AZ-700 Designing and Implementing Microsoft Azure Networking Solutions Questions and Answers

Here are the steps and explanations for ensuring that requests for wwwjelecloud.com from any of your Azure virtual networks resolve to frontdoor1.azurefd.net:

To use a custom domain with your Azure Front Door, you need to create a CNAME record with your domain provider that points to the Front Door default frontend host.  A CNAME record is a type of DNS record that maps a source domain name to a destination domain name 1 .

To create a CNAME r ecor d, you need to sign in to your domain registrar’s website and go to the page for managing DNS settings 1 .

Creat e a CNAME record with the followin g information 1 :

Source domain name: wwwjelecloud.com

Destination domain name: frontdoor1.azurefd.net

Save your changes and wait for the DNS propagation to take effect 1 .

To verify the custom domain, you need to go to the Azure portal and select your Front Door profile.  Then select Domains un der Settings and select Add 2 .

On the Add a domain page, select Non-Azure validated domain as the Domain type and enter wwwjeleclou d.com as the Domain name.  Then select Add 2 .

On the Domains page, select wwwjelecloud.com and select Verify.  This will check if the CNAME record is correctly configured 2 .

Once the domain is verified, you can associate it with your Front Door endpoint. On the Domains page, select wwwjelecloud.com and select Associate endpoint.  Then select your Front Door endpoint from the drop-down list and select Associa te 2 .

To ensure that only hosts on VNET1 can access the slcnage42150372 storage account and that access occurs over the Azure backbone network, you can use  Azure Private Endpoints . This method secures the connection by assigning a private IP address from your virtual network to the storage account, ensuring that traffic does not traverse the public internet.

Step-by-Step Solution

Step 1: Create a Private Endpoint for the Storage Account

Navigate to the Azure Portal .

Search for “Storage accounts”  and select the slcnage42150372 storage account.

In the storage account blade , select  “Networking”  under the “Security + networking” section.

Under “Private endpoint connections” , click on  “Add private endpoint” .

Enter the following details :

Name : Enter a name for the private endpoint (e.g., PrivateEndpoint-VNET1).

Region : Select the same region as your virtual network (VNET1).

Click on “Next: Resource” .

Step 2: Configure the Resource

Select “Target sub-resource” : Choose the storage service you want to connect to (e.g., blob, file, queue, table).

Click on “Next: Virtual network” .

Step 3: Select the Virtual Network and Subnet

Select the virtual n etwork : Choose VNET1.

Select the subnet : Choose the appropriate subnet within VNET1.

Click on “Next: Configuration” .

Step 4: Configure DNS Integration (Optional)

Configure DNS settings  if needed to ensure proper name resolution within your virtual network.

Click on “Next: Tags” , add any tags if necessary, and then click on  “Review + create” .

Review your settings  and click on  “Create” .

Step 5: Restrict Public Network Access

Navigate back to the storage account .

Select “Networking”  under the “Security + networking” section.

Under “Firewalls and virtual networks” , select  “Selected networks” .

Ensure that only VNET1 is listed  under the virtual networks section.

Click on “Save” .

Explanation

Private Endpoints : These provide secure connectivity to Azure services by assigning a private IP address from your VNet to the service, ensuring that traffic stays wit hin the Azure backbone ne twork 1 2 .

Firewall and Virtual Networks : Configuring the storage account to allow access only from selected networks (VNET1) ensures that no other network can access the s torage account 3 .

By following these steps, you can ensure that only hosts on VNET1 can access the slcnage42150372 storage account, and that all access occurs over the secure Azure backbone network.

To minimize the risk of SNAT port exhaustion for your 100 virtual machines in subnet4-1, while ensuring minimal administrative effort, you can use an  Azure NAT Gateway . This service provides scalable and resilient outbound connectivity for virtual networks, dynamically allocating SNAT ports to avoid exhaustion.

Navigate to the Azure Portal .

Search for “NAT gateways”  and select it.

Click on “Create” .

Enter the following details :

Subscription : Select your subscription.

Resource Group : Select an existing resource group or create a new one.

Name : Enter a name for the NAT gateway (e.g.,  NATGateway-Subnet4-1 ).

Region : Select the region where your virtual network is located.

Click on “Next: Outbound IP” .

Choose whether to use existing public IP addres ses or create new ones .

If creating new ones, click on  “Add new”  and configure the new public IP addresses.

Click on “Next: Subnet” .

Click on “Associate subnet” .

Select the virtual network  that contains subnet4-1.

Select subnet4-1  from the list of subnets.

Click on “OK” .

Review your settings  to ensure everything is correct.

Click on “Review + create”  and then  “Create” .

Azure NAT Gateway : This service provides outbound connectivity for virtual networks, dynamically allocating SNAT ports across all VM instances within a subnet.  This dynamic allocation helps prevent S NAT port exhaustion, especially in scenarios with high outbound connection volumes 1 2 .

Dynamic S NAT Port Allocation : Unlike static allocati on methods, NAT Gateway dynamically allocates SNAT ports based on demand, ensuring efficient use of availab le ports and reducing the risk of exhaus tion 2 .

Step-by-Step Solution Step 1: Create a NAT Gateway Step 2: Configure Outbound IP Addresses Step 3: Associate the NAT Gateway with Subnet4-1 Step 4: Review and Create Explanation By following these steps, you can ensure that your 100 virtual machines in subnet4-1 can make the necessary API calls without running into SNAT port exhaustion, all while minimizing administrative effort.

Here are the steps and explanations for ensuring that all hosts deployed to subnet3-2 connect to the internet by using the same static public IP address:

To use the same static public IP address for multiple hosts, you need to create a NAT gateway and associate it with subnet3-2.  A N AT gateway is a resourc e that performs network address translation ( N AT) for outbound traffic from a subnet 1 .  It allows you to use a single public IP address for multiple private IP addre sses 2 .

To create a NAT gateway, you need to go to the Azure portal and select Create a resource.  Search for  NAT gateway , select  NAT gat eway , then select  Create 3 .

On the Create a NAT gateway page, enter or sele ct the following information and accept the defaults for the remaining settings:

Subscription: Select your subscription name

Resource group: Select your resource group

Name: Type a unique name for your NAT gateway

Region: Select the same region as your vir tual network

Public IP address: Select Create new and type a name for your public IP address.  Select  Sta ndard  a s the SKU an d  Static  as the assignment method 4 .

Se lect  Review + create  and then select  Create  to c reate your NAT gatewa y 3 .

To associate the NAT gateway with subnet3-2, you need to go to the Virtual networks service in the Azure portal and select your virtual network.

On the Virtual network page, select Subnet s under Settings, and then select subnet3-2 from the list.

On the Edit subnet page, under NAT gateway, select your NAT gateway from the drop-down list. Then select Save.

Here are the steps and explanations for configuring VNET1 to log all events and metrics and query them by using KQL:

To enable logging for VNET1, you need to create a diagnostic setting that collects the platform metrics and logs from the virtual network and routes them to one or more destinations.  You can choose to send the data to a Log Analytics workspace, a storage account, an event hub, or a partner solution 1 .

To create a diagnostic setting, you need to go to the Azure portal and select your virtual network.  Then select Diagnostic settings under Monitoring and select + Add diagnostic s etting 1 .

On the Add diagnostic setting page, enter or select the following information:

Diagnostic setting name: Type a unique name for your diagnostic setting.

Destination details: Select the destination where you want to send the data. For example, you can select Send to Log Analytics workspace and choose your workspace from the list.

Log: Select the categories of logs that you want to collect.  For VNET1, you can select NetworkSecurityGro up Event and NetworkSecurityGroupRuleCounter as the log categories 2 .

Metric: Select AllMetrics to collect all the platform m etrics for VNET1 2 .

Select Save to create your diagnostic se tting 1 .

To query the events and metrics from the Azure portal by using KQL, you need to go to the Log Analytics workspace that you selected as the destination.  Then select Logs under Gener al and enter your KQ L query in the query editor 3 .

