Practice Exam AZ-700: Azure Network Engineer Associate

Question bank: 100 · timed mock exam: 100 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Compare: JN0-106 vs AZ-700

Compare: AZ-104 vs AZ-700

  • Design and implement core networking infrastructure 28 questions
  • Design, implement, and manage connectivity services 24 questions
  • Design and implement application delivery services 18 questions
  • Design and implement Azure network security services 18 questions
  • Design and implement private access to Azure services 12 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 100 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Azure Network Engineer Associate (AZ-700) with InfraPrep

The 100 questions cover 5 domains: Design and implement core networking infrastructure, Design, implement, and manage connectivity services, Design and implement application delivery services, Design and implement Azure network security services, Design and implement private access to Azure services. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 100 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Design and implement core networking infrastructure

A team deploys a VM with a Standard SKU public IP attached to its NIC, but creates no NSG at all. They expect that, without an NSG explicitly allowing it, no inbound traffic can reach the VM. Is this expectation correct?

  1. No — Standard SKU public IPs are open by default, so unrestricted inbound traffic reaches the VM
  2. Yes — Standard SKU public IPs use a secure-by-default model and are closed to inbound traffic when used as a frontend
  3. Yes, but only because Basic SKU is silently used as a fallback with the same protection
  4. No — the public IP SKU has no effect on inbound security; only NSGs matter
Show the answer and the explanation

Correct answer: B

Standard SKU public IPs follow a secure-by-default model: they are closed to inbound traffic as a frontend unless an NSG explicitly allows it.

Source: official documentation

Question 2 Design, implement, and manage connectivity services

An enterprise needs 140 separate site-to-site VPN tunnels terminating on a single hub — more than any single VPN Gateway SKU supports. What should they use instead?

  1. A Basic SKU VPN Gateway, which supports unlimited S2S tunnels
  2. Multiple point-to-site connections instead of site-to-site
  3. A single VpnGw1 gateway, which supports up to 1000 tunnels
  4. Azure Virtual WAN, since if you need more than 100 S2S VPN tunnels you should use Virtual WAN instead of VPN Gateway
Show the answer and the explanation

Correct answer: D

The documentation states directly that if you need more than 100 site-to-site VPN tunnels, use Virtual WAN instead of VPN Gateway.

Source: official documentation

Question 3 Design and implement core networking infrastructure

A team needs firewall rules keyed to a fixed public IP address for a VM's endpoint, and cannot tolerate the address changing if the VM is stopped and restarted. Which public IP allocation method should they choose?

  1. Zone-redundant dynamic
  2. Static
  3. Dynamic
  4. Basic SKU dynamic
Show the answer and the explanation

Correct answer: B

Setting the allocation method to static ensures the IP address remains the same for as long as the resource exists, which firewall rules keyed to that address require.

Source: official documentation

Question 4 Design, implement, and manage connectivity services

A branch office has its own on-premises VPN device and needs a permanent, always-on IPsec/IKE tunnel from that device straight into a VNet's VPN gateway — not a per-user client connection and not a link between two Azure VPN gateways. Which VPN Gateway connection type fits?

  1. ExpressRoute connection
  2. Point-to-site connection
  3. Site-to-site connection
  4. VNet-to-VNet connection
Show the answer and the explanation

Correct answer: C

This is the documented definition of a site-to-site connection: a cross-premises IPsec/IKE VPN tunnel between the VPN gateway and an on-premises VPN device.

Source: official documentation

Question 5 Design and implement core networking infrastructure

An administrator wants to delete a subnet that has been delegated to an Azure PaaS service. What must happen first?

  1. The delegation must be removed before the subnet or virtual network can be deleted
  2. The virtual network must be deleted before the subnet
  3. The PaaS service must be scaled to zero instances before removing the delegation
  4. The subnet is deleted directly, since delegation is removed automatically
Show the answer and the explanation

Correct answer: A

Subnet delegation requires the delegation to be removed before the subnet, or the virtual network that contains it, can be deleted.

