Download Microsoft AZ-720 Mock Test Study Material
AZ-720 Questions Prepare with Learning Information
The AZ-720 certification exam is designed for IT professionals who have experience working with Azure and want to enhance their troubleshooting skills. AZ-720 exam focuses on testing the candidate's ability to diagnose and resolve connectivity issues that can occur in Azure. AZ-720 exam covers a range of topics, including networking, security, and infrastructure, to ensure that the candidate has a comprehensive understanding of the Azure environment.
Microsoft AZ-720 exam covers a range of topics related to Azure connectivity, including troubleshooting network connectivity issues, diagnosing and resolving DNS and name resolution issues, resolving issues with virtual network gateways, and troubleshooting issues with Azure ExpressRoute.
NEW QUESTION # 55
A company has an Azure Virtual Network gateway named VNetGW1. The company enables point-to-site connectivity on VNetGW1. An administrator configures VNetGW1 for the following:
OpenVPN for the tunnel type.
Azure certificate for the authentication type.
Users receive a certificate mismatch error when connecting by using a VPN client.
You need to resolve the certificate mismatch error.
What should you do?
- A. Reissue the client certificate with client authentication enabled.
- B. Install an IKEv2 VPN client on the user's computers.
- C. Configure the tunnel type for IKEv2 and OpenVPN on VNetGW1.
- D. Create a profile manually, add the server FQDN and reissue the client certificate.
Answer: C
NEW QUESTION # 56
A company deploys a new file sharing application on four Standard_D2_v3 virtual machines (VMs) behind an Azure Load Balancer. The company implements Azure Firewall.
Users report that the application is slow during peak usage periods. An engineer reports that the peak usage for each VM is approximately 1 Gbps.
You need to implement a solution that support a minimum of 10 Gbps.
What should you do to increase the throughput?
- A. Request an increase in networking quotas.
- B. Move two of the servers behind a separate load balancer and configure round robin routing in Traffic Manager.
- C. Disable the Azure Firewall and implement network security groups in its place.
- D. Increase the size of the VM instance.
Answer: D
Explanation:
To achieve this goal, the best option is to increase the size of the VM instance. The Standard_D2_v3 virtual machine size has a maximum network bandwidth of 1 Gbps, so increasing the size of the VM instance to a higher tier, such as Standard_D8_v3 or higher, will provide more network bandwidth and improve the application's performance.
Option A, requesting an increase in networking quotas, may not be sufficient to achieve the required network bandwidth.
Option C, disabling the Azure Firewall and implementing network security groups, may not have a significant impact on the network bandwidth.
Option D, moving two of the servers behind a separate load balancer and configuring round-robin routing in Traffic Manager, may improve availability and performance but will not increase the network bandwidth.
Source: [1] https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes-general [2] https://docs.microsoft.com/en-us/azure/virtual-network/designing-hub-spoke-topologies#optimize-data-transfer-between-hub-and-spoke-vnets
NEW QUESTION # 57
You need to troubleshoot the Azure Key Vault issues.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 58
A company uses an Azure VPN gateway with an IP address of 203.0.113.20.
Users report that the VPN connection frequently drops.
You need to determine when each connection failure occurred.
How should you complete the Azure Monitor query?
Answer:
Explanation:
NEW QUESTION # 59
You need to resolve the issue repotted by Admin2.
What should you do?
- A. Disassociate NSG2 from Subnet12.
- B. Add a rule to N5G2 that allows outbound traffic to the internet over port 80.
- C. Configure a second network interface on VM4.
- D. Disassociate NSG5 from NIC4.
Answer: D
Explanation:
To resolve the issue reported by Admin2, you need to disassociate NSG5 from NIC4, which is the network interface of VM4. NSG5 is a network security group that has an inbound security rule that denies traffic from ASG2 to ASG5 over port 80. This rule prevents Admin2 from connecting to the web server public IP address on VM4 from VM2, as VM2 is in ASG2 and VM4 is in ASG5. By disassociating NSG5 from NIC4, you can remove the rule that blocks the traffic and allow Admin2 to access the web server on VM4. Alternatively, you could also modify or remove the rule in NSG5, but disassociating NSG5 from NIC4 is simpler and more effective.
NEW QUESTION # 60
A company enables just-in-time (JIT) virtual machine (VM) access in Azure.
An administrator observes a list of VMs on the Unsupported tab of the JIT VM access page in the Microsoft
Defender for Cloud portal.
You need to determine why some VMs are not supported for JIT VM access.
What should you conclude?
- A. The administrator does not have the SecurityReader role.
- B. The VMs were provisioned by using a classic deployment.
- C. The administrator is using the Microsoft Defender for Cloud free tier.
- D. The VMs were recently provisioned by using an Azure Resource Manager deployment.
Answer: B
NEW QUESTION # 61
You need to resolve the issue.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 62
A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a network security group (NSG) with all of the subnets.
Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named VNet2. Virtual network peering is enabled between VNet1 and VNet2.
You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet.
You discover that FlowLog1 is not reporting outbound flow traffic.
You need to resolve the issue with FlowLog1.
What should you do?
- A. Configure FlowLog1 for version 2.
- B. Enable FlowLog1 in a network security group associated with the subnet of VM1.
- C. Configure the FlowTimeoutInMinutes property on VNet2 to a non-null value.
- D. Configure the FlowTimeoutInMinutes property on VNet1 to a non-null value.
Answer: B
Explanation:
According to 2, when FastPath is enabled on an ExpressRoute gateway, network traffic between your on-premises network and your virtual network bypasses the gateway and goes directly to virtual machines in the virtual network. Therefore, if you want to capture outbound flow traffic from VM1, you need to enable flow logging on an NSG associated with the subnet of VM1.
NEW QUESTION # 63
A company uses an Azure Virtual Network (VNet) gateway named VNetGW1. VNetGW1 connects to a partner site by using a site-to-site VPN connection with dynamic routing.
The company observes that the VPN disconnects from time to time.
You need to troubleshoot the cause for the disconnections.
What should you verify?
- A. VNetGW1 has exceeded the subnet Security Association pairs.
- B. The partner's VPN device and VNetGW1 are configured using the same shared key.
- C. The partner's VPN device and VNetGW1 are configured with the same virtual network address space.
- D. The public IP address of the partner's VPN device is configured in the local network gateway address space on VNetGW1.
Answer: B
Explanation:
To troubleshoot the cause for the VPN disconnections between VNetGW1 and the partner site, you should verify that the partner's VPN device and VNetGW1 are configured using the same shared key.
NEW QUESTION # 64
A company named Contoso connects to Azure PaaS services using Azure Private Link. The company has a
virtual network named contoso-vn in a resource group named contoso-rg.
An engineer modifies the Private Link service by using Azure CLI. They are unable to use a source IP address
from a subnet named default.
You need to resolve the issue.
How should you complete the command?
Answer:
Explanation:
NEW QUESTION # 65
A company uses public Azure DNS zones.
The company reports DNS record creation and name resolution issues.
You need to troubleshoot the issues.
What are the causes of the issues?
Answer:
Explanation:
NEW QUESTION # 66
You need to troubleshoot the Azure Key Vault issues.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 67
A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR).
An administrator receives an error that password writeback cloud not be enabled during the Azure AD Connect configuration. The administrator observes the following event log error:
Error getting auth token
You need to resolve the issue.
Solution: Restart the Azure AD Connect service.
Does the solution meet the goal?
- A. Yes
- B. No
Answer: A
NEW QUESTION # 68
A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.
The company reports that the Azure VM backup job is failing.
You need to troubleshoot the issue.
Solution: Configure the retention range for the current VM backup policy.
Does the solution meet the goal?
- A. Yes
- B. No
Answer: A
NEW QUESTION # 69
A company uses an Azure VPN gateway with an IP address of 203.0.113.20.
Users report that the VPN connection frequently drops.
You need to determine when each connection failure occurred.
How should you complete the Azure Monitor query?
Answer:
Explanation:
NEW QUESTION # 70
You need to resolve the problem reported by User2.
What should you do?
- A. Assign an Azure AD Premium Pi license to User2
- B. Instruct User2 to wait 24 hours and try again.
- C. Identify and resolve the misconfigured directory information for User2.
- D. Enable all users for the self-service password reset feature.
- E. Enable the warehouse group for the self-service password reset feature.
Answer: A
Explanation:
To resolve the problem reported by User2, you need to assign an Azure AD Premium P1 license to User2. User2 is a member of the warehouse group, which is enabled for the self-service password reset (SSPR) feature. However, User2 cannot register for SSPR because they do not have a valid license that supports SSPR. To use SSPR, a user must have one of the following licenses: Azure AD Premium P1, Azure AD Premium P2, Enterprise Mobility + Security (EMS) E3 or EMS E5. By assigning an Azure AD Premium P1 license to User2, you can enable them to use the SSPR feature and reset their password without contacting the helpdesk
NEW QUESTION # 71
A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).
A new subnet should be unreachable from the on-premises network.
You need to implement a solution.
Solution: Disable peering on the virtual network.
Does the solution meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
Disabling peering on the virtual network will not prevent the on-premises network from reaching the new subnet. Virtual network peering is a way to connect virtual networks and allows resources in both virtual networks to communicate with each other securely. It does not affect connectivity between on-premises and virtual network resources.
A better solution would be to create a network security group (NSG) and associate it with the new subnet. The NSG can be configured to deny traffic from the on-premises network to the new subnet. This way, the new subnet will be isolated from the on-premises network.
Reference:
Azure Virtual Network peering: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview Azure Network Security Groups: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
NEW QUESTION # 72
A company uses an Azure Backup agent to back up specific files and folder from an Azure virtual machine (VM) and an on-premises VM.
An administrator reports that the backup job fails on both VMs. Errors are returned in Microsoft Azure Recovery Services (MARS).
You need to troubleshoot the backup issues.
Which troubleshooting solution should you use?
Answer:
Explanation:
NEW QUESTION # 73
You need to resolve the VM2 routing issue.
What should you do?
- A. Add a network interface to VM2.
- B. Modify the IP configuration setting of the Azure network interface resource of VM2.
- C. Modify the IP configuration setting of the Azure network interface resource of VM1.
- D. Add a network interface to VM1.
Answer: B
Explanation:
To resolve the VM2 routing issue, you should modify the IP configuration setting of the Azure network interface resource of VM2. This will ensure that VM2 can communicate with other resources in the virtual network.
Troubleshooting connectivity problems between Azure VMs involves several steps such as checking whether NIC is misconfigured, whether network traffic is blocked by NSG or UDR, whether network traffic is blocked by VM firewall, whether VM app or service is listening on the port and whether the problem is caused by SNAT1.
Fabrikam Inc. runs an online reservation service that allows agents to manage online registrations for various hotels, vacation rentals, and customers.
The company has on-premises infrastructure and services that are hosted in Azure. The on-premises infrastructure includes servers that run Active Directory Domain Services (AD DS). Azure services include virtual machines (VMs) that are in one subscription and the following environments: development, testing, and production. Each environment is located in a different virtual network (VNet).
The company has a perimeter network that supports connections to the internet. The perimeter network is also hosted in a separate VNet All of the VNets are connected by using virtual network peering.
The company's subscription contains the following Azure virtual machines (VMs):
The Web Server (IIS) role is installed on VM4 The operating system firewall for each VM allows inbound ping requests.
The company's subscription includes the following network security groups (NSGs):
NSG1, NSG2. NSG3, and NSG5 use the default inbound security rules. NSG4. NSG5. and NSG10 use the default outbound security rules. NSG4 has the following inbound security rule:
NSG10 has the following inbound security rules:
Network Policy Server (NPS) is installed on an on-premises server named SRV2. The NPS extension for Azure AD multi-factor authentication (MFA) is configured on the server as well.
The virtual network peering connections are in the following table.
You provision a virtual network gateway named VNetGW in the perimeter network. The virtual network gateway uses SKU VpnGw1 and the public IP address 16.4.4.4 The virtual network gateway will provide:
* Network routing to customer data centers using site-to-site VPN connections.
* Network routing to Azure for the scheduling agents and sales employees using a point-to-site VPN connection.
The company's site-to-site VPN connections with customers are shown in the following table.
The point-to-site VPN is configured as shown in the following table;
The company's user and group memberships are shown in the following table:
The scheduling agents, warehouse, and sales groups are members of the self-service password reset (SSPR) group named SSPR-group.
Azure AD Connect is installed on an on-premises server named SRV1. In addition;
* The server uses a pass-through authentication agent.
* The SSPR feature is enabled
* The SSPR feature is applied only to a group named SSPR-group
* The scheduling agents' internet connectivity must be blocked when connected to the point-to-site VPN.
* Sales employees must use the default VPN client on MacOS computers to connect to Azure.
* Azure AD Connect must synchronize all user accounts from AD DS to Azure AD.
* Pass-through authentication is required for all users.
* Azure AD multi-factor authentication (MFA) is requited for all users.
* All admin user accounts must be in an organizational unit (OU) named Admins.
NEW QUESTION # 74
You need to troubleshoot and resolve the reverse VPN connectivity issues.
What should you do? To answer, select the appropriate option in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 75
A company uses an Azure Virtual Network (VNet) gateway named VNetGW1. VNetGW1 connects to a
partner site by using a site-to-site VPN connection with dynamic routing.
The company observes that the VPN disconnects from time to time.
You need to troubleshoot the cause for the disconnections.
What should you verify?
- A. The IP address of the local network gateway matches the partner's VPN device.
- B. The partner's VPN device and VNetGW1 are configured using the same shared key.
- C. The partner's VPN device and VNetGW1 are configured with the same virtual network address space.
- D. The partner's VPN device is enabled for Perfect forward secrecy.
Answer: C
NEW QUESTION # 76
A company has an Azure virtual network (VNet). An administrator creates a subet in the VNet named AzureSastionSubnet. The administrator deploys Azure Bastion to AzureBastionSubnet.
The administrator creates a default network security group named nsg-Bastion. The following error message display when the administrator attempts to assign nsg-Bastion to AzureBastionSubnet:
Network security group nsg-Bastion does not have necessary rules for Azure Bastion Subnet AzureBastionSubnet You need to resolve the issues with the inbound security rules.
Which port or set of ports should you configure?
Answer:
Explanation:
NEW QUESTION # 77
......
Exam AZ-720: Troubleshooting Microsoft Azure Connectivity
Candidates for this exam should have experience with networking and with hybrid environments, including knowledge of routing, permissions, and account limits. They must be able to use available tools to diagnose issues related to business continuity, hybrid environments, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), access control, networking, and virtual machines connectivity.
Passing score: 700. Learn more about exam scores.
Part of the requirements for: Microsoft Certified: Azure Support Engineer for Connectivity Specialty
Most Reliable Microsoft AZ-720 Training Materials: https://www.pass4sures.top/Microsoft-Certified-Azure-Support-Engineer-for-Connectivity-Specialty/AZ-720-testking-braindumps.html
Practice Material for AZ-720 Exam Question Preparation: https://drive.google.com/open?id=1Bti05ws9QDSwEVOAmRH8b4iCXOl9r8hO