For example, you can use the following KQL query to get the top 10 network security group events for VNET1 in the last 24 hours:

NetworkSecurityGr oupEvent

| where TimeGenerated > ago(24h)

| where ResourceId contains " VNET1 "

| summarize count() by EventID

| top 10 by count_

Copy

Select Run to execute your query and view the re sults in a tabl e or a chart 3 .

Here are the steps and explanations for ensuring that hosts on VNET2 can access hosts on both VNET1 and VNET3, but hosts on VNET1 and VNET3 cannot communicate through VNET2:

To connect different virtual networks in Azure, you need to use virtual network peering.  Vir tual network peering allows you to create low-latency, high-bandwidth connections between virtua l networks without using gatew ays or the internet 1 .

To create a virtual network peering, you need to go to the Azure portal and select your virtual network.  The n select Peerings under Settings a nd select + Add 2 .

On the Add peering page, enter or select the following information:

Name: Type a unique name for the peering from the source virt ual network to the destination virtual network.

Virtual network deployment model: Select Resource manager.

Subscription: Select the subscription that contains the destination virtual network.

Virtual network: Select the destination virtual network from the list or enter its resource ID.

Name of the peering from [destination virtual network] to [source virtual network] : Type a unique name for the peering from the destination virtual network to the source virtual network.

Configure virtual network access sett ings: Select Enabled to allow resources in both virtual networks to communicate with each other.

Allow forwarded traffic: Select Disabled to prevent traffic that originates from outside either of the peered virtual networks from being forwarded through eit her of them.

Allow gateway transit: Select Disabled to prevent either of the peered virtual networks from using a gateway in the other virtual network.

Use remote gateways: Select Disabled to prevent either of the peered virtual networks from using a gateway in the other virtual network as a transit point to another network.

Select Add to create the peering 2 .

Repeat the previous steps to create peerings between VNET2 and VNET1, and between VNET2 and VNET3. This will allow hosts on VNET2 to access hosts on both VNET1 and VNET3.

To prevent hosts on VNET1 and VNET3 from communicating through VNET2, you need to use network security groups (NSGs) to filter traffic between subnets.  NSGs are r ules that allow or deny inboun d or outbound traffic based on source o r destination IP address, port, or prot ocol 3 .

To create an NSG, you need to go to the Azure portal and select Create a resource. Search for network security group and select Network security group.  Then select Create 4 .

On the Create a network security group page, enter or select the following information:

Subscription: Select your subscription name.

Resource group: Select your resource group name.

Name: Type a unique name for your NSG.

Region: Select the same region as your virtual networks.

Select Review + create and then select Create to crea te your NSG 4 .

To add rules to your NSG, you need to go to the Network security groups service in the Azure portal and select your NSG.  T hen select Inbound security rule s or Outbound security rules under Settings and select + Add 4 .

On the Add inbound security rule page or Add outbound security rule page, enter or select the following information:

Source or Destination: Select CIDR block.

Source CIDR blocks or Destinatio n CIDR blocks: Enter the IP address range of the source or destination subnet that you want to filter. For example, 10.0.1.0/24 for VNET1 subnet 1, 10.0.2.0/24 for VNET2 subnet 1, and 10.0.3.0/24 for VNET3 subnet 1.

Protocol: Select Any to apply the rule t o any protocol.

Action: Select Deny to block traffic from or to the source or destination subnet.

Priority: Enter a number between 100 and 4096 that indicates the order of evaluation for this rule. Lower numbers have higher priority than higher numbers.

Na me: Type a unique name for your rule.

Select Add to create your rule 4 .

Repeat the previous steps to create inbound and outbound rules for your NSG that deny traffic between VNET1 and VNET3 subnets. For example, you can create an inbound rule that denies traffic from 10.0.1.0/24 (VNET1 subnet 1) to 10.0.3.0/24 (VNET3 subnet 1), and an outbound rule that denies traffic from 10.0.3.0/24 (VNET3 subnet 1) to 10.0.1.0/24 (VNET1 subnet 1).

To associate your NSG with a subnet, you need to go to the Virtual networks service in the Azure portal a nd select your virtual network.  Then select Subnets under Settings and select the subnet that you want to associ ate with y our NSG 5 .

On the Edit subnet page, under Network security group, select your NSG from the drop-down list.  Then select Save 5 .

