Skip to content

Azure Network Engineer Associate (AZ-700) - Practice Questions

15 questions for AZ-700 prep, weighted toward routing (25-30%) and core networking infrastructure (20-25%), then private access, monitoring, and hybrid connectivity.

Cert page: exams/azure/az-700/

Question 1

Scenario: Two virtual networks are peered. A VM in VNet A cannot reach a VM in VNet B, and peering status shows Connected on both sides.

A. Peering is not transitive; check that the reverse peering exists and that no NSG rule or route table blocks B. Peering requires a VPN gateway C. VNets in the same region cannot peer, so a Connected status only means the two VNets see each other's metadata but not data traffic D. Peering only supports IPv6

Answer **Correct: A** **Why:** Connected peering gives connectivity, so the failure is almost always an NSG rule, a user-defined route sending traffic to a virtual appliance, or an overlapping address space. Peering is bidirectional and must be configured from both VNets, and it is not transitive: A-B and B-C does not give A-C without a hub route or a gateway.

Question 2

Scenario: A subnet must send all internet-bound traffic through a network virtual appliance.

A. A user-defined route for 0.0.0.0/0 with next hop type Virtual appliance, on the subnet B. Azure Firewall Manager policy alone, applied to the subnet without making any route table changes C. Service endpoints D. A Network Security Group with a deny rule for internet destinations, which forces traffic to use the appliance

Answer **Correct: A** **Why:** UDRs override Azure's system routes, and a default route to a virtual appliance is the standard forced tunneling pattern. NSGs filter traffic but never redirect it. Remember the appliance's own NIC needs IP forwarding enabled, or the packets are dropped.

Question 3

Scenario: A storage account must be reachable privately from a VNet, with a private IP in that VNet, and not over the public endpoint.

A. Service endpoint B. VNet peering C. Private endpoint with a private DNS zone D. NAT gateway

Answer **Correct: C** **Why:** A private endpoint places a NIC with a private IP into your subnet and maps it to the PaaS resource. The part people miss is DNS: without the `privatelink` private DNS zone linked to the VNet, the name still resolves to the public IP. Service endpoints keep the public IP and merely restrict access by VNet.

Question 4

Scenario: Outbound internet access from a subnet must use a stable, predictable set of source IPs and avoid SNAT port exhaustion.

A. An internal load balancer B. A public IP on each VM C. A NAT gateway associated with the subnet D. Default outbound access, which gives each VM a fixed address from a pool dedicated to your subscription

Answer **Correct: C** **Why:** NAT gateway gives a large SNAT port pool with far better scaling than load balancer outbound rules or default outbound access, and it pins egress to the public IPs or prefix you attach. Per-VM public IPs work but multiply cost and attack surface. Default outbound access is being retired and uses unpredictable addresses.

Question 5

Scenario: An HTTPS web app needs path-based routing, WAF, and TLS termination.

A. Traffic Manager B. Azure Load Balancer C. Application Gateway with the WAF SKU D. NAT gateway

Answer **Correct: C** **Why:** Application Gateway is the regional layer 7 load balancer, and the WAF SKU adds OWASP rule protection. Azure Load Balancer is layer 4 and cannot read paths. Traffic Manager is DNS-based global routing with no data path at all, so it cannot terminate TLS.

Question 6

Scenario: Global HTTP traffic must be routed to the closest healthy regional backend with edge caching.

A. Azure Front Door B. Azure Load Balancer Standard, a layer 4 service with no HTTP awareness C. Application Gateway, a regional layer 7 service deployed into one VNet D. ExpressRoute, a private connection between on-premises networks and Azure

Answer **Correct: A** **Why:** Front Door is the global layer 7 entry point with anycast, edge caching, WAF, and health-based origin selection. Application Gateway is regional. Standard Load Balancer is regional layer 4. ExpressRoute is private connectivity to Azure, not internet-facing distribution.

Question 7

Scenario: ExpressRoute must carry traffic to Azure PaaS services, such as Azure Storage, through their public endpoints over the private connection, not the internet.

A. A site-to-site VPN gateway running over the public internet to reach those services B. Private peering only, with the PaaS services reached through their public endpoints C. Public peering, which is the current option for reaching Azure PaaS public IPs and needs no route filters D. Microsoft peering, with route filters selecting the service communities

Answer **Correct: D** **Why:** Private peering reaches VNets by private IP address. Microsoft peering reaches Azure PaaS services and Microsoft 365 on public IP addresses, and no routes are advertised until a route filter selects the BGP service communities. Public peering is no longer offered on new circuits. If the PaaS services are reached through private endpoints in a VNet instead, private peering carries that traffic. **Key Concept:** [ExpressRoute circuits and peering](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-circuit-peerings)

Question 8

Scenario: A hub-and-spoke topology needs spokes to reach on-premises through the hub's VPN gateway.

