Users report intermittent connectivity to a web app hosted on an Azure VM. The VM is behind a public load balancer. You need to determine whether the load balancer's health probe is failing and whether the VM's OS is accepting traffic on the probe port. Which two Network Watcher tools should you use together?

Connection monitor and NSG flow logs

IP flow verify and effective security rules

Connection troubleshoot and packet capture

Load balancer health probe metrics in Azure Monitor and IP flow verify

A security team wants to reduce their Secure Score by remediating network recommendations. They have limited time and want to focus on recommendations that also reduce attack paths. What should they prioritize?

Recommendations that appear in attack path analysis and have a high potential score increase.

Recommendations that are easiest to implement.

Recommendations that are required for compliance.

Recommendations with the highest number of affected resources.

A company has DDoS Network Protection enabled on a virtual network. During an attack, they want to automatically block the attacker's IP addresses at the network layer and also want to see the attack traffic in near real-time. What should they configure?

Network Watcher packet capture to record the attack and then manually block IPs.

DDoS protection policies with automatic tuning and diagnostic logs to a Log Analytics workspace.

NSG flow logs to identify attacker IPs and then create NSG rules to block them.

Azure Firewall with threat intelligence-based filtering.

Your organization has a complex Azure environment with many VNets, subnets, and NSGs. You need to identify all NSGs that have rules allowing inbound traffic from the internet on port 22, and then determine which of those NSGs are part of an attack path to a critical asset. Which two tools should you use?

Azure Monitor for Networks to find the NSGs, and Cloud Security Explorer to determine attack paths.

Network Watcher topology to find the NSGs, and secure score to determine criticality.

Cloud Security Explorer to find the NSGs, and attack path analysis to determine if they are part of an attack path.

Attack path analysis to find the NSGs, and secure score to determine criticality.

Microsoft Certified:Azure Network Engineer Associate

Domain 1Objective 4

Monitor Networks AZ-700 Practice Questions (Page 4)

Part of the Design and implement core networking infrastructure domain, which accounts for 25–30% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~10–20 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

25–30%of the exam

Questions 16–20

16expert · hard
A network administrator is troubleshooting a connectivity issue between a VM and an on-premises server over a Site-to-Site VPN. The VM can reach the on-premises server, but performance is poor. They suspect packet loss. They want to use Network Watcher to diagnose the issue. Which tool should they use?
Select an answer first
17application · medium
Users report intermittent connectivity to a web app hosted on an Azure VM. The VM is behind a public load balancer. You need to determine whether the load balancer's health probe is failing and whether the VM's OS is accepting traffic on the probe port. Which two Network Watcher tools should you use together?
Select an answer first
18expert · hard
A security team wants to reduce their Secure Score by remediating network recommendations. They have limited time and want to focus on recommendations that also reduce attack paths. What should they prioritize?
Select an answer first
19expert · hard
A company has DDoS Network Protection enabled on a virtual network. During an attack, they want to automatically block the attacker's IP addresses at the network layer and also want to see the attack traffic in near real-time. What should they configure?
Select an answer first
20expert · hard
Your organization has a complex Azure environment with many VNets, subnets, and NSGs. You need to identify all NSGs that have rules allowing inbound traffic from the internet on port 22, and then determine which of those NSGs are part of an attack path to a critical asset. Which two tools should you use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.

Monitor Networks AZ-700 Practice Questions (Page 4)

Questions 16–20

A security team wants to reduce their Secure Score by remediating network recommendations. They have limited time and want to focus on recommendations that also reduce attack paths. What should they prioritize?

A company has DDoS Network Protection enabled on a virtual network. During an attack, they want to automatically block the attacker's IP addresses at the network layer and also want to see the attack traffic in near real-time. What should they configure?

Keep studying — Design and implement core networking infrastructure