Detailed Exam Domain Coverage
To pass the AZ-700 exam, you must master the core pillars of Azure networking. This practice test bank provides extensive coverage across all official testing domains:
-
Design and Implement Core Networking Infrastructure (20–25%): Designing virtual networks, public and private IP addressing, routing configurations, Azure DNS, and virtual network peering.
-
Design, Implement, and Manage Connectivity Services (20–25%): Configuring Azure VPN Gateway architecture, ExpressRoute, and Azure Virtual WAN architectures.
-
Design and Implement Application Delivery Services (20–25%): Deploying and tuning Azure Load Balancer, Application Gateway, Azure Front Door, and Traffic Manager routing methods.
-
Design and Implement Network Security (24–30%): Securing resources using Azure Firewall, Network Security Groups (NSGs), Application Security Groups (ASGs), Web Application Firewall (WAF), and Azure Bastion.
Course Description
Navigating the complexities of enterprise cloud infrastructure requires a deep, practical understanding of networking. The Microsoft Certified: Azure Network Engineer Associate (AZ-700) certification validates your ability to design, implement, and maintain secure, scalable hybrid environments.
To help you clear this benchmark, I have developed a comprehensive repository of 1,500 high-quality practice questions. This resource functions as a rigorous simulator, mirroring the depth, scenario structures, and technical ambiguity found on the actual Microsoft exam. Rather than relying on simple memorization, every single question features exhaustive troubleshooting logic for both correct and incorrect options, building the architectural intuition required on the job.
Sample Practice Questions
To understand the depth of analysis provided throughout this course, review the technical breakdowns below.
Question 1: Hybrid Connectivity Routing
An enterprise establishes a Site-to-Site VPN to an Azure Virtual Network (VNet) using a Route-Based VPN Gateway. The local on-premises network must route traffic to a newly created subnet within the VNet. The administrator notices traffic is dropping. BGP is not enabled. Which component must be manually updated to ensure end-to-end routing?
-
A) The local network gateway object in Azure
-
B) The Azure System Route Table attached to the gateway subnet
-
C) The Application Security Group (ASG) assigned to the resources
-
D) The Virtual Network Peering configuration settings
-
E) The Azure ExpressRoute circuit private peering configuration
-
F) The Internet Information Services (IIS) binding tables
Correct Answer: A
-
Why it is correct (A): In a non-BGP static routing scenario, the Local Network Gateway object represents the on-premises address space in Azure. If a new subnet or IP range is added on-premises or needs specific path definitions without dynamic propagation, the local network gateway’s address space property must reflect these changes so Azure knows where to route return traffic.
-
Why it is incorrect (B): Azure system routes automatically handle the traffic mapping between the GatewaySubnet and internal VNets; manual intervention on the system route table for basic internal VNet propagation is unnecessary.
-
Why it is incorrect (C): ASGs group network interfaces for security rule applications but do not dictate layer 3 routing logic or cross-premises path definitions.
-
Why it is incorrect (D): Peering links distinct Azure VNets together. It does not control the direct pathing between a single VNet and an on-premises datacenter over a VPN gateway.
-
Why it is incorrect (E): The scenario explicitly states the infrastructure uses a Site-to-Site VPN, making ExpressRoute configurations completely irrelevant to this path.
-
Why it is incorrect (F): IIS binding tables are application-level configurations for web hosting servers, operating at Layer 7, and have zero impact on network layer routing.
Question 2: Layer 7 Load Balancing & Security
An application requires path-based routing (/images/* to Pool A and /video/* to Pool B) along with SSL termination and centralized protection against SQL injection attacks. Which Azure networking service fulfills all these design constraints?
