AZ-700: Azure Network Engineer Associate Practice Exam

What the AZ-700 exam covers

• Core networking infrastructure262 questions
• Connectivity services210 questions
• Application delivery services143 questions
• Private access to Azure services127 questions
• Secure network connectivity to Azure resources139 questions

Free AZ-700 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 881.

1. Question 1Connectivity services

   Your organization requires a site-to-site VPN connection between your on-premises datacenter and Azure. The connection must support a throughput of 1.25 Gbps. Which VPN Gateway SKU is the minimum that meets this requirement?

   • AVpnGw1
   • BBasic
   • CVpnGw3
   • DVpnGw2Correct
   ✓ Correct answer: D

   VpnGw2 SKU supports a maximum aggregate throughput of 1.35 Gbps, which exceeds the requirement of 1.25 Gbps. Azure VPN Gateway SKUs are tiered by throughput capacity: VpnGw1 supports up to 650 Mbps, VpnGw2 supports up to 1.35 Gbps, and VpnGw3 supports up to 2.5 Gbps. Choosing the minimum SKU that meets requirements is a cost optimization best practice.

   Why the other options are wrong

   • AVpnGw1 is incorrect because it has a maximum throughput of 650 Mbps, which falls short of the 1.25 Gbps requirement.
   • BBasic is incorrect because the Basic SKU is deprecated and only supports legacy configurations with very limited throughput (less than 100 Mbps).
   • CVpnGw3 is incorrect because while it would meet the requirement, it provides 2.5 Gbps throughput and is more expensive than necessary when VpnGw2 already satisfies the 1.25 Gbps requirement.
2. Question 2Connectivity services

   A company has an ExpressRoute circuit with a bandwidth of 200 Mbps. During peak hours, they experience congestion on the circuit. The network engineer wants to increase the bandwidth without downtime. What should the engineer do?

   • AAdd a second ExpressRoute circuit and configure load balancing
   • BDelete the current circuit and create a new one with higher bandwidth
   • CScale up the bandwidth of the existing ExpressRoute circuitCorrect
   • DEnable ExpressRoute Premium add-on to increase bandwidth
   ✓ Correct answer: C

   ExpressRoute circuits support in-place bandwidth scaling without requiring circuit deletion or service interruption. The operator can contact their service provider to increase the circuit bandwidth from 200 Mbps to higher tiers (such as 500 Mbps, 1 Gbps, etc.). This scaling operation is non-disruptive and can be performed without downtime, making it the most efficient solution for addressing congestion on an existing circuit.

   Why the other options are wrong

   • AAdd a second ExpressRoute circuit and configure load balancing is incorrect because while adding a second circuit provides additional bandwidth, this approach is more complex and costly than simply scaling the existing circuit.
   • BDelete the current circuit and create a new one with higher bandwidth is incorrect because this approach causes service downtime and is inefficient; scaling the existing circuit in-place is the proper method.
   • DEnable ExpressRoute Premium add-on to increase bandwidth is incorrect because the Premium add-on enables global reach and removes regional limitations on connectivity; it does not increase the bandwidth capacity of the circuit itself.
3. Question 3Core networking infrastructure

   You have a VNet with address space 10.0.0.0/16 and need to add a second address space of 172.16.0.0/16. Can this be done without downtime?

   • ANo, you must delete and then recreate the entire VNet resource
   • BNo, you must first remove all of the VNet's existing subnets
   • CYes, address spaces can be added to a live VNet without downtimeCorrect
   • DYes, but only if no VMs are currently running in the VNet
   ✓ Correct answer: C

   Azure treats a virtual network's address space as a mutable property, so adding a second range like 172.16.0.0/16 to a VNet that already uses 10.0.0.0/16 is a live operation. Running VMs keep their connectivity throughout, and after the new space is added you can create subnets within it and deploy resources. No deletion, subnet removal, or VM shutdown is needed. This flexibility lets networks grow in place as capacity needs increase.

