AZ-700: Azure Network Engineer Associate Practice Exam

What the AZ-700 exam covers

• Core networking infrastructure278 questions
• Connectivity services225 questions
• Application delivery services150 questions
• Private access to Azure services130 questions
• Secure network connectivity to Azure resources148 questions

Free AZ-700 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 931.

1. Question 1Connectivity services

   Your organization requires a site-to-site VPN connection between your on-premises datacenter and Azure. The connection must support a throughput of 1.25 Gbps. Which VPN Gateway SKU is the minimum that meets this requirement?

   • AVpnGw1
   • BBasic
   • CVpnGw3
   • DVpnGw2Correct
   ✓ Correct answer: D

   VpnGw2 SKU supports a maximum aggregate throughput of 1.35 Gbps, which exceeds the requirement of 1.25 Gbps. Azure VPN Gateway SKUs are tiered by throughput capacity: VpnGw1 supports up to 650 Mbps, VpnGw2 supports up to 1.35 Gbps, and VpnGw3 supports up to 2.5 Gbps. Choosing the minimum SKU that meets requirements is a cost optimization best practice.

   Why the other options are wrong

   • AVpnGw1 is incorrect because it has a maximum throughput of 650 Mbps, which falls short of the 1.25 Gbps requirement.
   • BBasic is incorrect because the Basic SKU is deprecated and only supports legacy configurations with very limited throughput (less than 100 Mbps).
   • CVpnGw3 is incorrect because while it would meet the requirement, it provides 2.5 Gbps throughput and is more expensive than necessary when VpnGw2 already satisfies the 1.25 Gbps requirement.
2. Question 2Connectivity services

   A network engineer needs to configure a VPN gateway that supports both site-to-site and point-to-site VPN connections simultaneously. The gateway must handle up to 30 concurrent point-to-site connections and a site-to-site tunnel with 650 Mbps aggregate throughput. Which VPN gateway SKU should the engineer select?

   • AVpnGw2
   • BVpnGw1Correct
   • CVpnGw3
   • DBasic
   ✓ Correct answer: B

   VpnGw1 provides a 650 Mbps aggregate throughput benchmark and supports up to 250 IKEv2/OpenVPN point-to-site connections and up to 30 S2S tunnels, and it can run S2S and P2S at the same time. This exactly satisfies the stated requirements of 650 Mbps and 30 concurrent P2S connections. Because the question asks for the SKU that meets these requirements at the lowest capacity, VpnGw1 is the correct generation-1 SKU; higher SKUs only add unneeded capacity and cost.

   Why the other options are wrong

   • AVpnGw2 (about 1 Gbps aggregate throughput and up to 500 P2S connections) exceeds the 650 Mbps / 30 P2S requirement and over-provisions capacity and cost.
   • CVpnGw3 (about 1.25 Gbps and up to 1000 P2S connections) over-provisions the workload even further and is unnecessarily costly for these requirements.
   • DThe Basic SKU tops out at 100 Mbps, does not support IKEv2/OpenVPN point-to-site connections, and lacks active-active and other production features, so it cannot meet the 650 Mbps or P2S requirements.
3. Question 3Application delivery servicesSelect all that apply

   A network engineer is deploying an Azure Application Gateway with Web Application Firewall (WAF). The company needs to protect against SQL injection and cross-site scripting attacks while also allowing a custom health monitoring page. Which TWO configurations should the engineer implement? (Choose two.)

   • AEnable Azure DDoS Network Protection on the Application Gateway public IP
   • BEnable SSL/TLS termination on the Application Gateway HTTPS listener only
   • CConfigure a custom health probe with the path to the health monitoring endpointCorrect
   • DConfigure an NSG rule on the gateway subnet to block SQL injection strings
   • EEnable WAF with the OWASP Core Rule Set (CRS) in prevention modeCorrect
   ✓ Correct answer: C, E

   To protect the Application Gateway against SQL injection and cross-site scripting attacks while allowing a custom health page, the engineer must enable WAF with the OWASP Core Rule Set (CRS) in prevention mode. The OWASP CRS contains signatures for detecting and blocking SQL injection, XSS, and other common web application attacks. In prevention mode, the WAF blocks malicious requests. Additionally, the engineer must configure a custom health probe pointing to the health monitoring endpoint. This allows the load balancer to verify backend health without the custom health page being filtered by WAF rules (since it's used for health checking, not client requests).

