Azure networking scenarios are best solved by identifying the required connectivity behavior and eliminating designs that satisfy only part of the requirement. These 20 newly written practice questions are illustrative exercises for the Microsoft AZ-700 networking objectives effective July 27, 2026. They are not actual Microsoft exam questions, do not claim access to a live exam bank, and should be checked against current product documentation when implementing a real environment.<\/p>\n
Work through each scenario before reading the answer. The distractors are deliberately plausible: a service might solve a DNS problem but not a routing problem, or provide private transport without end-to-end encryption. The current AZ-700 skill domains<\/a> cover core network infrastructure, connectivity, application delivery, private access and network security. A strong response should satisfy every stated constraint, not merely name a familiar product.<\/p>\n Question 1.<\/b> An organization has an on-premises network using 10.20.0.0\/16. A proposed Azure virtual network uses 10.20.4.0\/22. The team expects to establish routed hybrid connectivity with no address translation. What design change should be made before deployment?<\/p>\n A. Add more NSG allow rules. B. Use a nonoverlapping Azure address space. C. Attach Azure Traffic Manager. D. Change only the virtual-network resource group’s name.<\/p>\n Answer: B.<\/b> The Azure range lies inside the existing on-premises range, making unambiguous routing across the two environments impossible without more complex translation. Plan nonoverlapping addresses, confirm subnet capacity and route advertisement, and then build the connection. NSG rules do not solve an overlapping addressing plan. The principles behind Azure virtual network configuration<\/a> start with this address-space decision.<\/p>\n Question 2.<\/b> A private workload subnet must reach approved public update endpoints without assigning public IP addresses to individual virtual machines. The organization wants a managed, scalable explicit outbound method. Which service is the closest fit?<\/p>\n A. NAT Gateway. B. Azure DNS Private Resolver. C. Private Endpoint on every VM. D. Traffic Manager.<\/p>\n Answer: A.<\/b> Azure NAT Gateway provides managed outbound source network address translation when associated with the subnet, without allowing unsolicited inbound connections. It does not grant application-layer authorization or automatically bypass a user-defined route that deliberately sends internet traffic to a virtual appliance or gateway. Check that the chosen SKU and region support the intended requirements.<\/p>\n Question 3.<\/b> A spoke virtual network must use a VPN gateway deployed in a hub virtual network to reach a branch office. The two VNets are peered. Which additional configuration is relevant?<\/p>\n A. Put a second gateway in each spoke. B. Enable gateway transit in the hub and use the remote gateway from the spoke, with compatible routing. C. Change the VNets to identical address ranges. D. Enable an Azure Firewall policy only.<\/p>\n Answer: B.<\/b> Gateway transit allows an appropriately configured peered VNet to use the hub’s VPN or ExpressRoute gateway. Peerings and route propagation must still be planned, and the spoke cannot simultaneously use its own gateway as a remote-gateway user in the described design. Virtual network peering<\/a> by itself is not a blanket rule that makes every spoke transitively connected to every other network.<\/p>\n Question 4.<\/b> After deploying a 0.0.0.0\/0 user-defined route to a network virtual appliance, a VM loses internet access. Before modifying security groups, the engineer wants to see how Azure selects the next hop for traffic to a test destination. What diagnostic is most suitable?<\/p>\n A. Network Watcher Next hop. B. Azure Cost Management. C. Traffic Manager DNS routing. D. Application Gateway path rules.<\/p>\n Answer: A.<\/b> Next hop can examine the selected route toward a specific destination from the VM’s network interface. Check effective routes and whether the appliance forwards and returns traffic. An NSG might also block communication, but changing rules without validating routing could hide the actual issue. A 0.0.0.0\/0 route to an appliance may also take precedence over the expected NAT Gateway internet path.<\/p>\n Question 5.<\/b> Employees use company laptops from changing hotel and home networks. Each user must connect securely to private Azure network resources through an individual authenticated client connection. What connectivity type is the natural first option?