AZ-700: Azure Network Engineer Associate Practice Exam

What the AZ-700 exam covers

• Core networking infrastructure269 questions
• Connectivity services216 questions
• Application delivery services147 questions
• Private access to Azure services130 questions
• Secure network connectivity to Azure resources144 questions

Free AZ-700 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 906.

1. Question 1Connectivity services

   Your organization requires a site-to-site VPN connection between your on-premises datacenter and Azure. The connection must support a throughput of 1.25 Gbps. Which VPN Gateway SKU is the minimum that meets this requirement?

   • AVpnGw1
   • BBasic
   • CVpnGw3
   • DVpnGw2Correct
   ✓ Correct answer: D

   VpnGw2 SKU supports a maximum aggregate throughput of 1.35 Gbps, which exceeds the requirement of 1.25 Gbps. Azure VPN Gateway SKUs are tiered by throughput capacity: VpnGw1 supports up to 650 Mbps, VpnGw2 supports up to 1.35 Gbps, and VpnGw3 supports up to 2.5 Gbps. Choosing the minimum SKU that meets requirements is a cost optimization best practice.

   Why the other options are wrong

   • AVpnGw1 is incorrect because it has a maximum throughput of 650 Mbps, which falls short of the 1.25 Gbps requirement.
   • BBasic is incorrect because the Basic SKU is deprecated and only supports legacy configurations with very limited throughput (less than 100 Mbps).
   • CVpnGw3 is incorrect because while it would meet the requirement, it provides 2.5 Gbps throughput and is more expensive than necessary when VpnGw2 already satisfies the 1.25 Gbps requirement.
2. Question 2Connectivity services

   A multinational corporation uses ExpressRoute to connect their Singapore datacenter to Azure Southeast Asia. They now need to connect the same datacenter to resources in Azure West Europe. What should the network engineer configure to enable this connectivity without provisioning a new ExpressRoute circuit?

   • AEnable ExpressRoute FastPath on the existing circuit
   • BEnable the ExpressRoute Premium add-on on the existing circuitCorrect
   • CConfigure VNet peering between Southeast Asia and West Europe VNets
   • DCreate a new VPN gateway in West Europe and use S2S VPN
   ✓ Correct answer: B

   By default, an ExpressRoute circuit can only reach Azure regions within the same geopolitical area as the circuit's peering location. The ExpressRoute Premium add-on lifts this boundary so a single circuit can reach Azure resources in any region worldwide. Enabling Premium on the existing Singapore circuit lets the datacenter connect to West Europe without provisioning a second circuit.

   Why the other options are wrong

   • AEnable ExpressRoute FastPath on the existing circuit is wrong because FastPath only bypasses the virtual network gateway to improve data-path performance and does not extend the circuit's regional reach.
   • CConfigure VNet peering between Southeast Asia and West Europe VNets is wrong because peering connects Azure VNets to each other and would not provide connectivity from the on-premises datacenter, and it does not extend an ExpressRoute circuit's reach.
   • DCreate a new VPN gateway in West Europe and use S2S VPN is wrong because it introduces a separate connectivity path rather than reusing the existing ExpressRoute circuit, adding cost and forgoing ExpressRoute's private, high-throughput path.
3. Question 3Core networking infrastructure

   A network engineer is designing a virtual network for a three-tier application. The web tier must be accessible from the internet, the application tier should only communicate with the web and database tiers, and the database tier should only be accessible from the application tier. How should the engineer design the subnet architecture?

   • ACreate three separate virtual networks with VNet peering between them
   • BCreate a single subnet and use application security groups to segment traffic
   • CCreate three subnets without NSGs and rely on Azure Firewall for all traffic filtering
   • DCreate three subnets with NSGs on each subnet to control traffic flow between tiersCorrect
   ✓ Correct answer: D

   For a three-tier application architecture, the best approach is to create three separate subnets (one for each tier) and apply Network Security Groups to each subnet to enforce traffic control between tiers. This design provides clear network segmentation that aligns with application tiers and allows granular security policies. NSGs can be configured with rules that permit only necessary traffic (web tier accepts internet traffic, application tier accepts from web tier only, database tier accepts from application tier only), implementing defense-in-depth principles. This subnet-based segmentation is more efficient than application-level segmentation and scales well as the application grows.

