https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/AZ-700-Dumps-1zc5u0/page_4_img_2.jpg

A Private Endpoint assigns Storage1 a private IP inside a virtual network. Traffic from Azure VNets or from on-premises networks that are connected through VPN/ExpressRoute stays on the Microsoft backbone, and the public endpoint can be disabled. This satisfies typical PaaS-networking requirements (private access, routable from hybrid links) and business requirements that deny Internet exposure.

A. Service endpoints work only for traffic originating in an Azure VNet; on-premises traffic would still traverse the public address, violating the stated requirements.

B. Azure Front Door is an application-layer global load balancer for HTTP/S, not a mechanism to create private network connectivity to a storage account.

D. Traffic Manager performs DNS-based load balancing across public endpoints and offers no capability to provide private network access.

1. Microsoft Learn – “Azure Private Link overview”

sections “Connect privately to services running in Azure” and “Access over on-premises networks” (https://learn.microsoft.com/azure/private-link/private-link-overview).

2. Microsoft Learn – “Virtual network service endpoints overview”

section “Service endpoints and on-premises traffic” (https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview).

3. Microsoft Learn – “What is Azure Front Door?” paragraph “Front Door is a global

secure entry point for web traffic” (https://learn.microsoft.com/azure/frontdoor/front-door-overview).

4. Microsoft Learn – “Azure Traffic Manager overview”

paragraph “Traffic Manager can’t provide private connectivity” (https://learn.microsoft.com/azure/traffic-manager/traffic-manager-overview).

8

CERT EMPIRE

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/AZ-700-Dumps-1zc5u0/page_9_img_1.jpg

Box 2: One NSG

The minimum requirement is one NSG. You could attach the NSG to VMScaleSet1 and restrict

outbound traffic, or you could attach the NSG to VMScaleSet2 and restrict inbound traffic. Either way

you would need two custom NSG rules.

Box 1: Two custom rules

With the NSG attached to VMScaleSet2, you would need to create a custom rule blocking all traffic

from VMScaleSet1. Then you would need to create another custom rule with a higher priority than

the first rule that allows traffic on port 443.

The default rules in the NSG will allow all other traffic to VMScaleSet2.

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/AZ-700-Dumps-1zc5u0/page_7_img_2.jpg

Reference:

https://docs.microsoft.com/en-us/azure/load-balancer/skus

https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-outboundconnections#outboundrules

:

Virtual Network Service Endpoints extend a subnet’s private address space to an Azure Storage service. After the endpoint is enabled and the storage account firewall is limited to that subnet, traffic reaches the service over the Microsoft backbone only and never traverses the public Internet, satisfying the PaaS-networking requirement of “private, Microsoft-owned path” without the extra DNS changes or per-connection cost of Private Link. Because Service Endpoints are a platform feature (no appliance or front-end needed) they also meet the stated business goal of keeping the solution simple and cost-effective while giving the required access to storage2.

B. Private endpoint gives a dedicated private IP but adds DNS plumbing and per-GB data charges; requirement only calls for secure VNet reachability, which a service endpoint already provides.

C. Azure Firewall is a security appliance, not a connectivity feature; it cannot itself expose Storage2 to the VNet.

D. Azure Front Door is a global HTTP(S) load balancer for public endpoints, irrelevant to private access for a storage account.

1. Microsoft Azure Documentation – “Virtual network service endpoints for Azure Storage”

Sections: ‘Benefits’ & ‘Secure your storage account to a virtual network’

para 1-3. (https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview)

2. Microsoft Azure Documentation – “Secure Azure PaaS services with virtual network integration”

Table 1

‘Azure Storage – Service Endpoints vs Private Link’. (https://learn.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/extend-vnet)

3. Microsoft Azure Documentation – “Azure Private Link overview”

Limitations

para 2-3 (explains added DNS/charge considerations). (https://learn.microsoft.com/azure/private-link/private-link-overview)

In a hub-and-spoke network topology, which is implied by the question's structure, Border Gateway Protocol (BGP) is the standard mechanism for dynamically advertising routes between virtual networks connected via gateways. A default route (0.0.0.0/0) can be advertised from a central location, such as the hub VNet's gateway or a connected on-premises network. The spoke VNets (Vnet2 and Vnet3), when peered with the hub and configured for gateway transit, will learn this default route via BGP. This allows for centralized control of traffic, forcing all outbound traffic from the spokes through the hub, typically for inspection by a network virtual appliance (NVA) or for egress to the internet or an on-premises location.