<\/p>\n A. Site-to-site VPN. B. Point-to-site VPN. C. Azure Front Door. D. Public DNS record only.<\/p>\n Answer: B.<\/b> Point-to-site VPN is designed for individual clients connecting to a virtual network with supported authentication and tunnel configuration. Site-to-site VPN is a better fit when entire office networks require gateway connectivity. Correct client authentication does not remove the need to configure accessible routes, DNS and resource-level security.<\/p>\n Question 6.<\/b> An enterprise selects ExpressRoute private peering because it needs private connectivity between its network and Azure. The security team additionally requires end-to-end encryption of traffic. Which statement is accurate?<\/p>\n A. All ExpressRoute customer data is encrypted automatically. B. Private peering removes the need for encryption. C. Deploy a supported IPsec overlay when end-to-end encryption is required. D. Configure an NSG to encrypt the circuit.<\/p>\n Answer: C.<\/b> ExpressRoute transport is not encrypted by default. Supported IPsec over ExpressRoute can provide end-to-end encryption, while MACsec is an alternative for supported physical ExpressRoute Direct links and has a different protection boundary. A private circuit reduces exposure to the public internet but is not itself a substitute for a stated encryption requirement.<\/p>\n Question 7.<\/b> On-premises clients connected over a private hybrid network must resolve an Azure private DNS zone through a managed Azure service. Which DNS Private Resolver component should the on-premises conditional forwarder target?<\/p>\n A. Inbound endpoint. B. Outbound endpoint alone. C. Traffic Manager profile. D. Virtual-network NAT Gateway.<\/p>\n Answer: A.<\/b> An Azure DNS Private Resolver inbound endpoint receives DNS queries from connected external networks. The appropriate private DNS zone must be available in the resolver’s VNet context, and the on-premises conditional forwarder needs connectivity to the inbound endpoint address. This directionality matters: an outbound endpoint is used to forward Azure-originating queries toward other DNS servers.<\/p>\n Question 8.<\/b> Azure virtual machines using Azure-provided DNS must resolve an internal corporate zone served by DNS servers in a connected data center. The team wants to avoid maintaining custom resolver VMs. What pattern best fits?<\/p>\n A. Create an Azure public DNS zone and open inbound internet DNS. B. Use Azure DNS Private Resolver outbound endpoint with an appropriate forwarding ruleset and VNet links. C. Replace DNS with an NSG service tag. D. Add a Traffic Manager endpoint for each hostname.<\/p>\n Answer: B.<\/b> The outbound endpoint and forwarding ruleset support conditional forwarding of Azure-originated DNS queries to specified external DNS servers. The destination DNS path must be reachable and permitted, and the ruleset must be associated correctly. An inbound endpoint alone does not provide the forwarding behavior requested here.<\/p>\n Question 9.<\/b> Two regional web applications share a single HTTP entry point, but requests with a path beginning \/billing must go to one backend and \/orders to another. Which Azure service directly supports this type of regional layer-seven routing?<\/p>\n A. Azure Load Balancer. B. Application Gateway. C. NAT Gateway. D. VPN Gateway.<\/p>\n Answer: B.<\/b> Azure Application Gateway supports HTTP and HTTPS request routing based on application-level criteria such as paths or hostnames. An Azure Load Balancer operates primarily at transport layers and does not parse HTTP request paths. The routing rules must still be matched to healthy backends, appropriate TLS settings and access-control requirements.<\/p>\n Question 10.<\/b> A worldwide public web application wants an Azure-managed global edge entry point with HTTP acceleration and web application firewall features. Which choice is most directly aligned?<\/p>\n A. Azure Front Door. B. Azure Private DNS zone. C. ExpressRoute gateway. D. Network Watcher packet capture.<\/p>\n Answer: A.<\/b> Azure Front Door provides a global HTTP\/HTTPS edge delivery architecture with supported routing, caching, TLS and WAF capabilities. It does not replace every origin security and availability requirement. An application should still restrict origin access where appropriate and choose a tier whose features support the required security and private connectivity.<\/p>\n Question 11.