-
A) Azure Basic Load Balancer
-
B) Azure Standard Load Balancer
-
C) Azure Application Gateway with WAF tier
-
D) Azure Traffic Manager with performance routing
-
E) Azure Front Door Standard tier without security add-ons
-
F) Azure Firewall Premium tier with IDPS
Correct Answer: C
-
Why it is correct (C): Azure Application Gateway operates at Layer 7 (HTTP/HTTPS) and natively supports URL path-based routing and SSL termination. When provisioned with the Web Application Firewall (WAF) tier, it includes pre-configured OWASP core rule sets to block SQL injection attacks at the edge.
-
Why it is incorrect (A): The Basic Load Balancer operates strictly at Layer 4 (TCP/UDP). It cannot inspect URL paths, terminate SSL certificates, or inspect payloads for SQL injections.
-
Why it is incorrect (B): Like the Basic tier, a Standard Load Balancer handles Layer 4 traffic distribution based on IPs and ports, completely lacking Layer 7 URL routing capability and WAF logic.
-
Why it is incorrect (D): Traffic Manager uses DNS-based routing to direct clients to endpoints globally. It does not process individual HTTP paths, terminate SSL, or inspect packets.
-
Why it is incorrect (E): While Front Door handles Layer 7 routing globally, the Standard tier without security add-ons lacks the necessary WAF controls to stop SQL injection out of the box.
-
Why it is incorrect (F): Azure Firewall Premium offers stateful network/application filtering and Intrusion Detection and Prevention (IDPS), but it does not function as an application load balancer with native path-based backend pool routing configurations.
Question 3: Network Security Groups & Evaluation Logic
A backend subnet contains multiple database virtual machines. You attach a Network Security Group (NSG) to the subnet. Rule 100 allows inbound TCP port 1433 from the frontend subnet. Rule 110 denies all inbound traffic from the virtual network. A developer reports they cannot connect to the database from an allowed frontend host. Upon inspection, an explicit inbound security rule on the individual VM network interface (NIC) denies port 1433 with a priority of 90. How is this traffic processed?
-
A) Traffic is allowed because subnet rules always take absolute precedence over NIC rules.
-
B) Traffic is blocked because rules with lower priority numbers are processed first, and the NIC rule explicitly drops it.
-
C) Traffic is allowed because Rule 100 has a lower priority number than Rule 110.
-
D) Traffic is blocked because inbound traffic evaluates the subnet NSG first, passes it, then evaluates the NIC NSG, where it is denied.
-
E) Traffic is allowed because the virtual network tag overrides regional NIC rules.
-
F) Traffic is blocked because Azure Bastion is required to bridge connections between subnets.
Correct Answer: D
-
Why it is correct (D): For inbound traffic, Azure evaluates the Subnet-level NSG rules first. If allowed (which Rule 100 does), the traffic proceeds to the NIC-level NSG rules. At the NIC level, the rule with priority 90 explicitly denies the traffic, dropping the packet before it reaches the VM operating system.
-
Why it is incorrect (A): Subnet rules do not override NIC rules; inbound traffic must successfully clear both evaluation zones sequentially to gain access.
-
Why it is incorrect (B): While lower numbers mean higher priority within a single NSG, this choice ignores the architectural rule that subnet and NIC NSGs are evaluated as two entirely separate, sequential steps.
-
Why it is incorrect (C): This accurately explains why the traffic cleared the subnet layer, but it fails to account for the secondary block occurring at the NIC level.
-
Why it is incorrect (E): Service tags simplify rule creation but do not alter the foundational sequential processing architecture of subnet-to-NIC NSG evaluation.
-
Why it is incorrect (F): Azure Bastion is a secure management tool for RDP/SSH access; it is not a routing mechanism or a prerequisite for standard internal cross-subnet communication.
Welcome to the Mock Exam Practice Tests Academy to help you prepare for your Microsoft Certified: Azure Network Engineer Associate (AZ-700) certification.
-
You can retake the exams as many times as you want
-
This is a huge original question bank
-
You get support from instructors if you have questions
-
Each question has a detailed explanation
-
Mobile-compatible with the Udemy app
I hope that by now you’re convinced! And there are a lot more questions inside the course.