   Why the other options are wrong

   • ADeleting and recreating the VNet is unnecessary because address spaces can be added to a live VNet; recreation would cause avoidable disruption.
   • BRemoving all subnets first is not required, since adding a new address space does not affect existing subnets within the current ranges.
   • DRequiring that no VMs be running is incorrect because the operation is non-disruptive and works while resources are active.
4. Question 4Core networking infrastructureSelect all that apply

   Which two are valid next hop types in an Azure User Defined Route (UDR)? (Choose two.)

   • AAzure Firewall
   • BVirtual Network GatewayCorrect
   • CAzure Load Balancer
   • DInternetCorrect
   ✓ Correct answer: B, D

   These are valid next hop types for UDRs in Azure. Virtual Network Gateway directs traffic to a VPN or ExpressRoute gateway for on-premises connectivity, and Internet directs traffic through Azure's infrastructure to public internet destinations. Both are legitimate next hop types supported by Azure's routing engine.

   Why the other options are wrong

   • AAzure Firewall is incorrect because while Azure Firewall is commonly used in routing scenarios, the proper UDR next hop type for an Azure Firewall is 'Virtual Appliance' pointing to its private IP, not 'Azure Firewall' as a dedicated next hop type.
   • CAzure Load Balancer is incorrect because Load Balancer cannot be configured as a UDR next hop type; only specific resource types like Virtual Appliances and Virtual Network Gateways are valid.
5. Question 5Secure network connectivity to Azure resources

   Azure Firewall Premium supports TLS inspection for outbound traffic.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   Azure Firewall Premium does support TLS inspection (also called SSL inspection) for outbound traffic. This advanced capability allows the firewall to decrypt outbound HTTPS connections, inspect the decrypted traffic for threats, and re-encrypt the traffic before forwarding it to the destination. TLS inspection is a key feature of the Premium SKU that provides visibility into encrypted communications for threat detection and compliance purposes. False is incorrect because TLS inspection is a key premium feature of Azure Firewall Premium that enables the firewall to decrypt, inspect, and re-encrypt outbound HTTPS traffic for advanced threat detection and compliance.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true. Azure Firewall Premium does support TLS inspection (also called SSL inspection) for outbound traffic. This advanced capability allows the firewall to decrypt outbound HTTPS connections, inspect the decrypted traffic for threats, and re-encrypt the traffic before forwarding it to the destination.
6. Question 6Private access to Azure services

   When you create an Azure Private Endpoint for an Azure Storage account, you must also configure a Private DNS zone (e.g., privatelink.blob.core.windows.net) or a custom DNS solution to ensure name resolution works correctly for the private endpoint.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   When you create an Azure Private Endpoint for an Azure Storage account, DNS name resolution is critical for the private endpoint to function correctly. Without a Private DNS zone configured (such as privatelink.blob.core.windows.net for blob storage), DNS queries for the storage account will resolve to the public IP address instead of the private endpoint's IP address, causing the connection to bypass the private endpoint and traverse the public internet. Azure provides these specific privatelink DNS zones to map Azure service names to private IP addresses within your VNet. False is incorrect because it ignores the requirement for DNS resolution to return the private IP address of the private endpoint rather than the public endpoint IP.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true. When you create an Azure Private Endpoint for an Azure Storage account, DNS name resolution is critical for the private endpoint to function correctly.
7. Question 7Secure network connectivity to Azure resources

   A VM in Contoso's subnet cannot receive traffic on TCP 3389 and you suspect an NSG rule. You want Azure to evaluate a specific 5-tuple (source IP, destination IP, protocol, and ports) and report whether it is allowed or denied and which security rule made the decision. Which Network Watcher tool should you use?

   • AConnection Monitor
   • BIP flow verifyCorrect
   • CPacket capture
   • DEffective security rules
   ✓ Correct answer: B

   Network Watcher IP flow verify takes a specific 5-tuple and returns an allow or deny result along with the name of the NSG rule that determined the outcome. That makes it the right tool for confirming whether a particular packet would be permitted to or from a VM.

