Azure AZ-700 Practice Test

AZ-700 practice test: what's covered

• Azure Network Engineer Associate

Free AZ-700 sample questions

1. A retailer needs a private, predictable 10 Gbps connection from its on-premises datacenter to Azure that bypasses the public internet entirely for a latency-sensitive ERP system. Which connectivity option should the network team design?

   • A. ExpressRoute circuit using a connectivity provider with private peering
   • B. Site-to-site VPN over IPsec using a VpnGw1 gateway
   • C. Point-to-site VPN with OpenVPN and Azure AD authentication
   • D. Public internet egress through an Azure NAT gateway
   Show answer

   Correct: A. ExpressRoute provides a private, dedicated circuit through a partner that never traverses the public internet, delivering bandwidths up to 10 Gbps (or 100 Gbps with Direct) and predictable latency. A site-to-site VPN is incorrect because it rides the public internet and tops out far below 10 Gbps. Point-to-site is for individual clients, not datacenter links, and NAT gateway only handles outbound public traffic, so neither meets the requirement.

2. You are configuring an active-active site-to-site VPN with BGP between Azure and two on-premises devices for maximum resiliency. Which design elements must be in place? (Choose THREE)

   • A. A VPN gateway SKU that supports active-active mode such as VpnGw2 or higher
   • B. Two public IP addresses assigned to the Azure VPN gateway instances
   • C. BGP enabled with a unique ASN configured on the gateway and on-premises peers
   • D. A Basic SKU gateway to minimize the monthly gateway cost
   • E. Forced disabling of BGP so static routes alone control failover
   Show answer

   Correct: A and B and C. Active-active mode requires a VpnGw2+ SKU, two public IPs (one per gateway instance), and BGP with distinct ASNs so routes are exchanged dynamically and failover is automatic. The Basic SKU is incorrect because it does not support active-active or BGP. Disabling BGP is wrong because dynamic routing is precisely what enables seamless tunnel failover in this design.

3. Your company already uses an ExpressRoute private peering circuit for VNet traffic and now wants to reach Microsoft 365 and Azure PaaS public endpoints over that same circuit with route filtering. Which ExpressRoute peering should you enable?

   • A. Microsoft peering with route filters applied to advertised prefixes
   • B. Private peering extended to cover the PaaS public IP ranges
   • C. Legacy public peering with a default route advertisement
   • D. Global Reach to link the circuit to another region
   Show answer

   Correct: A. Microsoft peering carries Microsoft public services (Microsoft 365, Azure PaaS public endpoints) and uses route filters to control which BGP communities/prefixes are advertised. Private peering is incorrect because it only carries traffic to your VNet private IP space. Public peering is deprecated and cannot be newly created, and Global Reach only connects two ExpressRoute circuits across regions, not public services.

4. A global enterprise must connect 35 branch offices and several Azure regions with automatic any-to-any transit, integrated SD-WAN, and centralized routing instead of manually meshing hub-and-spoke VNets. Which Azure service fits this design?

   • A. Azure Virtual WAN with secured virtual hubs
   • B. A single hub VNet with manually peered spokes
   • C. Azure Route Server deployed in each spoke VNet
   • D. Standalone Azure Firewall in one central VNet
   Show answer

   Correct: A. Azure Virtual WAN provides a managed global transit network where virtual hubs automatically mesh, integrate SD-WAN and branch connectivity, and centralize routing across many regions. A manually peered hub-spoke is incorrect because it does not scale to dozens of branches with automatic transit. Route Server only injects routes for NVAs, and a standalone firewall does not provide any branch or transit connectivity by itself.

5. An administrator wants to write NSG rules that reference logical application tiers (web, app, data) rather than hardcoded IP addresses so that adding new VMs automatically inherits the rules. Which feature should be used as the source and destination?

   • A. Application Security Groups attached to the VM network interfaces
   • B. Service tags such as VirtualNetwork in every rule
   • C. A single large address prefix covering all three tiers
   • D. Static private IP reservations listed individually per rule
   Show answer

   Correct: A. Application Security Groups (ASGs) let you group VM NICs by role and reference those groups as source/destination in NSG rules, so new VMs added to an ASG automatically inherit the rules. Service tags represent Azure service ranges, not your own tiers, so they are incorrect here. A single broad prefix removes the tier separation you want, and listing static IPs is exactly the manual approach ASGs are designed to eliminate.

Last updated: 2026-10-19

AZ-700 practice test FAQ

Related practice tests

• Azure AZ-104 practice test
• Azure AZ-305 practice test
• Azure Firewall practice test
• AWS ANS-C01 practice test
• CCNA 200-301 practice test
• Azure AZ-900 practice test