AZ-700 Practice Test
Microsoft Certified: Azure Network Engineer Associate
Master Azure networking. Build secure, scalable cloud infrastructure.
Our AZ-700 questions cover VNet design, ExpressRoute, VPN gateways, Azure Firewall, Application Gateway, Private Link, and more — the exact topics tested on exam day.
Start Free Practice — 40 QuestionsNo credit card required. Upgrade to full 500 questions for $19.99 when ready.
Is this for you?
This is NOT for you if:
AZ-700 Exam Details
What to expect on exam day
Questions
40-60 questions
Duration
120 minutes
Passing Score
700/1000
Exam Cost
$165 USD
Exam Domains Covered
Master all topics tested on the AZ-700 exam
Core Networking Infrastructure (25-30%)
Connectivity Services (20-25%)
Application Delivery Services (15-20%)
Private Access to Azure Services (10-15%)
Network Security Services (15-20%)
Test Yourself Right Now
Try 5 real practice questions — no signup needed
5 Free AZ-700 Questions
See how ready you are for the AZ-700 exam. Each question includes a detailed explanation so you learn as you go.
Sample AZ-700 Practice Questions
10 real questions from the free AZ-700bank. Pick an answer in your head, then open “Show answer” for the explanation.
1. What problem does Azure Route Server solve for NVA deployments?
- A. Removes the need for NSGs on NVA subnets by providing centralized access control for spoke traffic
- B. Eliminates the need for Azure Firewall by providing NVA auto-failover and stateful traffic inspection
- C. Automatically provisions and scales NVA instances based on traffic volume using Azure VMSS integration
- D. Eliminates manual UDR maintenance by letting NVAs exchange routes with the VNet via BGP
Show answer
Correct answer: D
Azure Route Server allows NVAs to exchange routes with Azure via BGP. When NVA-advertised routes change, they are automatically propagated to VM effective routes throughout the VNet. This eliminates manual UDR updates that would otherwise be required whenever routes change.
2. What is the maximum prefix size for an Azure Public IP Address Prefix?
- A. /24
- B. /26
- C. /30
- D. /28
Show answer
Correct answer: D
Azure Public IP Address Prefixes support a maximum size of /28, providing up to 16 contiguous public IP addresses. Available sizes are /28, /29, /30, and /31. Larger prefixes like /24 are not supported for the standard prefix feature.
3. Your company needs two Azure VNets to communicate. VNet-A has address space 10.0.0.0/16 and VNet-B has 10.0.0.0/24. What prevents direct VNet peering between them?
- A. Different subscription ownership
- B. Overlapping address spaces
- C. Different regions
- D. Insufficient subnet size
Show answer
Correct answer: B
VNet peering requires non-overlapping address spaces. Since 10.0.0.0/24 is contained within 10.0.0.0/16, they overlap. Azure will reject the peering. One VNet must be re-addressed before peering is possible.
4. What is the required name for the subnet used by Azure Firewall?
- A. FirewallSubnet
- B. AzureFirewallHostSubnet
- C. AzureFirewallMgmtSubnet
- D. AzureFirewallSubnet
Show answer
Correct answer: D
Azure Firewall must be deployed into a subnet named exactly AzureFirewallSubnet. This subnet must be at least /26. The name is mandatory and cannot be changed.
5. What Azure service provides automatic, managed private DNS resolution with VM record auto-registration inside a VNet?
- A. Azure Public DNS Zones for internet records
- B. Azure Traffic Manager DNS load balancing
- C. Azure Private DNS Zones with VM auto-registration
- D. Azure DNS Private Resolver for conditional DNS forwarding in hybrid scenarios
Show answer
Correct answer: C
Azure Private DNS Zones provide automatic, managed name resolution within VNets. They eliminate the need for custom DNS VMs for internal Azure name resolution and support auto-registration of VM records.
Show 5 more questions
6. What is the purpose of an Azure DNS Private Resolver inbound endpoint?
- A. Forwards DNS queries that originate from Azure VMs out to on-premises or external DNS servers via forwarding rulesets
- B. Provides a dedicated Azure IP that on-premises DNS servers forward queries to for private DNS zone resolution
- C. Caches DNS responses locally at the resolver endpoints to reduce query latency for frequently accessed names
- D. Acts as a public-facing DNS resolver accessible by external internet clients for Azure-hosted domains
Show answer
Correct answer: B
The inbound endpoint provides an IP address (from a delegated subnet) that on-premises DNS servers can forward queries to. This allows on-premises clients to resolve Azure Private DNS zones without deploying custom DNS VMs in Azure.
