AZ-700 Microsoft Designing and Implementing Microsoft Azure Networking Solutions Free Practice Exam Questions (2026 Updated)

To prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts within subnet 1-2, you can use a  Network Security Group (NSG) . This solution is straightforward and minimizes administrative effort.

Step-by-Step Solution

Step 1: Create a Network Security Group (NSG)

Navigate to the Azure Portal .

Search for “Network security groups”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NSG (e.g., NSG-Subnet1-2).

Region : Select the region w here your virtual network is located.

Click on “Review + create”  and then  “Create” .

Step 2: Create an Inbound Security Rule

Navigate to the newly created NSG .

Select “Inbound security rules”  from the left-hand menu.

Click on “Add”  to create a new rule.

Ent er the following details :

Source : Select  Service Tag .

Source Service Tag : Select  VirtualNetwork .

Source port ranges : Leave as *.

Destination : Select  IP Addresses .

Destination IP addresses/CIDR ranges : Enter the IP range of subnet1-2 (e.g., 10.1.2.0/24).

Destination port ranges : Enter 5585.

Protocol : Select  TCP .

Action : Select  Deny .

Priority : Enter a priority value (e.g., 100).

Name : Enter a name for the rule (e.g., Deny-TCP-5585).

Click on “Add”  to create the rule.

Step 3: Associate the NSG with Subnet1-2

Navigate to the virtual network  that contains subnet1-2.

Select “Subnets”  from the left-hand menu.

Select subnet1-2  from the list of subnets.

Click on “Network security group” .

Select the NSG  you created (NSG-Subnet1-2).

Click on “Save” .

Explanation

Netwo rk Security Group (NSG) : NSGs are used to filter network traffic to and from Azure resources in an Azure virtual network.  They contain security rules tha t allow or deny inbound and outbound traffic based on source and destination IP addresses, port, and pr otocol 1 .

Inbound Security Rule : By creating a rule that denies traffic on TCP port 5585 from any source outside of subnet1-2, you ensure that only hosts within subnet1-2 can connect to this port.

Association with Subnet : Associating the NSG with subnet1-2 ensures that the security rules are applied to all resources within this subnet.

By following these steps, you can effectively prevent all Azure hosts outside of subnet1-2 from connecting to TCP port 5585 on hosts within subnet1-2, while minimizing administrative effort.

Here are the steps and explanations for ensuring that requests for wwwjelecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net:

To use a custom domain with your Azure Front Door, you need to create a CNAME record with your domain provider that points to the Front Door default frontend host.  A CNAME record is a type of DNS record that maps a source domain name to a destination domain name 1 .

To create a CNAME r ecor d, you need to sign in to your domain registrar’s website and go to the page for managing DNS settings 1 .

Creat e a CNAME record with the followin g information 1 :

Source domain name: wwwjelecloud.com

Destination domain name: frontdoor1.azurefd.net

Save your changes and wait for the DNS propagation to take effect 1 .

To verify the custom domain, you need to go to the Azure portal and select your Front Door profile.  Then select Domains un der Settings and select Add 2 .

On the Add a domain page, select Non-Azure validated domain as the Domain type and enter wwwjeleclou d.com as the Domain name.  Then select Add 2 .

On the Domains page, select wwwjelecloud.com and select Verify.  This will check if the CNAME record is correctly configured 2 .

Once the domain is verified, you can associate it with your Front Door endpoint. On the Domains page, select wwwjelecloud.com and select Associate endpoint.  Then select your Front Door endpoint from the drop-down list and select Associa te 2 .

Here are the steps and explanations for configuring VNET1 to log all events and metrics and query them by using KQL:

To enable logging for VNET1, you need to create a diagnostic setting that collects the platform metrics and logs from the virtual network and routes them to one or more destinations.  You can choose to send the data to a Log Analytics workspace, a storage account, an event hub, or a partner solution 1 .

To create a diagnostic setting, you need to go to the Azure portal and select your virtual network.  Then select Diagnostic settings under Monitoring and select + Add diagnostic s etting 1 .

On the Add diagnostic setting page, enter or select the following information:

Diagnostic setting name: Type a unique name for your diagnostic setting.

Destination details: Select the destination where you want to send the data. For example, you can select Send to Log Analytics workspace and choose your workspace from the list.

Log: Select the categories of logs that you want to collect.  For VNET1, you can select NetworkSecurityGro up Event and NetworkSecurityGroupRuleCounter as the log categories 2 .

