Microsoft offers a range of training courses and resources to help individuals prepare for the exam, including online courses, study guides, and practice exams. It is also recommended that individuals gain hands-on experience with Azure networking and troubleshooting by working on real-world projects.
NEW QUESTION # 20
A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute
gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a
network security group (NSG) with all of the subnets.
Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named
VNet2. Virtual network peering is enabled between VNet1 and VNet2.
You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet.
You discover that FlowLog1 is not reporting outbound flow traffic.
You need to resolve the issue with FlowLog1.
What should you do?
- A. Configure the FlowTimeoutInMinutes property on VNet1 to a non-null value.
- B. Create the storage account for FlowLog1 as a premium page blob.
- C. Enable FlowLog1 in a network security group associated with the subnet of VM1.
- D. Create the storage account for FlowLog1 as a premium block blob.
Answer: B
NEW QUESTION # 21
You need to resolve the connectivity issue with the on-premises database named CosmosDB1.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 22
A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a network security group (NSG) with all of the subnets.
Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named VNet2. Virtual network peering is enabled between VNet1 and VNet2.
You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet.
You discover that FlowLog1 is not reporting outbound flow traffic.
You need to resolve the issue with FlowLog1.
What should you do?
- A. Enable FlowLog1 in a network security group associated with the network interface of VM1.
- B. Configure the FlowTimeoutInMinutes property on VNet2 to a non-null value.
- C. Configure FlowLog1 for version 2.
- D. Create the storage account for FlowLog1 as a premium block blob.
Answer: C
Explanation:
According to 1, flow logging using ExpressRoute Traffic Collector requires version 2 of flow logs. Version 1 of flow logs does not support ExpressRoute Traffic Collector. You can configure the version of flow logs when you enable them on a network security group (NSG).
NEW QUESTION # 23
You need to troubleshoot the sales department issues.
How should you configure the system? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 24
A company has an Azure Active Directory (Azure AD) tenant. The company deploys Azure AD Connect to synchronize users from an Active Directory Domain Services (AD DS).
The synchronization of a user object is failing.
You need to troubleshoot the failing synchronization by using a built-in Azure AD Connect troubleshooting task.
Which two pieces of information should you collect before you start troubleshooting?
- A. Object distinguished name
- B. Azure AD connector name
- C. Object common name
- D. AD connector name
- E. Object globally unique identifier
Answer: A,D
Explanation:
the two pieces of information that should be collected before starting to troubleshoot the failing synchronization by using a built-in Azure AD Connect troubleshooting task are: B. AD connector name E. Object distinguished name Azure AD Connect is a tool used to synchronize users from an on-premises Active Directory Domain Services (AD DS) to Azure AD. When troubleshooting synchronization issues, it is important to have information about the object that is failing to synchronize. The AD connector name refers to the name of the connector used to connect to the on-premises AD DS. The object distinguished name refers to the unique identifier of the object in the on-premises AD DS. Having this information can help identify and resolve synchronization issues.
NEW QUESTION # 25
A company deploys a new application and places the application behind an Azure Application Gateway Web Application Firewall (WAF).
A user with client IP 203.0.113.26 reports that they cannot access the application.
You need to troubleshoot the issue.
How should you complete the query?
Answer:
Explanation:
NEW QUESTION # 26
A company has an Azure tenant. The company deploys an Azure Firewall named FW1 using the Standard
SKU. You configure FW1 using classic firewall rules.
The company creates an application rule collection with the following settings:
Priority: 100
Action: Deny
Rule type: FQDN
Source type: IP address
Source: *
Protocol: http:80,https:443
Target FQDN: *.cloud.contoso.com
An engineer observes that traffic to console.cloud.conotoso.com is still allowed by FW1.
You need to determine why the traffic is allowed.
What should you review?
- A. Infrastructure rules
- B. Network rules
- C. Web categories
- D. Application rules
Answer: A
NEW QUESTION # 27
A company deploys an Azure Firewall. The company reports the following log entry:
For each of the following questions, select Yes or No.
Answer:
Explanation:
NEW QUESTION # 28
A company uses an Azure VPN gateway to connect to their on-premises environment.
The company's on-premises VPN gateway is used by several services. One service is experiencing
connectivity issues.
You need to minimize downtime for all services and resolve the connectivity issue.
Which three actions should you perform?
- A. Configure the pre-shared key to be the same on the Azure VPN gateway and the on-premises VPN
gateways. - B. Rest the VPN gateway.
- C. Configure the pre-shared key to be different on the Azure VPN gateway and the on-premises VPN gateways.
- D. Rest the VPN connection.
- E. Configure the hashing algorithm to be different on both gateways.