<\/b> A service needs DNS-based selection among public endpoints in different regions, with monitoring and failover. The requirement specifically does not call for the traffic to pass through a global HTTP proxy. Which service fits?<\/p>\n A. Traffic Manager. B. Application Gateway. C. NSG. D. Private Endpoint.<\/p>\n Answer: A.<\/b> Traffic Manager returns DNS responses directing clients to selected public endpoints; clients subsequently connect to those endpoints rather than sending application traffic through Traffic Manager. DNS caching and TTL behavior influence how quickly failover becomes visible. Application Gateway is a regional application proxy and addresses different requirements.<\/p>\n Question 12.<\/b> A backend application requires regional distribution of arbitrary TCP sessions to healthy VM instances. Inspecting HTTP URLs is unnecessary. Which service should be considered?<\/p>\n A. Azure DNS Private Resolver. B. Azure Load Balancer. C. Azure Front Door WAF only. D. Traffic Manager with no endpoint service.<\/p>\n Answer: B.<\/b> Azure Load Balancer<\/a> provides layer-four distribution for supported TCP and UDP workload patterns. Health probes and backend pool membership must be configured correctly. For an application that requires HTTP routing based on path, cookie behavior or web firewall policy, a layer-seven service would be a more suitable comparison.<\/p>\n Question 13.<\/b> A team requires a supported Azure PaaS data service to be reached through a private IP on a virtual-network interface rather than by granting general public network access. Which feature matches that access model?<\/p>\n A. Private Endpoint. B. Public IP prefix. C. Traffic Manager. D. Standard public load balancer.<\/p>\n Answer: A.<\/b> Azure Private Endpoint uses a private address in the customer’s VNet to connect to a supported service via Azure Private Link. It is not merely an outbound internet optimization. The service’s access-control policy, DNS mapping and the connection approval state where applicable remain important; a private IP does not automatically authorize access to data.<\/p>\n Question 14.<\/b> A storage account has a Private Endpoint, but an application VM unexpectedly resolves the service name to a public address. A private DNS zone exists with the intended A record. What should the engineer examine first?<\/p>\n A. Whether the zone is linked to the querying virtual network and custom DNS forwards the namespace correctly. B. Whether the storage account is in the same resource group as the VM. C. Whether Traffic Manager health probes are running. D. Whether an NSG has an allow-all rule.<\/p>\n Answer: A.<\/b> Private Endpoint connectivity depends on clients resolving the intended name to its private endpoint address. Missing virtual network links, incomplete conditional forwarding or stale records can cause the wrong result. Name resolution and network access are separate controls: after correcting DNS, test the route, permitted traffic and service authorization rather than assuming the problem is fully resolved.<\/p>\n Question 15.<\/b> An organization must publish a controlled inbound service through a centralized Azure Firewall public address while forwarding connections to a private internal destination. Which firewall capability is relevant?<\/p>\n A. DNS Private Resolver inbound endpoint. B. Azure Firewall destination network address translation (DNAT). C. Virtual network flow logs. D. Network Watcher Next hop alone.<\/p>\n Answer: B.<\/b> Azure Firewall DNAT<\/a> can translate supported incoming connections from a firewall public IP and port to an internal address and port under an authorized rule. It must be paired with correct routing and firewall policy. A translation rule does not validate the receiving application or eliminate the need for service-level authentication.<\/p>\n Question 16.<\/b> An inbound NSG rule explicitly denies TCP 443 at priority 200, while another inbound rule allows the same flow at priority 400. Both match the traffic. What is the expected security-rule decision?<\/p>\n A. Allow because 400 is higher. B. Deny because the lower numeric priority rule is evaluated first. C. Random result depending on VM size. D. Routing takes precedence and bypasses both rules.<\/p>\nCore networking infrastructure and routing<\/h2>\n
Hybrid connectivity and DNS resolution<\/h2>\n
Application delivery and global traffic direction<\/h2>\n
Private access to Azure services<\/h2>\n
Network security, diagnostics and operational judgment<\/h2>\n