Dec-2023 Realistic AZ-720 Accurate & Verified Answers As Experienced in the Actual Test!
Latest Microsoft AZ-720 Practice Test Questions, Troubleshooting Microsoft Azure Connectivity Exam Dumps
Microsoft AZ-720 certification exam consists of multiple-choice questions and is designed to test the candidate's knowledge and skills in troubleshooting connectivity issues in Microsoft Azure. AZ-720 exam covers a wide range of topics, including virtual networking, network security, network monitoring, and troubleshooting tools and techniques. Candidates will be required to demonstrate their ability to diagnose and resolve connectivity issues in a Microsoft Azure environment.
The Microsoft AZ-720 exam covers a range of topics related to Azure connectivity, including troubleshooting virtual network connectivity, troubleshooting virtual machine connectivity, and troubleshooting hybrid connectivity. AZ-720 exam also covers troubleshooting Azure ExpressRoute connectivity and connectivity issues related to Azure VPN Gateway.
NEW QUESTION # 49
A company uses Azure Active Directory (Azure AD) with Azure role-based access control (RBAC) for access
to resources.
Some users report that they are unable to grant RBAC roles to other users.
You need to troubleshoot the issue.
How should you complete the Azure Monitor query?
Answer:
Explanation:
NEW QUESTION # 50
A customer creates an Azure resource group named RG1 in the East US region. RG1 contains the following resources:
The customer performs the following tasks:
Create a private endpoint for sqlsrv1 in subnet2 with the private IP address of 192.168.2.100.
Create a private DNS zone named privatelink.database.windows.net by using a single A record named sqlsvr1 and the IP address 192.168.2.100.
Disable public access by using the public endpoint for sqlsvr1.
The customer reports that connections from VM1 to DB1 are failing. The solution must allow connections from VM1 to DB1 without making platform-level changes.
You need to troubleshoot and resolve the issue.
What should you do?
Answer:
Explanation:
NEW QUESTION # 51
A company deploys the Azure Application Gateway Web Application Firewall (WAF) to protect their web
applications.
Users in a remote office location report the following issues:
* Unable to access part of a web application.
* Part of the web application is failing to load.
* Parts of the web application has activities that are not performing as expected.
You need to troubleshoot the issue.
Which diagnostic log should you review?
- A. Access
- B. Azure Activity
- C. Performance
- D. Firewall
Answer: B
NEW QUESTION # 52
A company uses public Azure DNS zones.
The company reports DNS record creation and name resolution issues.
You need to troubleshoot the issues.
What are the causes of the issues?
Answer:
Explanation:
NEW QUESTION # 53
A company has an Azure point-to-site virtual private network (VPN) that uses certificate-based authentication.
A user reports that the following error message when they try to connect to the VPN by using a VPN client on a Windows 11 machine:
A certificate could not be found
You need to resolve the issue.
Which three actions should you perform?
- A. Configure an Azure Active Directory (Azure AD) tenant.
- B. Install a client certificate on the user's device.
- C. Install a root certificate on the user's device.
- D. Generate a client certificate.
- E. Generate a root certificate.
- F. Enable Azure AD authentication on the gateway
- G. Install a client certificate on the VPN gateway.
Answer: B,C,D
Explanation:
To resolve the issue where a user reports an error message stating "A certificate could not be found" when trying to connect to an Azure point-to-site VPN that uses certificate-based authentication, you should perform the following three actions: B. Install a root certificate on the user's device. F. Generate a client certificate. G. Install a client certificate on the user's device.
Azure point-to-site VPNs that use certificate-based authentication require both a root certificate and a client certificate to be installed on the user's device. The root certificate is used to validate the identity of the VPN gateway, while the client certificate is used to authenticate the user. If either of these certificates is missing or invalid, the user will not be able to connect to the VPN and may receive an error message stating that a certificate could not be found.
NEW QUESTION # 54
A company has an Azure point-to-site virtual private network (VPN) that uses certificate-based authentication.
A user reports that the following error message when they try to connect to the VPN by using a VPN client on a Windows 11 machine:
A certificate could not be found
You need to resolve the issue.
Which three actions should you perform?
- A. Install a client certificate on the user's device.
- B. Enable Azure AD authentication on the gateway
- C. Install a root certificate on the user's device.
- D. Configure an Azure Active Directory (Azure AD) tenant.
- E. Generate a client certificate.
- F. Generate a root certificate.
- G. Install a client certificate on the VPN gateway.
Answer: B,D,F
NEW QUESTION # 55
A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR).
An administrator receives an error that password writeback could not be enabled during the Azure AD
Connect configuration. The administrator observes the following event log error:
Error getting auth token
You need to resolve the issue.
What should you do?
- A. Configure Azure AD Connect using a global administrator account that is not federated.
- B. Restart the Azure AD Connect service.
- C. Disable password writeback and then enable password writeback using the Azure AD Connect configuration.
- D. Configure Azure AD Connect using a global administrator account with a password that is less than 256 characters.
Answer: D
NEW QUESTION # 56
A company manages a solution that uses Azure Functions.
A function returns the following error: Azure Function Runtime is unreachable.
You need to troubleshoot the issue.
What are two possible causes of the issue?
- A. The function key was deleted.
- B. The storage account for the function was deleted.
- C. The storage account application settings were deleted.
- D. The execution quota is full.
- E. The company did not configure a timer trigger.
Answer: B,C
Explanation:
Two possible causes of the issue where a function returns the error "Azure Function Runtime is unreachable" are: C. The storage account application settings were deleted. E. The storage account for the function was deleted.
According to Microsoft, this issue occurs when the Functions runtime can't start. The most common reason for this is that the function app has lost access to its storage account. If that account is deleted or if the storage account application settings were deleted, your functions won't work
https://learn.microsoft.com/en-us/azure/azure-functions/functions-recover-storage-account
NEW QUESTION # 57
A company deploys a new file sharing application on four Standard_D2_v3 virtual machines (VMs) behind an Azure Load Balancer. The company implements Azure Firewall.
Users report that the application is slow during peak usage periods. An engineer reports that the peak usage for each VM is approximately 1 Gbps.
You need to implement a solution that support a minimum of 10 Gbps.
What should you do to increase the throughput?
- A. Request an increase in networking quotas.
- B. Move two of the servers behind a separate load balancer and configure round robin routing in Traffic Manager.
- C. Disable the Azure Firewall and implement network security groups in its place.
- D. Increase the size of the VM instance.
Answer: D
Explanation:
According to the given scenario, the application deployed on four Standard_D2_v3 virtual machines behind an Azure Load Balancer is experiencing slow performance during peak usage periods It is reported that the peak usage for each VM is approximately 1 Gbps, and the goal is to increase the throughput to a minimum of 10 Gbps.
To achieve this goal, the best option is to increase the size of the VM instance. The Standard_D2_v3 virtual machine size has a maximum network bandwidth of 1 Gbps, so increasing the size of the VM instance to a higher tier, such as Standard_D8_v3 or higher, will provide more network bandwidth and improve the application's performance.
Option A, requesting an increase in networking quotas, may not be sufficient to achieve the required network bandwidth.
Option C, disabling the Azure Firewall and implementing network security groups, may not have a significant impact on the network bandwidth.
Option D, moving two of the servers behind a separate load balancer and configuring round-robin routing in Traffic Manager, may improve availability and performance but will not increase the network bandwidth.
Source: [1] https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes-general [2] https://docs.microsoft.com/en-us/azure/virtual-network/designing-hub-spoke-topologies#optimize-data-transfer-between-hub-and-spoke-vnets
NEW QUESTION # 58
A company deploys Azure Bastion to connect to their virtual machine (VM) infrastructure.
An engineer attempts to connect to a Windows VM by using Remote Desktop Protocol (RDP). The connection fails.
You need to troubleshoot the issue.
Which two actions should you perform?
- A. Monitor traffic with the following PowerShell cmdlet Test-AzNetworkWatcherConnectivity.
- B. Run the Network Watcher Connection troubleshoot service.
- C. Apply a network security group on the same subnet as Azure Bastion.
- D. Monitor traffic with the following PowerShell cmdlet New-AzNetworkWatcherFlowLog.
- E. Configure Azure Bastion with static assignment.
Answer: A,B
Explanation:
The two actions that should be performed to troubleshoot the issue of a failed RDP connection to a Windows VM through Azure Bastion are A) Monitor traffic with the PowerShell cmdlet 'Test-AzNetworkWatcherConnectivity' and D) Run the Network Watcher Connection troubleshoot service.
A) Monitor traffic with the PowerShell cmdlet 'Test-AzNetworkWatcherConnectivity': This cmdlet can be used to verify connectivity between two endpoints in Azure. By monitoring traffic, you can identify the root cause of issues with the VM's connectivity through Azure Bastion.
D) Run the Network Watcher Connection troubleshoot service: This service can help identify the root cause of connectivity issues with Azure resources. It analyses network traffic to identify common misconfiguration issues and provides guidance on how to resolve them.
NEW QUESTION # 59
A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).
A new subnet should be unreachable from the on-premises network.
You need to implement a solution.
Solution: Configure a route table with route propagation disabled.
Does the solution meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
The proposed solution of configuring a route table with route propagation disabled will not meet the goal of making the new subnet unreachable from the on-premises network.
Route tables in Azure are used to control traffic flow within a virtual network and between virtual networks. By default, each subnet in an Azure virtual network is associated with a system-generated route table, which contains a default route that enables traffic to flow to and from all the subnets within the virtual network.
Disabling route propagation in a custom route table would prevent any new routes from being propagated to the associated subnets. However, it would not prevent traffic from the on-premises network from reaching the new subnet since traffic between the virtual network and the on-premises network would still use the default route in the system-generated route table.
To meet the goal of making the new subnet unreachable from the on-premises network, you would need to create a new route table with a route that sends traffic destined for the new subnet to a null interface. This would cause the traffic to be dropped and the subnet to be effectively unreachable from the on-premises network.