   Why the other options are wrong

   • AConnection Monitor measures ongoing connectivity, latency, and reachability between endpoints; it does not evaluate a single packet against NSG rules.
   • CPacket capture records actual traffic on the NIC for offline analysis, but it does not tell you which NSG rule allows or denies a hypothetical flow.
   • DEffective security rules lists all rules applied to a NIC but does not evaluate a specific 5-tuple to return an allow or deny decision.
8. Question 8Core networking infrastructureSelect all that apply

   A hybrid application suffers intermittent slowness, and you need continuous measurement of network health between an on-premises host and an Azure VM. Which two metrics does Azure network performance monitoring, delivered through Connection Monitor, report for this path? (Choose two.)

   • ARound-trip latency between endpointsCorrect
   • BPercentage of packet loss on the pathCorrect
   • CTLS certificate expiry on endpoints
   • DSQL query execution time on the VM
   • ECPU utilization of the on-prem server
   ✓ Correct answer: A, B

   Connection Monitor continuously probes the endpoints and reports round-trip latency and the percentage of packet loss along the path, which are the core indicators of network health for a hybrid link. It can also surface the topology and highlight the specific hop introducing loss. These are network-path measurements rather than application or host metrics.

   Why the other options are wrong

   • CCertificate expiry is tracked by services such as Key Vault or Application Gateway health, not by network path probes.
   • DDatabase query timing is an application and database metric, outside the scope of network path monitoring.
   • EHost CPU utilization is a compute metric collected by VM insights, not a network measurement.
9. Question 9Connectivity services

   An engineer needs to ensure traffic from Azure to a specific set of Microsoft PaaS services (advertised over ExpressRoute Microsoft peering) is limited to only the service prefixes the company actually uses, to reduce the number of routes and meet compliance. Which feature accomplishes this?

   • AA UDR on each subnet listing only the allowed PaaS service IP ranges with next hop Internet
   • BAzure Route Server with branch-to-branch enabled to filter PaaS prefixes
   • CAn ExpressRoute route filter that selects only the required BGP community service prefixes for Microsoft peeringCorrect
   • DAn NSG with service tags applied to the GatewaySubnet to drop unwanted PaaS prefixes
   ✓ Correct answer: C

   Microsoft peering over ExpressRoute can advertise a large set of Microsoft 365/Azure PaaS service prefixes; a route filter lets you select only the specific BGP communities (services/regions) you need, so only those prefixes are advertised and installed. This reduces route count and meets the requirement of restricting connectivity to required services. Route filters are the purpose-built mechanism for Microsoft peering prefix selection.

   Why the other options are wrong

   • AManually maintaining UDRs for PaaS ranges is brittle and does not limit what is advertised over Microsoft peering; it also does not reduce learned route counts.
   • BRoute Server and branch-to-branch are unrelated to ExpressRoute Microsoft peering prefix selection.
   • DNSG service tags filter data-plane traffic, not which BGP community prefixes are advertised/learned over Microsoft peering.
10. Question 10Application delivery servicesSelect all that apply

    You are building a custom rule in an Application Gateway WAF_v2 policy. Which TWO request attributes can the rule match conditions evaluate?

    • AGeographic locationCorrect
    • BRequest URICorrect
    • CTLS cipher suite
    • DBackend response code
    ✓ Correct answer: A, B

    WAF custom rules evaluate inbound request match variables such as RemoteAddr, GeoMatch (geographic location), RequestUri, RequestHeaders, QueryString, RequestMethod, and RequestBody, letting you allow or block based on these request attributes. Geographic location and the request URI are both valid match variables.

    Why the other options are wrong

    • CThe negotiated TLS cipher suite is not an available WAF custom rule match variable.
    • DThe backend response code is a server-side response attribute; WAF custom rules inspect the inbound request, not backend responses.

Related Microsoft resources

• AZ-700 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

AZ-700 practice exam FAQ