A. A user-defined route (UDR) is associated with workload subnets to override default routing. Applying a UDR to a GatewaySubnet is a specific configuration to force traffic from the gateway to an NVA, not to advertise a route to other VNets.

B. A UDR on the hub's (Vnet1) GatewaySubnet does not propagate routes to peered spoke VNets. Route propagation to spokes is managed through the VNet peering configuration (gateway transit) and BGP.

D. Route filters are used exclusively with ExpressRoute Microsoft peering to selectively receive route advertisements for public Microsoft services (like Microsoft 365), not for propagating default routes for private VNet traffic.

1. Microsoft Learn

"About BGP with Azure VPN Gateway": This document states

"You can advertise a default route (0.0.0.0/0) from your on-premises BGP device to Azure. This forces all virtual network egress traffic towards your on-premises site for inspection." This principle applies to VNet-to-VNet communication as well

where one VNet's gateway acts as the BGP peer. (See the "FAQ" section under "Can I advertise a default route (0.0.0.0/0) to Azure VPN gateways?").

2. Microsoft Learn

"Configure BGP for a VPN gateway: Azure portal": In the section "To enable BGP on a gateway connection

" the documentation details the steps for enabling BGP

which is the prerequisite for exchanging routes like the default route between gateways.

3. Microsoft Learn

"Virtual network traffic routing": This document clarifies the purpose of UDRs on a GatewaySubnet: "You can add a user-defined route to the GatewaySubnet. This allows you to direct traffic that enters the virtual network through the virtual network gateway to a network virtual appliance." This confirms UDRs on GatewaySubnets serve a different function than route advertisement to peers.

4. Microsoft Learn

"Route filtering for Microsoft peering": This source explains

"Route filters are a way to consume a subset of supported services through Microsoft peering." This confirms that route filters are not applicable to the scenario of private VNet routing.

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/AZ-700-Dumps-1zc5u0/page_10_img_2.jpg

Reference:

https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vmsand-role-instances

To meet modern network security requirements for Point-to-Site (P2S) VPN users, selecting the OpenVPN (SSL) tunnel type is the most appropriate choice. This is because OpenVPN is the only protocol that supports Azure Active Directory (Azure AD) authentication for P2S VPNs. Integrating with Azure AD enables the enforcement of advanced security policies such as Multi-Factor Authentication (MFA) and Conditional Access, which are critical components of a robust security posture. While other protocols provide encryption, they lack this native integration with Azure's primary identity and access management service.

A. IKEv2 and OpenVPN (SSL): While a valid configuration, the question implies meeting specific security requirements that are uniquely fulfilled by OpenVPN's support for Azure AD authentication, making it the essential choice.

B. IKEv2: This protocol is secure and fast but does not support Azure AD authentication for P2S VPNs. It relies on certificate or RADIUS authentication, which may not meet modern identity security requirements.

C. IKEv2 and SSTP (SSL): This option omits OpenVPN, thereby excluding the ability to use Azure AD for authentication, which is a key security feature for managing user access.

E. SSTP (SSL): This is a legacy, Microsoft-proprietary protocol with limited client support (Windows-only) and does not support Azure AD authentication, making it less suitable for modern security needs.

1. Microsoft Learn

"About Point-to-Site VPN": In the section "Which protocol does P2S use?"

under the "OpenVPN" subsection

the documentation states

"OpenVPN protocol can also be used to support Azure AD authentication." This highlights the unique capability of OpenVPN.

2. Microsoft Learn

"Configure an Azure AD tenant for P2S VPN connections": In the section "Enable Azure AD authentication on the gateway"

Step 1 explicitly instructs the user to "Configure the gateway to use OpenVPN tunnel type." This confirms that OpenVPN is a prerequisite for enabling Azure AD authentication.

3. Microsoft Learn

"Point-to-Site VPN protocols and clients": This document provides a table comparing client and authentication support for each protocol. The table clearly shows that "Azure Active Directory" authentication is only available for the "OpenVPN Protocol".

https://kxbjsyuhceggsyvxdkof.supabase.co/storage/v1/object/public/file-images/AZ-700-Dumps-1zc5u0/page_39_img_2.jpg

Reference:

https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-endpoint-types