- F. Configure the hashing algorithm to be the same on both gateways.
Answer: A,C,F
NEW QUESTION # 29
A company named Contoso connects its on-premises resources to Azure by using ExpressRoute.
An administrator reports that the circuit is in a failed state.
You need to resolve the issue.
How should you complete the PowerShell commands?
Answer:
Explanation:
NEW QUESTION # 30
A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR).
An administrator receives an error that password writeback cloud not be enabled during the Azure AD
Connect configuration. The administrator observes the following event log error:
Error getting auth token
You need to resolve the issue.
Solution: Use a global administrator account that is not federated to configure Azure AD Connect.
Does the solution meet the goal?
- A. No
- B. Yes
Answer: B
NEW QUESTION # 31
A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).
A new subnet should be unreachable from the on-premises network.
You need to implement a solution.
Solution: Configure subnet delegation.
Does the solution meet the goal?
- A. Yes
- B. No
Answer: B
NEW QUESTION # 32
A company has an Azure Active Directory (Azure AD) tenant. The company deploys Azure AD Connect to
synchronize objects from their Active Directory Domain Services (AD DS) domain.
You observe that AD DS objects are not synchronizing to Azure AD.
You need to verify that the staging mode is enabled.
What should you do?
- A. Review the history for the Azure AD Connect sync scheduled task.
- B. Run this PowerShell cmdlet: Get-ADSyncScheduler
- C. Run this PowerShell cmdlet: Get-ADSyncConnetorRunStatus
- D. Review the triggers for the Azure AD Connect sync scheduled task.
Answer: B
NEW QUESTION # 33
A company has two virtual networks (VNets) that are configured to use peering. Several Azure virtual
machines are connected to each network. An on-premises network is connected to one of the VNets by using
Azure VPN Gateway.
An administrator reports that communication between applications across the VNets is failing.
You need to troubleshoot the issue.
Which two features can you use to achieve the goal?
- A. NSG flow logs
- B. Network Watcher topology
- C. Next hop
- D. IP flow verify
- E. AzureNetworkWatchExtension
Answer: C,D
NEW QUESTION # 34
A company enables just-in-time (JIT) virtual machine (VM) access in Azure.
An administrator observes a list of VMs on the Unsupported tab of the JIT VM access page in the Microsoft Defender for Cloud portal.
You need to determine why some VMs are not supported for JIT VM access.
What should you conclude?
- A. The administrator does not have the SecurityReader role.
- B. The client firewall does not allow port 22 on the VMs.
- C. The administrator is using the Microsoft Defender for Cloud free tier.
- D. A network security group is not associated with the VMs.
Answer: C
Explanation:
Topic 1, Contoso Ltd,
Background
Contoso, Ltd. is a financial services company based in Boston. MA, United States. Contoso hires you to manage their Azure environment and resolve several operational issues.
General
Contoso's Azure environment contains the following resources. All resources are associated with the same subscription and are located in the East US region. Users connect to resources from Windows 10 computers by using the built-in SSTP VPN software.
Recent changes
The company implements the following changes:
Extend the IP address space of VNet1 and create subnets in the new IP address space.
Allow users with computers that run the current version of MacOS to use the built-in VPN client for connecting to the point-to-site VPN.
Enable a service endpoint on contosostoragel to provide direct access to the storage content from all Configure all business critical VM workloads to use encryption keys stored in all five key vaults.
Enable a private endpoint on CosmbsDBT to provide direct access to its content from VNetl.
Develop an automated process to deploy Azure VMs by using A2ure Bicep. The passwords for the local administrator accounts are stored in the key vaults. You grant the team that initiates the deployment the Reader RBAC role to all key vaults.
Deploy a multi-tier SharePoint Server environment into a subnet in VNet2. You implement network security groups (NSGs) to allow only specific ports between tiers in the subnet. You configure NSGs to use application security groups (ASGs) when designating the source and destination of cross-tier traffic.
Deploy a secondary multi-tier SharePoint Server environment into a subnet in VNet3.
Requirements
General Requirements
You must adhere to the principle of least privilege when granting access to resources.
Reverse DNS lookup
You must identify the reason for the differences between reverse DNS lookup results in the hub and the spoke networks and recommend a solution that provides the reverse DNS lookup in the format [vmnameJ.contoso.com for all three virtual networks.
Public DNS lookup
You must verify that the Azure public DNS rone is currently used to resolve DNS name requests for www.contoso.com and recommend.a solution that uses the Azure public DNS zone.
Windows VPN
You must verify if VPN client connectivity issues are related to routing and recommend a solution.
MacOS VPN
You must verify if Remote ID and local ID VPN client settings on the MAcOS devices are properly configured.
