AZ-700 Azure Network Engineer Associate Exam — Questions and Answers

Question 1: What routing protocol does ExpressRoute use to exchange routes with Azure?

RIP
OSPF
BGP (Border Gateway Protocol) (Correct answer)
EIGRP

Correct answer: BGP (Border Gateway Protocol)

ExpressRoute exclusively uses BGP (Border Gateway Protocol) for dynamic route exchange between your on-premises network and Azure.

Question 2: What is ExpressRoute Global Reach used for?

Linking an ExpressRoute circuit to multiple Azure regions
Increasing the bandwidth of an ExpressRoute circuit
Enabling IPv6 on an ExpressRoute circuit
Connecting two on-premises networks to each other through the Microsoft backbone (Correct answer)

Correct answer: Connecting two on-premises networks to each other through the Microsoft backbone

ExpressRoute Global Reach allows two on-premises networks, each connected to Azure via ExpressRoute, to communicate with each other through the Microsoft global network.

Question 3: You need to control outbound internet traffic from an Azure Kubernetes Service (AKS) cluster using Azure Firewall. What must you configure in the AKS network settings?

Enable the AKS HTTP application routing add-on
Configure a NAT gateway on the AKS subnet
Set outboundType to userDefinedRouting and add UDRs to the firewall (Correct answer)
Deploy Azure API Management in front of AKS

Correct answer: Set outboundType to userDefinedRouting and add UDRs to the firewall

Setting outboundType to 'userDefinedRouting' in AKS tells the cluster to rely on UDRs for egress, allowing you to route traffic through Azure Firewall.

Question 4: How should ethical dilemmas be handled in Load Balancing and DNS?

Follow established ethical guidelines, consult with supervisors, and prioritize stakeholder welfare (Correct answer)
Make decisions based solely on personal preference
Always choose the cheapest option
Ignore ethical concerns

Correct answer: Follow established ethical guidelines, consult with supervisors, and prioritize stakeholder welfare

Ethical decision-making requires following professional guidelines and prioritizing the welfare of all stakeholders.

Question 5: What type of IP address does a private endpoint use?

A static public IP from Azure's pool
A private IP address from the VNet address space (Correct answer)
A dynamic public IP assigned by Azure
A link-local address (169.254.x.x)

Correct answer: A private IP address from the VNet address space

A private endpoint is assigned a private IP address from the address space of the virtual network where it is deployed.

Question 6: A customer reports that their ExpressRoute-connected on-premises network can reach Azure VMs but cannot reach Azure PaaS services via private endpoints. What should be verified?

That the ExpressRoute circuit has Microsoft peering enabled
That the PaaS service firewall allows the on-premises IP range
That the private endpoint has a public IP associated
That the private DNS zone is linked to the VNet and on-premises DNS forwards to Azure DNS Private Resolver (Correct answer)

Correct answer: That the private DNS zone is linked to the VNet and on-premises DNS forwards to Azure DNS Private Resolver

Private endpoint DNS resolution requires on-premises DNS to forward private DNS zone queries to Azure, typically via DNS Private Resolver, and the zone must be linked to the VNet.

Question 7: What are the key regulatory requirements affecting Virtual Networks?

Regulations are optional guidelines
Only federal regulations apply
There are no regulations
Compliance with applicable laws, industry standards, and licensing requirements specific to the field (Correct answer)

Correct answer: Compliance with applicable laws, industry standards, and licensing requirements specific to the field

Practitioners must comply with all applicable regulations, which may include federal, state, and industry-specific requirements.

Question 8: What is the default system route behavior for traffic in an Azure VNet that does not match any more specific route?

Traffic is broadcast to all subnets in the VNet
Traffic is sent to the nearest Azure datacenter for inspection
Traffic is forwarded to the VNet gateway for routing decisions
Traffic is dropped because no matching route exists (Correct answer)

Correct answer: Traffic is dropped because no matching route exists

When traffic matches the default system route with next hop 'None' (no route), Azure drops the traffic silently.

Question 9: Which approach is most effective for problem-solving in Virtual Networks?

Always asking someone else
Ignoring the problem until it resolves itself
Systematic analysis followed by evidence-based decision making (Correct answer)
Random trial and error

Correct answer: Systematic analysis followed by evidence-based decision making

Systematic, evidence-based approaches lead to more reliable solutions than ad hoc methods.

Question 10: What are the two connection approval workflow options for a private endpoint?

Automatic and Manual (Correct answer)
Push and Pull
Public and Private
Shared and Dedicated

Correct answer: Automatic and Manual

Private endpoint connections support Automatic approval (for resources in the same tenant/subscription you control) and Manual approval (requiring explicit acceptance by the resource owner).

