AZ-700 sample exam questions

15 exam-style questions for Microsoft AZ-700: Azure Network Engineer, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.

Take the free practice exam AZ-700 exam guide
  1. Question 1Single choiceTopic 1
    Your company has a single on-premises datacenter in Washington DC. The East US Azure region has a peering location in Washington DC.
    The company only has Azure resources in the East US region.
    You need to implement ExpressRoute to support up to 1 Gbps. You must use only ExpressRoute Unlimited data plans. The solution must minimize costs.
    Which type of ExpressRoute circuits should you create?
    1. A
      ExpressRoute Local
    2. B
      ExpressRoute Direct
    3. C
      ExpressRoute Premium
    4. D
      ExpressRoute Standard
    Show answer

    Correct answer: A

    Why

    ExpressRoute Local gives access only to Azure regions near the peering location (East US here) and includes unlimited data at no egress charge, making it the cheapest. Standard and Premium cost more, and Direct is a 10/100 Gbps port offering, not suited for 1 Gbps.

  2. Question 2HotspotTopic 1
    HOTSPOT

    You have an Azure subscription.

    You plan to use Azure Virtual WAN.

    You need to deploy a virtual WAN hub that meets the following requirements:

    • Supports 4 Gbps of Site-to-Site (S2S) VPN traffic
    • Supports 8 Gbps of ExpressRoute traffic
    • Minimizes costs

    How many scale units should you configure? To answer, select the appropriate options in the answer area.

    NOTE: Each correct selection is worth one point.

    For the S2S VPN gateway:2 / 4 / 8 / 16
    For the ExpressRoute gateway:2 / 4 / 8 / 16
    Show answer
    • For the S2S VPN gateway: 8
    • For the ExpressRoute gateway: 4
    Why

    In a Virtual WAN hub, one S2S VPN scale unit gives 500 Mbps, so 4 Gbps needs 8 units. One ExpressRoute scale unit gives 2 Gbps, so 8 Gbps needs 4 units. Choosing the minimum units that meet each requirement keeps costs down.

  3. Question 3Single choiceTopic 2
    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might
    meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
    You have two Azure virtual networks named Vnet1 and Vnet2.
    You have a Windows 10 device named Client1 that connects to Vnet1 by using a Point-to-Site (P2S) IKEv2 VPN.
    You implement virtual network peering between Vnet1 and Vnet2. Vnet1 allows gateway transit. Vnet2 can use the remote gateway.
    You discover that Client1 cannot communicate with Vnet2.
    You need to ensure that Client1 can communicate with Vnet2.
    Solution: You resize the gateway of Vnet1 to a larger SKU.
    Does this meet the goal?
    1. A
      Yes
    2. B
      No
    Show answer

    Correct answer: B

    Why

    Resizing the Vnet1 gateway SKU does not change the routes the P2S client holds. The client needs its VPN configuration package downloaded and reinstalled after the peering change. So this does not meet the goal.

  4. Question 4HotspotTopic 2
    HOTSPOT

    You have an Azure virtual network named Vnet1 that contains two subnets named Subnet1 and Subnet2. Both subnets contain virtual machines.

    You create a NAT gateway named NATgateway1 as shown in the following exhibit.



    Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

    NOTE: Each correct selection is worth one point.

    NATgateway1 can be linked to [answer choice].only GatewaySubnet / only Subnet1 or Subnet2 / both Subnet1 and Subnet2 / only Vnet1
    NATgateway1 is assigned [answer choice].0 IP addresses / 1 IP address / 2 IP addresses / 16 IP addresses / 28 IP addresses
    Show answer
    • NATgateway1 can be linked to [answer choice]. both Subnet1 and Subnet2
    • NATgateway1 is assigned [answer choice]. 16 IP addresses
    Why

    A NAT gateway is associated with subnets, and one NAT gateway can serve several subnets in the same virtual network (but never the GatewaySubnet). The /28 public IP prefix gives the gateway 16 public IP addresses (2^(32-28)).

  5. Question 5Single choiceTopic 3
    You have an Azure Virtual Desktop deployment that has 500 session hosts.
    All outbound traffic to the internet uses a NAT gateway.
    During peak business hours, some users report that they cannot access internet resources. In Azure Monitor, you discover many failed SNAT connections.
    You need to increase the available SNAT connections.
    What should you do?
    1. A
      Bind the NAT gateway to another subnet.
    2. B
      Add a public IP address.
    3. C
      Deploy Azure Standard Load Balancer that has outbound rules.
    Show answer

    Correct answer: B

    Why

    Each public IP address on a NAT gateway adds 64,512 SNAT ports. Adding another public IP increases available SNAT connections. Binding another subnet does not add ports, and a load balancer would replace the NAT gateway.

  6. Question 6Drag and dropTopic 3
    DRAG DROP

    You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.

    You plan to deploy the resources shown in the following table.



    You need to deploy two load balancers to manage the traffic for VMSS1, VM1, and VM2. The solution must meet the following requirements:

    • Either VM1 or VM2 must inspect all the traffic from the internet to App1.
    • All user connections from the internet to App1 must be load balanced.
    • Costs must be minimized.

    Which load balancer SKU should you include in the solution? To answer, drag the appropriate SKUs to the correct resources. Each SKU may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

    NOTE: Each correct selection is worth one point.

    Move each item to the matching row:

    • Basic
    • Gateway
    • Standard
    • VMSS1:
    • VM1 and VM2:
    Show answer
    • VMSS1: Standard
    • VM1 and VM2: Gateway
    Why

    A Standard public load balancer balances internet connections to App1 on VMSS1. A Gateway load balancer fronts the NVAs and is chained to the Standard frontend, transparently sending traffic through VM1 or VM2 for inspection. Gateway load balancers can only chain to Standard SKU resources; Basic is also retired.

  7. Question 7Single choiceTopic 4
    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You have an Azure subscription that contains an Azure Front Door Premium profile named AFD1 and an Azure Web Application Firewall (WAF) policy named WAF1. AFD1 is associated with WAF1.

    You need to configure a rate limit for incoming requests to AFD1.

    Solution: You configure a managed rule for WAF1.

    Does this meet the goal?
    1. A
      Yes
    2. B
      No
    Show answer

    Correct answer: B

    Why

    Managed rules (Default Rule Set, Bot Manager) detect known attack patterns and cannot throttle request volume. Rate limiting in an Azure Front Door WAF policy is only available through a custom rule of type rate limit. So this solution does not meet the goal.

  8. Question 8Drag and drop: orderTopic 4
    DRAG DROP

    You have an Azure Web Application Firewall (WAF) v2 tier named AG1 on an Azure application gateway. AG1 has a policy named Policy1.

    You need to add a custom rule to Policy1. The rule must block all requests from IP addresses in a specific IP address range.

    Which four PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

    Arrange 4 of these in the correct order:

    • New-AzApplicationGatewayFirewallPolicyExclusion
    • New-AzApplicationGatewayFirewallMatchVariable
    • New-AzApplicationGatewayFirewallCondition
    • New-AzApplicationGatewayFirewallCustomRule
    • Set-AzApplicationGatewayFirewallPolicy
    Show answer
    1. New-AzApplicationGatewayFirewallMatchVariable
    2. New-AzApplicationGatewayFirewallCondition
    3. New-AzApplicationGatewayFirewallCustomRule
    4. Set-AzApplicationGatewayFirewallPolicy
    Why

    Create the match variable (RemoteAddr), use it in a condition with the IPMatch operator and the address range, build the custom rule with a Block action from that condition, then save it to Policy1. Exclusions only exempt request elements from managed rules, so they are not needed.

  9. Question 9HotspotTopic 5
    HOTSPOT

    You have two Azure subscriptions named Subscription1 and Subscription2.

    There are no connections between the virtual networks in the two subscriptions.

    You configure a private link service as shown in the privatelinkservice1 exhibit. (Click the privatelinkservice1 tab.)



    You create a load balancer name in Subscription1 and configure the backend pool shown in the lb1 exhibit. (Click the lb1 tab.)



    You create a private endpoint in Subscription2 as shown in the privateendpoint4 exhibit. (Click the privateendpoint4 tab.)



    For each of the following statements, select Yes if the statement is true. Otherwise, select No.

    NOTE: Each correct selection is worth one point.

    The resources that will be accessed by using privatelinkservice1 must be added to backendpool1 on LB1.Yes / No
    Users in Subscription2 can connect to the resources published by privatelinkservice1 by using IP address 10.3.0.7.Yes / No
    The private endpoint must be approved by an administrator in Subscription1.Yes / No
    Show answer
    • The resources that will be accessed by using privatelinkservice1 must be added to backendpool1 on LB1. Yes
    • Users in Subscription2 can connect to the resources published by privatelinkservice1 by using IP address 10.3.0.7. No
    • The private endpoint must be approved by an administrator in Subscription1. Yes
    Why

    A private link service sends traffic to the backend pool of its Standard load balancer. Consumers connect to their private endpoint IP, 10.5.0.7, because 10.3.0.7 is only the NAT IP. The connection is Pending, so the service owner in Subscription1 must approve it.