A. Deploy a VPN gateway in each spoke VNet, with a separate site-to-site connection to the on-premises device, instead of using the hub's gateway B. Use service endpoints C. Enable "Use remote gateways" on the spoke peering and "Allow gateway transit" on the hub peering D. Enable IP forwarding on the NICs of all spoke VMs, so that each one can relay traffic on to the hub gateway

Answer **Correct: C** **Why:** Gateway transit is the pair of peering settings that lets spokes use the hub's gateway. Both sides must be set, and a spoke can use only one remote gateway. Deploying a gateway per spoke works but multiplies cost and complexity, which defeats the point of a hub.

Question 9

Scenario: BGP is configured on a site-to-site VPN and on-premises advertises 0.0.0.0/0. What is the effect on Azure VMs?

A. Only DNS resolution is affected, because BGP routes apply to name lookups alone B. Forced tunneling: internet-bound VM traffic is sent to on-premises C. The tunnel drops D. No effect, because Azure system routes always take precedence over any route learned from BGP

Answer **Correct: B** **Why:** A default route learned over BGP overrides Azure's system default to the internet, so egress hairpins through on-premises. Some organizations want exactly this for inspection; others discover it accidentally when connectivity to Azure services breaks. Effective routes on the NIC are the fastest way to confirm.

Question 10

Scenario: You need to see, for a specific VM NIC, which route Azure will actually use for a destination.

A. Azure Advisor, which lists the effective route table of each NIC along with recommendations B. The activity log, which records the control plane operations performed on each resource C. Service Health, which reports Azure platform incidents that affect your subscription D. Network Watcher Effective routes and IP flow verify

Answer **Correct: D** **Why:** Effective routes merges system routes, UDRs, BGP-learned routes, and peering, which is the only reliable view when several sources conflict. IP flow verify answers "would this specific packet be allowed" and names the NSG rule that decided. Advisor, activity logs, and Service Health do not evaluate the data path.

Question 11

Scenario: An NSG on a subnet and another on the NIC both apply. How is inbound traffic evaluated?

A. Only the NIC NSG applies, because the NSG closest to the VM replaces the subnet NSG entirely for that VM B. The subnet NSG is evaluated first for inbound, then the NIC NSG; each one must allow the traffic C. The rules are merged D. The most permissive rule wins, so an allow in either NSG is enough to let the traffic through to the VM

Answer **Correct: B** **Why:** For inbound, the subnet NSG is processed then the NIC NSG, and both must allow. For outbound the order reverses. Since there is no merge and no permissive override, a deny in either place wins, which is why layered NSGs are a common cause of "the rule is right but it still fails."

Question 12

Scenario: DNS resolution is needed for private endpoints across many VNets from an on-premises resolver.

A. Public Azure DNS zones B. Azure DNS Private Resolver with an inbound endpoint, plus private DNS zones linked to the VNets C. Custom DNS on every VNet pointing to 8.8.8.8, with conditional forwarders for the privatelink zones added on each VNet D. A hosts file on each VM

Answer **Correct: B** **Why:** Private DNS zones are not reachable from on-premises by themselves. The Private Resolver's inbound endpoint gives on-premises a private IP to forward queries to, and the outbound endpoint plus forwarding rulesets handle the reverse direction. Public resolvers cannot see privatelink records.

Question 13

Scenario: Virtual WAN is chosen over a manually built hub. What is the main benefit?

A. It provides layer 7 WAF and path-based routing for every branch, replacing Application Gateway entirely B. Lower per-GB cost always C. It removes the need for NSGs D. Managed hubs with automated any-to-any branch, VNet, and user connectivity and built-in routing

Answer **Correct: D** **Why:** Virtual WAN's value is managed transit: Microsoft runs the hub routing, VPN and ExpressRoute gateways, and scale-out, so you configure connections rather than route tables. Cost is not automatically lower. Security controls and WAF are still separate services you attach.

Question 14

Scenario: Traffic between two spokes must be inspected by Azure Firewall in the hub.

A. Peer the spokes directly, since peering forces all spoke traffic through the hub firewall for inspection B. UDRs in each spoke pointing the other spoke's prefix at the firewall's private IP C. Rely on NSGs on each spoke subnet to inspect the traffic and block unwanted flows between the spokes D. Enable service endpoints on both spoke subnets so that the traffic between them is routed through the firewall

Answer **Correct: B** **Why:** Without a route, spoke-to-spoke traffic through peering goes directly and never touches the firewall. Explicit UDRs force the hairpin through the hub, and the firewall needs rules permitting the flow. Direct peering makes the bypass worse rather than better.

Question 15

Scenario: You must capture packet-level evidence of a connectivity problem on a running VM.

A. Network Watcher packet capture B. NSG flow logs C. Connection Monitor D. Azure Monitor metrics

Answer **Correct: A** **Why:** Packet capture writes a capture file from the VM extension for the depth you need to see handshakes and resets. Flow logs record allow and deny decisions per flow, which is excellent for "was it blocked" but not for payload or TCP state. Connection Monitor does synthetic reachability testing over time.

Where to go deeper