Question 11: What are the key regulatory requirements affecting Load Balancing and DNS?

Regulations are optional guidelines
There are no regulations
Only federal regulations apply
Compliance with applicable laws, industry standards, and licensing requirements specific to the field (Correct answer)

Correct answer: Compliance with applicable laws, industry standards, and licensing requirements specific to the field

Practitioners must comply with all applicable regulations, which may include federal, state, and industry-specific requirements.

Question 12: Which tool in the Azure portal allows you to trace the next hop for traffic from a specific VM to a destination IP address for routing troubleshooting?

Network Watcher – Next Hop (Correct answer)
Traffic Analytics
Azure Advisor
Azure Monitor – Network Insights

Correct answer: Network Watcher – Next Hop

Network Watcher's 'Next Hop' feature evaluates the effective routing for a VM's NIC and returns the next hop type and IP for a specified destination, directly reflecting the VM's effective route table.

Question 13: What is the most important foundational concept in Connectivity Solutions?

Memorizing all rules without understanding
Ignoring established guidelines
Only following instructions from supervisors
Understanding core principles and their practical application in Connectivity Solutions (Correct answer)

Correct answer: Understanding core principles and their practical application in Connectivity Solutions

Core principles provide the foundation for all decision-making and practice in Connectivity Solutions.

Question 14: An Azure Front Door origin health probe is failing, causing all traffic to fail over to a secondary origin. The primary origin responds correctly to direct requests. What should you check?

Whether the origin uses HTTP instead of HTTPS
Whether the origin's NSG or firewall blocks Front Door's probe IP ranges (Correct answer)
Whether the origin group load balancing sensitivity is set too low
Whether geo-filtering is enabled on Front Door

Correct answer: Whether the origin's NSG or firewall blocks Front Door's probe IP ranges

Front Door health probes come from specific Microsoft IP ranges; if the origin's firewall blocks those ranges, probes will fail even if the origin is healthy.

Question 15: How should risk be managed in Virtual Networks?

Through identification, assessment, mitigation strategies, and ongoing monitoring of potential risks (Correct answer)
Risk management is not necessary
By ignoring potential problems
By avoiding all risk entirely

Correct answer: Through identification, assessment, mitigation strategies, and ongoing monitoring of potential risks

Effective risk management involves a systematic process of identifying, evaluating, and addressing potential threats.

Question 16: By default, what is the state of network policies for private endpoints on a subnet?

Enabled
Disabled (Correct answer)
Inherited from VNet
Configured by Azure Policy

Correct answer: Disabled

Network policies (such as NSG and UDR support) for private endpoints are disabled by default on subnets and must be explicitly enabled.

Question 17: What is the importance of communication skills in Connectivity Solutions?

Communication skills cannot be learned
Communication is only important for managers
Technical skills are sufficient without communication
Clear communication prevents errors, builds relationships, and ensures understanding among all parties (Correct answer)

Correct answer: Clear communication prevents errors, builds relationships, and ensures understanding among all parties

Effective communication is essential for coordination, error prevention, and stakeholder relationships.

Question 18: Which Azure CLI command enables network policies on a subnet to support NSGs on private endpoints?

az network nsg rule create --endpoint-policy enabled
az network vnet subnet update --private-endpoint-network-policies Enabled (Correct answer)
az network vnet subnet update --disable-private-endpoint-network-policies false
az network private-endpoint create --network-policies true

Correct answer: az network vnet subnet update --private-endpoint-network-policies Enabled

The command `az network vnet subnet update --private-endpoint-network-policies Enabled` turns on NSG and UDR enforcement for private endpoint NICs in that subnet.

Question 19: How does technology impact modern practices in Load Balancing and DNS?

Technology is only useful for record keeping
Technology replaces all human judgment
Technology has no impact on this field
Technology improves efficiency, accuracy, and access to information while requiring new skills (Correct answer)

Correct answer: Technology improves efficiency, accuracy, and access to information while requiring new skills

Technology enhances capabilities while also requiring practitioners to develop new competencies.

Question 20: What quality metrics are most important in Load Balancing and DNS?

Measurable outcomes, process compliance, and stakeholder satisfaction (Correct answer)
Only speed of completion
Only financial metrics
No metrics are needed

Correct answer: Measurable outcomes, process compliance, and stakeholder satisfaction

Quality in Load Balancing and DNS is measured through multiple dimensions including outcomes, processes, and satisfaction.

