Azure Network Engineer Associate (AZ-700) - Full Practice Exam 1

1. A branch needs encrypted IPsec connectivity to an Azure VNet over the internet. Which Azure gateway connection type directly fits?
2. A company needs DNS-based routing between public application endpoints in Azure and another provider. It does not need a proxy to terminate application connections. Which service fits?
3. A company owns a public domain and wants Azure DNS to answer authoritative queries for it. What must be changed at the domain registrar after the zone is created?
4. A company requires private connectivity from a colocation provider into Azure VNets. It wants to avoid carrying the connection over the public internet. Which service should it use?
5. A firewall policy contains a broad allow network rule for outbound TCP 443 and a more restrictive HTTP application rule for the same destination traffic. Why might the application restriction not be evaluated as intended?
6. A Front Door deployment must reach a supported App Service origin through Private Link and restrict direct public origin access. Which Front Door tier and connectivity feature should be evaluated?
7. A global enterprise wants managed transit hubs connecting many branches, VNets, and remote users with centralized routing. Which Azure service is designed for this large-scale connectivity model?
8. A hub VNet is peered with two spoke VNets. The spokes need to exchange traffic through a firewall in the hub. What must the design include beyond the peerings?
9. A load-balanced backend stops responding successfully to its configured health probe. What is the expected effect on new flows to that backend?
10. A network security group allows a VM to initiate an outbound connection. Must an explicit inbound rule separately allow the corresponding response flow?
11. A Private DNS zone must automatically register VMs from VNet A and resolve names from VNet B without registering B's VMs. Which TWO link settings meet the requirement? Select TWO.
12. A provider wants customers in separate VNets to reach its supported service privately through their own private endpoints. The provider uses a supported Standard Load Balancer frontend. Which provider-side feature fits?
13. A public-facing Azure application needs enhanced protection and visibility against volumetric network DDoS attacks. Which service directly targets this threat?
14. A regional application needs HTTP path-based routing to separate backend pools and TLS termination inside its Azure network architecture. Which service directly supports these functions?
15. A route table contains 0.0.0.0/0 to a firewall and 10.20.0.0/16 to another next hop. A packet is destined for 10.20.4.7. Which destination prefix is selected first?
16. A service requires load balancing for inbound TCP traffic to regional VM backends without HTTP-level inspection. Which service is the closest fit?
17. A site-to-site design must use an active-active Azure VPN gateway. What should the on-premises topology be prepared to establish?
18. A spoke should use a hub's VPN gateway. Which two peering settings are required on the corresponding sides? Select TWO.
19. A storage private endpoint has been approved, but a VM resolves the service hostname to its public address. Which change is the most direct first step?
20. A subnet has an applicable user-defined route and a system route for the same destination prefix. Which route source normally takes precedence?
21. A subnet uses NAT Gateway. A partner tries to initiate a new inbound connection to one of its NAT public IPs. What should the network engineer explain?
22. A team assumes every ExpressRoute circuit automatically encrypts application payloads end to end. Which statement is accurate?
23. A team compares a storage service endpoint with a storage private endpoint. Which distinction is correct?
24. A team creates a private endpoint for a service and assumes all public access is automatically disabled. What additional step should it validate?
25. A team creates an Azure IPv4 subnet with a /27 prefix. How many addresses are available for assignment after Azure's reserved addresses?
26. A team enables WAF in detection mode to observe false positives. What should it expect for requests matching a managed attack rule?
27. A team needs rules targeting groups of application-tier VMs without writing each private IP address into every NSG rule. Which grouping mechanism fits?
28. A VM cannot receive a TCP connection, and the engineer suspects an NSG rule. Which Network Watcher tool can identify whether the specified flow is allowed or denied by NSG rules?
29. A VM is deployed as a network virtual appliance. A route points traffic to it, but forwarded packets fail. Which VM network-interface setting should be checked in addition to appliance OS forwarding?
30. A VM's private IP must remain stable across guest OS restarts. Where should the static assignment be configured for the Azure NIC?
31. A VPN design uses BGP. The remote appliance has the same ASN and overlapping address plan as an unrelated network being integrated. What should the engineer validate before deployment?
32. An application needs protection against common HTTP attacks such as SQL injection and cross-site scripting. Which control directly addresses this Layer 7 requirement?
33. An enterprise must tolerate loss of an entire ExpressRoute peering location. Which design most directly improves resilience to that failure?
34. An enterprise wants centrally managed firewall policies across multiple supported Azure Firewall deployments. Which service should it evaluate?
35. An internet application runs in several Azure regions. It needs global HTTP routing, TLS termination near users, and web application firewall protection at the edge. Which service is the best fit?
36. Application Gateway marks a healthy application unhealthy because the default probe receives an unexpected response from the root path. What should the engineer configure?
37. Application rules use FQDNs, and the team wants consistent name resolution between clients and Azure Firewall. Which setting should it evaluate with the appropriate client DNS configuration?
38. Azure workloads must resolve an on-premises namespace through specified on-premises DNS servers. Which Private Resolver configuration supports this direction?
39. In a Virtual WAN hub, a connection must learn selected routes while advertising its own prefixes to a different collection of connections. Which concepts govern these two directions?
40. On-premises DNS servers must resolve Azure private DNS zones over a private connection without maintaining Azure DNS-forwarder VMs. Which managed feature should they forward relevant queries to?
41. Private application VMs need predictable outbound public IP addresses for a vendor allowlist. They do not require unsolicited inbound internet access. Which subnet capability directly fits?
42. Remote employees need individual VPN access to an Azure VNet from supported laptops. No branch VPN appliance is available. Which connection type should be designed?
43. Remote users must authenticate to a supported Azure point-to-site VPN using Microsoft Entra ID. Which tunnel protocol is required for this configuration?
44. Requests to /images/* should reach an image service while /api/* requests reach a separate API backend. Which Application Gateway feature should be configured?
45. Security requires inspection of encrypted outbound HTTPS content and intrusion detection and prevention at the network firewall. Which Azure Firewall tier should be evaluated?
46. Several branches change their advertised prefixes frequently. The team wants dynamic route exchange with a supported Azure VPN gateway rather than editing static routes for every change. Which protocol should it configure?
47. The team needs ExpressRoute connectivity specifically to private IP resources inside Azure VNets. Which peering type is used?
48. Traffic from a VM follows an unexpected path. The engineer wants to identify Azure's selected next hop for a destination. Which tool is the direct fit?
49. Traffic Manager switches to a healthy endpoint after the primary fails, but some clients continue using the old endpoint briefly. What is the most relevant explanation?
50. Two VNets in different Azure regions need private connectivity with non-overlapping prefixes. No on-premises routing or encrypted internet tunnel is required. Which option best minimizes connectivity infrastructure?

Comments — 0