AZ-700 exam dumps: questions 101 to 200 of 310

Correct answer: B

• A. Incorrect.

  Option A (Basic) is incorrect because the Basic SKU is limited in both throughput and the number of supported point-to-site connections (128 maximum). Your requirement of 200 users exceeds that limit.

• B. Correct.

  Option B (VpnGw1) is correct because it supports up to 250 concurrent point-to-site VPN connections and offers OpenVPN protocol capabilities at a moderate cost, satisfying the scenario where about 200 concurrent users are needed.

• C. Incorrect.

  Option C (VpnGw2) is incorrect in this context, not because it wouldn't work (it can support more connections and higher throughput), but it would be more expensive than VpnGw1 without a clear need for additional concurrency or bandwidth. Therefore, it isn't the most cost-effective choice here.

• D. Incorrect.

  Option D (VpnGw3) is incorrect for similar reasons as VpnGw2�it provides even higher capacity and throughput but is generally more expensive and unnecessary for 200 concurrent users, making it an over-provisioned solution in this scenario.

Correct answer: C

• A. Incorrect.

  Incorrect. The Basic SKU supports a maximum of 128 point-to-site connections, which is insufficient for the 300 connections required. Additionally, it does not support Azure AD authentication.

• B. Incorrect.

  Incorrect. Although VpnGw1 supports Azure AD authentication, it only provides up to 250 concurrent point-to-site connections, which does not meet the 300 connection requirement.

• C. Correct.

  Correct. VpnGw2 supports up to 500 concurrent point-to-site connections and Azure AD authentication, making it suitable for 300 concurrent connections while remaining cost-efficient compared to higher SKUs.

• D. Incorrect.

  Incorrect. VpnGw3 supports up to 1,000 concurrent connections, which is more than needed. It would work but is not the most cost-effective choice given the 300-connection requirement.

Correct answer: B

• A. Incorrect.

  Option 1 (Policy-based VPN): Incorrect. While policy-based VPNs can secure traffic based on specific IP address pairs (static routes), they do not support BGP or active-active configurations with multiple tunnels. Policy-based VPNs generally work well for smaller, fixed traffic patterns but are not suitable for dynamic routing requirements.

• B. Correct.

  Option 2 (Route-based VPN): Correct. Route-based VPNs use any-to-any (wildcard) traffic selectors and can integrate with BGP for dynamic routing. They also support active-active configurations, enabling high availability and scalability when multiple tunnels are needed.

• C. Incorrect.

  Option 3 (ExpressRoute Private Peering): Incorrect. ExpressRoute is a dedicated circuit for private connectivity to Azure, not a Site-to-Site VPN tunnel type. While ExpressRoute can offer high throughput and reliability, it does not replace the need for a VPN tunnel solution in this scenario.

• D. Incorrect.

  Option 4 (Point-to-Site (Client VPN) using SSTP): Incorrect. Point-to-Site connections are suited for individual clients or remote users to connect securely to Azure, not for corporate Site-to-Site scenarios that require dynamic routing and redundancy.

Correct answer: C

• A. Incorrect.

  Incorrect. While a Policy-based (Basic) gateway is compatible with an older firewall that only supports policy-based VPN, it does not support future dynamic routing via BGP. This approach would force you to upgrade the gateway to route-based later.

• B. Incorrect.

  Incorrect. ExpressRoute provides private, high-throughput connectivity, but it is not an IPsec-based VPN solution and does not address the immediate requirement of connecting a policy-based firewall over a VPN tunnel. It also entails higher costs and different provisioning steps.

• C. Correct.

  Correct. A Route-based VPN gateway with policy-based traffic selectors can support the older firewall� policy-based IPsec now and accommodate dynamic routing (BGP) in the future without requiring a gateway replacement. This approach offers maximum flexibility for upcoming routing needs.

• D. Incorrect.

  Incorrect. Although a route-based VPN with active-active configuration offers higher availability pathways, it does not specifically address the compatibility requirements of a policy-based firewall. Active-active alone does not solve the policy-based compatibility challenge.

Correct answers: A, B

• A. Correct.

  Correct. A system-assigned managed identity is automatically created, managed, and rotated by Azure, so the VM can authenticate to Key Vault without storing credentials. This approach meets the requirement of not placing credentials on the VM.

• B. Correct.

  Correct. A user-assigned managed identity is created independently of a specific VM but can be assigned to multiple resources. It also avoids credential storage on the VM since Azure manages rotations and lifecycle.

• C. Incorrect.

  Incorrect. While using an Azure AD service principal is a valid authentication method, storing a client secret on the VM violates the requirement that no credentials be stored on the VM.

• D. Incorrect.

  Incorrect. Shared keys stored on the VM create a security concern, as they would be considered static credentials. This goes against the organization� requirement to avoid local credential storage.