   Why the other options are wrong

   • ACreate three separate virtual networks with VNet peering between them is incorrect because creating separate VNets adds unnecessary operational complexity and management overhead without providing additional security benefits compared to subnet-based segmentation.
   • BCreate a single subnet and use application security groups to segment traffic is incorrect because placing all tiers in a single subnet eliminates the network-level isolation that subnet-based segmentation provides, and application security groups are better suited for micro-segmentation within a subnet rather than for separating application tiers.
   • CCreate three subnets without NSGs and rely on Azure Firewall for all traffic filtering is incorrect because while Azure Firewall can provide filtering, NSGs on subnets provide essential first-line defense, and relying solely on a firewall adds a single point of failure and increases latency.
4. Question 4Core networking infrastructure

   You configure a UDR with next hop type 'None' for destination 10.5.0.0/16. What happens to traffic destined for 10.5.1.10?

   • ATraffic is sent to the default gateway
   • BTraffic is dropped silentlyCorrect
   • CTraffic is routed to the VNet gateway
   • DTraffic is routed to the internet
   ✓ Correct answer: B

   When a UDR is configured with next hop type 'None', it explicitly signals that traffic matching that route should be discarded. This is useful for blocking specific traffic patterns without generating error messages. Traffic destined for 10.5.1.10 would match the 10.5.0.0/16 destination prefix and be dropped immediately without returning ICMP unreachable messages to the source.

   Why the other options are wrong

   • ATraffic is sent to the default gateway is incorrect because the 'None' next hop type explicitly drops traffic rather than routing it elsewhere.
   • CTraffic is routed to the VNet gateway is incorrect because 'None' does not forward traffic to any gateway.
   • DTraffic is routed to the internet is incorrect because 'None' drops the traffic silently rather than routing it to the internet.
5. Question 5Core networking infrastructure

   You need to inspect all traffic between two subnets in the same VNet using Azure Firewall. What must you configure?

   • AUDRs on both subnets pointing to the Azure Firewall's private IPCorrect
   • BVNet peering configured directly between the two subnets
   • CAn Application Gateway deployed between the two subnets
   • DAn NSG rule configured to redirect traffic to the firewall
   ✓ Correct answer: A

   Within a single VNet, subnets reach each other directly via the default system route, which bypasses any firewall. To inspect traffic between two subnets with Azure Firewall, each subnet needs a UDR that steers the relevant traffic to the firewall's private IP as next hop, so packets traverse the firewall in both directions. Applying the routes to both subnets ensures symmetric inspection of the inter-subnet flow. Without these UDRs, the traffic never reaches the firewall.

   Why the other options are wrong

   • BPadded with accurate detail; meaning unchanged, peering connects VNets not subnets and would not force inspection.
   • CPadded with accurate detail; meaning unchanged, App Gateway is L7 only and not a transparent inspection device.
   • DPadded with accurate detail; meaning unchanged, NSGs allow/deny but cannot redirect to an appliance.
6. Question 6Private access to Azure servicesSelect all that apply

   You need to restrict which subscriptions can create private endpoint connections to your Private Link service. Which two features help control access? (Choose two.)

   • ANetwork Security Group rules on the provider VNet
   • BAzure Policy assigned to the consumer subscription
   • CAuto-approval settings on the Private Link serviceCorrect
   • DVisibility settings on the Private Link serviceCorrect
   ✓ Correct answer: C, D

   Private Link services provide two key settings for controlling access from consumers: Auto-approval settings allow the provider to automatically approve connection requests from specific subscriptions without manual intervention, while Visibility settings restrict which subscriptions or consumer tenants can even see and attempt to connect to the Private Link service. Together, these settings provide multiple layers of access control from the provider side.

   Why the other options are wrong

   • ANetwork Security Group rules on the provider VNet is incorrect because NSG rules control internal VNet traffic but do not directly control which subscriptions can request Private Endpoint connections to the service.
   • BAzure Policy assigned to the consumer subscription is incorrect because while Azure Policy can enforce organizational standards on consumers, it is not a direct mechanism within the Private Link service itself for controlling connection access.
7. Question 7Connectivity services

   A retailer needs a site-to-site VPN gateway that supports BGP peering and active-active redundancy while keeping cost to the minimum. Which SKU is the lowest-priced option that meets both requirements?

   • AVpnGw1Correct
   • BBasic
   • CVpnGw2
   • DVpnGw3
   ✓ Correct answer: A

   The Basic SKU cannot run BGP or active-active mode, so the lowest generation that supports both is VpnGw1. Every VpnGw1 through VpnGw5 generation supports BGP and active-active, so choosing a higher SKU only adds throughput and cost that this requirement does not call for.