Question 21: What role does continuing education play in Virtual Networks?

Keeping practitioners current with evolving best practices and new developments (Correct answer)
Only beneficial for management
It is optional and rarely helpful
Only required for new practitioners

Correct answer: Keeping practitioners current with evolving best practices and new developments

Continuing education ensures practitioners stay current with advances in their field.

Question 22: In a hub-spoke VNet topology using Azure Route Server, what configuration change is needed to allow spokes to learn each other's routes through the hub NVA?

Create static UDRs in each spoke pointing to the NVA
Enable VNet peering transitivity in the Azure portal
Enable 'Branch-to-Branch' traffic on Azure Route Server (Correct answer)
Configure BGP route reflector clusters on the gateway

Correct answer: Enable 'Branch-to-Branch' traffic on Azure Route Server

Enabling the 'Branch-to-Branch' (also called hub-and-spoke or spoke-to-spoke) setting on Azure Route Server allows it to advertise routes between connected NVA BGP peers, enabling spoke-to-spoke routing via the hub NVA.

Question 23: What role does continuing education play in Connectivity Solutions?

Only required for new practitioners
It is optional and rarely helpful
Keeping practitioners current with evolving best practices and new developments (Correct answer)
Only beneficial for management

Correct answer: Keeping practitioners current with evolving best practices and new developments

Continuing education ensures practitioners stay current with advances in their field.

Question 24: You need to audit all NSG flow logs for compliance. Which service stores NSG flow logs and enables traffic analytics?

Azure Monitor Metrics
Azure Service Bus
Azure Network Watcher with storage account (Correct answer)
Azure Sentinel only

Correct answer: Azure Network Watcher with storage account

NSG flow logs are stored in an Azure Storage account via Network Watcher, and Traffic Analytics can process these logs for visualization and insights.

Question 25: Which Azure VPN Gateway generation and SKU supports the highest aggregate throughput?

Generation2 VpnGw5AZ (Correct answer)
Generation1 VpnGw5
Generation2 VpnGw1AZ
Generation1 VpnGw3

Correct answer: Generation2 VpnGw5AZ

Generation 2 VpnGw5AZ supports up to 10 Gbps aggregate throughput and is zone-redundant, making it the highest-performance option for Azure VPN Gateway.

Question 26: How does technology impact modern practices in Connectivity Solutions?

Technology has no impact on this field
Technology improves efficiency, accuracy, and access to information while requiring new skills (Correct answer)
Technology is only useful for record keeping
Technology replaces all human judgment

Correct answer: Technology improves efficiency, accuracy, and access to information while requiring new skills

Technology enhances capabilities while also requiring practitioners to develop new competencies.

Question 27: A subnet route table has a custom route for 10.0.0.0/16 pointing to a virtual appliance, and a system route for 10.0.1.0/24 (a subnet within 10.0.0.0/16) pointing to VnetLocal. Traffic destined for 10.0.1.5 will use which route?

Traffic is dropped because conflicting routes exist
The /24 system route to VnetLocal (Correct answer)
The /16 custom route to the virtual appliance
The route with the lowest administrative distance

Correct answer: The /24 system route to VnetLocal

Azure uses longest prefix match, so the more specific /24 route wins over the /16 route regardless of route source.

Question 28: After enabling Azure DDoS Protection Standard on a VNet, legitimate traffic spikes are being dropped. What should you configure to prevent this?

Configure DDoS protection policies with custom thresholds using adaptive tuning (Correct answer)
Add the source IPs to an NSG allowlist
Increase the DDoS protection plan tier
Disable DDoS protection temporarily during traffic spikes

Correct answer: Configure DDoS protection policies with custom thresholds using adaptive tuning

DDoS Protection Standard uses adaptive tuning to learn normal traffic patterns, but custom threshold policies can be set to accommodate known legitimate traffic patterns.

Question 29: What makes a professional competent in Network Security?

A combination of education, practical experience, ongoing learning, and adherence to professional standards (Correct answer)
Only certifications matter
Only experience matters
Only formal education matters

Correct answer: A combination of education, practical experience, ongoing learning, and adherence to professional standards

Competence requires the integration of knowledge, skills, experience, and professional conduct.

Question 30: What is the significance of documentation in Load Balancing and DNS?

Only management needs to document
Only required during audits
It provides a record for accountability, quality assurance, and legal compliance (Correct answer)
Documentation is unnecessary busy work

Correct answer: It provides a record for accountability, quality assurance, and legal compliance

Proper documentation supports accountability, enables quality review, and satisfies legal requirements.