Repeat the previous steps to associate your NSG with the subnets in VNET1 and VNET3 that you want to isolate from each other.

Box 1: No

Zone2.contoso.com is not linked to any virtual networks. Therefore, no VMs are able to resolve names in the zone.

Box 2: Yes

VM4 is in VNet3. Zone1.contoso.com has a link to VNet3 and auto-registration is enabled on the link.

Box3: No

VNet3 is linked to zone1.contoso.com and auto-registration is enabled on the link. A virtual network can only have one registration zone. You can link zone2.contoso.com to VNet3 but you won’t be able to enable auto-registration on the link.

There is no virtual network peering between VM4’s VNet (VNet3) and VM5’s VNet (VNet4). To enable the VMs to communicate over the Microsoft backbone network a VNet peering is required between VNet3 and VNet4.

NGS1 only

VM2, VM3, VM4 and VM5

Box 1: VM2, VM3 and VM4.

VM1 is in VNet1/Subnet1. VNet1 is peered with VNet2 and VNet3.

There are no NSGs blocking outbound ICMP from VNet1. There are no NSGs blocki ng inbound ICMP to VNet1/Subnet2, VNet2 or VNet3. Therefore, VM1 can ping VM2 in VNet1/Subnet2, VM3 in VNet2 and VM4 in VNet3.

Box 2:

VM4 is in VNet3. VNet3 is peered with VNet1 and VNet2. There are no NSGs blocking outbound ICMP from VNet3. There are no NSGs blocking inbound ICMP to VNet1/Subnet1, VNet1/Subnet2 or VNet2 from VNet3 (NSG10 blocks inbound ICMP from VNet4 but not from VNet3). Therefore, VM4 can ping VM1 in VNet1/Subnet1, VM2 in VNet1/Subnet2 and VM3 in VNet2.

No

subnet1(WM1- > NSG1 outbound- > NSG10 outbound)- > subnet2(NSG1 inbound- > NSG11 inbound- > VM2)

Yes

NSG10 blocks ICMP from VNet4 (source 10.10.0.0/16) but it is not blocked from VM2 ג €™s subnet (VNet1 /Subnet2).

No

NSG11 blocks RDP (port TCP 3389) destined for ג €˜VirtualNetwork ג €™. VirtualNetwork is a service tag and means the address space of the virtual network (VNet1) which in this case is 10.1.0.0/16. Therefore, RDP traffic from subnet2 to anywhere else in VNet1 is blocked.

Box 2: One NSG

The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way you would need two custom NSG rules.

Box 1: Two custom rules

With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic f rom VMScaleSet1. Then you would need to create another custom rule with a higher priority than the first rule that allows traffic on port 443.

The default rules in the NSG will allow all other traffic to VMScaleSet2.

For the first question, only ExpressRoute GW SKU Ultra Performance support FastPath feature.

For the second question, vnet1 will connect to ExpressRoute gw, once Vnet1 peers with Vnet2, the traffic from on-premise network will bypass GW and Vnet1, directly goes to Vnet2, while this feature is under public preview.

====Reference

ExpressRoute virtual network gateway is designed to exchange network routes and route network traffic. FastPath is designed to improve the data path performance between your on-premises network and your virtual network. When enabled, FastPath sends network traffic directly to virtual machines in the virtual network, bypassing the gateway.

To configure FastPath, the virtual network gateway must be either:

Ultra Performance

ErGw3AZ

VNet Peering - FastPath will send traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway.

https://docs.microsoft.com/en-us/azure/expressroute/about-fastpath

Gateway SKU

https://docs.microsoft.com/en-us/azure/expressroute/express route-about-virtual-network-gateways

VNet 1 will get the default from BGP and propagate it to VNET 2 and 3

https://techc omm unity.micro soft.com/t5/azure-network-secu r ity-blo g/rate- limiting-feature-for-azure- waf-on-application-gateway-now/ba-p/3934957#:~:text=Rate%20limiting%20is%20configured%20using,and%20a%20group%20by%20variable .

Only static IPv4 addresses in the Standard SKU are supported. IPv6 doesn’t support NAT.