   Why the other options are wrong

   • BThe Basic SKU does not support BGP or active-active mode, so it cannot satisfy the requirements at any price.
   • CVpnGw2 does support both features but costs more than VpnGw1 while adding throughput that was not requested.
   • DVpnGw3 is an even higher, more expensive tier and exceeds the stated minimum-cost goal.
8. Question 8Private access to Azure services

   A subnet is configured with the Microsoft.Storage service endpoint. You must guarantee that virtual machines in that subnet can reach only the specific storage accounts owned by your subscription and cannot exfiltrate data to storage accounts in other tenants over the endpoint. What should you apply to the subnet?

   • AAn NSG outbound deny rule
   • BA storage private endpoint
   • CA service endpoint policyCorrect
   • DAn Azure Firewall FQDN rule
   ✓ Correct answer: C

   Service endpoint policies let you restrict service-endpoint traffic from a subnet to an explicit list of Azure Storage account resource IDs (or a whole subscription/resource group). This is the purpose-built control that blocks data exfiltration to storage accounts you do not own while still allowing your approved accounts over the endpoint.

   Why the other options are wrong

   • AAn NSG filters by IP address, port, and service tag, so it can allow or block the Storage service tag wholesale but cannot distinguish between individual storage account resources.
   • BA private endpoint replaces the service-endpoint path with a private IP for one resource; it does not filter which accounts are reachable over an existing service endpoint.
   • DAzure Firewall FQDN filtering would require routing subnet traffic through the firewall and cannot cleanly separate accounts that share the *.blob.core.windows.net namespace.
9. Question 9Secure network connectivity to Azure resources

   A subnet hosts both web servers and database servers behind a single NSG. You need a maintainable rule that allows the web tier to reach the database tier on TCP 1433 without referencing fixed IP addresses, even as VMs scale in and out. Which NSG feature BEST achieves this?

   • AUse the built-in VirtualNetwork service tag as both source and destination on TCP 1433
   • BCreate augmented security rules listing each VM's private IP in a comma-separated source field
   • CAdd a Deny-all inbound rule and rely on the default AllowVNetInBound rule for TCP 1433
   • DCreate web-tier and DB-tier ASGs, assign NICs to them, and allow web-ASG to db-ASG on TCP 1433Correct
   ✓ Correct answer: D

   ASGs decouple NSG rules from specific IP addresses: you assign each VM's network interface to an ASG (for example webASG and dbASG), then author a rule with source webASG and destination dbASG. As instances scale, you simply add their NICs to the appropriate ASG and the existing rule automatically applies, eliminating IP churn and reducing rule sprawl. ASGs work within the same VNet and integrate with augmented rules. This is the recommended micro-segmentation pattern for multi-tier workloads.

   Why the other options are wrong

   • AMeaning preserved; added 'built-in' (VirtualNetwork tag is still too broad to isolate tiers).
   • BListing fixed IPs (even in augmented rules) breaks the moment VMs scale and is exactly the maintenance burden ASGs are designed to avoid.
   • CMeaning preserved; added 'inbound' and 'TCP' (still relies on the permissive default AllowVNetInBound rule).
10. Question 10Application delivery services

    You are designing a Traffic Manager profile that must return several healthy endpoint addresses in a single DNS response so the client can retry an alternate address if one is unreachable. Which condition must the profile satisfy to use the MultiValue routing method?

    • AAll external endpointsCorrect
    • BAll Azure endpoints
    • COnly nested endpoints
    • DHTTPS monitoring on
    ✓ Correct answer: A

    MultiValue routing is only supported when every endpoint in the profile is an External endpoint specified as an IPv4 or IPv6 address. Traffic Manager then returns up to the configured maximum number of healthy addresses in one DNS answer, allowing the client to fail over to another address locally.

    Why the other options are wrong

    • BAzure endpoint types are not eligible for MultiValue routing; the method requires External endpoints with explicit IP addresses.
    • CNested endpoints (child profiles) are not supported by MultiValue routing.
    • DThe monitor protocol setting is unrelated to whether a profile qualifies for MultiValue routing.

Who this AZ-700 practice exam is for

This practice set is for anyone preparing for the AZ-700: Azure Network Engineer Associate exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-700 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AZ-700 exam.

Related Microsoft resources

• AZ-700 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Best AZ-104 Practice Exams (2026)Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-900 practice examRelated
• DP-300 practice examRelated
• DP-420 practice examRelated

AZ-700 practice exam FAQ