Question 31: What is the primary purpose of standardized procedures in Load Balancing and DNS?

To slow down work processes
To create unnecessary bureaucracy
To benefit only management
To ensure consistency, safety, and quality across all practitioners (Correct answer)

Correct answer: To ensure consistency, safety, and quality across all practitioners

Standardized procedures ensure that all practitioners deliver consistent, safe, and high-quality outcomes.

Question 32: What is the purpose of a private DNS zone group on a private endpoint?

To configure BGP routing for the private endpoint
To assign a custom domain name to the private endpoint
To group multiple private endpoints under a single DNS zone
To automatically create and manage DNS records in a linked private DNS zone (Correct answer)

Correct answer: To automatically create and manage DNS records in a linked private DNS zone

A private DNS zone group links a private endpoint to a private DNS zone and automatically creates/updates the DNS A record when the endpoint is created or deleted.

Question 33: What is the default BGP Autonomous System Number (ASN) for Azure VPN Gateway?

64512
65535
65515 (Correct answer)
65000

Correct answer: 65515

Azure VPN Gateway uses ASN 65515 by default for BGP peering, though you can configure a custom private ASN during gateway creation.

Question 34: An Azure Firewall is deployed in a hub VNet. Spoke VMs can reach the internet but not each other through the firewall. What is likely missing?

A network rule allowing spoke-to-spoke traffic in Azure Firewall (Correct answer)
Forced tunneling configuration on spoke VNets
User-defined routes returning traffic to spoke VNets
An application rule for internal RFC1918 addresses

Correct answer: A network rule allowing spoke-to-spoke traffic in Azure Firewall

Azure Firewall blocks all traffic by default; a network rule explicitly allowing spoke-to-spoke traffic must be added.

Question 35: How should ethical dilemmas be handled in Network Security?

Always choose the cheapest option
Make decisions based solely on personal preference
Follow established ethical guidelines, consult with supervisors, and prioritize stakeholder welfare (Correct answer)
Ignore ethical concerns

Correct answer: Follow established ethical guidelines, consult with supervisors, and prioritize stakeholder welfare

Ethical decision-making requires following professional guidelines and prioritizing the welfare of all stakeholders.

Question 36: What are the key regulatory requirements affecting Network Security?

Only federal regulations apply
Compliance with applicable laws, industry standards, and licensing requirements specific to the field (Correct answer)
There are no regulations
Regulations are optional guidelines

Correct answer: Compliance with applicable laws, industry standards, and licensing requirements specific to the field

Practitioners must comply with all applicable regulations, which may include federal, state, and industry-specific requirements.

Question 37: Which Azure Firewall SKU supports IDPS (Intrusion Detection and Prevention System) and TLS inspection?

Azure Firewall Basic
Azure Firewall Premium (Correct answer)
Azure Firewall Standard
Azure Firewall Developer

Correct answer: Azure Firewall Premium

Azure Firewall Premium includes IDPS and TLS inspection features not available in the Standard or Basic tiers.

Question 38: An NSG is applied to both a subnet and a NIC. Traffic arrives at the subnet. In what order are the NSG rules evaluated for inbound traffic?

Only the subnet NSG is evaluated
Both NSGs evaluated simultaneously with most permissive winning
Subnet NSG first, then NIC NSG (Correct answer)
NIC NSG first, then subnet NSG

Correct answer: Subnet NSG first, then NIC NSG

For inbound traffic, the subnet NSG is evaluated first, and if traffic passes, the NIC NSG is evaluated second.

Question 39: What do service endpoint policies allow you to do?

Restrict VNet service endpoint access to specific Azure Storage accounts (Correct answer)
Apply NSG rules to service endpoint traffic
Block all outbound traffic from a subnet
Enable private DNS resolution for service endpoints

Correct answer: Restrict VNet service endpoint access to specific Azure Storage accounts

Service endpoint policies let you filter outbound VNet traffic to Azure Storage, allowing access only to specific storage accounts rather than all accounts.

Question 40: A security audit requires that all Azure resources have no public IP addresses. Which Azure Policy effect enforces this during resource deployment?

Deny (Correct answer)
Audit
AuditIfNotExists
Modify

Correct answer: Deny

The Deny effect prevents deployment of resources that violate the policy condition, such as having a public IP address assigned.

AZ-700 Azure Network Engineer Associate Exam

The Microsoft AZ-700 exam certifies skills in designing, implementing, and managing Azure networking solutions including virtual networks, ExpressRoute, VPN gateways, load balancing, DNS, Private Link, network security, and hybrid connectivity.

Questions

100 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds