All About Approved AZ-720 Study Guide

NEW QUESTION 1
A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.
The company reports that the Azure VM backup job is failing. You need to troubleshoot the issue.
Solution: Install the VM guest agent by using administrative permissions. Does the solution meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 2
A company deploys the Azure Application Gateway Web Application Firewall (WAF) to protect their web applications.
Users in a remote office location report the following issues:
Unable to access part of a web application.
Part of the web application is failing to load.
Parts of the web application has activities that are not performing as expected.
You need to troubleshoot the issue. Which diagnostic log should you review?

• A. Performance
• B. Firewall
• C. Access
• D. Azure Activity

Answer: D

NEW QUESTION 3
A company has an ExpressRoute gateway between their on-premises site and Azure. The ExpressRoute gateway is on a virtual network named VNet1. The company enables FastPath on the gateway. You associate a network security group (NSG) with all of the subnets.
Users report issues connecting to VM1 from the on-premises environment. VM1 is on a virtual network named VNet2. Virtual network peering is enabled between VNet1 and VNet2.
You create a flow log named FlowLog1 and enable it on the NSG associated with the gateway subnet. You discover that FlowLog1 is not reporting outbound flow traffic.
You need to resolve the issue with FlowLog1. What should you do?

• A. Configure FlowLog1 for version 2.
• B. Create the storage account for FlowLog1 as a premium block blob.
• C. Configure the FlowTimeoutInMinutes property on VNet2 to a non-null value.
• D. Enable FlowLog1 in a network security group associated with the network interface of VM1.

Answer: A

NEW QUESTION 4
A company uses Azure Active Directory (Azure AD) with Azure role-based access control (RBAC) for access to resources.
Some users report that they are unable to grant RBAC roles to other users. You need to troubleshoot the issue.
How should you complete the Azure Monitor query?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 5
A company named Contoso connects its on-premises resources to Azure by using ExpressRoute. An administrator reports that the circuit is in a failed state.
You need to resolve the issue.
How should you complete the PowerShell commands?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 6
A company implements Windows and Linux VMs in an Azure Virtual Network. The company plans to apply routing changes to the virtual network.
You need to determine the impact of these changes on network latency affecting applications that use TCP and UDP traffic. The solution must provide the highest level of accuracy.
Which tools should you use?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 7
A company implements Azure Firewall and deploys an Azure Firewall policy.
The policy incudes multiple application and network rules for the company's infrastructure. After deployment, an application is not accessible from on-premises computers.
You need to enable diagnostic logging for the following settings:
AzureFirewallApplicationRule
AzureFirewallNetworkRule
AzureFirewallDnsProxy
How should you complete the PowerShell cmdlet?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 8
A company migrates an on-premises Windows virtual machine (VM) to Azure. An administrator enables backups for the VM by using the Azure portal.
The company reports that the Azure VM backup job is failing. You need to troubleshoot the issue.
What should you do?

• A. Create a new manual backup in Backup center.
• B. Run chkdsk on the VM.
• C. Configure the retention range of the current backup policy for the VM.
• D. Install the VM guest agent with administrative permissions.
• E. Enable replication and create a recovery plan for the backup vault.

Answer: D

NEW QUESTION 9
A company has an Azure tenant. The company deploys an Azure firewall named FW1 to control access from an on-premises datacenter to an Azure virtual machine named VM1.
The company troubleshoots ICMP connectivity from the on-premises datacenter to VM1. You are unable to ping VM1 from an on-premises server.
You need to determine if ICMP connectivity to VM1 is allow on FW1. What should you do?

• A. Use the ping command targeting the IP address of VM1 and review the Infrastructure rules log of FW1.
• B. Use the ping command targeting the IP address of VM1 and review the command's response.
• C. Use the ping command targeting the IP address of VM1 and review the Network rules log of FW1.
• D. Use the ping command targeting the fully qualified domain name of VM1 and review the command's response.

