Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AZ-104 > Virtual Networking > Flashcards

Virtual Networking Flashcards

1
Q

What type of DNS record should you create to ensure Azure can verify the domain name?

A

MX
TXT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does a NS record do?

A

Tells recursive name servers which name servers are authoritative for a zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

If you have a registered DNS domain and then create a public Azure DNS zone with the same name, how do you ensure the records created in the zone are resolvable?

A

Modify the NS records in the DNS domain registrar so they point to your Azure DNS NS records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the benefit of having multiple NS records?

A

Redundancy of your DNS service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How would you create Azure AD DNS records in a custom domain for a domain you already registered?

A
  • Add the custom domain name to your directory
  • Add a DNS entry for the domain name at the registrar
  • Verify the custom domain name
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which IP addresses are reserved by Azure in each subnet?

A

.0 network address
.1 gateway address
.2 and .3 DNS
.255 broadcast

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Whats the smallest possible subnet in Azure? (CIDR)

A

/29
3 possible addresses (8 addresses, but 5 are reserved)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What networking solution provides network load balancing between virtual machines that reside inside a cloud service or a virtual network with a regional scope?

A

Azure Internal Load Balancer (ILB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What networking tool provides SQL injection protection?

A

Azure Web Application Firewall (WAF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What protection does an application gateway with Azure Web Application Firewall (WAF) provide?

A

Centralized protection of your web apps from common exploits and vulnerabilities; like SQL injections and cross-site scripting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a virtual hub?

A
  • A Microsoft-manged VNET
  • The hub contains various service endpoints to enable connectivity; the core of your network in a region
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What do Azure Private DNS zones do?

A

Provide name resolution within a virtual network and between virtual networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Azure Log Analytics workspace?

A

A unique Log Analytics environment with its own data repository, data sources, and solutions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What do NSG flow logs allow you to view?

A

Information about ingress and egress IP traffic through a NSG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What additional capabilities does a Standard load balancer offer over a Basic load balancer?

A
  • Supports diagnostics
  • Global VNet Peering support
  • Compatible with Availability Zones
  • Supports HA ports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What might prevent you from being able to peer two VNets?

A

Address spaces overlapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does a backend pool define?

A
  • Critical component of the load balancer
  • The group of resources that will serve traffic for a given load-balancing rule
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is a floating IP?

A
  • Enables traffic to bypass the load balancer and go directly to the backend servers
  • Enables multiple applications in the backend pool to use the same port
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why might you use a floating IP?

A
  • If you want to reuse the backend port across multiple rules
  • Clustering for high availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What should you do if you make changes to the topology of your network and have Windows VPN clients?

A

The VPN client package for Windows clients must be downloaded and installed again in order for the changes to be applied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does enabling auto registration on an azure DNS private zone do?

A

Makes it so when you link a VNet with a private DNS zone, a DNS record gets created for each VM deployed in the VNet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are some restrictions Azure has in place for auto registration?

A
  • Only works for VMs
  • Only can be used by private Azure DNS zones
  • Only created for one NIC, and NIC needs to be using DHCP
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What subnets can you assign a NSG to?

A

A subnet in the same region of the NSG

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How would you add or delete address ranges from a VNet’s address space if the VNet is already peered?

A

Remove peering
Make changes
Recreate peering

Now (2022) you can make changes and sync the networks after changes are complete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Are you able to move a NIC across RGs?

A

Yes, but the location will not change

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

How would you enable a webapp to access the resources in a VNet?

A

Connect the webapp to the VNet using webapp VNet integration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What does enabling session persistence do?

A

Maps a client’s session to a specific server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the default port for RDP?

A

TCP port 3389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

With what tool does Azure DNS support importing and exporting zone files?

A

Azure CLI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What does an inbound NAT rule do?

A

Forwards incoming traffic to a specific VM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does a load balancer rule do?

A

Forward traffic to a backend pool

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What can a basic load balancer balance traffic between?

A

Backend pool endpoints for VMs in a single availability set or VMSS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What type of DNS zones can you link VNets to?

A

Private zones only

34
Q

What steps are necessary for connecting your on-premises network to Azure using a site-to-site VPN?

A
  • Create a VNet
  • Create a gateway subnet
  • Create a VPN gateway
  • Create a local gateway
  • Create a VPN connection
35
Q

Can you connect VNets in different regions from different subscriptions?

A

Yes, by using a VNet-to-VNet connection

36
Q

What does a Point-to-Site (P2S) VPN gateway connection do?

A

Lets you create a secure connection to your VNet from an individual client computer
Useful when you have only a few clients that need to connect to a VNet

37
Q

What does each client computer need to connect to a VNet using a Point-to-Site connection?

A
  • A client certificate installed
  • You can generate one from the self-signed root certificate, then export and install it
38
Q

What are service endpoints used for?

A

Enabling private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet

39
Q

What is an Application Security Group (ASG)?

A

A logical collection of VMs (NICs)

40
Q

How do you use ASGs?

A
  • Application Security Group
  • You join VMs (NICs) to the ASG, then use the ASG as a source or destination in the NSG rules
41
Q

What is needed to set up a site-to-site VPN?

A
  • Local gateway
  • Gateway subnet
  • VPN gateway
  • A connection to connect the local gateway and VPN gateway
42
Q

What do public load balancers do?

A
  • Load balance Internet traffic to your VMs
  • Load balancer and the public IP address SKU must match when you use them with public IP addresses
43
Q

What must we have before creating a NIC?

A

A VNet

44
Q

What is IP flow verify used for?