  10. Question 10Single choiceTopic 5
    You have an Azure Private Link service named PL1 that uses an Azure load balancer named LB1.

    You need to ensure that PL1 can support a higher volume of outbound traffic.

    What should you do?
    1. A
      Increase the number of frontend IP configurations for LB1.
    2. B
      Increase the number of NAT IP addresses assigned to PL1.
    3. C
      Deploy an Azure Application Gateway v2 instance to the source NAT subnet.
    4. D
      Redeploy LB1 with a different SKU.
    Show answer

    Correct answer: B

    Why

    A Private Link service translates traffic with source NAT, and each NAT IP address provides about 64k ports. Adding more NAT IP addresses to PL1 raises the number of concurrent connections. More frontend IPs, a different load balancer SKU or Application Gateway do not add SNAT capacity.

  11. Question 11Single choiceTopic 7
    You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements.
    Which connectivity method should you use?
    1. A
      a private endpoint
    2. B
      Azure Firewall
    3. C
      Azure Front Door
    4. D
      a service endpoint
    Show answer

    Correct answer: A

    Why

    The case study is not shown here, so this follows the usual pattern. A private endpoint gives private IP connectivity reachable from VNets and on-premises, while a service endpoint only works from subnets within Azure. Community votes are nearly split; the decision depends on whether on-premises access is required.

  12. Question 12Single choiceTopic 8
    You need to configure GW1 to meet the network security requirements for the P2S VPN users.
    Which Tunnel type should you select in the Point-to-site configuration settings of GW1?
    1. A
      IKEv2 and OpenVPN (SSL)
    2. B
      IKEv2
    3. C
      IKEv2 and SSTP (SSL)
    4. D
      OpenVPN (SSL)
    5. E
      SSTP (SSL)
    Show answer

    Correct answer: D

    Why

    Based on the P2S requirements, OpenVPN (SSL) is the tunnel type that supports Microsoft Entra authentication and works on non-Windows clients. IKEv2 and SSTP combinations do not support Entra ID authentication, so OpenVPN alone is selected.

  13. Question 13Multiple responseTopic 9
    You need to connect Vnet2 and Vnet3. The solution must meet the virtual networking requirements and the business requirements.
    Which two actions should you include in the solution? Each correct answer presents part of the solution.
    NOTE: Each correct selection is worth one point.
    1. A
      On the peering from Vnet1, select Allow gateway transit.
    2. B
      On the peerings from Vnet2 and Vnet3, select Use remote gateways.
    3. C
      On the peerings from Vnet2 and Vnet3, select Allow gateway transit.
    4. D
      On the peering from Vnet1, select Use remote gateways.
    5. E
      On the peering from Vnet1, select Allow forwarded traffic.
    Show answer

    Correct answer: A, B

    Why

    To let spokes use the hub gateway, the hub peering from Vnet1 must have Allow gateway transit, and the peerings from Vnet2 and Vnet3 must have Use remote gateways. This lets Vnet2 and Vnet3 communicate via the gateway in Vnet1. Forwarded traffic is not the setting needed here.

  14. Question 14Single choiceTopic 10
    What should you implement to meet the virtual network requirements for the virtual machines that connect to Vnet4 and Vnet5?
    1. A
      a private endpoint
    2. B
      a routing table
    3. C
      a service endpoint
    4. D
      a private link service
    5. E
      a virtual network peering
    Show answer

    Correct answer: E

    Why

    Virtual network peering connects Vnet4 and Vnet5 so VMs communicate over the Microsoft backbone using private IPs. Private endpoints, private link services and service endpoints expose PaaS or specific services, and a route table alone does not create connectivity between VNets.

  15. Question 15Single choiceTopic 11
    You need to configure the default route on Vnet2 and Vnet3. The solution must meet the virtual networking requirements.
    What should you use to configure the default route?
    1. A
      route filters
    2. B
      BGP route exchange
    3. C
      a user-defined route assigned to GatewaySubnet in Vnet1
    4. D
      a user-defined route assigned to GatewaySubnet in Vnet2 and Vnet3
    Show answer

    Correct answer: B

    Why

    With a VPN gateway in Vnet1, spokes receive a default route learned through BGP route exchange when gateway transit is used and the gateway advertises 0.0.0.0/0. A UDR on GatewaySubnet or route filters would not configure the default route on Vnet2 and Vnet3.