7. What is the primary benefit of Azure NAT Gateway over Load Balancer outbound rules for SNAT?
- A. NAT Gateway encrypts outbound internet traffic with TLS at the network layer, whereas Load Balancer outbound rules process the traffic unencrypted
- B. NAT Gateway improves inbound throughput by routing outbound connections through a dedicated subnet-level gateway resource
- C. NAT Gateway reduces latency for outbound internet connections because it bypasses Load Balancer queue processing for egress flows
- D. NAT Gateway dedicates SNAT ports per public IP for outbound connections, removing competition with inbound traffic and preventing port exhaustion
Show answer
Correct answer: D
NAT Gateway provides 64,512 SNAT ports per public IP dedicated solely to outbound connections. Load Balancer SNAT shares those ports with inbound connection tracking, creating competition that causes port exhaustion at high outbound connection rates. NAT Gateway eliminates this contention entirely.
8. Can a subnet with delegation still contain regular virtual machines?
- A. Yes, virtual machines and other resource types can be deployed in delegated subnets with no configuration changes required
- B. No, delegated subnets are reserved for the delegated service; regular VMs cannot be deployed alongside the delegation
- C. Yes, if the VMs are in the same resource group as the delegated service resource within the subnet
- D. Yes, provided the VMs have NSG rules allowing the delegated service's required network traffic on its ports
Show answer
Correct answer: B
For most service delegations, the subnet is reserved exclusively for the delegated service. Regular virtual machines and other resources cannot be deployed into a delegated subnet. This ensures the service has dedicated capacity and proper network policy management.
9. You have VNet-A peered to VNet-B, and VNet-B peered to VNet-C. Can a VM in VNet-A communicate with a VM in VNet-C through VNet-B by default?
- A. Yes, peering is fully transitive across VNets
- B. No, VNet peering is non-transitive by design
- C. Yes, if VNet-B and VNet-C are in the same region as VNet-A, peering automatically extends connectivity transitively
- D. Yes, provided VNet-A and VNet-C share a common address prefix that allows route propagation through VNet-B
Show answer
Correct answer: B
VNet peering is non-transitive by design. VNet-A cannot reach VNet-C through VNet-B without additional configuration such as an NVA in VNet-B with appropriate UDRs, Azure Route Server, or full mesh peering.
10. What is a Network Group in Azure Virtual Network Manager?
- A. A resource group type containing Azure networking resources scoped to a given workload or environment
- B. A logical collection of VNets that share common connectivity or security admin configurations in AVNM
- C. A built-in peering configuration that automatically links multiple VNets within the same region
- D. A management group scoping Azure Policy and RBAC assignments to networking subscriptions
Show answer
Correct answer: B
A Network Group is a logical container of VNets in AVNM. VNets are added manually or via Azure Policy conditions. Connectivity configurations (hub-spoke or mesh) and security admin rules are then applied to the network group. (AVNM is Azure Virtual Network Manager.)
AZ-700 study resources
Why Practice with MSCertQuiz?
Microsoft Learn teaches concepts. We prepare you for the actual exam.
Deep coverage of VNet design, subnetting, peering, and Azure Virtual Network Manager
Comprehensive ExpressRoute, Site-to-Site VPN, and Virtual WAN scenarios
Application Gateway WAF, Azure Front Door, Load Balancer, and Traffic Manager questions
Azure Firewall, NSG, Private Link, and Private Endpoint exam-style questions
Not sure if you're ready for the AZ-700 exam?
Take the free AZ-700 Readiness Check →What Our Users Say
“The ExpressRoute and BGP questions were exactly what I needed. The explanations went deep into Private Peering vs Microsoft Peering differences. Passed AZ-700 on first attempt.”
Thomas M.
AZ-700 Certified
“The Azure Firewall policy hierarchy questions were challenging and realistic. After working through the practice questions, the real exam felt very familiar.”
Lisa C.
Azure Network Engineer
“Private Link and Private Endpoints were my weak areas. The practice questions with detailed explanations helped me understand the difference between service endpoints and private endpoints. First try pass.”
Raj B.
Passed AZ-700 first try
Choose Your Plan
Start free, upgrade when you're ready to get serious
Free
Good for exploring the platform
- 40 practice questions
- Practice mode only
- Progress tracking
- No exam simulation mode
AZ-700 Full Access
Best if your exam is in the next 2-4 weeks
- 500 practice questions
- Practice & Exam modes
- Detailed explanations
- Lifetime access
7-day money-back guarantee
Pro — All Certs
Best if you're planning multiple Microsoft exams
- ALL certifications included
- Unlimited questions
- New certs added free
- Cancel anytime
Save 30% vs buying individually
Your AZ-700Exam Won't Wait
Candidates who complete at least 2 full mock exams pass at significantly higher rates than those who only study passively.
Don't risk $165 USD on the real exam without testing yourself first.
Start Free Practice NowNo credit card required • 40 free questions • Upgrade for $19.99 when ready
Official Microsoft Resources
Our practice questions are aligned with official Microsoft exam objectives. We recommend studying with Microsoft Learn first, then using MSCertQuiz to test your readiness.
View Official AZ-700 Exam DetailsAZ-700 Frequently Asked Questions
Everything you need to know about the AZ-700 Designing and Implementing Microsoft Azure Networking Solutions certification
How hard is the AZ-700 exam?
What does AZ-700 cover?
Is the AZ-700 exam worth it in 2026?
What prerequisites should I have for AZ-700?
How much does the AZ-700 exam cost in 2026?
What is the AZ-700 passing score in 2026?
Does the AZ-700 certification expire?
How is AZ-700 different from AZ-104?
How is AZ-700 different from AZ-500?
How is AZ-700 different from AZ-305?
What is the average AZ-700 salary in 2026?
What are the AZ-700 exam topics for 2026?
AZ-700 Exam Cost 2026
The AZ-700 exam costs $165 USD in 2026. This is the standard Microsoft Associate-level certification price. Pricing varies by country — approximately ₹4,800 INR in India, £113 GBP in the UK, and roughly €165 EUR in most European markets. Always confirm the current price on the official Microsoft Learn scheduling page for your region.
There are no formal prerequisites, though Microsoft strongly recommends hands-on Azure networking experience and prior completion of AZ-104 or equivalent broad Azure knowledge. AZ-700 expires annually — renewal is free via a shorter online assessment on Microsoft Learn. Microsoft Ignite, Enterprise Skills Initiative (ESI), and Microsoft Learn Cloud Skills Challenges occasionally offer free or discounted vouchers.
AZ-700 vs AZ-104: Specialization vs Broad Administration
Both are Microsoft Associate-level Azure certifications at $165, but they serve different career paths. AZ-104 builds breadth; AZ-700 builds depth in networking.
| AZ-104 | AZ-700 | |
|---|---|---|
| Role | Azure Administrator | Azure Network Engineer |
| Scope | Broad — VMs, storage, identity, governance, networking basics | Deep networking — connectivity, application delivery, network security |
| Networking weight | 15–20% | 100% |
| Cost | $165 USD | $165 USD |
| Salary (US) | $85K–$130K | $95K–$150K |
| Best for | Cloud administrators, generalists | Network engineers, network architects |
Take AZ-104 first if you want broad Azure career flexibility. Add AZ-700 if your role focuses on enterprise networking topology, hybrid connectivity, or network security. Many enterprise network architects earn both.
AZ-700 vs AZ-500: Networking Depth vs Security Breadth
AZ-700 (Azure Network Engineer, $165) focuses on designing and implementing Azure networking — connectivity, routing, application delivery, and network security. AZ-500 (Azure Security Engineer, $165) covers Azure-wide security including identity, network security, compute security, Defender for Cloud, and Sentinel basics. The two overlap on network security primitives (NSGs, Azure Firewall, WAF, DDoS Protection), but AZ-700 goes much deeper on Azure Firewall policy hierarchies, Virtual WAN secure hubs, and Private Link patterns, while AZ-500 covers more breadth across non-network topics. Take AZ-700 if your role is network design; take AZ-500 if your role is cross-cutting Azure security. Network security architects often earn both.
AZ-700 vs AZ-305: Networking Specialist vs Solutions Architect
AZ-700 (Associate, $165) is a specialized networking certification — designing and implementing Azure networking in depth. AZ-305 (Expert, $165) is the broad Azure Solutions Architect certification — designing across compute, storage, networking, identity, and business continuity at an Expert level. AZ-305 covers Azure networking at much shallower depth than AZ-700. They complement each other rather than overlap: AZ-305 holders who want deep network design credentials often add AZ-700. AZ-305 assumes AZ-104-equivalent broad experience; AZ-700 builds on the same Associate-level Azure foundation but specializes vertically.
AZ-700 Salary and Career Outlook (2026)
AZ-700 is one of the higher-paying Microsoft Associate certifications because Azure networking is a specialized skill set most general Azure admins don't have. Reported US salary ranges in 2026:
- • Entry-level Azure network engineer (1–3 yrs): $80,000–$105,000 USD
- • Azure network engineer (3–6 yrs): $110,000–$135,000 USD
- • Senior Azure network engineer / SDN engineer: $135,000–$160,000 USD
- • AZ-700 + AZ-305 (Network Architect): $140,000–$180,000 USD
- • AZ-700 + AZ-500 (Network Security Architect): $130,000–$170,000 USD
AZ-700 is particularly valuable for IT professionals transitioning from traditional networking (Cisco, Juniper, on-premises) into cloud networking — it explicitly signals Azure-native networking competency that organizations need as they migrate workloads. ExpressRoute, Virtual WAN, and Azure Firewall expertise commands premium compensation in enterprise environments.
AZ-700 Exam Topics 2026: Domain Breakdown
AZ-700 covers five domains. Microsoft refines wording periodically but the weights remain stable. Always verify the latest objectives on the official Microsoft Learn AZ-700 page.
Core Networking Infrastructure
25–30%Virtual Networks, subnets, IP addressing (public, private, IPv6), VNet peering and hub-spoke topologies, Azure Virtual Network Manager, NAT Gateway, Azure DNS (public and private zones), Network Watcher, network routing and User Defined Routes.
Connectivity Services
20–25%Site-to-Site VPN (active-active, BGP), Point-to-Site VPN, ExpressRoute (peering types, Global Reach, FastPath, encryption), Virtual WAN (hub design, secure hubs, routing intent), VPN Gateway sizing and SKUs.
Application Delivery Services
15–20%Azure Load Balancer (Public, Internal, Standard, Basic), Application Gateway (with and without WAF), Azure Front Door (Standard and Premium), Traffic Manager (priority, weighted, performance, geographic), session persistence, health probes.
Private Access to Azure Services
10–15%Private Link Service (provider side), Private Endpoint (consumer side), Service Endpoints, Private DNS integration with Private Endpoints, distinguishing Service Endpoints vs. Private Endpoints in policy decisions.
Network Security Services
15–20%Network Security Groups (NSG) and Application Security Groups (ASG), Azure Firewall (Standard and Premium tiers, policy hierarchy, IDPS, TLS inspection), Azure DDoS Protection (Network vs. IP plans), Azure Web Application Firewall (managed rules, custom rules, bot protection).
AZ-700 Study Plan: 8-Week Schedule
Most candidates pass AZ-700 with 6–10 weeks of preparation. This 8-week plan assumes AZ-104-equivalent broad Azure knowledge and basic networking fundamentals (TCP/IP, BGP, DNS):
- Week 1: Core networking — VNets, subnets, IP addressing, peering, hub-spoke topology, Azure Virtual Network Manager, DNS. Build at least one hub-spoke VNet topology hands-on.
- Week 2–3: Connectivity services — Site-to-Site VPN, Point-to-Site VPN, ExpressRoute peerings and circuits, Virtual WAN hub design. This domain has the trickiest configuration questions.
- Week 4: Application delivery — Load Balancer SKUs and rules, Application Gateway WAF, Azure Front Door tiers, Traffic Manager routing methods. Practice deciding between AG and Front Door based on regional vs. global scope.
- Week 5: Private access — Service Endpoints vs. Private Endpoints, Private Link Service, Private DNS integration. AZ-700 frequently tests when to use each option.
- Week 6: Network security — NSG/ASG rules, Azure Firewall policy hierarchy (Standard vs. Premium), DDoS Protection plans, WAF rule sets.
- Week 7: Take 40 free practice questions to find weak areas. Re-study the weakest two domains. AZ-700 case studies often combine connectivity + security trade-offs.
- Week 8: Two full timed mock exams. Review every wrong answer. Target consistent 80%+ before booking. Budget 12–15 minutes per case study.
Training your whole team on AZ-700? Per-seat pricing covers every certification, with a manager dashboard to see who's exam-ready.
See team pricing →Also Preparing For
Candidates studying AZ-700 often prepare for these certifications next.