Azure Storage connectivity
You must resolve the issues with the SMB-mounts from VNet2 and VNet3 as well as ensure that on- premises connections to contosostorage are successful. Your solution must ensure that, whenever possible, network traffic does not traverse public internet.
Cosmos DB connectivity
You must verify if on-premises connections to ContosoDB1 are using the CosmosDB1 public endpoint. You need to recommend a solution if connections are not using private endpoints.
DNS issues
Reverse DNS lookups from VNetl return two records. One DNS record is in the format [vmname].contoso.com and the other DNS record is in the format [vmname].internal.cloudapp.net. Reverse DNS lookups from VNet2 and VNet3 return DNS names in the format
[vmname].internal.cloudapp.net.
VMs on each virtual network can only resolve reverse DNS lookup names of VMs on the same virtual network.
Public DNS lookup
You are notified that name resolution requests for www,contoso.com are using the DNS zone hosted by the DNS registrar where the zone was originally created.
Connectivity and routing issues
Window VPN
Windows VPN clients cannot connect to Azure VMs on the subnets recently added to VNet1.
Sales department VPN.
The sales department users connect by using the MacOs VPN client.
Azure Storage Connectivity
Server Message Block (SMB)-mount from VMs on VNet2 and VNet3 to file shares In contosostorage1 are failing Azure Storage Explorer connection using access keys from on-premses computer to contosostorage1 are failing Cosmos DB connectivity You observe that connections to ConsomosDB1 from the on-premises environment are using the CosmosDB1 public endpoint. However connections to CosmosDB1 from the on-premises environment should be using the private endpoint. You verify that connections to CosmosDB1 from VNet1 are using the private endpoint.
Azure Key vault
Access attempts to Azure Key vault oy VM workloads intermittently fail with the HTTP response code 429. You must identify the reason for the failures and recommend a solution.
SharePoint
SharePoint In VNet2
SharePoint traffic between tiers is blocked by NSGs which is causing application failures. You need to identify the NSG rules that are blocking traffic. You also need to collect the data that is blocked by the NSG rules. The solution must minimize administrative effort.
SharePoint in VNet3.
ASGs used in the NSG rules associated with the VNet2 subnet are not visible when configuring NSG rules in VNet3. You need to create NSG rules for VNet3 with the same name, source and destination settings that are configured for the NSG associated with VNet2. The solution must minimize administrative effort.
Permission issues
Azure Biccp
You must identify the minimum privileges required to provision Azure VMs using Azure Bicep.
Data engineering team
You must identify the role-based access control (RBAQ roles required by the data engineering team to access the storage account by using Azure portal. The team requires minimum permissions to backup and restore blobs in contosostorage1. The Contoso data engineering tearn.js unable to view the contosostorage1 account in the Azure portal.
Azure VM deployment
Azure VM deployments that uses Azure Bicep are failing with an authorization error. The error indicates three are insufficient access permissions retrieve password of the local administrator account in the key vault.
VM1 and VM2
RT12 must be configured to route internal traffic from VM1 through VM2. You observe that internet traffic from VM1 is routed directly to the internet.
VM2
You configure VM2 to route internet traffic from VM1. After configuring RT12 to route internet traffic from VM1 through VM2, traffic reaches VM2 but then it is dropped. You that routing for VM2 is configured correctly.
NEW QUESTION # 35
A company connects an on-premises network to an Azure virtual network by using ExpressRoute.
The ExpressRoute connection is experiencing higher than normal latency.
You need to confirm the traffic flow.
How should you complete the PowerShell command?
Answer:
Explanation:
NEW QUESTION # 36
A company uses an Azure blob container.
The IT department has a service-level agreement (SLA) that requests on average cannot exceed 20 milliseconds.
You need to implement a log analytics query to generate the SLA report.
How should you complete the query?
Answer:
Explanation:
NEW QUESTION # 37
You need to troubleshoot and resolve the reverse VPN connectivity issues.
What should you do? To answer, select the appropriate option in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 38
A company deploys Azure Traffic Manager load balancing for an Azure App Service solution.
Load balancing performance is showing a degraded status after deployment, and new HTTPS probes are failing to reach the Traffic Manager endpoints.
You need to troubleshoot the probe failure.
How should you complete the PowerShell script?
Answer:
Explanation:
NEW QUESTION # 39
......
Get Prepared for Your AZ-720 Exam With Actual 121 Questions: https://www.real4prep.com/AZ-720-exam.html
Authentic AZ-720 Exam Dumps PDF - 2023 Updated: https://drive.google.com/open?id=1IpmLUAnmgYTRGdHqvem5MpQlPSxGqrJt