Free Exam AZ-700: Designing and Implementing Microsoft Azure Networking Solutions Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam AZ-700: Designing and Implementing Microsoft Azure Networking Solutions practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An Azure IPv4 subnet uses 10.20.1.0/27. How many addresses are available for resource assignment after Azure reservations?

   1. A. 25
   2. B. 27
   3. C. 30
   4. D. 32

   Answer: B

   Explanation: Microsoft states, "Azure reserves the first four addresses and the last address, for a total of five IP addresses within each subnet." A /27 contains 32 addresses, so 32 − 5 = 27 are assignable.

   Reference: Azure Virtual Network frequently asked questions — Are there any restrictions on using IP addresses within these subnets?

2. 2An Azure VPN gateway is active-active and connects to one on-premises VPN device. How should the on-premises device establish the Azure-side tunnels?

   1. A. Use one tunnel to a shared public IP of both Azure instances
   2. B. Use two tunnels, one to each Azure gateway instance's public IP
   3. C. Use two tunnels to the private IP of the Azure GatewaySubnet
   4. D. Use one tunnel to each workload subnet's default gateway IP

   Answer: B

   Explanation: Microsoft specifies, "configure your on-premises VPN device to accept or establish two S2S VPN tunnels to those two Azure VPN gateway public IP addresses." Each active Azure instance has its own public IP.

   Reference: Design highly available gateway connectivity for cross-premises and VNet-to-VNet connections — Active-active VPN gateways

3. 3A TCP service must be load balanced to Azure VMs through a private frontend reachable over a hybrid network. Which frontend design fits?

   1. A. A public load balancer using a public frontend IP
   2. B. An internal load balancer using a private frontend IP
   3. C. An internal load balancer using a public frontend IP
   4. D. A public load balancer using a private frontend IP

   Answer: B

   Explanation: The component rule is "A private IP address creates an internal load balancer." Its frontend supports private Azure and on-premises access.

   Reference: Azure Load Balancer components — Frontend IP configuration

4. 4Which network representation does an Azure private endpoint provide for a Private Link service consumer?

   1. A. A public IP prefix assigned to the service provider
   2. B. A VPN gateway shared by all service consumers
   3. C. A DNS forwarding rule with no network interface
   4. D. A network interface with a private IP from the consumer VNet

   Answer: D

   Explanation: Microsoft defines it as "a network interface that uses a private IP address from your virtual network." The endpoint privately represents the target service within the consumer network.

   Reference: What is a private endpoint? — Introduction

5. 5An NSG has matching inbound rules: priority 200 Allow TCP 443 and priority 300 Deny TCP 443. What is the result for a new matching connection?

   1. A. Deny because deny actions always override allow actions
   2. B. Deny because the higher numerical priority wins
   3. C. Allow because priority 200 is evaluated first
   4. D. Neither; matching allow and deny rules cannot coexist at different priorities

   Answer: C

   Explanation: Microsoft states, "lower numbers have higher priority. Once traffic matches a rule, processing stops." The matching priority-200 allow prevents evaluation of the priority-300 deny.

   Reference: Azure network security groups overview — Security rules, Priority

6. 6What prefix length must an IPv6 subnet in an Azure virtual network use?

   1. A. /48
   2. B. /56
   3. C. /64
   4. D. /128

   Answer: C

   Explanation: The subnet sizing rule says, "IPv6 subnets must be exactly /64 in size." The other lengths do not satisfy this requirement.

   Reference: Azure Virtual Network frequently asked questions — How small and how large can virtual networks and subnets be?

7. 7A design uses an active-active Azure VPN gateway and two active on-premises VPN devices, each fully connected to Azure. How many IPsec tunnels form the full mesh?

   1. A. 2
   2. B. 3
   3. C. 4
   4. D. 8

   Answer: C

   Explanation: The dual-redundancy description specifies "a full mesh connectivity of 4 IPsec tunnels". Each of two Azure instances connects to each of two on-premises devices.

   Reference: Design highly available gateway connectivity for cross-premises and VNet-to-VNet connections — Dual-redundancy: active-active VPN gateways for both Azure and on-premises networks

8. 8One Standard Load Balancer backend VM fails its health probe. What happens to new connections for that VM?

   1. A. They continue to the failed VM until every backend fails
   2. B. They continue to the failed VM while its established TCP flows close
   3. C. The load balancer stops sending new connections to it
   4. D. They are retried on the failed VM until its idle timeout expires

   Answer: C

   Explanation: Microsoft states, "When a probe doesn't respond, the load balancer stops sending new connections to the unhealthy instances." Existing TCP flows have separate termination conditions.

   Reference: Azure Load Balancer components — Health probes

9. 9A storage account has a working private endpoint. Public endpoint access must also be prevented. What additional action is required?

   1. A. Configure the storage account's public network access or firewall
   2. B. Create an additional private endpoint without changing public access settings
   3. C. Resolve the storage name privately without changing public access settings
   4. D. Restrict the consumer subnet NSG without changing storage access rules

   Answer: A

   Explanation: Microsoft warns, "Creating a private link does not automatically block connections on the public endpoint." Public access must be restricted separately on the storage service.

   Reference: Use private endpoints for Azure Storage — Introduction, storage account security

10. 10An NSG permits a VM to initiate an outbound TCP connection to port 443. Is a separate inbound NSG rule required solely for that connection's response packets?

    1. A. Yes, using the same destination port 443 on the VM
    2. B. Yes, using every ephemeral port as a new inbound flow
    3. C. Only if the VM has a static private IP address
    4. D. No, the NSG tracks the allowed connection's state

    Answer: D

    Explanation: Microsoft states, "The flow record allows a network security group to be stateful." Responses to an allowed outbound flow do not require a separate inbound initiation rule.

    Reference: Azure network security groups overview — Security rules, flow records and stateful behavior