Answer: B

NEW QUESTION 10
A company has an Azure environment that uses one virtual network.
The company restructures the environment to use two different virtual networks. Virtual machines in one network cannot communicate with virtual machines in the other virtual network.
You need to re-establish a connection between virtual machines in the two networks. How should you configure the networks?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 11
A customer creates an Azure resource group named RG1 in the East US region. RG1 contains the following resources:

The customer performs the following tasks:
Create a private endpoint for sqlsrv1 in subnet2 with the private IP address of 192.168.2.100.
Create a private DNS zone named privatelink.database.windows.net by using a single A record named sqlsvr1 and the IP address 192.168.2.100.
Disable public access by using the public endpoint for sqlsvr1.
The customer reports that connections from VM1 to DB1 are failing. The solution must allow connections from VM1 to DB1 without making platform-level changes.
You need to troubleshoot and resolve the issue.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 12
A company connects their on-premises network by using Azure VPN Gateway. The on-premises environment includes three VPN devices that separately tunnel to the gateway by using Border Gateway Protocol (BGP).
A new subnet should be unreachable from the on-premises network. You need to implement a solution.
Solution: Disable peering on the virtual network. Does the solution meet the goal?

• A. Yes
• B. No

Answer: B

NEW QUESTION 13
A company uses Azure Site Recovery for their on-premises Hyper-V servers. The company manages servers by using System Center Virtual Machine Manager (SCVMM).
An administrator reports that replication to the secondary site has failed. You need to inspect the SCVMM logs and configuration files.
Which PowerShell cmdlets should you use?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 14
A company enables just-in-time (JIT) virtual machine (VM) access in Azure.
An administrator observes a list of VMs on the Unsupported tab of the JIT VM access page in the Microsoft
Defender for Cloud portal.
You need to determine why some VMs are not supported for JIT VM access. What should you conclude?

• A. The administrator is using the Microsoft Defender for Cloud free tier.
• B. The VMs were provisioned by using a classic deployment.
• C. The VMs were recently provisioned by using an Azure Resource Manager deployment.
• D. The administrator does not have the SecurityReader role.

Answer: B

NEW QUESTION 15
A company deploys ExpressRoute.
The company reports that there is an autonomous system (AS) number mismatch. You need to identify the AS number of the circuit.
Which PowerShell cmdlet should you run?

• A. Get-AzExpressRouteCircuitPeeringConfig
• B. Get-AzExpressRouteCircuitStats
• C. Get-AzExpressRouteCircuitRouteTable
• D. Get-AzExpressRouteCircuit

Answer: B

NEW QUESTION 16
A company deploys an Azure Firewall. The company reports the following log entry:

For each of the following questions, select Yes or No.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 17
A company has an Azure Virtual Network gateway named VNetGW1. The company enables point-to-site connectivity on VNetGW1. An administrator configures VNetGW1 for the following:
OpenVPN for the tunnel type.
Azure certificate for the authentication type.
Users receive a certificate mismatch error when connecting by using a VPN client. You need to resolve the certificate mismatch error.
What should you do?

• A. Reissue the client certificate with client authentication enabled.
• B. Create a profile manually, add the server FQDN and reissue the client certificate.
• C. Reissue the client certificate with server authentication enabled.
• D. Install an IKEv2 VPN client on the user's computers.

Answer: B

NEW QUESTION 18
A company uses Azure AD Connect. The company plans to implement self-service password reset (SSPR). An administrator receives an error that password writeback cloud not be enabled during the Azure AD Connect configuration. The administrator observes the following event log error:
Error getting auth token
You need to resolve the issue.
Solution: Use a global administrator account with a password that is less than 256 characters to configure Azure AD Connect.
Does the solution meet the goal?

• A. Yes
• B. No

Answer: A

NEW QUESTION 19
A company uses an Azure Virtual Network (VNet) gateway named VNetGW1. VNetGW1 connects to a partner site by using a site-to-site VPN connection with dynamic routing.
The company observes that the VPN disconnects from time to time.
You need to troubleshoot the cause for the disconnections. What should you verify?

• A. The partner's VPN device and VNetGW1 are configured using the same shared key.
• B. The IP address of the local network gateway matches the partner's VPN device.
• C. The partner's VPN device is enabled for Perfect forward secrecy.
• D. The partner's VPN device and VNetGW1 are configured with the same virtual network address space.

Answer: D

NEW QUESTION 20
A company is deploying Azure Bastion to provide secure clientless access to its Azure VMs. The company configures a network security group named NSG1.
During deployment, the following error displays: Network security group NSG1 does not have necessary rules for Azure Bastion Subnet AzureBastionSubnet.
You need to fix the inbound rules for NSG1. How should you complete the configuration?

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 21
......