Updated Microsoft AZ-720 Exam Questions [2023] Tips to Help You Get the Best Results

Jonnie Karnath2023-04-17T17:02:32+00:00

If you’re aiming to get the Microsoft Certified: Azure Support Engineer for Connectivity Specialty certification, passing the Microsoft AZ-720 exam is a crucial step towards achieving that goal. To ensure your success in the Microsoft AZ-720 exam, it’s important to have a solid understanding of the exam format, content, and question types. Our team of experts has developed a comprehensive set of updated Microsoft AZ-720 exam questions that will help you maximize your chances of getting the best results. So what are you waiting for? Sign up for our Microsoft AZ-720 exam questions today and start your journey towards success!

Page 1 of 3

1. A company has an Azure point-to-site virtual private network (VPN) that uses certificate-based authentication.

A user reports that the following error message when they try to connect to the VPN by using a VPN client on a Windows 11 machine:

A certificate could not be found

You need to resolve the issue.

Which three actions should you perform?

Configure an Azure Active Directory (Azure AD) tenant.

Install a root certificate on the user's device.

Generate a root certificate.

Install a client certificate on the VPN gateway.

Enable Azure AD authentication on the gateway

Generate a client certificate.

Install a client certificate on the user's device.

2. A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).

A new subnet should be unreachable from the on-premises network.

You need to implement a solution.

Solution: Scale the gateway to Generation2.

Does the solution meet the goal?

Yes

3. A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a network security group (NSG) with all of the subnets.

Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named VNet2. Virtual network peering is enabled between VNet1 and VNet2.

You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet.

You discover that FlowLog1 is not reporting outbound flow traffic.

You need to resolve the issue with FlowLog1.

What should you do?

Create the storage account for FlowLog1 as a premium block blob.

Create the storage account for FlowLog1 as a premium page blob.

Enable FlowLog1 in a network security group associated with the subnet of VM1.

Configure the FlowTimeoutInMinutes property on VNet1 to a non-null value.

4. A company has two virtual networks (VNets) that reside in the same Azure region.

An administrator reports that virtual machines (VMs) in each VNet are unable to connect to VMs in the other VNet.

You need to configure a connection between the two networks that maximizes throughput and minimizes latency.

What should you do?

Configure a VPN gateway.

Create a site-to-site VPN connection.

Configure virtual network peering.

Create a point-to-site VPN connection.

5. A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).

A new subnet should be unreachable from the on-premises network.

You need to implement a solution.

Solution: Configure a route table with route propagation disabled.

Does the solution meet the goal?

Yes

6. HOTSPOT

A company uses Azure Site Recovery for an on-premises server.

The company reports that replication of the server to Azure has failed.

You need to inspect the logs on the server to troubleshoot the issue.

How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

7. A company uses an Azure Virtual Network (VNet) gateway named VNetGW1. VNetGW1 connects to a partner site by using a site-to-site VPN connection with dynamic routing.

The company observes that the VPN disconnects from time to time.

You need to troubleshoot the cause for the disconnections.

What should you verify?

The partner's VPN device and VNetGW1 are configured using the same shared key.

The IP address of the local network gateway matches the partner's VPN device.

The partner's VPN device is enabled for Perfect forward secrecy.

The partner's VPN device and VNetGW1 are configured with the same virtual network address space.

8. A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).

A new subnet should be unreachable from the on-premises network.

You need to implement a solution.

Solution: Disable peering on the virtual network.

Does the solution meet the goal?

Yes

9. A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR).

An administrator receives an error that password writeback cloud not be enabled during the Azure AD Connect configuration. The administrator observes the following event log error:

Error getting auth token

You need to resolve the issue.

Solution: Disable password writeback and then enable password writeback.

Does the solution meet the goal?

Yes

10. A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.

The company reports that the Azure VM backup job is failing.

You need to troubleshoot the issue.

Solution: Configure the retention range for the current VM backup policy.

Does the solution meet the goal?

Yes

Page 2 of 3

11. A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a network security group (NSG) with all of the subnets.

Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named VNet2. Virtual network peering is enabled between VNet1 and VNet2.

