AZ-700 exam dumps: questions 201 to 300 of 310

Correct answer: B

• A. Incorrect.

  Option 1: This is incorrect. Associating the route table with SubnetB does not affect traffic originating in SubnetA. The route table must be associated with the subnet whose traffic you want to control (SubnetA).

• B. Correct.

  Option 2: This is correct. A user-defined route only takes effect when the route table is associated with the specific subnet in which you want to override the default routing. Associating it with SubnetA ensures its outbound traffic is directed to the NVA.

• C. Incorrect.

  Option 3: This is incorrect. A load balancer rule alone will not alter the default routing path for SubnetA� outbound internet traffic. User-defined routes must be applied at the subnet level.

• D. Incorrect.

  Option 4: This is incorrect. Changing the next hop to 'Virtual Network Gateway' would direct traffic toward an Azure VPN or ExpressRoute gateway. A public IP on the NVA is unrelated to the need for associating the route table with the correct subnet.

Correct answer: D

• A. Incorrect.

  Incorrect. BGP route propagation primarily affects routes learned from on-premises or ExpressRoute connections. Enabling this will not ensure intra-VNet custom routes are applied.

• B. Incorrect.

  Incorrect. Associating a route table with the virtual network gateway subnet applies routes to that specific subnet only, not to Subnet A where the traffic originates.

• C. Incorrect.

  Incorrect. Setting the next hop type to 'Internet' would send traffic out to the public Internet, not to the IDS. This does not meet the requirement of forwarding traffic to a subnet-hosted IDS.

• D. Correct.

  Correct. A custom route table must be explicitly associated with the subnet that will use the custom routes. Associating the route table with Subnet A ensures all traffic from Subnet A is redirected to the next hop you configured, which is the IDS in Subnet B.

Correct answers: A, B

• A. Correct.

  Enabling cookie-based affinity ensures that each returning user is consistently routed to the same backend instance, maintaining session state correctly.

• B. Correct.

  Setting the backend protocol to HTTPS guarantees secure communication between the Application Gateway and the web applications, fulfilling the requirement for encrypted traffic.

• C. Incorrect.

  Disabling server name indication (SNI) is normally not required in this scenario. SNI helps host multiple SSL certificates on the same IP/port. Turning it off wouldn�t address session affinity or encrypted traffic requirements.

• D. Incorrect.

  Disabling cookie-based affinity would break session-specific routing; in fact, you need to enable it, not disable it.

Correct answers: A, B

• A. Correct.

  Option 1: Correct. Disabling the 'Override with a specific domain name' means the Application Gateway will pass the original host header to the backend, preserving upstream data needed for licensing checks.

• B. Correct.

  Option 2: Correct. Enabling 'Cookie-based affinity' ensures that each client stays on the same backend server, providing session persistence.

• C. Incorrect.

  Option 3: Incorrect. Enabling this override would replace the original host header with a custom domain name, which would break the licensing checks that depend on the original host header.

• D. Incorrect.

  Option 4: Incorrect. Specifying a custom path override adjusts the path portion of the request, not the host header or session affinity. It� unrelated to preserving the original host header or managing session-based persistence.

• E. Incorrect.

  Option 5: Incorrect. Connection Draining is useful when removing backend instances but does not affect host headers or session-based persistence settings.

Correct answers: A, D

• A. Correct.

  Correct. For end-to-end TLS, you must provide the PFX (containing the private key) to the Application Gateway� HTTPS listener. You also need to configure the HTTP setting to use HTTPS, ensuring encrypted communication with the backend. This setup allows the Application Gateway to decrypt and re-encrypt traffic properly for the custom domain.

• B. Incorrect.

  Incorrect. Using HTTP on port 80 for the backend setting would terminate TLS at the Application Gateway, which means the traffic from the gateway to the web app would be unencrypted. This option would not achieve end-to-end TLS.

• C. Incorrect.

  Incorrect. A self-signed certificate using a mismatched domain name would break TLS validation. In an end-to-end TLS configuration, the certificate must match the custom domain to avoid certificate errors or failed connections.

• D. Correct.

  Correct. When using end-to-end TLS, the backend web app must also serve the same (or a domain-valid) certificate. The root certificate for that certificate must be uploaded to the Application Gateway� trusted root store so that the gateway can properly validate and trust secured traffic to the backend.