A
  • Used when a VM becomes unable to communicate with another resource because of a security rule
  • Tests the communication, informs if the connection succeeds or fails, and tells you which rule causes the communication failure
45
Q

What feature of Azure Network Watcher would you use to validate connectivity from a VM to an external host?

A

Connection troubleshoot

46
Q

If you have two configured DNS servers, NIC and VNET, which takes precedence?

A

NIC configured DNS servers

47
Q

What can Connection Monitor tell you?

A
  • Latency over time
  • Round-trip time to make the connection
  • Inspects traffic over a specific port
48
Q

What are the pre-requisites of VMs/VMSSs for load balancers with a standard SKU?

A

VMs must be connected to the same virtual network

49
Q

What Azure networking component is redundant by default?

A

Azure VPN gateways have two instances for redundancy

50
Q

What is the default DNS suffix for Azure provisioned DNS if no specific DNS is configured in the network?

A

internal.cloudapp.net

51
Q

What is an Azure Load Balancer health probe?

A
  • A feature that detects the health status of your application instances, helping you detect application failures, manage load, and plan for downtime
  • Sends a request to the instances to check if they are available and responding to requests
  • Can be configured to use different protocols, like TCP, HTTP, or HTTPS
52
Q

What type of VPN is required for a P2S connection?

A

A Route-based VPN type

53
Q

How do Policy-based VPNs handle traffic?

A
  • Uses the combination of prefixes from both networks to define how traffic is encrypted/decrypted through IPsec tunnels
  • Only available with Basic SKU
  • Does not support P2S connectivity
54
Q

How do Route-based VPNs handle traffic?

A
  • Uses any-to-any (wildcard) traffic selectors
  • Lets routing tables direct traffic to different IPsec tunnels
55
Q

How can virtual networks be linked to a private DNS zone?

A
  • Registration virtual network (can have multiple but only one registration zone)
  • Resolution virtual network (can have multiple, and multiple resolution zones)
56
Q

What does the Packet capture function of Network Watcher do?

A
  • Intercepts data packets and stores them temporarily so it can be analyzed, for a maximum of a 5 hour interval
  • Inspects network traffic and helps diagnose network anomalies
57
Q

What do you need to configure when creating a load balancer?

A
  • Frontend IP address
    If you want to apply rules, you also need
  • Health probe
  • Backend pool
58
Q

How would you set up a virtual WAN site-to-site portal?

A
  • Create Virtual WAN
  • Create Virtual Hub
  • Create VPN sites
  • Connect VPN sites to virtual hub
59
Q

What OSI layer does Azure Load Balancer operate at?

A

L4

60
Q

What OSI layer does Azure App Gateway operate at?

A

L7

61
Q

What is an A record used for?

A

To map a DNS/domain name to an IP address

62
Q

What network security policy supports kubernet networking?

A

Calico Network Policies

63
Q

Why would you create a route table?

A

Custom routes are helpful when you want to route traffic between subnets through a network virtual appliance (NVA)

64
Q

What are site-to-site VPN gateway connections used for?

A

To connect your on-premises network to an azure VNet over an IPsec/IKE VPN tunnel

65
Q

How is the subnet of the target VM selected if a subnet with the same name doesn’t exist?

A

Alphabetical order

66
Q

Are there any firewall resource group restrictions?

A

Yes
The firewall, VNet, and the public IP address must all be in the same resource group

67
Q

What resource can you select when using connection monitor?

A

A region

68
Q

What is Azure Bastion?

A
  • A service you deploy that lets you connect to a VM using your browser/Azure portal or via the native SSH or RDP client installed on your computer
  • You provision it inside your VNet and it provides secure RDP/SSH connectivity to your VM directly from the Azure portal over TLS. Your VM doesn’t need a public IP, agent, or special client software.
69
Q

When configuring Azure Bastion, what’s the difference between using a Basic SKU and a Standard SKU?

A
  • Basic creates two instances
  • Standard allows you to specify the number of instances; host scaling
  • Standard allows use of the native client, letting you connect via Azure CLI and expands your sign-in options to include AAD and local SSH key pair
  • Standard supports global tier IPs
70
Q

What kind of IP addresses does Azure Bastion support?

A

Standard SKU public IPs that are static

71
Q

What resources do you need to consider moving when moving a VM from one subscription to another?

A

All dependent resources must be moved along with it
ie. Disk (OS), NIC, VNet

72
Q

How would you enable multi-user authorization for a Recovery Services vault?

A
  • Create resource guard
  • Enable MUA on vault
  • Authorize critical operations on vault
73
Q

In what order would you deploy resources in an ARM template to deploy a VM?

A

VNet
NIC
VM

74
Q

How would you migrate VMs to Azure using Azure Site Recovery?

A
  • Create Recovery Service Vault
  • Configure VNet
  • Configure extended network
75
Q

What is the recommended subnet size for Azure Bastion?

A

/26 or larger

76
Q

How is traffic handled between VMs in peered VNets?

A

Using the Microsoft backbone infrastructure

77
Q

What are service tags?

A
  • Group of IP address prefixes from a given Azure Service
  • Used in place of specific IP addresses when you create security rules and routes
78
Q

What can you create Service Endpoints for?

A

Azure services

79
Q

What are private links used for?

A
  • Connect privately to Azure Monitor without opening public network access
  • Ensure monitoring data is only accessed through authorized private networks
  • Keep all traffic inside the Azure backbone network
80
Q

What’s the difference been an A record and a CNAME record?

A

If the IP address changes, a CNAME entry is still valid, whereas an A record must be updated

81
Q

For what OS is private networking supported for?

A

Linux containers

AZ-104 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions