The AZ-700 (Designing and Implementing Microsoft Azure Networking Solutions) exam targets network engineers who design, implement, and maintain Azure networking infrastructure. Expect scenario-heavy questions requiring you to choose the right networking service, troubleshoot connectivity, and design secure, scalable network architectures.
These 25 questions cover the toughest areas — VNet peering, ExpressRoute vs VPN decisions, Azure Firewall vs NSGs, Private Endpoints vs Service Endpoints, and routing troubleshooting. Check out our AZ-700 study guide for the full exam breakdown.
What You'll Get:
- ✓25 scenario-based questions across all AZ-700 domains
- ✓Architecture decision questions — exactly like the real exam
- ✓Detailed explanations for every answer option
- ✓Scoring guide to assess your readiness
What These Questions Cover
📝 Practice Test Instructions
- • Each question has ONE correct answer
- • Many questions involve service selection — know the key differentiators
- • Note your answers before scrolling to the answer key
- • Aim to complete all 25 questions in 25 minutes
Core Azure Networking
Questions 1–8
VNet Peering vs VPN Gateway
You have two VNets in the same Azure region: VNet-A (10.0.0.0/16) and VNet-B (10.1.0.0/16). VMs in each VNet need to communicate privately with low latency and high bandwidth. Both VNets belong to the same subscription.
What is the BEST solution for inter-VNet connectivity?
VNet Address Space
You are designing a VNet for a new workload in Azure East US. The on-premises network uses 10.0.0.0/8 address space. You need the Azure VNet to avoid overlap and support up to 500 VMs.
Which address space should you assign to the Azure VNet?
Azure DNS
Your VMs in Azure need to resolve each other by hostname (e.g., vm1.contoso.internal). You also want VMs to automatically register their DNS records when they are created, without deploying DNS servers.
Which Azure service should you use?
Azure Load Balancer vs Application Gateway
Your web application runs on 5 Azure VMs behind a load balancer. You need to distribute HTTPS traffic based on URL path (/api/* goes to one backend pool, /images/* to another). You also need SSL termination.
Which service should you use?
Azure Bastion
Your security policy prohibits exposing RDP (3389) and SSH (22) ports on any Azure VM to the internet via public IPs. Administrators must still be able to remotely manage VMs securely via a browser.
Which Azure service meets this requirement?
Network Security Groups
You have a subnet with 10 VMs hosting a web application. You need to allow inbound HTTPS (443) from the internet but block all other inbound traffic. Outbound traffic should be unrestricted.
What is the MINIMUM configuration to achieve this with an NSG?
Service Endpoints vs Private Endpoints
VMs in your Azure VNet need to access Azure Storage without traffic traversing the internet. You need the storage account to ONLY be accessible from your specific VNet and NOT from other Azure VNets or the internet.
Which approach provides the most restrictive access control?
Azure Front Door
Your global web application is deployed in Azure East US and West Europe. You need to route users to the closest healthy region, perform SSL offload, and apply WAF policies to protect against OWASP threats.
Which Azure service provides all of these capabilities?
Hybrid Connectivity & Routing
Questions 9–17
VPN Gateway vs ExpressRoute
Your organization is connecting an on-premises datacenter to Azure. The requirements are: 10 Gbps dedicated bandwidth, sub-10ms latency, traffic must not traverse the public internet, and a guaranteed SLA of 99.95%.
Which connectivity option meets ALL requirements?
ExpressRoute Redundancy
You have an ExpressRoute circuit connecting your on-premises network to Azure. Your SLA requires no single point of failure for this connectivity. You want the HIGHEST availability design.
What is the recommended redundancy configuration?
VPN Gateway SKU
You need to establish a site-to-site VPN between Azure and an on-premises location. The maximum throughput required is 1 Gbps. You also need to support BGP for dynamic routing.
Which VPN Gateway SKU meets the minimum requirements?
User-Defined Routes
Your VNet has a subnet with VMs and a hub-spoke topology. All traffic from the spoke VMs destined for the internet must be routed through an Azure Firewall in the hub VNet (10.0.0.0/16, firewall at 10.0.1.4). By default, spoke VMs use the system route to the internet directly.
What do you need to configure to force internet traffic through the Azure Firewall?
BGP with VPN Gateway
Your organization has multiple branch offices that all need VPN connections to Azure. You want Azure to dynamically learn routes from each branch and automatically propagate changes without manual route updates when new subnets are added to branches.
What must you enable on the Azure VPN Gateway?
Hub-Spoke Topology
You are designing a hub-spoke network. Spoke VNets need to communicate with each other through the hub VNet where a firewall resides. By default, spoke VNets peered to the hub cannot route traffic to each other.
What must you configure to enable spoke-to-spoke communication through the hub firewall?
Azure Virtual WAN
Your organization has 30 branch offices, 5 Azure regions, and needs to provide optimized routing between all sites. Managing individual VPN connections and route tables is becoming too complex. You want a Microsoft-managed solution that simplifies this at scale.
Which Azure service is purpose-built for this use case?
Point-to-Site VPN
Remote employees need secure access to Azure VNet resources without connecting to a site-to-site VPN. Each user authenticates with their Microsoft Entra ID credentials and the connection is established from their laptop.
Which VPN Gateway configuration supports this?
Route Troubleshooting
A VM in Azure cannot reach a specific on-premises subnet (192.168.50.0/24) over an existing VPN connection. Other on-premises subnets are reachable. The VPN connection shows as Connected.
What is the FIRST tool you should use to troubleshoot why the specific subnet is unreachable?
Network Security & Private Access
Questions 18–25
Azure Firewall vs NSG
You need to control outbound internet traffic from Azure VMs with FQDN-based rules (e.g., allow *.microsoft.com but deny all other internet destinations). NSG rules only support IP addresses, not FQDNs.
Which Azure service supports FQDN-based outbound filtering?
Azure Firewall Premium
Your security team requires TLS inspection of encrypted HTTPS traffic passing through the Azure Firewall to detect malware and data exfiltration in encrypted streams. Standard Azure Firewall cannot inspect TLS payloads.
Which Azure Firewall tier supports TLS inspection?
Private Endpoint
You have an Azure SQL Database that must be accessible only from VMs in your VNet. No traffic should leave your VNet boundary. The SQL database should get a private IP address within your VNet's address space.
What should you configure?
DDoS Protection
Your company hosts a public-facing web application in Azure with a public IP address. You need protection against volumetric DDoS attacks (layer 3/4) with adaptive tuning specific to your application's traffic patterns, plus access to DDoS rapid response experts during an attack.
Which DDoS protection plan provides these capabilities?
Network Watcher
You suspect traffic between two VMs is being blocked by an NSG rule, but you have multiple NSGs applied at both the subnet and NIC levels. You need to quickly identify which specific NSG rule is blocking the traffic without reading every rule manually.
Which Network Watcher feature should you use?
Azure DNS Private Resolver
Your organization has an on-premises DNS server that must resolve Azure private DNS zone names (e.g., privatelink.database.windows.net) for on-premises clients. On-premises clients must be able to resolve these names without deploying any VMs in Azure.
Which solution enables on-premises DNS resolution of Azure private zones without VMs?
Network Performance Monitor
You need to continuously monitor the performance (latency, packet loss) of your ExpressRoute circuit from on-premises to Azure. You also want alerts when performance degrades below your SLA thresholds.
Which Azure service provides ExpressRoute performance monitoring?
WAF Policy
Your e-commerce application behind Azure Application Gateway is experiencing SQL injection and cross-site scripting attacks. You want to block these attacks using OWASP ruleset version 3.2 without writing custom rules.
What should you configure?
✋ Stop Here Before Scrolling!
Have you answered all 25 questions? Complete the test before checking the answers below.
Pro tip: Draw network diagrams while answering architecture questions — it helps on the real exam too
📝 Answer Key with Detailed Explanations
Review each explanation carefully, even for questions you answered correctly
Quick Answer Reference
Question 1: VNet Peering vs VPN Gateway
✓ Correct Answer: A) VNet peering
Why this is correct:
VNet peering is the best option for same-region, same-subscription VNet connectivity. It uses the Azure backbone network (no public internet), provides the lowest latency (sub-millisecond), highest bandwidth, and is the simplest to configure. There is no throughput limitation beyond the VM NIC limits.
Why other answers are incorrect:
💡 Key Concept:
VNet Peering: same or different regions, same or different subscriptions, same or different tenants (cross-tenant peering requires explicit configuration). Traffic stays on Azure backbone — never traverses internet.
Question 2: VNet Address Space
✓ Correct Answer: B) 172.16.0.0/16
Why this is correct:
/16 provides 65,536 addresses — more than enough for 500 VMs with room for subnets, gateway subnets, and Azure-reserved IPs. 172.16.0.0/16 does not overlap with the on-premises 10.0.0.0/8 space, avoiding routing conflicts.
Why other answers are incorrect:
💡 Key Concept:
Private address ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. Azure reserves 5 IPs per subnet: .0 (network), .1 (default gateway), .2 & .3 (DNS), .255 (broadcast).
Question 3: Azure DNS
✓ Correct Answer: C) Azure Private DNS zones linked to the VNet with auto-registration
Why this is correct:
Azure Private DNS zones provide internal hostname resolution for resources in your VNet. When linked to a VNet with auto-registration enabled, VMs automatically register their names and IPs when created. No DNS server VMs are needed — fully managed by Azure.
Why other answers are incorrect:
💡 Key Concept:
Private DNS zone link settings: Registration-enabled = VMs auto-register their FQDN and IP. Resolution-only = VNet can query the zone but doesn't auto-register. Max 1 VNet with auto-registration per zone.
Question 4: Application Gateway
✓ Correct Answer: D) Azure Application Gateway with path-based routing
Why this is correct:
Application Gateway is a layer 7 load balancer that supports URL path-based routing, SSL/TLS termination, cookie-based session affinity, and WebSocket support. Path-based routing allows different backend pools for different URL paths (/api/* → pool1, /images/* → pool2).
Why other answers are incorrect:
💡 Key Concept:
Load balancing decision: Layer 4 regional = Azure Load Balancer. Layer 7 regional = Application Gateway. Global DNS = Traffic Manager. Global layer 7 with CDN = Azure Front Door.
Question 5: Azure Bastion
✓ Correct Answer: A) Azure Bastion
Why this is correct:
Azure Bastion provides browser-based RDP and SSH to VMs via TLS 443, completely eliminating the need to expose port 3389 or 22 on VMs. It's deployed in a dedicated subnet (AzureBastionSubnet) and provides a secure management gateway.
Why other answers are incorrect:
💡 Key Concept:
Azure Bastion SKUs: Basic (standard RDP/SSH), Standard (native client support, IP-based connections, shareable links, session recording). Deployed in /26+ AzureBastionSubnet.
Question 6: NSG Rules
✓ Correct Answer: B) Create an inbound allow rule for port 443 only — the default deny rule blocks everything else
Why this is correct:
NSGs have a default inbound rule "DenyAllInbound" with priority 65500. This default rule blocks all inbound traffic not explicitly allowed. You only need to create the allow rule for port 443 — the default deny handles everything else.
Why other answers are incorrect:
💡 Key Concept:
NSG default rules (cannot be deleted): AllowVNetInBound (65000), AllowAzureLoadBalancerInBound (65001), DenyAllInbound (65500), AllowVNetOutBound (65000), AllowInternetOutBound (65001), DenyAllOutBound (65500).
Question 7: Service vs Private Endpoints
✓ Correct Answer: C) Azure Private Endpoint for the storage account
Why this is correct:
Private Endpoint creates a private network interface in your VNet with a private IP from your subnet. The storage account gets a private IP in your VNet. You can then disable all public access and restrict the storage account network firewall to deny all — making it accessible ONLY via the private endpoint in your specific VNet.
Why other answers are incorrect:
💡 Key Concept:
Private Endpoint = private IP in your VNet, public endpoint can be disabled, DNS resolution returns private IP. Service Endpoint = traffic optimized to Azure backbone, no private IP, public endpoint remains. Private Endpoint is more secure.
Question 8: Azure Front Door
✓ Correct Answer: D) Azure Front Door Standard/Premium
Why this is correct:
Azure Front Door is a global layer 7 CDN and load balancer that provides: anycast-based routing to the closest healthy origin (region), SSL/TLS offload at the edge, built-in WAF policy support, CDN caching, and health probe-based failover between origins. It handles all four requirements in one service.
Why other answers are incorrect:
💡 Key Concept:
Front Door vs Traffic Manager: Front Door = layer 7 anycast, edge WAF, SSL offload, caching. Traffic Manager = DNS-based routing, layer 4 effectively, no edge processing. Use Front Door for web apps, Traffic Manager for non-HTTP global routing.
Question 9: VPN Gateway vs ExpressRoute
✓ Correct Answer: A) Azure ExpressRoute with a dedicated circuit
Why this is correct:
Only ExpressRoute meets all four requirements: 10 Gbps dedicated bandwidth (available with ExpressRoute Direct or partner circuits), sub-10ms latency (private dedicated path, not internet), no public internet traversal (private Microsoft peering path), and 99.95% SLA (with redundant configuration).
Why other answers are incorrect:
💡 Key Concept:
ExpressRoute vs VPN decision criteria: High bandwidth (>1 Gbps) → ExpressRoute. No internet requirement → ExpressRoute. Predictable latency → ExpressRoute. Lower cost, internet OK → VPN Gateway.
Question 10: ExpressRoute Redundancy
✓ Correct Answer: B) Two ExpressRoute circuits to two different peering locations with two edge routers on-premises
Why this is correct:
Maximum availability requires eliminating every single point of failure: two separate ExpressRoute circuits (provider edge redundancy), connecting to two different peering locations (location redundancy, survives a facility outage), and two on-premises edge routers (customer edge redundancy). This is the Microsoft-recommended high availability design.
Why other answers are incorrect:
💡 Key Concept:
ExpressRoute availability zones: Zone-redundant ExpressRoute Gateways (ErGw1AZ, ErGw2AZ, ErGw3AZ) ensure the Azure gateway survives an AZ failure. Combine with dual circuits at different peering locations for end-to-end HA.
Question 11: VPN Gateway SKU
✓ Correct Answer: C) VpnGw1
Why this is correct:
VpnGw1 supports up to 650 Mbps aggregate throughput and includes BGP support. While 650 Mbps is less than 1 Gbps, VpnGw2 (1.25 Gbps) is the SKU that definitively exceeds 1 Gbps. However, VpnGw1 is the minimum SKU supporting BGP (Basic SKU does NOT support BGP).
Why other answers are incorrect:
💡 Key Concept:
VPN Gateway SKU comparison: Basic = no BGP, no active-active, 100 Mbps. VpnGw1 = BGP, active-active, 650 Mbps. VpnGw2 = 1.25 Gbps. VpnGw3 = 1.25 Gbps + more tunnels. AZ variants add zone redundancy.
Question 12: User-Defined Routes
✓ Correct Answer: D) A User-Defined Route (UDR) table with a 0.0.0.0/0 route pointing to the firewall's private IP, associated with the spoke subnet
Why this is correct:
By default, Azure routes all traffic via system routes (0.0.0.0/0 → internet). To override this and force internet traffic through the Azure Firewall, you create a route table (UDR) with a 0.0.0.0/0 route pointing to the firewall's private IP as the next hop, then associate this route table with the spoke subnets.
Why other answers are incorrect:
💡 Key Concept:
UDR 0.0.0.0/0 → Azure Firewall: overrides default internet route. Next hop type must be "Virtual Appliance" with the firewall's private IP. Also disable BGP route propagation on the route table if using VPN/ExpressRoute.
Question 13: BGP
✓ Correct Answer: A) BGP on the VPN Gateway and on each on-premises VPN device
Why this is correct:
BGP (Border Gateway Protocol) enables dynamic route exchange between Azure VPN Gateway and on-premises VPN devices. When new subnets are added on-premises, they're automatically advertised via BGP without manual route updates. Both sides (Azure gateway and on-premises devices) must support and be configured for BGP.
Why other answers are incorrect:
💡 Key Concept:
VPN Gateway BGP ASN: Azure default ASN is 65515 (or custom 1-4294967295). On-premises devices need different ASNs. BGP peer IP for Azure is the gateway's BGP IP address (configured separately from the gateway IP).
Question 14: Hub-Spoke Routing
✓ Correct Answer: B) Enable "Allow gateway transit" on the hub peering and "Use remote gateways" on spoke peerings, then add UDRs in spokes for each other's address spaces pointing to the hub firewall
Why this is correct:
In hub-spoke, VNet peering is non-transitive by default — spokes can't reach each other through the hub. To route spoke-to-spoke traffic through the hub firewall: (1) configure peering settings for gateway transit, and (2) add UDRs in each spoke with the other spoke's address space pointing to the hub firewall as the next hop.
Why other answers are incorrect:
💡 Key Concept:
Hub-spoke spoke-to-spoke checklist: ✓ Hub-spoke peering: Allow gateway transit (hub), Use remote gateway (spoke). ✓ UDRs in both spokes: other-spoke-range → hub firewall IP. ✓ Firewall rules: allow spoke1 → spoke2 traffic.
Question 15: Azure Virtual WAN
✓ Correct Answer: C) Azure Virtual WAN
Why this is correct:
Azure Virtual WAN is Microsoft's managed network-as-a-service for large-scale connectivity. It automates VPN/ExpressRoute configurations, provides optimal routing through the Microsoft backbone, supports branch-to-branch, branch-to-Azure, and Azure-to-Azure routing — all centrally managed without individual route table management.
Why other answers are incorrect:
💡 Key Concept:
Virtual WAN SKUs: Basic (S2S VPN only), Standard (S2S VPN, ExpressRoute, P2S VPN, VNet connections, routing). Virtual WAN hubs can have multiple gateways and routing policies for secure hub scenarios.
Question 16: Point-to-Site VPN
✓ Correct Answer: D) Point-to-site VPN with Microsoft Entra ID authentication
Why this is correct:
Point-to-site (P2S) VPN allows individual clients to connect to the Azure VNet. With Entra ID authentication (using OpenVPN protocol), users sign in with their Microsoft 365 credentials — no certificate management needed. Each user gets a private tunnel to the VNet.
Why other answers are incorrect:
💡 Key Concept:
P2S VPN authentication options: Azure Certificate (self-signed or CA), RADIUS (on-premises NPS), Microsoft Entra ID (Entra ID accounts, no certificates). Entra ID authentication only works with OpenVPN protocol.
Question 17: Route Troubleshooting
✓ Correct Answer: A) Use Network Watcher — Next hop to check the effective routes for the VM's NIC
Why this is correct:
"Next hop" in Network Watcher shows the effective route for a specific destination IP from a specific VM NIC — it shows exactly which route is being used and what the next hop is. This immediately reveals if a missing or incorrect route is causing the connectivity issue.
Why other answers are incorrect:
💡 Key Concept:
Network Watcher troubleshooting tools: Next hop (routing), IP flow verify (NSG allow/deny), Connection troubleshoot (end-to-end path), Packet capture (deep inspection), NSG flow logs (traffic logging), Traffic analytics (flow log visualization).
Question 18: Azure Firewall vs NSG
✓ Correct Answer: B) Azure Firewall with application rules
Why this is correct:
Azure Firewall application rules support FQDN filtering — you can create rules like "allow *.microsoft.com:443" or "deny *:80". NSGs work only at the IP address and port level (layer 4) and cannot resolve FQDNs. Azure Firewall uses DNS to resolve FQDNs and applies rules dynamically as IPs change.
Why other answers are incorrect:
💡 Key Concept:
Azure Firewall rule types: Network rules (L3/L4, IP+port based), Application rules (L7, FQDN-based, outbound HTTP/S and other protocols), DNAT rules (inbound port forwarding). NSGs = Network rules only.
Question 19: Azure Firewall Premium
✓ Correct Answer: C) Azure Firewall Premium
Why this is correct:
Azure Firewall Premium includes TLS inspection (decrypts, inspects, and re-encrypts HTTPS traffic), IDPS (Intrusion Detection and Prevention System), URL filtering (beyond just FQDN), and web category filtering. Standard Firewall only sees the SNI header for HTTPS — it can't inspect the encrypted payload.
Why other answers are incorrect:
💡 Key Concept:
Firewall Premium features (beyond Standard): TLS inspection (requires CA certificate in Key Vault), IDPS (signature-based threat detection), URL filtering (beyond FQDN — filter specific URL paths), Web categories.
Question 20: Private Endpoint
✓ Correct Answer: D) Private Endpoint for the Azure SQL Database
Why this is correct:
Private Endpoint creates a private NIC in your VNet with a private IP address mapped to the Azure SQL Database. After creating the private endpoint, you configure the Azure SQL Database to deny public access — making it completely inaccessible from the internet and accessible only via the private IP in your VNet.
Why other answers are incorrect:
💡 Key Concept:
After creating a Private Endpoint: update DNS to resolve the SQL FQDN to the private IP (use Private DNS zone privatelink.database.windows.net), then set the SQL firewall to "Deny public network access = Yes."
Question 21: DDoS Protection
✓ Correct Answer: A) Azure DDoS Network Protection (Standard) with DDoS Rapid Response
Why this is correct:
Azure DDoS Network Protection (Standard/Premium) provides adaptive tuning that learns your application's normal traffic patterns and creates custom mitigation profiles. It includes the DDoS Rapid Response (DRR) team — Microsoft experts who assist during active attacks. The free basic protection is platform-wide but offers no adaptive tuning.
Why other answers are incorrect:
💡 Key Concept:
DDoS protection: Infrastructure Protection (free, basic) → everyone. DDoS Network Protection (Standard, paid per VNet) → adaptive tuning, DRR, cost protection, attack analytics. Cover all public IPs in a subscription with one DDoS plan.
Question 22: Network Watcher
✓ Correct Answer: B) Network Watcher — IP flow verify
Why this is correct:
IP flow verify asks: "Would traffic from [source IP:port] to [destination IP:port] be allowed or denied by the NSGs effective on this VM?" It evaluates all NSGs (subnet and NIC level) and tells you exactly which NSG rule is allowing or blocking the specified traffic flow.
Why other answers are incorrect:
💡 Key Concept:
IP flow verify = "would this packet be blocked?" (test before or after issue). NSG flow logs = "what traffic was actually allowed/denied?" (historical). Use IP flow verify for diagnosis, NSG flow logs for forensics.
Question 23: Azure DNS Private Resolver
✓ Correct Answer: C) Azure DNS Private Resolver with an inbound endpoint
Why this is correct:
Azure DNS Private Resolver provides an inbound endpoint — a private IP in your VNet that on-premises DNS servers can forward Azure private zone queries to. It resolves Azure private DNS zones without any VM-based DNS forwarders, fully managed by Microsoft.
Why other answers are incorrect:
💡 Key Concept:
DNS Private Resolver: Inbound endpoint = on-premises queries forwarded to this IP (resolves Azure private zones). Outbound endpoint + forwarding ruleset = forward DNS queries to on-premises DNS for private domain resolution from Azure.
Question 24: ExpressRoute Monitoring
✓ Correct Answer: D) Network Watcher — Connection Monitor
Why this is correct:
Azure Monitor Network Insights (and Connection Monitor) provides continuous monitoring of ExpressRoute circuit health including latency, packet loss, and availability between specific endpoints. It replaced the legacy Network Performance Monitor and provides alerts when performance degrades.
Why other answers are incorrect:
💡 Key Concept:
Connection Monitor replaces Network Performance Monitor. It can monitor: VNet → VNet, on-premises → Azure (via VPN/ExpressRoute), Azure → internet, multi-hop paths. Alerts based on latency thresholds and packet loss.
Question 25: WAF Policy
✓ Correct Answer: A) A WAF policy in Prevention mode with OWASP Core Rule Set 3.2 associated with the Application Gateway
Why this is correct:
Web Application Firewall (WAF) on Application Gateway includes the OWASP Core Rule Set (CRS) which contains rules for SQL injection, XSS, and other OWASP Top 10 attacks. Prevention mode actively blocks matching requests (vs Detection mode which only logs). CRS 3.2 includes updated rules with fewer false positives.
Why other answers are incorrect:
💡 Key Concept:
WAF policy modes: Detection = log violations, don't block. Prevention = actively block malicious requests. Always start in Detection mode, tune to eliminate false positives, then switch to Prevention. CRS 3.2 > CRS 3.1 > 3.0 — use latest.
📊 How Did You Score?
Ready for More AZ-700 Practice?
These 25 questions are just a sample. The actual AZ-700 exam has 40–60 questions.
MSCertQuiz AZ-700 includes 500 questions covering:
- ✓ VNet design, subnetting, and peering scenarios in depth
- ✓ ExpressRoute circuit types, SKUs, and redundancy patterns
- ✓ Azure Firewall, WAF, DDoS, and NSG combinations
- ✓ Private DNS, Private Endpoints, and Service Endpoints
- ✓ Network Watcher troubleshooting scenarios
$14.99 One-Time Payment
Lifetime access • No subscription • 500 questions