AZ-700 sample questions with answers
The other 175 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsDesign and implement core networking infrastructure
- A network engineer carves a subnet of 192.168.44.0/26 for a set of application servers in Azure. How many addresses can be assigned to resources in that subnet?
- A team deploys VMs into a new subnet in a recently created VNet. The VMs must download patches from public repositories using a stable outbound IP, and nothing on the internet should be able to initiate connections to them. What is the best fit?
- A jump host cannot open RDP (TCP 3389) to a VM in another subnet. You need to know which NSG rule, if any, allows or denies that exact flow, and you want a fast answer. Which Network Watcher tool should you run?
- A team proposes attaching an Azure DDoS Network Protection plan directly to a Virtual WAN hub to protect branch-to-cloud traffic. How should you respond?
- Workloads in several spoke VNets need answers for names kept on DNS servers in the corporate datacenter, and a central Azure resolver should enforce one policy. What should be deployed and configured?
- A hub DNS Private Resolver has an inbound endpoint at 10.10.0.4. A ruleset forwards corp.example.net queries to that address, so spoke VNets can use the hub. Which of these VNets must be left unlinked from this ruleset?
Design, implement and manage connectivity services
- A team plans to give field engineers remote access through a point-to-site VPN. Their existing gateway was built as a policy-based device. What must change to support remote access?
- A hub network hosts a VPN gateway. A spoke network must send traffic to on-premises through that gateway over peering. Which settings are needed?
- A trading platform streams market data over ExpressRoute and needs lower latency. Its design should let packets bypass the virtual network gateway and reach the VMs directly. What should be turned on?
- Consultants working from home laptops need encrypted access to resources in an Azure virtual network. The firm does not want to buy VPN hardware for any location. Which connectivity option fits best?
- A branch router can hold two IPsec sessions at once. The business needs the site-to-site connection to keep working when one Azure gateway instance is lost. Which gateway configuration should you choose?
- A manufacturer has ExpressRoute circuits serving a plant in Chicago and another in Toronto. The two plants must exchange routes and traffic across Microsoft's network, not over the internet. Which capability should be enabled?
- A logistics company runs 40 branch offices spread across three continents. Each branch must reach other branches and several VNets, and the team wants to avoid building and routing hub networks by hand. Which architecture fits best?
Design and implement application delivery services
- A game studio runs a pool of dedicated game-server VMs in one region. Players connect over raw TCP and UDP sockets rather than HTTP. The team needs a service that spreads these connections across the VMs at the transport layer. Which service fits?
- A ticketing platform serves fans worldwide. It needs a web application firewall and acceleration at the global edge, then path- and host-based routing inside each region toward that region's web tier. Which layered design fits?
- A team turns on a web application firewall for a new public site. It wants to record which requests would be blocked, without actually blocking anything, before enforcing rules. Which mode should it start with?
- Several worker VMs in a Standard Load Balancer backend pool must reach external APIs through a shared public address. The operations team also wants to control how many SNAT ports each instance receives so that egress capacity is predictable. Which configuration provides this?
Design and implement private access to Azure services
- A SaaS vendor runs its API on virtual machines behind an internal Standard Load Balancer. Customers in other tenants must reach it over private addressing without any public exposure. What should the vendor create?
- Your company subscribes to a third-party analytics service that the vendor publishes through Private Link. What must you provision inside your own network to reach it privately?
- A team switched its Azure SQL traffic off the old service endpoint path onto a private endpoint. Apps that connect by IP work, but apps using the server name fail. What should be fixed?
Design and implement network security
- A group security office needs deny rules that every regional firewall must honor. Each region may add its own allow rules, but no regional policy may weaken the global deny list. Which firewall rule architecture meets this requirement?
- You are preparing a virtual network so that a managed jump service can be deployed into it. The subnet must carry one exact name and must not host other workloads. Which name must you give that subnet?
- A workload must send TCP traffic on port 8443 to a fixed partner appliance IP through Azure Firewall. The protocol is not HTTP. Which firewall rule type should you configure?
- A company runs three Azure Firewalls in separate virtual hubs. Each needs the same rule collections and the same threat intelligence mode, and the security team wants one place to edit them. Which resource should hold these settings?
- A team building a new workload in 2026 wants flow-level records of its virtual network traffic. NSG flow log creation is no longer available to them. What should they use?