Designing and Implementing Microsoft Azure Networking Solutions (AZ-700) practice questions

Domain coverage 5 domains

• Design and Implement Core Networking Infrastructure
• Design and Implement Hybrid Networking
• Design and Implement Routing
• Secure and Monitor Networks
• Design and Implement Private Access to Azure Services

Sample questions 10 of 100 shown

1. Q1 Design and Implement Core Networking Infrastructure (25-30%)

   You create an Azure subnet with the address range 10.10.20.0/24. How many IP addresses are available for Azure resources in that subnet?

   1. 251
   2. 252
   3. 254
   4. 256

   Azure reserves the first four IP addresses and the last IP address in every subnet. A /24 has 256 total addresses (0-255). Azure reserves x.x.x.0 (network), x.x.x.1 (default gateway), x.x.x.2 and x.x.x.3 (DNS), and x.x.x.255 (broadcast). So 256 - 5 = 251 usable addresses for Azure resources. This is consistent across all subnets regardless of size.
2. Q2 Design and Implement Core Networking Infrastructure (25-30%)

   You are designing multiple Azure VNets that will later be peered to each other and connected to on-premises networks. Which address planning approach should you use?

   1. Reuse the same 10.0.0.0/16 range in every VNet to simplify templates
   2. Assign non-overlapping private ranges to every VNet and on-premises network
   3. Use public IP ranges inside VNets to avoid translation
   4. Place all workloads into one flat /8 subnet

   Azure VNet peering and hybrid connectivity require non-overlapping address spaces to route traffic correctly. Reusing the same prefixes across networks creates routing conflicts that block peering, VPN, and ExpressRoute connectivity. Each VNet must have a unique address space that does not overlap with any other VNet or on-premises network it needs to communicate with.
3. Q3 Design and Implement Core Networking Infrastructure (25-30%)

   Your security team wants a reserved block of contiguous public IP addresses so that external partners can allowlist a predictable range before you deploy Azure Firewall instances. Which Azure resource should you create?

   1. Application security group
   2. Public IP Prefix
   3. Private endpoint
   4. Service endpoint

   A Public IP Prefix reserves a contiguous block of public IP addresses in your subscription within a specific region. You specify the prefix size (e.g., /28 gives 16 addresses, /31 gives 2). Once created, individual public IP resources can be allocated from this prefix. This is ideal for firewall allowlisting scenarios where external partners need a predictable IP range.
4. Q4 Design and Implement Core Networking Infrastructure (25-30%)

   You change a virtual network to use custom DNS servers, but existing VMs continue using the old DNS settings. What should you do next?

   1. Delete and recreate the NICs
   2. Restart the VMs or renew their DHCP lease
   3. Enable accelerated networking
   4. Move the VMs to a different subnet

   Azure VMs obtain DNS server settings via DHCP from the virtual network configuration. When you change the DNS servers on a VNet, existing VMs only pick up the new settings after a DHCP lease renewal. The simplest way is to restart the VMs (which triggers DHCP renewal). On Windows, you can also run ipconfig /renew without a full restart.
5. Q5 Design and Implement Core Networking Infrastructure (25-30%)

   You have two VNets in the same Azure region: VNet-A (10.0.0.0/16) and VNet-B (10.1.0.0/16). VMs in each VNet need to communicate privately with low latency and high bandwidth. Both VNets belong to the same subscription. What is the BEST solution for inter-VNet connectivity?

   1. VNet peering
   2. VPN Gateway with VNet-to-VNet connection
   3. Azure ExpressRoute
   4. Azure Virtual WAN

   VNet peering is the optimal choice for VNet connectivity within the same region and subscription. It uses the Azure backbone network (never traverses the public internet), provides sub-millisecond latency, highest bandwidth (subject only to VM NIC limits, not gateway throughput), and is the simplest to configure. VPN Gateway (B) would introduce unnecessary latency and throughput limits.
6. Q6 Design and Implement Core Networking Infrastructure (25-30%)

   You are designing a VNet for a new workload in Azure East US. The on-premises network uses 10.0.0.0/8 address space. You need the Azure VNet to avoid overlap and support up to 500 VMs. Which address space should you assign to the Azure VNet?