Reference:
Microsoft documentation on how to create a custom route table and associate it with a subnet: https://docs.microsoft.com/en-us/azure/virtual-network/manage-route-table#create-a-custom-route-table.
Microsoft documentation on how to configure a route to a null interface: https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal#to-route-to-a-null-interface.
NEW QUESTION # 60
A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.
The company reports that the Azure VM backup job is failing.
You need to troubleshoot the issue.
Solution: Create a new manual backup in Backup center.
Does the solution meet the goal?
- A. Yes
- B. No
Answer: A
NEW QUESTION # 61
A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).
A new subnet should be unreachable from the on-premises network.
You need to implement a solution.
Solution: Disable peering on the virtual network.
Does the solution meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
Disabling peering on the virtual network will not prevent the on-premises network from reaching the new subnet. Virtual network peering is a way to connect virtual networks and allows resources in both virtual networks to communicate with each other securely. It does not affect connectivity between on-premises and virtual network resources.
A better solution would be to create a network security group (NSG) and associate it with the new subnet. The NSG can be configured to deny traffic from the on-premises network to the new subnet. This way, the new subnet will be isolated from the on-premises network.
Reference:
Azure Virtual Network peering: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview Azure Network Security Groups: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
NEW QUESTION # 62
You need to troubleshoot the issue with SRV2.
Which PowerShell cmdlet should you run?
- A. Get-MsolDomamFederationSettings
- B. Confirm-MsolDomain
- C. Get-MsolServicePrincipalCredential
- D. Get-Mousers
- E. Get-MsolDomamVerificationDns
Answer: C
Explanation:
To troubleshoot the issue with SRV2, you need to run the Get-MsolServicePrincipalCredential PowerShell cmdlet, which returns the credentials that are associated with a service principal in Azure AD. The service principal is an identity that represents an application or a service that interacts with Azure AD. In this case, the service principal is used by the NPS extension for Azure AD MFA to communicate with Azure AD and perform MFA requests. The credentials of the service principal include a certificate and a key that are used to authenticate the service principal to Azure AD. If the credentials are expired or invalid, the MFA requests will fail with a security token error. To resolve this issue, you need to renew the credentials of the service principal by using the New-MsolServicePrincipalCredential cmdlet.
NEW QUESTION # 63
A company has an Azure virtual network (VNet). An administrator creates a subet in the VNet named AzureSastionSubnet. The administrator deploys Azure Bastion to AzureBastionSubnet.
The administrator creates a default network security group named nsg-Bastion. The following error message display when the administrator attempts to assign nsg-Bastion to AzureBastionSubnet:
Network security group nsg-Bastion does not have necessary rules for Azure Bastion Subnet AzureBastionSubnet You need to resolve the issues with the inbound security rules.
Which port or set of ports should you configure?
Answer:
Explanation:
NEW QUESTION # 64
A company has an Azure Active Directory (Azure AD) tenant. The company deploys Azure AD Connect to synchronize users from an Active Directory Domain Services (AD DS).
The synchronization of a user object is failing.
You need to troubleshoot the failing synchronization by using a built-in Azure AD Connect troubleshooting task.
Which two pieces of information should you collect before you start troubleshooting?
- A. AD connector name
- B. Object globally unique identifier
- C. Object distinguished name
- D. Azure AD connector name
- E. Object common name
Answer: B,D
NEW QUESTION # 65
A company uses Azure Backup Server to back up re deployed in an availability group.
The company reports that a backup operation for a database fails. The following error message displays:
Unable to configure protection.
You need to ensure that the backup operation runs successfully.
What should you do?
- A. Configure the availability group replicas to allow read and write operations on the SQL Server instance.
- B. Run the following command on the backup server: net stop OBEngine
- C. Add the Sysadmin role to the system account on the SQL Server instance.
- D. Add a partitioned drive to the storage pool on the backup server.
Answer: C
Explanation:
To ensure that the backup operation for a database in an availability group using Azure Backup Server runs successfully, you should add the Sysadmin role to the system account on the SQL Server instance. The system account on the SQL Server instance must have the Sysadmin role to perform backup operations. So the correct answer is B. Add the Sysadmin role to the system account on the SQL Server instance.
You can find more information about Azure Backup Server and its requirements in the official Microsoft documentation.
NEW QUESTION # 66
You need to resolve the issue with internet traffic from VM1 being routed directly to the internet.
What should you do?
- A. Associate RT12 with Subnet2a.
- B. Associate RT12 with Subnet1a.
- C. Modify IP address prefix of RT12
- D. Modify the next hop type of RT12.
Answer: B
Explanation:
This will ensure that the route table RT12, which has a route to direct internet traffic to the virtual network gateway VNG1, is applied to the subnet where VM1 is located. This will override the default route that sends internet traffic to the internet gateway.
NEW QUESTION # 67
......
Free AZ-720 Exam Files Downloaded Instantly 100% Dumps & Practice Exam: https://actualtests.vceengine.com/AZ-720-vce-test-engine.html