   Why the other options are wrong

   • ADDoS Network Protection mitigates volumetric Layer 3/4 attacks and cannot inspect or block Layer 7 SQL injection or XSS payloads.
   • BTLS termination only decrypts traffic and provides no rule-based inspection to block SQL injection or XSS.
   • DNSGs filter by IP, port, and protocol at Layers 3/4 and cannot parse Layer 7 SQL injection payloads.
4. Question 4Core networking infrastructure

   Which feature provides automatic route propagation from VPN gateways?

   • AService endpoint policies
   • BNetwork security groups
   • CUser-defined routes (UDR)
   • DGateway route propagationCorrect
   ✓ Correct answer: D

   Gateway route propagation is a per-route-table setting that automatically injects routes learned over a VPN or ExpressRoute gateway (typically via BGP) into the subnets associated with that route table. When enabled, prefixes advertised from on-premises appear in the subnet's effective routes without any manual entry, and they update as BGP changes. Disabling it stops that automatic injection, which is sometimes done to force traffic through an NVA instead. It is the mechanism that keeps gateway-learned routes in sync with subnet routing.

   Why the other options are wrong

   • AService endpoint policies restrict which services a subnet can reach; they do not propagate gateway-learned routes.
   • BNetwork security groups filter traffic by rules and have no role in propagating routes from a gateway.
   • CUser-defined routes are manually authored static routes and by definition are not auto-propagated from a gateway.
5. Question 5Secure network connectivity to Azure resources

   Azure Firewall Premium supports URL filtering for HTTPS traffic without TLS inspection when using SNI-based filtering.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   Azure Firewall Premium can filter HTTPS traffic based on Server Name Indication (SNI) headers without decrypting the entire TLS connection. SNI contains the destination domain name in plaintext during the TLS handshake, allowing the firewall to make URL filtering decisions based on the destination FQDN. This provides HTTPS filtering without the computational overhead and certificate management complexity of full TLS inspection. False is incorrect because Azure Firewall Premium can perform URL filtering on HTTPS traffic using Server Name Indication (SNI) headers during the TLS handshake without requiring full TLS inspection, as the SNI contains the destination domain name in plaintext.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true. Azure Firewall Premium can filter HTTPS traffic based on Server Name Indication (SNI) headers without decrypting the entire TLS connection.
6. Question 6Private access to Azure servicesSelect all that apply

   Which two Azure services support Private Link (Private Endpoints)? (Choose two.)

   • AAzure DNS public zones
   • BAzure SQL DatabaseCorrect
   • CAzure Cosmos DBCorrect
   • DMicrosoft Entra ID
   ✓ Correct answer: B, C

   Both Azure SQL Database and Azure Cosmos DB support Azure Private Link, allowing you to create private endpoints for these services. When a private endpoint is created, these services assign a private IP address within your VNet, enabling secure, private connectivity without exposure to the public internet.

   Why the other options are wrong

   • AAzure DNS public zones is incorrect because Azure DNS public zones are for managing public domain names and do not support Private Link.
   • DMicrosoft Entra ID is incorrect because Microsoft Entra ID is an identity and access management service and does not support Private Link endpoints; authentication to Entra ID is handled through dedicated protocols.
7. Question 7Core networking infrastructureSelect all that apply

   Contoso Ltd is designing IP addressing for a new production VNet that must peer with several existing VNets that already use RFC 1918 ranges, and it needs to guarantee no overlap now while still reserving contiguous room for future subnets. Which TWO actions should the administrator take when configuring the VNet? (Choose two.)

   • AAssign a non-overlapping CIDR block sized for planned growthCorrect
   • BAdd a secondary address space and reserve subnet ranges in advanceCorrect
   • CEnable a network security group on every subnet to filter inbound traffic
   • DDeploy an Azure Bastion host in the VNet for secure RDP and SSH access
   • EAssociate a route table with the GatewaySubnet to control routing
   ✓ Correct answer: A, B

   VNet peering fails when address spaces overlap, so choosing a non-overlapping CIDR block that is sized for the workload is the primary addressing decision. Adding a secondary address space and reserving subnet ranges up front guarantees contiguous room for future subnets without needing to re-address later. Both are pure IP-addressing design steps for the new VNet.

   Why the other options are wrong

   • CAn NSG filters traffic by port and IP and does nothing to prevent CIDR overlap or reserve address space for growth.
   • DAzure Bastion only provides secure RDP and SSH connectivity to VMs and is unrelated to IP address planning or overlap avoidance.
   • EA route table controls traffic paths and has no bearing on the allocation or reservation of VNet IP address ranges.
8. Question 8Private access to Azure services

   An administrator wants one portal experience that lists every private endpoint connection awaiting approval across all of their subscriptions, instead of opening each target resource separately to find pending requests. Which portal experience provides this consolidated view?

   • ANetwork Watcher connection monitor
   • BAzure Resource Graph Explorer
   • CAzure Monitor network insights
   • DPrivate Link Center pending connectionsCorrect
   ✓ Correct answer: D

   Private Link Center is the central hub for Private Link resources, and its Pending connections blade aggregates every private endpoint connection that is awaiting approval across the administrator's subscriptions, where they can be approved or rejected in one place.

   Why the other options are wrong

   • ANetwork Watcher connection monitor measures reachability and latency between endpoints; it does not surface approval requests.
   • BResource Graph can query resources with KQL but is a general reporting tool and cannot approve connections from a purpose-built blade.
   • CAzure Monitor network insights presents health and metrics dashboards, not the Private Link approval queue.
9. Question 9Private access to Azure services

   A security team mandates that all traffic from a subnet containing private endpoints be inspected by an Azure Firewall, using a route table that sends 0.0.0.0/0 to the firewall. After deploying the UDR, the team finds traffic to the private endpoints is bypassing the firewall. Why, and what must change to force inspection?

   • ANSGs are bypassed by private endpoint traffic; enable 'Network security group support for private endpoints' on the consuming subnet and the existing 0.0.0.0/0 UDR to the firewall will then take effect
   • BPrivate endpoints only honor service endpoint policies; replace the private endpoint with a VNet service endpoint and attach a matching service endpoint policy to the subnet to force firewall inspection
   • CPrivate endpoints inject a /32 system route on consuming subnets that takes precedence; you must enable 'Network policies for private endpoints' so UDRs apply, and route the /32 to the firewallCorrect
   • DThe 0.0.0.0/0 UDR is too broad to match private traffic; scope it to the VNet address range so the private endpoint address falls inside that route and is redirected to the firewall for inspection
   ✓ Correct answer: C

   When a private endpoint is created, a /32 system route to its IP is added on subnets in the VNet, and this more-specific system route beats a 0.0.0.0/0 UDR, so traffic to the endpoint goes directly and bypasses the firewall. To make UDRs apply to private endpoint traffic you must enable 'Network policies for private endpoints' (the PrivateEndpointNetworkPolicies setting) on the private endpoint's subnet, then add a UDR with the private endpoint's specific prefix (a /32 is honored) pointing to the Azure Firewall as the next hop. This is the documented way to insert an NVA/firewall in the path of private endpoint traffic. Without enabling the policy, the system route silently wins.

   Why the other options are wrong

   • ANSG support applies security-group rules, not route tables, and does not change the /32 system route's precedence over the UDR.
   • BService endpoint policies restrict which resources a subnet can reach and cannot steer traffic through a firewall.
   • DA route to the VNet range is still less specific than the /32 system route to the endpoint, so it never wins.
10. Question 10Application delivery services

    Woodgrove wants malicious web requests blocked as far from their regional backends as possible, at Azure's global edge, before traffic ever enters any region. Where should the Web Application Firewall be placed?

    • AWAF on Front DoorCorrect
    • BWAF on App Gateway
    • CWAF on Load Balancer
    • DWAF on Traffic Manager
    ✓ Correct answer: A

    WAF on Azure Front Door runs at Microsoft's global edge POPs, inspecting and blocking malicious requests before they are routed to any region. Placing the WAF here filters attack traffic as close to the client as possible, which is exactly Woodgrove's stated goal.

    Why the other options are wrong

    • BWAF on Application Gateway is regional, meaning attack traffic has already been routed into the region before it is inspected, which is the opposite of blocking at the edge.
    • CAzure Load Balancer is a Layer 4 service and cannot host a WAF at all, so no web inspection can occur there.
    • DTraffic Manager is DNS-based and out of the data path, so it cannot inspect or block any web request.

Who this AZ-700 practice exam is for

This practice set is for anyone preparing for the AZ-700: Azure Network Engineer Associate exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-700 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AZ-700 exam.

Related Microsoft resources

• AZ-700 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Best AZ-104 Practice Exams (2026)Comparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-802 practice examRelated
• AZ-900 practice examRelated
• DP-300 practice examRelated

AZ-700 practice exam FAQ