Source: official documentation

Question 6 Design, implement, and manage connectivity services

To protect on-premises connectivity from a single availability-zone failure in the region, a team wants their VPN gateways physically and logically separated across zones. Which deployment achieves this, and is a Basic SKU gateway an alternative?

  1. A Basic SKU gateway is zone-redundant by default, so it's an equally valid alternative to a zonal deployment
  2. A single non-zonal gateway becomes automatically zone-redundant once traffic volume increases
  3. Deploy the gateways in Azure Availability Zones; the Basic SKU gateway is not zone-redundant
  4. Two gateways placed in the same availability zone already provide equivalent zone-level protection
Show the answer and the explanation

Correct answer: C

Deploying gateways in Azure Availability Zones physically and logically separates them within a region and protects on-premises connectivity from zone-level failures; the Basic SKU gateway row shows it does not support zone redundancy.

Source: official documentation

Question 7 Design and implement core networking infrastructure

A team deploys VMs into a subnet that uses a NAT gateway for outbound internet connectivity. They now need inbound access from the internet to reach a specific VM. Does the NAT gateway that already provides outbound access also let inbound internet connections reach the VM?

  1. An NSG rule alone, without any public IP or public load balancer, is enough for inbound access
  2. No — inbound access needs a public IP address or a public load balancer for that resource; the NAT gateway doesn't permit unsolicited inbound connections from the internet
  3. Yes — once the NAT gateway allows outbound connectivity, it automatically allows inbound connections too
  4. A private DNS zone linked to the VNet enables inbound access automatically
Show the answer and the explanation

Correct answer: B

You can communicate inbound with a resource only by assigning it a public IP address or a public load balancer; a NAT gateway doesn't permit unsolicited inbound connections from the internet — only response packets to an outbound connection can pass through it.

Source: official documentation

Question 8 Design, implement, and manage connectivity services

A team standardizing on a single point-to-site protocol needs to know which protocol is restricted to Windows client devices only.

  1. OpenVPN
  2. SSTP
  3. IKEv2
  4. IPsec site-to-site
Show the answer and the explanation

Correct answer: B

SSTP is only supported on Windows devices.

Source: official documentation

Question 9 Design and implement core networking infrastructure

A VNet has a private DNS zone linked to it for internal name resolution. The team then configures a custom DNS server on that same VNet. Afterward, VM name lookups against the private zone start failing even though the zone and its records are unchanged. What is the most likely cause, and how can they keep the custom DNS server while still resolving the private zone?

  1. Custom DNS servers are permanently incompatible with private DNS zones under any configuration whatsoever
  2. The private zone must be re-linked to the VNet every single time a custom DNS server is added
  3. Private DNS zones stop working the moment autoregistration is disabled; re-enabling autoregistration is the fix
  4. The custom setting overrides the query order; deploy an Azure DNS Private Resolver linked to the zone
Show the answer and the explanation

Correct answer: D

When a custom DNS server is defined on a VNet, the system no longer automatically queries private DNS zones linked to that VNet — the custom setting overrides the resolution order. To resolve the private zone while keeping custom DNS, an Azure DNS Private Resolver deployed in a VNet linked to the zone is the documented fix.

Source: official documentation

Question 10 Design, implement, and manage connectivity services

An admin configures a P2S gateway with tunnel types "IKEv2 and OpenVPN" and authentication types "Microsoft Entra ID and RADIUS". Which tunnel type will Microsoft Entra ID authentication actually use, and why?

  1. Both IKEv2 and OpenVPN simultaneously for the same client
  2. Neither — this combination is rejected by the gateway at configuration time
  3. IKEv2 only, because it is listed first among the tunnel types
  4. OpenVPN only, because Microsoft Entra ID authentication is supported only for the OpenVPN protocol
Show the answer and the explanation

Correct answer: D

Microsoft Entra ID authentication is supported only for the OpenVPN protocol. The documentation gives exactly this scenario: with tunnel types "IKEv2 and OpenVPN" and authentication types including Microsoft Entra ID, Microsoft Entra ID will only use the OpenVPN tunnel type since it isn't supported by IKEv2.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.