AZ-700 Practice Questions

To configure a policy in Azure API Management that can be used by an Azure Application Gateway to protect against known web attack vectors and only allow requests from IP addresses in Canada, follow these steps:

Step-by-Step Solution

Step 1: Create or Access Your API Management Instance

Navigate to the Azure Portal .

Search for “ API Management services”  and select your API Management instance.

Step 2: Configure the Policy

In the API Management instance , go to the  “APIs”  section.

Select the API  you want to apply the policy to.

Go to the “Design” tab .

Select “All operations”  if you want to apply the policy to all operations, or select a specific operation.

Step 3: Add the Inbound Policy

In the Inbound processing section , click on  “+ Add policy” .

Select “IP filter”  from the list of policies.

Add the IP address ranges for Canada . You c an find the IP ranges for Canada from a reliable source or use a service that provides this information.

Here is an example of the XML configuration for the policy:

< inbound >

< ip-filter action= " allow " >

< address-range from= " 24.0.0.0 " to= " 24.255.255.255 " / >

< address-range from= " 47.0.0.0 " to= " 47.255.255.255 " / >

< !-- Add other Canadian IP ranges as needed -- >

< /ip-filter >

< ip-filter action= " deny " >

< address-range from= " 0.0.0.0 " to= " 255.255.255.255 " / >

< /ip-filter >

< /inbound >

Save the policy  to apply the changes.

Explanation

IP Filter Policy : This policy allows you to filter incoming requests based on their IP addresses. By specifying the IP ranges for Canada, you ensure that only requests originating from these IPs are allowed.

Inbound Processing : Applying the policy in the inbound section ensures that the requests are filtered before they reach your API.

By following these steps, you can configure a polic y in Azure API Management that res tricts a ccess to your API to only those requests ori ginating from IP ad dresses in Canada, thereby enhancing security and compliance

To achieve the task of ensuring that virtual machines on VNET1 and VNET2 are included automatically in a DNS zone named contoso.azure, and that they can resolve the names of the virtual machines on either virtual network, you can follow these steps:

Step-by-Step Solution

Step 1: Create a Private DNS Zone

Navigate to the Azure Portal .

Search for “Private DNS zones”  in the search bar and select it.

Click on “Create” .

Enter the DNS zone name  as contoso.azure.

Select the appropriate subscription  and resource group.

Click on “Review + create”  and then  “Create” .

Step 2: Link VNET1 and VNET2 to the DNS Zone

Go to the newly created DNS zone  (contoso.azure).

Select “Virtual network links”  from the left-hand menu.

Click on “Add” .

Enter a name  for the link (e.g., VNET1-link).

Select the subs cription  and  virtual network (VNET1) .

Enable auto-registration  to ensure that VMs are automatically registered in the DNS zone.

Click on “OK” .

Repeat the process  for VNET2.

Step 3: Configure DNS Settings for VNET1 and VNET2

Navigate to VNET1  in the Azure P ortal.

Select “DNS servers”  under the “Settings” section.

Ensure that the DNS server is set to “Default (Azure-provided)” .

Repeat the process  for VNET2.

Step 4: Verify Name Resolution

Deploy a virtual machine  in VNET1 and another in VNET2.

Connect to the v irtual machines  using Remote Desktop Protocol (RDP) or Secure Shell (SSH).

Test name resolution  by pinging the VM in VNET2 from the VM in VNET1 using its hostname (e.g., ping < VM-name > .contoso.azure).

Explanation

Private DNS Zone : This allows you to manage and resolve domain names in a private network without exposing them to the public internet.

Virtual Network Links : Linking VNET1 and VNET2 to the DNS zone ensures that VMs in these networks can register their DNS records automatically.

Auto-registration : This feature automatically registers the DNS records of VMs in the linked virtual networks, simplifying management.

DNS Settings : Using Azure-provided DNS ensures that the VMs can resolve each other’s names without additional configuration.

By following these steps, you ensure that virtual machines on VNET1 and VNET2 are included automatically in the DNS zone contoso.azure and can resolve each other’s names seamlessly.

To ensure that all traffic to the internet from subnet3-1 is forwarded to the appliance in subnet3-2 for packet inspection, you can use  User-Defined Routes (UDRs)  to direct the traffic. Here’s how you can do it:

Navigate to the Azure Portal .

Search for “Route tables”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the route table (e.g.,  RouteTable-Subnet3-1 ).

Region : Select the region where your virtual network is located.

Click on “Review + create”  and then  “Create” .

Navigate to the newly created route table .

Select “Routes”  from the left-hand menu.

Click on “Add”  to create a new route.

Enter the following details :

Route name : Enter a name for the route (e.g.,  RouteToAppliance ).

Address prefix : Enter  0.0.0.0/0  to route all internet traffic.

Next hop type : Select  Virtual appliance .

Next hop address : Enter the IP address of the appliance ( 10.3.2.100 ).

Click on “OK”  to add the route.

Navigate to the route table .

Select “Subnets”  from the left-hand menu.

Click on “Associate” .

Select the virtual network  that contains subnet3-1.

Select subnet3-1  from the list of subnets.

Click on “OK” .

User-Defined Routes (UDRs) : These allow you to control the routing of traffic within your virtual network.  By defining a route that directs all internet-bound traffic to the appliance, you ensure that the traffic is inspected before it reaches the internet 1 .

Virtual Appliance : This is a ne twork appliance that performs specif i c functions, such as packet inspection, and is treated as a next hop in the routin g table 2 .

Route Table Association : Associating the route table with subnet3-1 ensures that all traffic from this subnet follows the defined routes.

Step-by-Step Solution Step 1: Create a Route Table Step 2: Add a Route to the Route Table Step 3: Associate the Route Table with Subnet3-1 Explanation By following these steps, you can ensure that all internet-bound traffic from subnet3-1 is forwarded to the appliance in subnet3-2 for inspection, thereby enhancing your network security.

To create an Azure Firewall instance, you need to go to the Azure portal and select Create a resource. Type firewall in the search box and press Enter.  Sel ect Firewall and then select Create 1 .

To assign an IP address from the address range of 1 0.1.255.0/24 to the firewall, you need to select a public IP address that belongs to that range.  You can either create a new public IP address or use an existing one 1 .

To use a new Premium firewall policy named FW-policy1, you need to select Premium as the Firewall tier and c reate a new policy with the name FW-policy1 2 .  A Pre mium firewall pol icy allows you t o configure ad vanced features such as TLS Inspection, IDPS, URL Filtering, and Web Categories 3 .

To route traffic directly to the internet, you need to enable SNAT (Source Network Address Translation) for the firewall.  SNAT allows the firewall to use its pub lic IP address as the source address for out bound t raffic 4 .