AZ-700 question patterns

Application Gateway v2 with WAF.

It's the regional HTTP load balancer and reverse proxy. Load Balancer sees only layers 3 and 4.

Azure Front Door Standard or Premium.

Anycast edge, split TCP and CDN caching in one global service.

Traffic Manager with Priority or Performance routing.

It answers DNS queries only, so it works for any protocol. Failover time depends on TTL.

Global-tier Standard Load Balancer in front of regional public load balancers.

Layer 4 global anycast with fast failover, TCP and UDP only.

Virtual WAN Standard.

Automated transitive routing between branches, VNets and ExpressRoute.

A subnet named GatewaySubnet, /27 or larger, with no NSG.

The gateway needs the exact name and room for two instances.

Allow gateway transit on the hub peering and Use remote gateways on each spoke.

Peering is non-transitive. These two settings share the gateway.

UDRs in each spoke with next hop virtual appliance (firewall IP) and allow forwarded traffic on peerings.

Peering alone isn't transitive and doesn't inspect.

AVNM with network groups, a hub-and-spoke or mesh connectivity configuration and security admin rules.

Central, dynamic, and security admin rules are evaluated before NSGs.

Azure Route Server in RouteServerSubnet with BGP peering to the NVA.

It injects NVA routes into VNet route tables without manual UDRs.

NAT Gateway on the subnet with a public IP prefix.

64,512 ports per IP, up to 16 IPs, and it overrides other outbound methods.

UDR 0.0.0.0/0 to the VPN gateway (or BGP default route). Azure Firewall needs a management subnet.

The default route has to leave through the tunnel.

BYOIP: /24 minimum, ROA, provision then commission.

You prove ownership and Microsoft advertises the range.

A conditional forwarder on-premises to the Private Resolver inbound endpoint.

Private zones only answer inside linked VNets or through a resolver.

Outbound endpoint plus a forwarding ruleset linked to the VNets.

It replaces forwarder VMs.

Policy-based VPN (Basic SKU) or route-based with policy-based traffic selectors.

Route-based is the default for everything else.

Route-based gateway VpnGw1 or higher.

Only route-based supports them.

VpnGw#AZ with zone-redundant Standard public IPs.

The gateway instances are placed across zones.

P2S with Microsoft Entra ID auth and OpenVPN and the Azure VPN Client.

Entra auth is OpenVPN only.

P2S with RADIUS authentication.

The gateway forwards to your RADIUS server.

OpenVPN (TCP 443) with IKEv2 enabled too.

SSTP is Windows only and capped at 128 connections.

ExpressRoute circuit with private peering and an ER gateway.

Dedicated private connection with an SLA.

ExpressRoute Premium SKU.

Standard stays within a geopolitical region and 10 links.

Global Reach between circuits (private peering).

It links circuits to each other, not to VNets.

FastPath on an Ultra Performance or ErGw3AZ gateway.

It bypasses the gateway on the data path.

MACsec on ExpressRoute Direct, or IPsec VPN over ExpressRoute.

ExpressRoute isn't encrypted by default.

Microsoft peering with a route filter and public prefixes.

Private peering carries only private VNet traffic.

Enable floating IP (Direct Server Return) on the rule.

The listener IP must be accepted by the VM.

HA ports rule on an internal Standard Load Balancer.

One rule balances all TCP and UDP flows.

Gateway Load Balancer chained to the frontend.

VXLAN chaining avoids UDRs and SNAT.

NSG must allow the AzureLoadBalancer tag (168.63.129.16).

Probes come from that address.

HTTPS backend settings plus trusted root or well-known CA cert.

Offload alone leaves the last hop unencrypted.

Front Door Premium with Private Link and approve the connection.

Premium only. The origin owner approves.

AzureFrontDoor.Backend tag and X-Azure-FDID header check.

The tag alone allows any Front Door profile.

Private endpoint, private DNS zone and a conditional forwarder.

Service endpoints aren't reachable from on-premises.

Link the privatelink zone to the VNet (or forward to a resolver that sees it).

Peering doesn't share private zones.

Private Link service behind a Standard LB with an alias and approval.

Consumers create private endpoints to it.

Service endpoint plus storage VNet rule.

No cost and no DNS changes.

A service endpoint policy listing allowed accounts.

It prevents exfiltration to other accounts.

Security admin rule with Always Allow or Deny.

Evaluated before NSGs and skips them.

Application security groups in the same VNet.

Rules follow NICs, not IPs.

Network Watcher IP flow verify.

It names the allow or deny rule.

Virtual network flow logs plus Traffic Analytics.

They replace NSG flow logs.

Azure Bastion in an AzureBastionSubnet (/26).

TLS 443 from the portal to private VMs.

Azure Firewall Premium.

Standard and Basic don't offer them.

Parent policy with child policies.

Hierarchical policy inheritance.

Azure Firewall in the hub with routing intent.

Routing policies steer traffic through it.

WAF policy on Application Gateway or Front Door Premium.

Managed rule sets target OWASP-style attacks.

Run Detection, add exclusions, then Prevention.

Detection logs without blocking.

Add a WAF exclusion for that field or rule.

It fixes the false positive without disabling protection.