AZ-720 Free Practice Test

A company has an Azure Active Directory (Azure AD) tenant. You are assigned the Owner role-based access control (RBAC) role of an Azure resource group named RG1.
An administrator grants a user named User1 the Contributor RBAC role for RG1. User1 receives an authorization error when attempting to create a Cosmos DB account in RG1.
The administrator verifies that they can create a Cosmos DB account in RG1. You need to troubleshoot the issue.
What should you do?

Solution:


Does this meet the goal?

1. A. Yes
2. B. No

Correct Answer: A

A company has virtual machines (VMs) in the following Azure regions:
West Central US
Australia East
The company uses ExpressRoute private peering to provide connectivity to VMs hosted on each region and on-premises services.
The company implements global VNet peering between a VNet in each region. After configuring VNet peering, VM traffic attempts to use ExpressRoute private peering.
You need to ensure that traffic uses global VNet peering instead of ExpressRoute private peering. The solution must preserve existing on-premises connectivity to Azure VNets.
What should you do?

1. A. Add a user-defined route to the subnets route table.
2. B. Add a filter to the on-premises routers.
3. C. Add a second VNet to the virtual machines and configure VNet peering between the VNets.
4. D. Disable the ExpressRoute peering connections for one of the regions.

Correct Answer: B

A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a network security group (NSG) with all of the subnets.
Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named VNet2. Virtual network peering is enabled between VNet1 and VNet2.
You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet. You discover that FlowLog1 is not reporting outbound flow traffic.
You need to resolve the issue with FlowLog1. What should you do?

1. A. Enable FlowLog1 in a network security group associated with the subnet of VM1.
2. B. Configure the FlowTimeoutInMinutes property on VNet2 to a non-null value.
3. C. Configure the FlowTimeoutInMinutes property on VNet1 to a non-null value.
4. D. Configure FlowLog1 for version 2.

Correct Answer: B

A company has an Azure Virtual Network gateway named VNetGW1. The company enables point-to-site connectivity on VNetGW1. An administrator configures VNetGW1 for the following:
OpenVPN for the tunnel type.
Azure certificate for the authentication type.
Users receive a certificate mismatch error when connecting by using a VPN client. You need to resolve the certificate mismatch error.
What should you do?

1. A. Reissue the client certificate with client authentication enabled.
2. B. Create a profile manually, add the server FQDN and reissue the client certificate.
3. C. Reissue the client certificate with server authentication enabled.
4. D. Install an IKEv2 VPN client on the user's computers.

Correct Answer: B

A customer has an Azure Virtual Network named VNet1 that contains an internal standard SKU load balancer named LB1. The backend pool for LB1 includes the following virtual machines: VM1, VM2.
The customer configures a rule named Rul1 to load balance incoming HTTPS requests for VM1 and VM2. Rule1 is associated with an HTTPS health probe. The path for the probe is set to /.
The network adapters of VM1 and VM2 are associated with a network security named NSG1 that contains the following rules:

You connect to https://VM1 and https://VM2 from VNet1. Attempts to connect using the front-end IP address of LB1 are failing.
You need to resolve the issue. What should you do?

1. A. Change the health probe associated with Rule1 to use HTTP.
2. B. Add an NSG1 rule with the source set to VirtualNetwork.
3. C. Change the health probe associated with Rule1 to use TCP.
4. D. Add an NSG1 rule with the source set to AzureLoadBalancer.

Correct Answer: A