You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet.

You discover that FlowLog1 is not reporting outbound flow traffic.

You need to resolve the issue with FlowLog1.

What should you do?

Configure FlowLog1 for version 2.

Create the storage account for FlowLog1 as a premium block blob.

Configure the FlowTimeoutInMinutes property on VNet2 to a non-null value.

Enable FlowLog1 in a network security group associated with the network interface of VM1.

12. HOTSPOT

You create an Azure Traffic Manager profile with five endpoints Each endpoint is a web app running in an Azure virtual machine (VM).

You observe that one of the endpoints has a degraded status. You plan to verify whether the endpoint is responding to the Traffic Manager health probe with a valid status code.

You need to identify the PowerShell comdlet to use and the status code that the cmdlet should return.

Which value should you use for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

13. HOTSPOT

A company named Contoso connects its on-premises resources to Azure by using ExpressRoute.

An administrator reports that the circuit is in a failed state.

You need to resolve the issue.

How should you complete the PowerShell commands?

14. A company has an Azure Active Directory (Azure AD) tenant. The company provisions an Azure Active Directory Domain Services (Azure AD DS) instance.

Users report that they are unable to sign into Azure AD DS after being provisioned from Azure AD. You verify the user accounts exist in Azure AD DS.

You need to resolve the issue.

What should you do?

Delete the Azure application named AzureActiveDirectoryDomainControllerServices and then enable Azure AD DS again.

Deploy Azure AD Connect.

Delete the Azure application named Azure AD Domain Services Sync and then enable Azure AD DS again.

Instruct the users to change their password in Azure A

15. HOTSPOT

A company uses Azure Active Directory (Azure AD) with Azure role-based access control (RBAC) for access to resources.

Some users report that they are unable to grant RBAC roles to other users.

You need to troubleshoot the issue.

How should you complete the Azure Monitor query?

16. A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.

The company reports that the Azure VM backup job is failing.

You need to troubleshoot the issue.

Solution: Enable replication and create a recovery plan for the backup vault.

Does the solution meet the goal?

Yes

17. A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR).

An administrator receives an error that password writeback cloud not be enabled during the Azure AD Connect configuration.

The administrator observes the following event log error:

Error getting auth token

You need to resolve the issue.

Solution: Restart the Azure AD Connect service.

Does the solution meet the goal?

Yes

18. A company plans to use an Azure PaaS service by using Azure Private Link service. The azure Private Link service and an endpoint have been configured.

The company reports that the endpoint is unable to connect to the service.

You need to resolve the connectivity issue.

What should you do?

Disable the endpoint network policies.

Validate the VPN device.

Approve the connection state.

Disable the service network policies.

19. Topic 2, Misc. Questions Set

HOTSPOT

A company creates an Azure resource group named RG1.

RG1 has an Azure SQL Database logical server named sqlsvr1 that hosts the following resources:

An administrator grants a user named User1 the Reader RBAC role in RG1. The administrator grants User2 the Contributor role in sqlsvr1.

User1 reports that they can connect to SQLDB1 from the IP address 155.127.95.212. User1 cannot connect to SQLDB2. User2 can connect to both SQLDB1 and SQLDB2 from the IP address 121.19.27.18. Both users can successfully connect to SQLDB1 and SQLDB2 from VM1.

You are helping the administrator troubleshoot the issue. You run the following PowerShell command:

Get-AzSqlServerFirewallRule -ResourceGroupName 'RG1' -ServerName 'sqlsvr1'

The following output displays:

You need to identify the cause for the reported issue and resolve User1's issues. The solution must satisfy the principle of least privilege.

What should you do?

20. A company deploys an ExpressRoute circuit.

You need to verify accepted peering routes from the ExpressRoute circuit.

Which PowerShell cmdlet should you run?

Get-AzExpressRouteCrossConnectionPeering

Get-AzExpressRouteCircuit

Get-AzExpressRouteCircuitPeeringConfig

Get-AzExpressRouteCircuitRouteTable

Get-AzExpressRouteCircuitStats

Page 3 of 3

21. A company deploys an Azure Virtual Network gateway. The company connects to the gateway by using a site-to-site VPN connection.

The company's on-premises VPN gateway is reporting an issue with the Phase 1 proposal from the Azure Virtual Network gateway.

You need to troubleshoot the issue by reviewing the logs.

Which log should you analyze?

P2SDiagnosticLog

GatewayDiagnosticLog

IKEDiagnosticLog

RouteDiagnosticLog

22. A company uses Azure virtual machines (VMs) in multiple regions.

The VMs have the following configuration:

The backend pool of an internal Azure Load Balancer (ILB) named ILB1 contains VM1 and VM2. The ILB uses the Basic SKU and is in a resource group RG2.

Virtual network peering has been configured between VNet1 and VNet2.

Users report that they are unable to connect to resources on VM1 and VM2 by using ILB1 from VM3.

You need to resolve the connectivity issues.

What should you do?

Redeploy VM1 and VM2 into availability zones.

Move ILB1 to RG1.

Redeploy the ILB using the Standard SK

Move VM1 and VM2 into RG3.

23. A company has an Azure Virtual Network gateway named VNetGW1. The company enables point-to-site connectivity on VNetGW1.

An administrator configures VNetGW1 for the following:

✑ OpenVPN for the tunnel type.

✑ Azure certificate for the authentication type.

Users receive a certificate mismatch error when connecting by using a VPN client.

You need to resolve the certificate mismatch error.

What should you do?

Reissue the client certificate with client authentication enabled.

Configure preshared key for authentication on the VPN profile.

Install an IKEv2 VPN client on the user's computers.

Reissue the client certificate with server authentication enabled.

24. A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).

A new subnet should be unreachable from the on-premises network.

You need to implement a solution.

Solution: Configure subnet delegation.

Does the solution meet the goal?

Yes

25. A company enables just-in-time (JIT) virtual machine (VM) access in Azure.

An administrator observes a list of VMs on the Unsupported tab of the JIT VM access page in the Microsoft Defender for Cloud portal.

You need to determine why some VMs are not supported for JIT VM access.

What should you conclude?

The administrator does not have the SecurityReader role.

The administrator is using the Microsoft Defender for Cloud free tier.

The client firewall does not allow port 22 on the VMs.

A network security group is not associated with the VMs.

26. A company uses an Azure Virtual Network (VNet) gateway named VNetGW1. VNetGW1 connects to a partner site by using a site-to-site VPN connection with dynamic routing.

The company observes that the VPN disconnects from time to time.

You need to troubleshoot the cause for the disconnections.

What should you verify?

The partner's VPN device and VNetGW1 are configured using the same shared key.

The partner's VPN device is configured for one VPN tunnel per subnet pair.

The public IP address of the partner's VPN device is configured in the local network gateway address space on VNetGW1.

The partner's VPN device and VNetGW1 are configured with the same virtual network address space.

27. HOTSPOT

You need to troubleshoot the Azure Key Vault issues.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

28. A company hosts a network virtual appliance (VNA) and Azure Route Server in different virtual networks (VNets). Border Gateway Protocol (BGP) peering is enabled between the NVA loses internet connectivity after it advertises the default route to the route server.

You need to resolve the problem with the NVA.

What should you do?

Configure a user-defined route on the NVA subnet.

Move the route server to the same VNet as the NV

Configure a unique autonomous system number (ASN) on the NV

Configure a public IP address on the route server.

29. A company implements self-service password reset (SSPR).

After a firewall upgrade at the company's datacenter, SSPR stops working.

You need to resolve the issue.

Which two URLs must be present on the firewalls to allow SSPR to connect?

*.update.microsoft.com

*.servicebus.windows.net

*.passwordreset. microsoftonline.com

*.svc.ms

*.adl.windows.com

30. HOTSPOT

A company uses an Azure blob container.

The IT department has a service-level agreement (SLA) that requests on average cannot exceed 20 milliseconds.

You need to implement a log analytics query to generate the SLA report.

How should you complete the query?

Facebook Twitter LinkedIn Google + Email