Metric: Select AllMetrics to collect all the platform m etrics for VNET1 2 .

Select Save to create your diagnostic se tting 1 .

To query the events and metrics from the Azure portal by using KQL, you need to go to the Log Analytics workspace that you selected as the destination.  Then select Logs under Gener al and enter your KQ L query in the query editor 3 .

For example, you can use the following KQL query to get the top 10 network security group events for VNET1 in the last 24 hours:

NetworkSecurityGr oupEvent

| where TimeGenerated > ago(24h)

| where ResourceId contains " VNET1 "

| summarize count() by EventID

| top 10 by count_

Copy

Select Run to execute your query and view the re sults in a tabl e or a chart 3 .

To archive all the metrics of VNET1 to an existing storage account, you can use Azure Monitor’s diagnostic settings. Here’s how you can do it:

Step-by-Step Solution

Step 1: Navigate to VNET1 in the Azure Portal

Ope n the Azure Portal .

Search for “Virtual networks”  and select  VNET1  from the list.

Step 2: Configure Diagnostic Settings

In the VNET1 blade , select  “Diagnostic settings”  under the “Monitoring” section.

Click on “Add diagnostic setting” .

Step 3: Set Up the Diagnostic Setting

Enter a name  for the diagnostic setting (e.g., VNET1-Metrics-Archive).

Select the metrics  you want to archive. You can choose from various metrics like TotalBytesReceived, TotalBytesSent, etc.

Under “Destination details” , select  “Archive to a storage account” .

Choose the existing storage account  where you want to archive the metrics.

Configure the retention period  if needed.

Step 4: Save the Configuration

Review your settings  to ensure everything is correct.

Click on “Save”  to apply the diagnostic setting.

Explanation

Diagnostic Settings : These allow you to collect and route metrics and logs from your Azure resources to various destinations, including storage accounts, Log Analytics workspaces, and Event Hubs.

Metrics : Metrics provide num erical data about the performance and health of your resources. Archiving these metrics helps in long-term analysis and compliance.

Storage Account : Using an existing storage account ensures that the metrics are stored securely and can be accessed for futu re analysis.

By following these steps, you can ensure that all the metrics of VNET1 are archived to your existing storage account, enabling you to monitor and analyze the performance and health of your virtual network over time.

To ensure that hosts on VNET1 and VNET2 can communicate with minimal latency, you can use  Virtual Network Peering . This method connects the two virtual networks directly through the Microsoft backbone network, ensuring low-latency and high-bandwidth communication.

Step-by-Step Solution

Step 1: Set Up Virtual Network Peering

Navigate to the Azure Portal .

Search for “Virtual networks”  and select VNET1.

In the left-hand menu , select  “Peerings”  under the “Settings” section.

Click on “Add”  to create a new peering.

Enter the following details :

Name : Enter a name for the peering (e.g., VNET1-to-VNET2).

Peer virtual network : Select VNET2.

Allow virtual network access : Ensure this is enabled.

Allow forwarded traffic : Enable if needed.

Allow gateway transit : Enable if needed.

Click on “Add” .

Step 2: Configure Peering on VNET2

Navigate to VNET2  in the Azure Portal.

In the left-hand menu , select  “Peerings”  under the “Sett ings” section.

Click on “Add”  to create a new peering.

Enter the following details :

Name : Enter a name for the peering (e.g., VNET2-to-VNET1).

Peer virtual network : Select VNET1.

Allow virtual network access : Ensure this is enabled.

Allow forwarded traffic : Enable if needed.

Allow gateway transit : Enable if needed.

Click on “Add” .

Explanation

Virtual Network Peering : This feature connects two virtual networks in the same or different regions, allowing resources in both networks to communicate with each othe r as if they were part of the same network.  Th e traffic between peered virtual networks uses the Micros oft backbone infrastructure, ensuring low la tency and hi gh bandwidth 1 2 .

Allow Virtual Network Access : This setting ensures that the virtual networks can communicate with each other.

Allow Forwarded Traffic : This setting allows traffic forwarded from a network security appliance in the peered virtual network.

Allow Gateway Transit : This setting allows the peered virtual network to use the gateway in the local virtual network.

By following these steps, you can ensure that hosts on VNET1 and VNET2 can communicate with minimal latency, leveraging the high-speed Microsoft backbone network.