A company has a critical application with a public IP that is protected by DDoS Network Protection on the VNet. They want to receive alerts when an attack is detected. They also want to analyze the attack traffic. What should they do?

Use Azure Monitor for Networks to view DDoS attack alerts.

Configure diagnostic settings on the public IP to send DDoS metrics and logs to a Log Analytics workspace, and create alerts based on those metrics.

Enable NSG flow logs on the subnet to analyze attack traffic.

Use Network Watcher packet capture to capture attack traffic.

A security analyst is using attack path analysis and sees a path that involves a VM with a public IP and a network security group that allows RDP from the internet. The analyst wants to know if the path can be broken by changing the NSG rule or if there are other factors. What should they do?

Use Cloud Security Explorer to query for all VMs with public IPs and RDP rules.

Review the attack path details to see all the conditions and recommendations that contribute to the path.

Check the Secure Score to see if the recommendation is still present.

Run Network Watcher IP flow verify to test the RDP flow.

A user reports that they cannot connect to a VM from the internet. You use Network Watcher IP flow verify from the VM's network interface, specifying the user's public IP as the source and port 443 as the destination port. The test returns 'Access denied' with the security rule 'DenyAllInBound'. What is the most likely cause and what should you do next?

A network security group is blocking the traffic; review the NSG rules and the effective security rules for the subnet or NIC.

The VM is not running; start the VM and rerun IP flow verify.

The user's public IP is not allowed by the Azure Firewall; add a DNAT rule to the firewall.

The VM has no public IP address; assign a public IP and rerun the test.

Microsoft Certified:Azure Network Engineer Associate

Domain 1Objective 4

Monitor Networks AZ-700 Practice Questions (Page 6)

Part of the Design and implement core networking infrastructure domain, which accounts for 25–30% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~10–20 in this domain), expect 3–5 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

25–30%of the exam

Questions 26–30

26expert · hard
A company has a critical application with a public IP that is protected by DDoS Network Protection on the VNet. They want to receive alerts when an attack is detected. They also want to analyze the attack traffic. What should they do?
Select an answer first
27expert · hard
A security analyst is using attack path analysis and sees a path that involves a VM with a public IP and a network security group that allows RDP from the internet. The analyst wants to know if the path can be broken by changing the NSG rule or if there are other factors. What should they do?
Select an answer first
28application · medium
A user reports that they cannot connect to a VM from the internet. You use Network Watcher IP flow verify from the VM's network interface, specifying the user's public IP as the source and port 443 as the destination port. The test returns 'Access denied' with the security rule 'DenyAllInBound'. What is the most likely cause and what should you do next?
Select an answer first
29application · medium
A VM in Azure is experiencing intermittent connectivity issues. You suspect that a network security group is dropping some traffic. You want to see the actual traffic flows that are being allowed or denied by the NSG. Which Network Watcher tool should you use?
Select an answer first
30foundation · easy
Which Azure Network Watcher feature is used to enable network security group (NSG) flow logs for a virtual network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.

Monitor Networks AZ-700 Practice Questions (Page 6)

Questions 26–30

A company has a critical application with a public IP that is protected by DDoS Network Protection on the VNet. They want to receive alerts when an attack is detected. They also want to analyze the attack traffic. What should they do?

A security analyst is using attack path analysis and sees a path that involves a VM with a public IP and a network security group that allows RDP from the internet. The analyst wants to know if the path can be broken by changing the NSG rule or if there are other factors. What should they do?

A VM in Azure is experiencing intermittent connectivity issues. You suspect that a network security group is dropping some traffic. You want to see the actual traffic flows that are being allowed or denied by the NSG. Which Network Watcher tool should you use?

Which Azure Network Watcher feature is used to enable network security group (NSG) flow logs for a virtual network?

Keep studying — Design and implement core networking infrastructure