   1. 10.5.0.0/16
   2. 172.16.0.0/16
   3. 192.168.1.0/24
   4. 10.0.0.0/16

   A /16 provides 65,536 addresses — more than enough for 500 VMs plus subnets, gateway subnet, and Azure reserved IPs. 172.16.0.0/16 (part of the 172.16.0.0/12 private range) does not overlap with the on-premises 10.0.0.0/8 space. A and D overlap with on-premises. C (/24) only provides 251 usable addresses — insufficient for 500 VMs.
7. Q7 Design and Implement Core Networking Infrastructure (25-30%)

   Your VMs in Azure need to resolve each other by hostname (e.g., vm1.contoso.internal). You also want VMs to automatically register their DNS records when they are created, without deploying DNS servers. Which Azure service should you use?

   1. Azure DNS public zones
   2. Deploy a Windows Server DNS on a VM
   3. Azure Private DNS zones linked to the VNet with auto-registration
   4. Azure DNS resolver

   Azure Private DNS zones provide internal hostname resolution for resources in a VNet. When linked to a VNet with auto-registration enabled, VMs automatically register their name and IP when created. No DNS server VMs are required — it's fully managed by Azure. A registration virtual network link enables automatic DNS record management for VMs in the linked VNet.
8. Q8 Design and Implement Core Networking Infrastructure (25-30%)

   SpokeA is peered with a hub VNet, and SpokeB is also peered with the same hub. What is true about connectivity between SpokeA and SpokeB if no other configuration is added?

   1. They can communicate automatically because peering is transitive through the hub
   2. They can communicate only if both spokes are in the same region
   3. They cannot communicate because VNet peering is non-transitive
   4. They cannot communicate unless both spokes use Basic Load Balancer

   Azure VNet peering is not transitive by design. A hub VNet does not automatically relay traffic between two spoke VNets. To enable spoke-to-spoke communication, you need direct peering between spokes, routing through an NVA (like Azure Firewall) in the hub with UDRs, or a managed connectivity solution such as Azure Virtual Network Manager.
9. Q9 Design and Implement Core Networking Infrastructure (25-30%)

   You need low-latency connectivity between two Azure VNets in different regions without deploying VPN gateways. Which option should you choose?

   1. Site-to-site VPN between the VNets
   2. ExpressRoute Global Reach
   3. Global virtual network peering
   4. NAT Gateway in both VNets

   Global virtual network peering connects VNets across Azure regions over the Microsoft backbone network. It provides low-latency, high-bandwidth connectivity without the extra cost and complexity of VPN gateways. Unlike regular VNet peering (same region), global peering traffic traverses the Microsoft backbone between regions but still never goes over the public internet.
10. Q10 Design and Implement Core Networking Infrastructure (25-30%)

    You must force all internet-bound traffic from a subnet through an NVA that has the IP address 10.0.0.4. Which user-defined route should you create?

    1. 10.0.0.0/8 with next hop Virtual network
    2. 0.0.0.0/0 with next hop Virtual appliance 10.0.0.4
    3. 0.0.0.0/0 with next hop Internet
    4. ::/0 with next hop Virtual appliance 10.0.0.4

    A default route (0.0.0.0/0) matches any IPv4 destination not covered by a more specific prefix. Setting the next hop to "Virtual appliance" with the NVA's IP address (10.0.0.4) sends all unmatched outbound traffic through the NVA for inspection or forwarding — this is called forced tunneling. Option D is for IPv6 traffic.

Answer all 100 questions with instant feedback →

Reader reviews 369 ratings

• This AZ-700 practice test is no joke — questions are challenging but fair. If you can pass these, you’ll pass the real exam.

  ★★★★★★ William C.

• I used this alongside video courses for AZ-700 prep. The questions helped solidify what I learned from the lectures.

  ★★★★★★ Aria N.

• The domain-based breakdown in the AZ-700 questions really helped me identify which areas needed more work.

  ★★★★★★ Elena R.

• Comprehensive coverage for AZ-700. Every domain is represented and the question difficulty ramps up nicely.

  ★★★★★★ Emma J.

• My colleague recommended this for AZ-700 and I’m glad I listened. Passed on my first go after two weeks of solid study.

  ★★★★★ Logan T.

• Only used this for a week before my AZ-700 exam and it was enough. Questions are very close to the real deal.

  ★★★★★★ Katherine W.

Frequently asked questions

Free study resources

Community-verified analysis of 27 questions from real test-taker discussions — 9 deep analyses and 0 FAQs.

More Microsoft exams